openldap-technical

openldap-technical@openldap.org

9 participants
9867 discussions

java API for SAML integration
by Jignesh Patel 04 Feb '14

04 Feb '14

We have been using SimpleSAMLphp with openldap 2.4.33. Is there any Java API available which can provide similar functionality? Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

4 4

set-based constraint for prefix
by Michael Ströder 04 Feb '14

04 Feb '14

HI! Maybe I'm overlooking something obvious... I'd like to enforce a prefix naming convention by using a set-based constraint. The idea is that 'cn' value of an entry should *start* with the 'cn' value of the superior entry and a hyphen. Example with Superior entry has 'cn: example': example-foo -> accept examplefoo -> disallow foo-bar -> disallow My problem is the "start with" since I cannot find a way to express the wildcard string in a set. The following does not work since [*] is interpreted literally so only the exact value 'example-*' is accepted: # 'cn' has to use superior entry's 'cn' value as prefix constraint_attribute cn set "(this/-1/cn + [-] + [*] ) & this/cn" restrict="ldap:///ou=ampua??sub?(|(objectClass=mySrvGroup)(objectClass=myGroup))" Any help is appreciated. Ciao, Michael.

3 2

Re: OpenLDAP 2.4.39 available
by Clément OUDOT 04 Feb '14

04 Feb '14

2014-01-30 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.39 is now available for download as detailed on our download > page: > > http://www.openldap.org/software/download/ > > Hi, packages from LDAP Tool Box were released this morning: http://ltb-project.org/wiki/download#openldap Clément.

1 0

changing database backend
by Aleksander Dzierżanowski 04 Feb '14

04 Feb '14

Hi, Any ideas how to migrate database from back-bdb to other backend (for example mdb), while using cn=config? When using slapd.conf - flat config file - it seems to be simple task. But how to do it using cn=config? For sure it is not online operation, and any offline modifications to LDIF config files are not recommended. Regards, — Olo

4 3

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 4:22 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Well...that was a "doh!" on my part. <lol> > > One last stupid question for the evening. "slapcat" created the ldif, > when slapadd-ing to the the secondary, should I remove the extra lines > (ex. entryUUID, creatorsName,createTimeStamp)? Only if your goal is to completely break replication. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 3:31 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks for your assistance Quanah! > > About the userPassword attributes... > > On Apache Directory Studio (we only normally use it as a quick visual > reference)...but, we bind both servers as cn=ldapadmin,dc=example,dc=ldap > & cn=admin,cn=config (plus now > uid=replicator,ou=Admins,dc=example,dc=ldap). > > I just tested an ldapsearch by binding to the uid=replicator and the > userPassword attribute returns when searching for it...though both are > different from each other (verified with other users "jdoe2" and "jdoe3", > etc) If it is correct via ldapsearch, that is what counts. ADS may be attempting some security by hiding userPassword? > Supposedly, if I update one server, the other server should update, too. > That is if they are properly talking. Correct? And assuming your masters are in sync to start with, which is critical when thinking about replication. It would appear you've been allowing writes ops to each master prior to getting replication working? I believe you mentioned before this is a test environment. I would suggest you reload your secondary master from the primary master, and then test replication. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 2:26 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Ok, > > Sanity Check, please. Still seeing "empty syncUUID" messages. Also, the > "userPassword" attributes on mm-server2, cannot be seen (via Apache > Directory Studio -- but show up with ldapsearch), but when I attempt to > add (via ldapmodify) it returns value already present. if it shows up with ldapsearch when binding as uid=ldapreplicator,ou=admins,dc=example,dc=ldap then you are set. I have no idea who/what you are binding with via apache dir studio. ># {1}bdb, config > dn: olcDatabase={1}bdb,cn=config > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="cn=ldapadmin,dc=example,dc=ldap" manage by > dn="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none > olcAccess: {1}to * by * read Unless you plan on doing some really bizarre things, it is unlikely your ldapadmin needs manage access. See <http://www.openldap.org/its/index.cgi/?findid=7795> ># {2}bdb, config > dn: olcDatabase={2}bdb,cn=config > olcAccess: {0}to * by > dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" write by * none The replicator only ever needs read access, not write. Also separate nit. You should be doing dn.exact in the first set of ACLs as well (you have it correctly in the second set). --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 1:06 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > The "cn=replicator,cn=accesslog" was the olcRootDN for the accesslog. > > Rather that was my intent. > > Rereading documentation...and the script you shared with me a few weeks > back. > > Currently, my set up is: > 1) The rootDN for the cn=config is cn=admin (cn=admin,cn=config) > 2) the rootDN for my primary dbase is cn=ldapadmin > (cn=ldapadmin,dc=example,dc=ldap) 3) the rootDN for the accesslog, as > mentioned above, is/was cn=replicator (cn=replicator,cn=accesslog) > > My ou=Users,dc=example,dc=ldap has all the End-Users uids for logins. > > Noticed you have a cn=admins,cn=zimbra. > > Bear with the stupid question, this is more of a sanity check for me > (getting pressure from my side to get this project done -- so very > rushed). > > I could/should create an "ou=Admins,dc=example,dc=ldap", on both > MM-Servers > > In that ou create/move the replicator that I wrongfully created in > cn=accesslog: > > uid=replicator,ou=Admins,dc=example,dc=ldap > > That will get this user in the dbase. > > Modify, the olcSyncrepl, olcAccess, etc on both MM-Servers. > > Is that basically, correct? Yes. For replication, you need one single replication DN to be used for replication, that has read access into both your primary DB and your accesslog DB. The rootdns are entirely separate from any of that. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 9:57 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > All, > > I turned off TLS on both MMR machines, so I could more easily > troubleshoot Syncrepl/MMR configuration. Once over this hurdle, I'll > re-incorporate TLS. > > The following is a snippet of the SLAPD output-log file: > > <MM-SERVER2> > 52efa558 => bdb_dn2id("cn=replicator,cn=accesslog") > 52efa558 <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair > found (-30989) 52efa558 send_ldap_result: conn=5226 op=0 p=3 > 52efa558 send_ldap_result: err=49 matched="" text="" What is cn=replicator,cn=accesslog? Whatever it is, it doesn't exist in your DB. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Deprecation of back-bdb
by Clément OUDOT 03 Feb '14

03 Feb '14

2014-02-03 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Monday, February 03, 2014 4:48 PM +0100 Clément OUDOT < > clem.oudot(a)gmail.com> wrote: > > >> >> >> >> Hi, >> >> as Howard said in his conference at FOSDEM, back-bdb is deprecated, and >> is disabled by default. >> >> Should I fill an ITS? >> > > No. It is deprecated in 2.5 and later. > > If I remember well, BDB should be deprecated for 2.4 and HDB deprecated for 2.5. See slide 37 of this presentation: http://fr.slideshare.net/ldapcon/whats-new-in-openldap Clément.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical