openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

ou=people hidden from ldapsearch
by Adam 17 Aug '13

17 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm sure this is a really stupid question, and I'm sorry for asking it, but I'm testing a migration from Sun DSEE to OpenLDAP 2.4.35 at the moment. I am creating a DIT similar to the following: dn: ou=people,dc=example,dc=com dn: ou=ftp,dc=example,dc=com dn: ou=groups,dc=example,dc=com dn: ou=hosts,dc=example,dc=com dn: ou=us,ou=people,dc=example,dc=com dn: ou=bd,ou=people,dc=example,dc=com dn: ou=id,ou=people,dc=example,dc=com dn: ou=users,ou=ftp,dc=example,dc=com dn: ou=groups,ou=ftp,dc=example,dc=com dn: ou=us,ou=groups,dc=example,dc=com dn: ou=bd,ou=groups,dc=example,dc=com dn: ou=id,ou=groups,dc=example,dc=com dn: ou=us,ou=hosts,dc=example,dc=com dn: ou=bd,ou=hosts,dc=example,dc=com dn: ou=id,ou=hosts,dc=example,dc=com When I perform a ldapsearch against our current Sun DSEE environment (with the same layout) I see the following: ldapsearch -x -h ldap.example.com -b example.com objectclass=organizationalUnit 1 -LLL dn: ou=people,dc=example,dc=com dn: ou=ftp,dc=example,dc=com dn: ou=groups,dc=example,dc=com dn: ou=hosts,dc=example,dc=com dn: ou=us,ou=people,dc=example,dc=com dn: ou=bd,ou=people,dc=example,dc=com dn: ou=id,ou=people,dc=example,dc=com dn: ou=users,ou=ftp,dc=example,dc=com dn: ou=groups,ou=ftp,dc=example,dc=com dn: ou=us,ou=groups,dc=example,dc=com dn: ou=bd,ou=groups,dc=example,dc=com dn: ou=id,ou=groups,dc=example,dc=com dn: ou=us,ou=hosts,dc=example,dc=com dn: ou=bd,ou=hosts,dc=example,dc=com dn: ou=id,ou=hosts,dc=example,dc=com When I perform the same search against OpenLDAP, I get the following: dn: ou=ftp,dc=example,dc=com dn: ou=hosts,dc=example,dc=com dn: ou=us,ou=people,dc=example,dc=com dn: ou=bd,ou=people,dc=example,dc=com dn: ou=id,ou=people,dc=example,dc=com dn: ou=users,ou=ftp,dc=example,dc=com dn: ou=groups,ou=ftp,dc=example,dc=com dn: ou=us,ou=groups,dc=example,dc=com dn: ou=bd,ou=groups,dc=example,dc=com dn: ou=id,ou=groups,dc=example,dc=com dn: ou=us,ou=hosts,dc=example,dc=com dn: ou=bd,ou=hosts,dc=example,dc=com dn: ou=id,ou=hosts,dc=example,dc=com Notice the destinct lack of ou=people,dc=example,dc=com and ou=groups,dc=example,dc=com. I know they're there, because I can create objects etc in them, but I'm at a complete loss as to why they don't show up in the ldapsearch. I know I'm obviously doing something stupid here, and again, I apologize, but any assistance would be appreciated. Thanks. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJSD4mtAAoJEH1iO/rgZIL9FwwH/3UxTIgxrVbe7IVf99IRB+hf veJMZ6NaqMjlFfFsla+KLbIF/64I5rwqVCLu/y6necJrQS2EY+cmZmNRlQ02/Cso rfd5ZQgp5q7ECZSkZCTLhrB1CIY183PiloDnG41lmpJkkP+thwj4NUdcMYYxP0bo EOMZIefdOewhV7+DOv0Jw807HCOAYrgfsbIk8uDmBUCdBaf4/WVmnLzTGMLq7zrj HLSJC09bPqcmlEieWVXFNVajE5ztZs8XI6WmFYvrDq1/+1bKoaYMRT2sMh8HnuEM hisFEUsLpQWSpwP52tmSGau2sOhthLPQKRBrIQbCyAwfEfwtqc+TUDmMsaxhKy0= =AqJ2 -----END PGP SIGNATURE-----

2 2

Schema Replication and data replication.
by espeake＠oreillyauto.com 12 Aug '13

12 Aug '13

So we are cooking with warm oil and I wan to the cooking with hot oil!!!! I have been able to get upgraded 2.4.28 on open ldap. Having issue with getting a good build of 2.4.35. But that isn't the problem. Below is the log on my log from one of my consumers after starting the slapd service. Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module back_hdb Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module back_hdb: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module ppolicy Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module ppolicy: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module memberof Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module memberof: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module dynlist Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module dynlist: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module syncprov Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module syncprov: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module refint Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module refint: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module back_ldap Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module back_ldap: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: Config: ** successfully added syncrepl rid=002 "ldap://tntest-ldap-master-1.oreillyauto.com" Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index objectClass 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index cn 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index uid 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index oreillyGroup 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index locationEntry 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index counterNumber 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index businessCategory 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index locationNumber 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index position 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index title 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index givenName 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index functionListing 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index manager 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index sn 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index nickName 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index employeeNumber 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index ou 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index entryUUID 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index supervisor 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index entryCSN 0x0004 Aug 7 21:36:17 tntest-ldap-2 slapd[3962]: slapd starting Aug 7 21:36:17 tntest-ldap-2 slapd[3962]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Here is where is stops. Here in the ldif file from my master: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 3411e7fc dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.com olcsyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="10 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=<password> olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none olcRootDN: cn=admin,cn=config olcRootPW:: c2VjcmV0 structuralObjectClass: olcDatabaseConfig entryUUID: 35b75e72-93c2-1032-9ca4-711c013d2dcb creatorsName: cn=config createTimestamp: 20130807153144Z entryCSN: 20130807153144.468097Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130807153144Z Here is the ldif from my consumer: dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcsyncrepl: {0}rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshOnly retry="5 +" searchbase="cn=config" bindmethod=simple binddn="cn=admin,cn=config" credentials=<password> schemachecking=on olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config ModifyTimestamp: 20110503162710Z logging is set to config and sync. Is the issue the maybe the entryCSN? I am wondering if I need to blow out the cn=config stuff and recreate it on the consumer It should be that hard, just take a little time. Am I headed in the right direction or am I off base. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

3 16

RE24 testing call (OpenLDAP 2.4.36)
by Quanah Gibson-Mount 12 Aug '13

12 Aug '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.36 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

8 17

UNSUBSCRIBE
by Kumar, Amit 12 Aug '13

12 Aug '13

1 0

DB config and log files
by jeevan kc 12 Aug '13

12 Aug '13

Hello thereMy DB_CONFIG looks like this set_cachesize 0 716800 0set_lg_bsize 2097512set_lg_dir /usr/local/var/openldap-logsset_flags DB_LOG_AUTOREMOVE Recently , we have few batch processes running in the LDAP server for Datawarehouse groups and other apps and this is causing DB logs to grow . When I do a ls -l the size of the logs are almost 4GB in size. This is causing trouble and we don't want this many logs. How do I limit the log size so that it doesn't exceed lets say 1 GB . These DB logs are of very little importance to us. We periodically do a backup using slapcat and we can use this in case we have a fatal crash .Please throw some light on how to limit these DB logs . Thanks Jeevan

3 4

Re: RE24 testing call (OpenLDAP 2.4.36)
by Marco Pizzoli 12 Aug '13

12 Aug '13

On Mon, Jul 29, 2013 at 9:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.36 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/**devel/gitweb.cgi?p=openldap.** > git;a=snapshot;h=refs/heads/**OPENLDAP_REL_ENG_2_4;sf=tgz<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > All MDB tests passed with current RE24 (apart from the very last additions you just made). RHEL6.4 x86_64 > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

MAC and Network Asset Inventory on LDAP
by Nick Milas 12 Aug '13

12 Aug '13

Hello, We are planning on using FreeRadius for MAC-auth based on MAC addresses (to be) stored on our OpenLDAP (in parallel to 802.1x using our ldap-stored users). With that opportunity we would be aiming at starting a comprehensive network asset inventory. So, I would like to ask people to share their experience regarding storing MAC addresses and other device info on LDAP. If using LDAP for device inventory, are you simply using device and ieee802Device object classes (in core.schema and nis.schema respectively), or you would suggest a more specialized/extensive schema to be used instead or additionally (auxiliary object class(es))? Which? An example method (found with some googling): http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Website/articles/S… Of course, one could try to re-invent the wheel (custom schema, custom apps), but I am sure there should be some well designed schema(s) around for this purpose. I think that it would also make sense, if possible, to be able to use a storage format that can be leveraged by other open-source network assets management software (like ocsinventory-ng or openipam, which however use SQL backends). Any experiences/suggestions would be highly appreciated. Thanks and Regards, Nick

1 0

Linux quota problem for LDAP users
by Osman ÜNALAN (ULAKBİM) 12 Aug '13

12 Aug '13

Hi, I'm trying to set quotas for LDAP users on a Linux server. But all the users' name begins with number and when I try to set quota for a user like "123456" it sets a quota for "#123456" I set quota like this: setquota -u 123456 1500 1500 0 0 -a repquota output is like: user used soft hard grace used soft hard grace 123456 -- 500 0 0 100 0 0 # 123456 -- 0 1500 1500 0 0 0 That's why the quota I set applies to non existing user named #123456. Does anyone know how can I fix that? Thanks, Osman Ünalan

4 3

One questions about nested gourp support of openldap
by ctosgh 11 Aug '13

11 Aug '13

Hi, there To meet the following requirement: "groupA" contains user entries: cn=a,ou=users,dc=test,dc=com cn=b,ou=users,dc=test,dc=com "groupB" contains "groupA" I have following questions: 1 Which object classes should I use to implement above requirement? Could anyone give a simple sample ldif file? 2 Is there a standard or commonly used way to implement nested groups? Appreciate your feedback~~~ Thanks, Jacky

3 3

developing module that instantiates check_password() function
by Scott Koranda 10 Aug '13

10 Aug '13

Hello, I wish to develop a user-defined loadable module that instantiates the check_password() function as described in the slapo-ppolicy man page. The man page specifies the function prototype as int check_password (char *pPasswd, char **ppErrStr, Entry *pEntry); In which header file is the 'Entry' type defined? Thanks, Scott

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical