openldap-technical

openldap-technical@openldap.org

6 participants
9858 discussions

Trying to migrate from ldap 2.4.x to 2.6.x and having an issue.
by Matthew Goebel 07 Feb '23

07 Feb '23

Hello, I am trying to migrate from directory.emich.edu : redhat ES 7 : redhat supplied ldap [root@directory.emich.edu:/etc/openldap]# /usr/sbin/slapd -V @(#) $OpenLDAP: slapd 2.4.44 (Jun 6 2020 17:06:42) $ mockbuild(a)x86-vm-25.build.eng.bos.redhat.com: /builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd to directory8.emich.edu : redhat ES 8 : hand rolled from source code ldap [root@directory8.emich.edu:/root]# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.6.X (Nov 15 2022 16:59:29) $ root(a)directory8.emich.edu: /home/src/openldap-OPENLDAP_REL_ENG_2_6/servers/slapd And everything seems to work except for one thing. I can't seem to do global anonymous searches? I don't understand ldap well enough to figure out what step or config I've missed. [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory.emich.edu" -LLL -b "uid=mgoebel,ou=people,o=emich.edu" -x -s sub "(objectClass=*)" dn: uid=mgoebel,ou=people,o=emich.edu objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson uid: mgoebel [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory8.emich.edu" -LLL -b "uid=mgoebel,ou=people,o=emich.edu" -x -s sub "(objectClass=*)" dn: uid=mgoebel,ou=people,o=emich.edu objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson uid: mgoebel [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory.emich.edu" -LLL -b "ou=people,o=emich.edu" -x -s sub "(objectClass=*)" returns every record with objectClass set [root@directory8.emich.edu:/tmp]# ldapsearch -H "ldap://directory8.emich.edu" -LLL -b "ou=people,o=emich.edu" -x -s sub "(objectClass=*)" No such object (32) compile options used for openldap were ./configure \ --prefix=/usr/local \ --disable-ipv6 \ --with-kerberos \ --enable-monitor \ --enable-dynamic \ --enable-phonetic \ --enable-slapd \ --enable-spasswd \ --enable-rlookups \ --enable-hdb \ --enable-dyngroup=yes \ --enable-proxycache=yes \ --enable-bdb \ --enable-crypt \ --with-cyrus-sasl=yes \ --with-tls Thanks, Matt -- Matthew Goebel : m <goebel(a)emunix.emich.edu>goebel(a)emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 1

Re: RE26 testing call (2.6.4) #3
by Simon Pichugin 06 Feb '23

06 Feb '23

Builds and tests cleanly on Fedora 38 (Rawhide). On Tue, Jan 31, 2023 at 9:59 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the third testing call for OpenLDAP 2.6.4. Depending on the > results, this may be the final testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.4 Engineering > Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) > Fixed ldapsearch memory leak with paged results (ITS#9860) > Fixed libldap ldif_open_urlto check for failure (ITS#9904) > Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) > Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) > Fixed lloadd memory leaks (ITS#9907) > Fixed lloadd shutdown code to protect memory correctly (ITS#9913) > Fixed lloadd race in epoch.c (ITS#9947) > Fixed lloadd potential deadlock with cn=monitor (ITS#9951) > Fixed lloadd to keep listener base around when not active (ITS#9984) > Fixed lloadd object reclamation sequencing (ITS#9983) > Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) > Fixed slapd free of redundant cmdline option (ITS#9912) > Fixed slapd transactions extended operations cleanup after write > (ITS#9892) > Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102) > Fixed slapd connection close logic (ITS#9991) > Fixed slapd bconfig locking of cn=config entries (ITS#9045) > Fixed slapd-mdb max number of index databases to 256 (ITS#9895) > Fixed slapd-mdb to always release entries from ADD operations > (ITS#9942) > Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) > Fixed slapd-monitor memory leaks with lloadd (ITS#9906) > Fixed slapd-monitor to free remembered cookies (ITS#9339) > Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) > Fixed slapo-deref memory leak (ITS#9924) > Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) > Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) > Fixed slapo-dynlist to mark internal searches as such (ITS#9960) > Fixed slapo-pcache crash in consistency_check (ITS#9966) > Fixed slapo-remoteauth memory leaks (ITS#9438) > Fixed slapo-rwm memory leaks (ITS#9817) > Build Environment > Fixed ancient DOS related ifdef checks (ITS#9925) > Fixed build process to not use gmake specific features (ITS#9894) > Fixed source tree to remove symlinks (ITS#9926) > Fixed slapo-otp testdir creation (ITS#9437) > Fixed slapd-tester memory leak (ITS#9908) > Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) > Fixed usage of bashism (ITS#9900) > Fixed test suite portability (ITS#9931) > Documentation > Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind > (ITS#9976) > Fixed slapo-asyncmeta(5) to clarify scheduling for target > connections (ITS#9941) > Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) > Fixed slapo-unique(5) to clarify when quoting should be used > (ITS#9915) > Minor cleanup > ITS#9935 > ITS#9336 > ITS#9337 > ITS#9985 > > Regards, > Quanah > >

1 0

Symas OpenLDAP RE25 and RE26 test packages available
by Shawn McKinney 03 Feb '23

03 Feb '23

For those who want a preview of upcoming 2.5.14 and 2.6.4, we have uploaded packages into our testing repo. To try them, follow these instructions: https://repo.symas.com/ Substituting ’testing’ for ‘release’ when setting up the package repo. For example, RHEL9 RE26 testing packages: ``` wget -q https://repo.symas.com/configs/SOLDAP/rhel9/testing26.repo -O /etc/yum.repos.d/soldap-testing26.repo ``` Or, U20.04 RE25: ``` wget -q https://repo.symas.com/configs/SOLDAP/u20/testing25.list -O /etc/apt/sources.list.d/soldap-testing25.list ``` The following platforms are available: - RHEL7/8/9 - Debian 10/11 - Ubuntu 18.04/20.04/22.04 - SLES 15.3 Notes: - RHEL9 and Ubuntu 22.04 packages are not yet in the release repo. Both will be there after this release. - Symas packages are not supported by the OpenLDAP project. - Issues directed to support(a)symas.com — Shawn

2 2

Setting acl on cn=accesslog (accesslog overlay)
by Simon Kainz 03 Feb '23

03 Feb '23

Hello, i am looking for a way to set an ACL entry for cn=accesslog, which is where i am logging the slapo-accesslog overlay entries to. I tried to set set it with the following: dn: olcDatabase{1}mdb,cn=config changeType: modify add: olcAccess alcAccess: to db.base="cn=accesslog" by dn.base="cn=ldap_cleanup,o=<....>" read by * break This operation works, and i see the intry in my slapd config. I am still unable to see entries from cn=accesslog. Regards, Simon

3 3

Requesting information about libraries/ldap_r
by jjrobert＠lexmark.com 01 Feb '23

01 Feb '23

We are upgrading our stack from using openldap 2.4.57 to 2.5.12 and one of our dependencies is missing lldap_r. I searched and only really found this, which gives me some idea of its purpose: https://marc.info/?l=openldap-devel&m=95218635611825 Is it simply gone now, or does it exist as a separate library? Is there any guidance on what to do if you were using it previously? Thanks, -Jeff

2 1

RE26 testing call (2.6.4) #3
by Quanah Gibson-Mount 01 Feb '23

01 Feb '23

This is the third testing call for OpenLDAP 2.6.4. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.4 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with paged results (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) Fixed lloadd memory leaks (ITS#9907) Fixed lloadd shutdown code to protect memory correctly (ITS#9913) Fixed lloadd race in epoch.c (ITS#9947) Fixed lloadd potential deadlock with cn=monitor (ITS#9951) Fixed lloadd to keep listener base around when not active (ITS#9984) Fixed lloadd object reclamation sequencing (ITS#9983) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd free of redundant cmdline option (ITS#9912) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102) Fixed slapd connection close logic (ITS#9991) Fixed slapd bconfig locking of cn=config entries (ITS#9045) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-mdb to always release entries from ADD operations (ITS#9942) Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) Fixed slapd-monitor memory leaks with lloadd (ITS#9906) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) Fixed slapo-dynlist to mark internal searches as such (ITS#9960) Fixed slapo-pcache crash in consistency_check (ITS#9966) Fixed slapo-remoteauth memory leaks (ITS#9438) Fixed slapo-rwm memory leaks (ITS#9817) Build Environment Fixed ancient DOS related ifdef checks (ITS#9925) Fixed build process to not use gmake specific features (ITS#9894) Fixed source tree to remove symlinks (ITS#9926) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Fixed test suite portability (ITS#9931) Documentation Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976) Fixed slapo-asyncmeta(5) to clarify scheduling for target connections (ITS#9941) Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Minor cleanup ITS#9935 ITS#9336 ITS#9337 ITS#9985 Regards, Quanah

2 1

RE25 testing call (2.5.14) #3
by Quanah Gibson-Mount 31 Jan '23

31 Jan '23

This is the third testing call for OpenLDAP 2.5.14. Depending on the results, this may be the final testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.14 Engineering Fixed client tools to remove 'h' and 'p' options (ITS#9917,ITS#8618) Fixed ldapsearch memory leak with paged results (ITS#9860) Fixed libldap ldif_open_urlto check for failure (ITS#9904) Fixed libldap ldap_url_parsehosts check for failure (ITS#9904) Fixed liblunicode UTF8bvnormalize buffer size (ITS#9955) Fixed lloadd race in epoch.c (ITS#9947) Fixed lloadd to keep listener base around when not active (ITS#9984) Fixed lloadd object reclamation sequencing (ITS#9983) Fixed slapd memory leak with olcAuthIDRewrite (ITS#6035) Fixed slapd transactions extended operations cleanup after write (ITS#9892) Fixed slapd deadlock with replicated cn=config (ITS#9930,ITS#8102) Fixed slapd connection close logic (ITS#9991) Fixed slapd bconfig locking of cn=config entries (ITS#9045) Fixed slapd-mdb max number of index databases to 256 (ITS#9895) Fixed slapd-mdb to always release entries from ADD operations (ITS#9942) Fixed slapd-mdb to fully init empty DN in tool_entry_get (ITS#9940) Fixed slapd-monitor to free remembered cookies (ITS#9339) Fixed slapo-accesslog reqStart ordering matching rule (ITS#9880) Fixed slapo-deref memory leak (ITS#9924) Fixed slapo-dynlist to ignore irrelevant objectClasses (ITS#9897) Fixed slapo-dynlist to avoid unnecessary searches (ITS#9929) Fixed slapo-dynlist to mark internal searches as such (ITS#9960) Fixed slapo-pcache crash in consistency_check (ITS#9966) Fixed slapo-remoteauth memory leaks (ITS#9438) Build Environment Fixed ancient DOS related ifdef checks (ITS#9925) Fixed build process to not use gmake specific features (ITS#9894) Fixed source tree to remove symlinks (ITS#9926) Fixed slapo-otp testdir creation (ITS#9437) Fixed slapd-tester memory leak (ITS#9908) Fixed usage of non-standard C syntax (ITS#9898, ITS#9899, ITS#9901) Fixed usage of bashism (ITS#9900) Fixed test suite portability (ITS#9931) Documentation Fixed ldap_bind(3) to document ber_bvfree in ldap_sasl_bind (ITS#9976) Fixed slapo-asyncmeta(5) to clarify scheduling for target connections (ITS#9941) Fixed slapo-dynlist(5) to clarify configuration settings (ITS#9957) Fixed slapo-unique(5) to clarify when quoting should be used (ITS#9915) Minor cleanup ITS#9935 ITS#9336 ITS#9337 ITS#9985 Regards, Quanah

1 0

How to retrieve invalid CA certificate error upon ldap over TLS connection using openldap PAI
by tishamol＠gmail.com 27 Jan '23

27 Jan '23

Hi, How can i get an error specific to invalid CA certificate for an ldaps connection(LDAP over TLS)? Our flow is like this 1:ldap_initialize() 2:ldap_sasl_bind_s() But even if i import an invalid CA certificate on ldap client to verify the server certificate , i don't get any error specific to TLS handshake fail. ldap_sasl_bind_s()() always return -1. Can you suggest someway to fetch this error from openldap? Thanks, Smitha

1 1

VRF support in openldap
by tishamol＠gmail.com 27 Jan '23

27 Jan '23

Hi, I would like to know is there any support for passing vrf-id to openldap library ? Thanks, Smitha

2 5

Any chance to include ITS#9990 fix in 2.5.14?
by Kartik Subbarao 26 Jan '23

26 Jan '23

I ran into a passwd exop overlay problem this week when upgrading from 2.4.57 to 2.5.13 and was able to track it down (ITS#9990). Fortunately the fix is very simple, just revert the changes to passwd.c made in ITS#8698. I noticed the testing call for 2.5.14 and wanted to ask if it might be possible to include this fix in that release. Totally understood if you guys need to get this out the door as soon as possible. just figured I'd ask to see if we can get this fix included :-) Thanks, -Kartik

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical