openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Updated scheme
by Artur Nike 21 Oct '13

21 Oct '13

Hi all , I have a question. How as the most updated schema file (dynamic) and all objects in the ldif file in. in OpenLDAP 2.4.31. Let's say I have a scheme with its own defined attributes and classes and after a while you need to add an attribute and for example, change the class. How to upload an updated scheme under the same name and do not change the names of the updated attributes and classes. Now Loading a revised scheme under a new name and change the object definitions in the ldif. Can anyone have any suggestions or experience with this problem. For all thank you in advance. Mariusz

1 0

ACL with val.regex expression
by Mark Dieterich 18 Oct '13

18 Oct '13

Hi all, I'm banging my head against a wall trying to get one particular ACL setup. We want our users, with the exception of those that have a restricted shell, to be able to change their own shell values. A typical user looks like: dn: uid=user,ou=people,dc=cs,dc=brown,dc=edu objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krb5Principal objectClass: sambaSamAccount objectClass: ownCloudUser objectClass: mailUser ... loginShell: /bin/bash We'd ideally like to have an ACL in place that looks like: access to dn.subtree="ou=people,dc=cs,dc=brown,dc=edu" attrs=loginShell val.regex="/bin/[^f][^s][^h]" by ssf=128 self write by * read The idea being that a user with a loginShell value of /bin/fsh would NOT be allowed to change their shell value. However, with this rule in place, no user is able to change their shell value. Even if I change the rule to be: access to dn.subtree="ou=people,dc=cs,dc=brown,dc=edu" attrs=loginShell val.exact="/bin/bash" by ssf=128 self write by * read users with loginShell of /bin/bash still can't change their own values. If I drop the val.<type>="<whatever>" restriction, users can change their shell values just fine. This the first time I've ever used and ACL with a val.<type>= restriction, but I've scoured the internet and I can't for the life of me figure out what I'm doing wrong. I'm happy to have someone here give me a dope slap... I'm just tired of the headaches ;) Thanks! Mark

5 14

Need to Create Default Printer Entries
by Michael C. Ibarra 17 Oct '13

17 Oct '13

Greetings; I’ve recently built a new LDAP infrastructure, migrated from NIS. Under NIS, I had a map, “printers”, which I used to query with “ypcat printers.byname|grep username”. I need to setup default printers for several applications, and making them centrally available, and configurable, is a must for me. The issue I am facing is that my users, now listed under people, have no place to add a default printer; although there is an “allowed attribute” for “host”, which right now for me goes unused. What I would like to do is to create a new database in my DIT, call it say defaultPrinters, which contains left side username, right side printer; i.e.: smitha hp001 joner hp002 carsont hp001 Additionally, I would like to be able to add an allowable attribute under People, named defaultPrinters, which points to the database that I am trying to create. Thanks in advance. -mi

3 3

Does MDB backend shrinks on disk files after delete operation?
by Igor Zinovik 17 Oct '13

17 Oct '13

Hello. I would like to understand one thing about mdb backend: Current size of /var/lib/ldap is 15 megabytes (~ 10000 entries). After i added to my database 1839 entries on disk directory size becomes 93 megabytes. But when i delete all 1839 entires mdb does not free disk space, my /var/lib/ldap is still 93 megabytes in size. It does not remove data and just marks it as 'free' meaning that it is reusable for new write operations? I use mdb from openldap 2.4.33

2 3

Berkeley DB backend - exact version check
by Jan Synacek 16 Oct '13

16 Oct '13

Hello, slapd checks the exact version of BDB at runtime and fails if it doesn't equal to the version that it's been linked against. Is there a reason for such precise check? Shouldn't the major and minor version numbers be enough? The code seems to have been there for a while, so I'm sorry if such question has been asked before. I couldn't find any answers. Thank you, -- Jan Synacek Software Engineer, Red Hat

2 2

bind-dyndb-ldap
by Brendan Kearney 16 Oct '13

16 Oct '13

i am trying to setup BIND to use LDAP as the zone data repository, using bind-dyndb-ldap and continue to run into issues. i am not sure what this error message means, but it seems to be part of the problem. i see that the bind attempt succeeds and that a search is attempted. but, when the search is attempted, a critical piece of the puzzle is missing and an extension is not recognized. indexing will be done once i get the rest of this working... 2013-10-15T19:10:16.980653-04:00 test slapd[12675]: conn=1057 fd=11 ACCEPT from IP=127.0.0.1:57849 (IP=0.0.0.0:389) 2013-10-15T19:10:16.980675-04:00 test slapd[12675]: conn=1057 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 2013-10-15T19:10:16.980680-04:00 test slapd[12675]: conn=1057 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" mech=SIMPLE ssf=0 2013-10-15T19:10:16.980683-04:00 test slapd[12675]: conn=1057 op=0 RESULT tag=97 err=0 text= 2013-10-15T19:10:16.982325-04:00 test slapd[12675]: conn=1058 fd=17 ACCEPT from IP=127.0.0.1:57850 (IP=0.0.0.0:389) 2013-10-15T19:10:16.983442-04:00 test slapd[12675]: conn=1058 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 2013-10-15T19:10:16.983456-04:00 test slapd[12675]: conn=1058 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" mech=SIMPLE ssf=0 2013-10-15T19:10:16.983459-04:00 test slapd[12675]: conn=1058 op=0 RESULT tag=97 err=0 text= 2013-10-15T19:10:16.990216-04:00 test slapd[12675]: conn=1057 op=1 SEARCH RESULT tag=101 err=12 nentries=0 text=critical extension is not recognized 2013-10-15T19:10:16.990883-04:00 test slapd[12675]: conn=1057 op=1 do_search: get_ctrls failed 2013-10-15T19:10:16.991177-04:00 test slapd[12675]: conn=1058 op=1 SRCH base="cn=dns,dc=my-domain,dc=com" scope=2 deref=0 filter="(&(idnsZoneActive=TRUE)(|(objectClass=idnsZone)(objectClass=idnsForwardZone)))" 2013-10-15T19:10:16.991468-04:00 test slapd[12675]: conn=1058 op=1 SRCH attr=idnsName idnsUpdatePolicy idnsAllowQuery idnsAllowTransfer idnsForwardPolicy idnsForwarders idnsAllowDynUpdate idnsAllowSyncPTR objectClass 2013-10-15T19:10:16.991740-04:00 test slapd[12675]: <= bdb_equality_candidates: (idnsZoneActive) not indexed 2013-10-15T19:10:16.992025-04:00 test slapd[12675]: conn=1058 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= i know that the schema for dyn-dns is loaded and all the objectClasses and attributeTypes are available. the problem i run into is an A Record that should be in the zone data cannot be queried out of the BIND instance that is talking to LDAP. [root@test conf.d]# nslookup foo.my-domain.com. localhost ;; Got SERVFAIL reply from 127.0.0.1, trying next server ;; Got SERVFAIL reply from 127.0.0.1, trying next server Server: localhost Address: 127.0.0.1#53 ** server can't find foo.my-domain.com: SERVFAIL i am using: bind - 9.9.3 bind-dyndb-ldap - 3.5 openldap 2.4.36 on Fedora 19 (yes, it is the distro packaged version). Can anyone give me some pointers on how to get this working?

1 1

temporarily removing a group object in SLES11
by Ulrich Windl 16 Oct '13

16 Oct '13

Hi! I realized that in SLES11 SP2 the YaST user management module does recreate a group (instead of modifying it) when you add a user to the particular group. I wonder what the consequences could be (despite of the unnecessary deltas being created). Did anybody else notice this, or even had some negative experience caused by that, escpecially for groups with many members? Regards, Ulrich

2 3

Q: access rights for shadowAccount attributes
by Ulrich Windl 16 Oct '13

16 Oct '13

Hi! I wonder what the minimum required access rights for the attributes of shadowAccount are: Should they be protected the same way the password is? At the moment an anonymous bind can read them (i.e. no special access rules present). Regards, Ulrich

2 1

Need help with replica
by Jacques Foucry 15 Oct '13

15 Oct '13

Hello list, I created a VM to test ppolicy migration and replication. On my master server some user (like mine) are "bind" to ppolicy: I have a OU policies dn: cn=default,ou=policies,dc=example,dc=com cn: default objectclass: top objectclass: device objectclass: pwdPolicy objectclass: pwdPolicyChecker pwdallowuserchange: TRUE pwdattribute: userPassword pwdcheckmodule: mmc-check-password.so pwdcheckquality: 0 pwdexpirewarning: 600 pwdfailurecountinterval: 0 pwdgraceauthnlimit: 5 pwdinhistory: 5 pwdlockout: TRUE pwdlockoutduration: 0 pwdmaxage: 7776000 pwdmaxfailure: 5 pwdminlength: 8 pwdmustchange: TRUE pwdsafemodify: FALSE And my user: dn: cn=Jacques Foucry,ou=People,dc=example,dc=com c: France cn: Jacques Foucry gidnumber: 1000 givenname: Jacques homedirectory: /home/jfoucry loginshell: /bin/zsh mail: jacques.foucry(a)example.com objectclass: inetOrgPerson objectclass: mozillaAbPersonAlpha objectclass: sambaSamAccount objectclass: posixAccount objectclass: top objectclass: shadowAccount objectclass: pwdPolicy ou: RT_Users postalcode: 75009 pwdattribute: userPassword sambaacctflags: [U] shadowlastchange: 15987 shadowmax: 120 shadowmin: 7 shadowwarning: 7 sn: Foucry uid: jfoucry uidnumber: 1010 userpassword: --password-- On the replica mv. I created a slapd.conf file (I cannot understand the "new" syntax). include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/mozillaAbPersonAlpha.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/pureftpd.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel config sync modulepath /usr/lib/ldap moduleload back_hdb database hdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}--password-- directory /var/lib/ldap referral ldaps://192.168.72.13 syncrepl rid=020 provider=ldaps://192.168.72.13 type=refreshOnly interval=00:08:00:00 retry="60 10 300 +" filter="(objectClass=*)" scope=sub attrs="*" bindmethod=simple schemachecking=off searchbase="dc=exmaple,dc=com" binddn="cn=syncuser,dc=exmaple,dc=com" credentials=--password-- tls_reqcert=never When I start slapd on the slave vm, It sound correct but only few off my user records are sync. For example mine is not. One the master: # ldapsearch -x -b"ou=people,dc=example,dc=com" uid=jfoucry # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=jfoucry # requesting: ALL # # Jacques Foucry, People, example.com dn: cn=Jacques Foucry,ou=People,dc=example,dc=com c: France cn: Jacques Foucry mail: jacques.foucry(a)example.com gidNumber: 1000 givenName: Jacques homeDirectory: /home/jfoucry loginShell: /bin/zsh ou: RT_Users postalCode: 75009 shadowMax: 120 shadowMin: 7 shadowWarning: 7 sn: Foucry uidNumber: 1010 uid: jfoucry objectClass: inetOrgPerson objectClass: mozillaAbPersonAlpha objectClass: sambaSamAccount objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: pwdPolicy pwdAttribute: userPassword shadowLastChange: 15987 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 On the slave: ldapsearch -x -b"ou=people,dc=exmaple,dc=com" uid=jfoucry # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=jfoucry # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 I can't figure what's wrong. Why some records are sync and other are not? Is it because of ppolicy? Thanks in advance for your help, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 1

remove unused schema from cn=config in n-way multi-master setup
by Igor Zinovik 14 Oct '13

14 Oct '13

Hello, opeldap-technical@ readers. I have a 3 nodes n-way multi-master setup configured accroding to OpenLDAP Admin Guide. Currently my catalog configuration stores custom schema which I made some time ago, but it no longer needed, so I would like to delete my custom schema from configuration. Replication is bothering me the most. I understand that consequences would be unexpectable when one of my server will see that other node is telling him to delete cn={14}example,cn=schema,cn=config. So my main question is how to correctly disable replication in n-way multi-master setup? Objects that are stored in catalog do not use attributes or object classes that are defined in custom schema. In my setup write operations are directed only to single node of a cluster. I would like to ask for advice about my deletion plan. 0. Make backup of current cn=config and data 1. Disable replication via deletion olcServerID in cn=config and setting olcMirrorMode to FALSE 2. Direct write operations to third node 3. Stop slapd instance on first node 4. Edit configuration (remove custom schema from file, renumber siblings in cn=schema,cn=config) 5. Load new configuration into /etc/openldap/slapd.d 6. Start slapd instance on first node 7. Check that schema is absent in cn=config on first node 8. Repeat steps from 3-7 on second node 9. Direct write operations to first node 10. Repeat steps from 3-7 on third node 11. Turn on replication in cluster If it matters i use OpenLDAP 2.4.33 (x86_64).

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical