openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

TLS_REQCERT and no server certificate
by Jan Synacek 13 Nov '13

13 Nov '13

Hello, quoting ldap.conf(5): TLS_REQCERT <level> ... try The server certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, the session is immediately terminated. ... I'd like to try the "If no certificate is provided" part, but can't manage to do so. I tried configuring the server to 1) not use any CA certificate or server certificate, 2) only use the CA certificate without any server certificate, 3) specify CA certificate dir with no certs in it, 4) specify CA certificate dir with a valid CA cert and no server certs. In any case, the client (ldapsearch) doesn't even connect to the server, stating either "SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" or simply failing to connect with "Can't contact LDAP server (-1)". The server is listening on ldap and ldaps. I tested this using both ldaps and StartTLS. That leads me to a conclusion that what I'm trying to achieve is not achievable and that the manpage should be changed. Is the manpage wrong or is there any other way I can test the client with no server certificate provided? Cheers, -- Jan Synacek Software Engineer, Red Hat

4 9

RE24 testing call (OpenLDAP 2.4.38)
by Quanah Gibson-Mount 12 Nov '13

12 Nov '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.38 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 3

Last days to get a place at LDAPCon 2013!
by Clément OUDOT 12 Nov '13

12 Nov '13

Hi, the final program of LDAPCon has been published: http://ldapcon.org/#program The conference is now in one week, and you can still book your place: http://ldapcon2013.eventbrite.fr Hope to see you next week in Paris! Clément.

1 0

Q: syntax 1.3.6.1.4.1.1466.115.121.1.51
by Ulrich Windl 12 Nov '13

12 Nov '13

Hi! I see that core.schema defines: --- attributetype ( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC2256: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) --- However I cannot locate the syntax for the OID. It's mentioned in secion 6.5 of RFC 2256, however. How is an LDAP client expected to resolve this? I see the following syntaxes defines in the LDAP schema: DB<17> print sort map { $_->{name} . "\n" } $s->all_syntaxes 1.2.36.79672281.1.5.0 1.3.6.1.1.1.0.0 1.3.6.1.1.1.0.1 1.3.6.1.1.16.1 1.3.6.1.4.1.1466.115.121.1.10 1.3.6.1.4.1.1466.115.121.1.11 1.3.6.1.4.1.1466.115.121.1.12 1.3.6.1.4.1.1466.115.121.1.14 1.3.6.1.4.1.1466.115.121.1.15 1.3.6.1.4.1.1466.115.121.1.22 1.3.6.1.4.1.1466.115.121.1.24 1.3.6.1.4.1.1466.115.121.1.26 1.3.6.1.4.1.1466.115.121.1.27 1.3.6.1.4.1.1466.115.121.1.28 1.3.6.1.4.1.1466.115.121.1.34 1.3.6.1.4.1.1466.115.121.1.36 1.3.6.1.4.1.1466.115.121.1.38 1.3.6.1.4.1.1466.115.121.1.39 1.3.6.1.4.1.1466.115.121.1.4 1.3.6.1.4.1.1466.115.121.1.40 1.3.6.1.4.1.1466.115.121.1.41 1.3.6.1.4.1.1466.115.121.1.44 1.3.6.1.4.1.1466.115.121.1.45 1.3.6.1.4.1.1466.115.121.1.49 1.3.6.1.4.1.1466.115.121.1.5 1.3.6.1.4.1.1466.115.121.1.50 1.3.6.1.4.1.1466.115.121.1.52 1.3.6.1.4.1.1466.115.121.1.6 1.3.6.1.4.1.1466.115.121.1.7 1.3.6.1.4.1.1466.115.121.1.8 1.3.6.1.4.1.1466.115.121.1.9 1.3.6.1.4.1.4203.666.11.10.2.1 Regards, Ulrich

2 3

OpenLDAP on CF disk
by richard lucassen 11 Nov '13

11 Nov '13

Hello list, I want to migrate some OpenLDAP servers from 3.5" disks to CF-disks. The data in the OpenLDAP is only updated once a month or so. It is just an "99%-read-only" LDAP implementation. However, with a standard Debian install, some files in the /var/lib/ldap directory are updated upon each query: # ls -altr -rw-r--r-- 1 openldap openldap 96 2008-11-19 11:45 DB_CONFIG drwxr-xr-x 28 root root 4096 2008-12-03 15:03 .. -rw------- 1 openldap openldap 8192 2013-04-08 10:50 cn.bdb -rw------- 1 openldap openldap 24576 2013-09-29 13:49 objectClass.bdb -rw------- 1 openldap openldap 180224 2013-09-29 13:49 id2entry.bdb -rw------- 1 openldap openldap 8192 2013-09-29 13:49 entryUUID.bdb -rw------- 1 openldap openldap 8192 2013-09-29 13:49 entryCSN.bdb -rw------- 1 openldap openldap 36864 2013-09-29 13:49 dn2id.bdb -rw------- 1 openldap openldap 1168654 2013-10-17 09:40 log.0000000001 -rw------- 1 openldap openldap 24576 2013-11-07 05:45 __db.005 -rw------- 1 openldap openldap 98304 2013-11-07 05:45 __db.003 -rw-r--r-- 1 openldap openldap 4096 2013-11-07 05:45 alock drwx------ 2 openldap openldap 4096 2013-11-07 05:45 accesslog drwx------ 3 openldap openldap 4096 2013-11-07 05:45 . -rw------- 1 openldap openldap 565248 2013-11-07 11:30 __db.004 -rw------- 1 openldap openldap 2629632 2013-11-07 11:30 __db.002 -rw------- 1 openldap openldap 8192 2013-11-07 11:30 __db.001 Apparently the cluster is doing some synchronizing at 05:45 in the morning, but that's once a day. My concern is the files called __db.001 __db.002 __db.004 Is there a simple way to prevent OpenLDAP from updating these files at each query? R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | +------------------------------------------------------------------+

6 13

New objectClass
by Merve Temizer 11 Nov '13

11 Nov '13

How can i add mailacceptinggeneralid and maildrop attirbutes to use postfix with openldap ? I tried to adding a schema like (into /etc/ldap/schema) # # postfix.schema - basic attributes based on default queries # postfix will make for alias and virtual account lookups # I don't think there is an official postfix schema out there, # but if there is, this most certainly is not it. # # leah(a)frauerpower.com # # mailacceptinguser and mailAccount added by Barrie Bremner < bjb(a)netcraft.com> # attributetype ( 1.3.6.1.4.1.25260.1.000 NAME 'mailacceptinggeneralid' DESC 'Defines an address that we accept mail for' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.25260.1.001 NAME 'maildrop' DESC 'Defines the address mail goes to' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.25260.1.002 NAME 'mailacceptinguser' DESC 'Defines if this user accepts mail' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClass ( 1.3.6.1.4.1.25260.1.1.100 NAME 'virtualaccount' DESC 'Holds mail info for a virtual account' STRUCTURAL MUST ( owner $ mailacceptinggeneralid $ maildrop $ cn ) ) objectClass ( 1.3.6.1.4.1.25260.1.1.101 NAME 'maillist' DESC 'Virtual account for holding mailing list info' STRUCTURAL MUST ( mailacceptinggeneralid $ maildrop $ cn ) ) objectClass ( 1.3.6.1.4.1.25260.1.1.102 NAME 'mailAccount' DESC 'Email account details' AUXILIARY MUST ( mailacceptinguser $ maildrop $ cn ) MAY ( mailacceptinggeneralid ) ) and add a line into /usr/share/slapd/slapd.conf " include /etc/ldap/schema/inetorgperson.schema" But i am geting ldap_add: Invalid syntax (21) additional info: objectClass: value #3 invalid per syntax when i try to add an object objectClass:mailAccount Where am i wrong? Thanks

2 1

ldapmodify replace olcAccess
by Daniel Jung 11 Nov '13

11 Nov '13

Hi all, Is it possible to use the replace the instead of delete then add again for olcAccess? dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcDbCacheSize olcDbCacheSize: 10240 - replace: olcAccess olcAccess: {0}to dn.base="" attrs=namingContexts by * none olcAccess: {1}to * by * read - Thanks

3 2

Re: ldap syncrepl issue.
by Ashok Kumar Shah 11 Nov '13

11 Nov '13

I don't see any fix done for syncrepl on 2.4.36. Speaking about the actual problem i have noticed that the do_syncrep* is not getting triggered as defined in the config: interval=00:00:05:00 retry="60 +" and get triggered after long delay about ~23hrs or so. Not sure if this a bug. Thanks, Ashok On Sun, Nov 10, 2013 at 6:14 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > I suggest you read the openldap changelog and upgrade to 2.4.36. > > --Quanah > > On Nov 9, 2013, at 12:34 AM, Ashok Kumar Shah <ashok.shah(a)flipkart.com> > wrote: > > I have upgraded to OpenLDAP 2.4.31. I was hoping that the syncrepl issue > will subside with the upgrade, but problem continue to persist even now. > Just to point out that the master still runs the older version i.e 2.4.31, > but i guess that should be ok since the issue is with the replication or > perhaps with contextCSN not getting updated on the client(slaves). > > Thanks, > Ashok > > > On Mon, Jul 15, 2013 at 3:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > >> --On Sunday, July 14, 2013 10:35 PM +0530 Ashok Kumar Shah < >> ashok.shah(a)flipkart.com> wrote: >> >> >>> I am running OpenLDAP 2.4.23. >>> >> >> I would advise you to run a modern release. I would strongly advise you >> to read the changes log since 2.4.23. >> >> >> --Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration >> > >

3 2

How to say not to use a particular objectClass for a dn
by Harishkumar Pathangay 10 Nov '13

10 Nov '13

Hi,How to say not to use a particular objectClass for a dn. For example,harish@openSUSE:~> ldapsearch -x -b 'dc=my-domain,dc=com' '(objectclass=*)' # extended LDIF## LDAPv3# base <dc=my-domain,dc=com> with scope subtree# filter: (objectclass=*)# requesting: ALL# # my-domain.comdn: dc=my-domain,dc=comobjectClass: dcObjectobjectClass: organizationdc: my-domaino: Example Corporation # Manager, my-domain.comdn: cn=Manager,dc=my-domain,dc=comobjectClass: organizationalRolecn: Managerdescription: Directory Manager # search resultsearch: 2result: 0 Success Here, we see that dn: dc=my-domain,dc=com uses objectClass: organizationI want to say not to use objectClass: organization. How to do this? Thanks,Harish Pathangay

3 4

Restricting Login based on AD GID
by Manish Nene 10 Nov '13

10 Nov '13

Hello, I've LDAP authentication functioning well against Novell e-directory. Is there a way I can restrict the login access to appliance based on the GID of an user? Thanks, - Manish. ------------------------ Powered by BigRock.com

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical