openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Re: Problem pwdChangedTime
by felas 07 Sep '13

07 Sep '13

The problem is i have this LDIF file with this attribute pwdChangedTime, and because that i have a error to import this file LDIF. 2013/9/6 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, September 06, 2013 9:50 PM +0200 felas <felas85(a)gmail.com> > wrote: > > > I try to add ppolicy.ldif to my schema, but no success. >> >> >> how i can do to resolve this problem? >> > > add ppolicy.ldif with success > > You need to be more detailed about how you tried to add the schema, to > start with. > > --Quanah > > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

RE: Antw: Re: Log service time?
by Chris Jacobs 07 Sep '13

07 Sep '13

You left off the part where I remind that he was looking for information - specifically how to get said information: "If the information Casper requested isn't available, say so. If it is, how would he get it?" As it stands now, his initial question remains unanswered, with the only guidance being "upgrade"; which lacking anything else he is running with in the blind hope it makes things faster (his actual issue, not his questions). That's really the meat of my response/addition to this conversation, and it's been simply side stepped again. -----Original Message----- From: Michael Ströder [mailto:michael@stroeder.com] Sent: Friday, September 06, 2013 2:16 PM To: Chris Jacobs Cc: openldap-technical(a)openldap.org Subject: Re: Log service time? Chris Jacobs wrote: > Michael: I cannot tell if you're being sarcastic or not, so, I'm running > with your words: I'm completely serious. > Software isn't developed in a vacuum - when truly useful, it's intended use > it to be used and it cannot be used sans distros (in any realistic > production operation; sure you can compile everything from source and > create StroderOS). Are you sarcastic here? Serious: Using packages from a Linux distribution is the normal case and works fine mostly for cases where you don't use very advanced features of a given software. If you experience certain bugs in a software packaged by your distro then build a newer distro package of that software. Yes, that's work but it's worth the effort if the component is really important for your infrastructure. This is about getting real control over important components. > While you may be blessed with using whatever software, > from whatever source you desire, with any (or no) support available, many > system administrators are under edicts and must work within the policies > and instructions of their company. Policies and instructions are always subject to controlled change process. If you don't have a change process then your policies are missing a very essential part. > SOX is a big deal at any organization that is publicly traded or works with > government entities. Be assured that I'm quite aware of what it means to run systems governed by lots of policies. > The support model of essentially "it's not the latest; go away until you update (compile it)" isn't helpful. Do you have a support contract with the OpenLDAP community? Everything here is community effort. If you insist on getting commercial-grade support model then pay people providing support (e.g. buy Symas' build for your favourite OS platform). > Quanah: "I would highly advise upgrading to a current release (2.4.36) and > switching to back-mdb." While I personally agree that Quanah should not just write "yuck" because of someone is using back-hdb (given that back-mdb is really usable just since 2.4.36) he's right in pointing out that someone should try to reproduce issues with the latest release first before asking. Ciao, Michael. This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 4

Problem pwdChangedTime
by felas 06 Sep '13

06 Sep '13

Hi, i have this ldif file to import, but i have this error: pwdChangedTime: attribute type undefined I try to add ppolicy.ldif to my schema, but no success. how i can do to resolve this problem?

2 1

Re: Problem pwdChangedTime
by felas 06 Sep '13

06 Sep '13

I don't know!... Il giorno 06/set/2013 22:49, "Turbo Fredriksson" <turbo(a)bayour.com> ha scritto: > On Sep 6, 2013, at 9:50 PM, felas wrote: > > > I try to add ppolicy.ldif to my schema, but no success. > > Why not? > -- > Build a man a fire, and he will be warm for the night. > Set a man on fire and he will be warm for the rest of his life. > >

1 0

2.4.36: test050-syncrepl-multimaster failed for mdm
by Покотиленко Костик 06 Sep '13

06 Sep '13

Following Quanah's advise tried to build 2.4.36 from sources: # ./configure # make depend # make ... test failed - server 1 and server 2 databases differ >>>>> test050-syncrepl-multimaster failed for mdm (exit 1) How bad is this?

2 3

SyncRepl Chaining
by espeake＠oreillyauto.com 06 Sep '13

06 Sep '13

I believe we are very close to our goal of a master/slave syncrepl configuration. I have a master that through refreshAndPersist instantly updates the slave servers. The issue I am having is is passing on updates to the master server for writing the updated information. This is the error message I get. ldap_modify: Strong(er) authentication required (8) I have set up chainingin bother the {-1}frontend database and the {1}hdb database. My understanding of what I read in man slapd-conf is that any attributes used in the {-1}frontend makes these global and I should not need that setup anywhere else unless I need to override the settings fro an individual DB. TLS with openSSL is setup through the compiling of the openldap. I am attaching the slapcat from my master. Any and all help is appreciated. (See attached file: config-20130819-master.ldif) Thank you, Eric Speake Web Systems Administrator O'Reilly Auto PartsThis communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

overlay accesslog entrydn conflict problem (err=68)
by gottabogh 06 Sep '13

06 Sep '13

Hi all, I have a problem with overlay accesslog. Here is my overlay configuration: overlay accesslog logdb dc=log,dc=ciccio.it logops all logold (objectclass=inetOrgPerson) logpurge 10+00:00 08:00 logsuccess FALSE If I try: ldapwhoami -H ldap://myserver -D "uid=myuser,ou=People,dc= ciccio.it" -W I obtain this in the log: Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=19 ADD dn="reqStart=20130826100104.000000Z,dc=log,dc=ciccio.it" Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=19 RESULT tag=105 err=0 text= Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1005 op=12 ADD dn="reqStart=20130826100104.000000Z,dc=log,dc=ciccio.it" Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1005 op=12 RESULT tag=105 err=68 text= Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=20 ADD dn="reqStart=20130826100104.000004Z,dc=log,dc=ciccio.it" Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=20 RESULT tag=105 err=0 text= And those are the entries in the dblog: # 20130826100104.000000Z, log.ciccio.it dn: reqStart=20130826100104.000000Z,dc=log,dc=ciccio.it objectClass: auditSearch reqStart: 20130826100104.000000Z reqEnd: 20130826100104.000001Z reqType: search reqSession: 1011 reqAuthzID: cn=Manager,dc=ciccio.it reqDN: uid=myuser,ou=People,dc=ciccio.it reqResult: 0 reqScope: base reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (objectClass=groupOfNames) reqAttr: member reqEntries: 0 reqTimeLimit: -1 reqSizeLimit: 1 # 20130826100104.000004Z, log.ciccio.it dn: reqStart=20130826100104.000004Z,dc=log,dc=ciccio.it objectClass: auditObject reqStart: 20130826100104.000004Z reqEnd: 20130826100104.000005Z reqType: unbind reqSession: 1011 reqAuthzID: uid=myuser,ou=People,dc=ciccio.it Like you can see there are a search and a unbind, but not the bind operation. I think that err=68 is because ldapwhoami is composed of search, bind, unbind. Since the first two operation are executed at the same time and the dn of a new entry is generated using reqStart, the bind operation takes error 68 (LDAP_ALREADY_EXISTS). How can I get around this problem? Can I modify generation of entrydn in the dblog? For example compose it in this way: "reqStart=xxxx,reqType=yyyy,dc=log,dc=ciccio.it" Thanks a lot, Fabio.

2 1

Fw: SyncRepl Chaining
by espeake＠oreillyauto.com 06 Sep '13

06 Sep '13

Bumping. Eric Speake Web Systems Administrator O'Reilly Auto Parts ----- Forwarded by Eric Speake/OReilly on 08/20/2013 07:39 AM ----- From: Eric Speake/OReilly To: openldap-technical(a)openldap.org Date: 08/19/2013 09:46 AM Subject: SyncRepl Chaining I believe we are very close to our goal of a master/slave syncrepl configuration. I have a master that through refreshAndPersist instantly updates the slave servers. The issue I am having is is passing on updates to the master server for writing the updated information. This is the error message I get. ldap_modify: Strong(er) authentication required (8) I have set up chainingin bother the {-1}frontend database and the {1}hdb database. My understanding of what I read in man slapd-conf is that any attributes used in the {-1}frontend makes these global and I should not need that setup anywhere else unless I need to override the settings fro an individual DB. TLS with openSSL is setup through the compiling of the openldap. I am attaching the slapcat from my master. Any and all help is appreciated. (See attached file: config-20130819-master.ldif) Thank you, Eric Speake Web Systems Administrator O'Reilly Auto PartsThis communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 1

OpenLDAP 2.4.36 slapd stop with assertion fail message
by "POISSON Frédéric" 06 Sep '13

06 Sep '13

Hello, I'm testing the latest release of OpenLDAP 2.4.36 and my slapd stop while i'm doing a change on cn=config. My tests are with my own compilation of OpenLDAP on a RHEL6 server but i see the same problem with "LTB project RPMs" http://ltb-project.org/wiki/download#openldap with RHEL6 package. My aim is to modify cn=config like this in order to implement TLS, here is my ldif : dn: cn=config changetype: modify add: olcTLSRandFile olcTLSRandFile: /dev/random The server shutdown when i add this entry and with slapd option "-d 255" i have : slapd: result.c:813: slap_send_ldap_result: Assertion `!((rs->sr_err)<0)' failed. /etc/init.d/slapd: line 285: 5461 Aborted $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS Notice that i test this ldif modification on release 2.4.35 without problem. Is there any changes inside cn=config behavior with release 2.4.36 that i don't see ? Thanks in advance, Regards, PS: In attachment my cn=config with slapcat, and the lines when starting slapd with debug -d 255. -- Frederic Poisson

2 1

Group values not returned with "id" command
by Justin Edmands 05 Sep '13

05 Sep '13

Hey, Certainly new to migrations of LDAP. I migrated our old setup from OpenLDAP to 389 Directory Server. When using the "id" command on an LDAP client, it only returns uid,gid, and one group. It for some reason does not show all of the actual groups that the user is associated with. What is set to return these values and what setting ensures they are properly mapped from OpenLDAP to 389DS? ### OpenLDAP example: ### [root openldapclient ~]# id jedmands uid=9999(jedmands) gid=100(users) groups=100(users),5000(manager),5001(linuxadmin),5002(storageadmin),5003(dbadmin),5004(webadmin),5006(it) ### 389 DS Example: ### [root 389dsclient ~]# id jedmands uid=9999(jedmands) gid=100(users) groups=100(users) Notes: Posted this to the 389-users list, nothing received. We are using the memberOf plugin for 389DS. I don't know too much about the openldap environment. I moved to CentOS 6 and figured DS was the way to go with SSL/TLS

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical