openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: extend groupOfURLs
by Michael Ströder 05 Jun '13

05 Jun '13

Carlos. please always follow-up on the mailing list so others can learn and answer as well. Carlos Santos wrote: > ################################################################################ > - # > - objectClass ( 1.3.6.1.4.1.5923.1.1.101 > - NAME 'dygroup' > - DESC 'dynamic group' > - SUP groupOfURLs > - STRUCTURAL > - MUST ( visibility $ groupname $ owner ) ) > - > - > - > ################################################################################ When using this and starting slapd with -d config,stats then it outputs: 51a8b922 line 53 (objectClass ( 1.3.6.1.4.1.5923.1.1.101 NAME 'dygroup' DESC 'dynamic group' SUP groupOfURLs STRUCTURAL MUST ( visibility $ groupname $ owner ) )) 51a8b922 /home/michael/ftp/Linux/Networking/LDAP/OpenLDAP/schema/experimental.schema: line 53 objectClass: AttributeType not found: "visibility" So where's the attribute type description for 'visibility'? => always use debug options when starting slapd after working on custom schema definitions. Ciao, Michael.

2 5

Substring Indexes on userPassword Attribute
by Tim Gustafson 04 Jun '13

04 Jun '13

Hi, I have a need to find out how many of my users are using different password hashing methods, so I went and tried to do this search: ldapsearch -D uid=tjg,ou=People,dc=com -W -b ou=People,dc=com 'userPassword={SHA}*' But that didn't return anything. So I figured maybe I needed to create a substr index on that attribute. When I did that, slapindex returned: slapd.conf: line 82: substr index of attribute "userPassword" disallowed Why is that? How can I do a search that would tell me which of my users is using an SHA-hashed password? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

4 8

Usage of the LDAP_OPT_X_SASL_GSS_CREDS
by Bernardo Pastorelli 31 May '13

31 May '13

Not sure if this is the right mailing list. I'm developing an LDAP client that uses GSSAPI as the transport mechanism. I would like to set the credentials to use for binding my user, and it seems that it is possible to set them using the LDAP_OPT_X_SASL_GSS_CREDS option. So I create the ldap context using ldap_initialize and then try to set the credentials using the option above, before calling the ldap_sasl_interactive_bind_s function for binding my user. But the options setting operation fails. Looking at the code, I see that, to set the option, it is necessary that the pointers in the chain below are not null: ld->ld_defconn->lconn_sasl_authctx But they are null after initializing the ldap context. So, which function calls do I have to execute for being able to set credentials before calling the bind function? Any alternative way? Regards, Bernardo Pastorelli

1 0

How to make OpenLDAP use random (v4) UUIDs in entryUUID attribute
by dorian taylor 31 May '13

31 May '13

Hello, It is my understanding that OpenLDAP keys its entries on UUIDs under the hood. I have a system that makes extensive use of UUIDs as canonical (and sometimes public-facing) identifiers, and would like to tap into the UUIDs generated for the objects in the LDAP directory for certain operations over those objects. The problem is I'm using type 4 (random) UUIDs [1] everywhere, and OpenLDAP uses type 1 (time-based). It is important to the system to some extent that these identifiers be resistant to sequencing. As such, they really ought to be random. Since it hasn't been deployed in production yet, the sanest course of action seems to be to bend OpenLDAP to comply. (The alternative would be to maintain a dictionary of some kind, which I'm not keen about.) A survey of the code is as such: OpenLDAP doesn't appear to care which version of UUID it uses save for the generator function itself. The util library is hardcoded [2] to use type 1, and the entryUUID attribute itself is constrained in the schema [3] to not permit modification (where "modification" ostensibly also extends to adding new records). I'm not too familiar with the source but at a glance it appears to accommodate an entryUUID attribute as input [4]. I guess my question is: what's the best strategy? * Relax NO-USER-MODIFY on the entryUUID schema entry and set it at the application layer (easiest but most prone to problems) * Hack uuid.c to use uuid_generate_random instead of uuid_generate (easy, but introduces a maintenance problem) * Create an overlay (no idea where to start but can figure it out) * Figure out some way to make the UUID version configurable and send a patch upstream (most work and would it even be desirable?) Links: 1) http://tools.ietf.org/html/rfc4122#section-4.4 2) http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… 3) http://tools.ietf.org/html/rfc4530#section-2.4 4) http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… -- Dorian Taylor http://doriantaylor.com/

2 4

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> Hello, >> >> >> is it possible to use a ldif-backup with operation attributes >> (ldapsearch ... '+' '*') with slapadd, to save the operation >> attributes, if no slapcat backup is available? Are there any concerns? > > > If you can't get a slapcat backup, how would you get a ldapsearch backup? > A seconds reason, why I try to prevent using slapcat on a productive system is: ======================================================= slapd[4812]: bdb(ou=root): PANIC: Permission denied slapd[4812]: bdb(ou=root): DB_ENV->log_newfh: 15752: DB_RUNRECOVERY: Fatal error, run database recovery slapd[4812]: bdb(ou=root): txn_checkpoint: failed to flush the buffer cache: DB_RUNRECOVERY: Fatal error, run database recover slapd[4812]: bdb(ou=root): PANIC: fatal region error detected; run recovery slapd[4812]: null_callback : error code 0x50 slapd[4812]: syncrepl_updateCookie: rid=001 be_modify failed (80) slapd[4812]: do_syncrepl: rid=001 rc 80 retrying (4 retries left) ======================================================= This message I got today on a productive system while getting a ldif via slapcat for setting up an syncrepl slave. This shouldn happen, slapcat (8) manpage tells: "For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. *It is always safe to run slapcat with the slapd-bdb(5)*, slapd-hdb(5), and slapd-null(5) backends." So using ldapsearch is more reliable for me ... Kindly regards Meike

2 2

Any issue on random OIDs?
by Geo P.C. 31 May '13

31 May '13

For our openldap server we created custom attributes by giving random OIDs like 2.25.10.1, 2.25.10.100.10 etc . We are able to add custom attributes and the LDAP server is working fine. Please let us know is there any issue in giving random OIDs for attributes and object classes. Also is there any issue in future while using this. Can anyone please advise us on this. Also I came to know that we can create OIDs without registering. From this site http://www.itu.int/ITU-T/asn1/cgi-bin/uuid_generate I can create UUID but from where I can convert this UUID to OID? Suppose when we convert this UUID to decimal shall we can use it permanently without any issue? Please help us on it Thanks Geo* <http://pcgeo.blogspot.in/>*

2 4

About ldapwhoami
by Jacques Foucry 31 May '13

31 May '13

Hello folks, I think I misunderstood something, but I can't make ldapwhoami working. Mu openldap server work perfectly I and all my users can connect using it. But whe I try to use ldapwhoami I get an error: ldapwhoami -x -D uid=jfoucry,ou=people,dc=example,dc=com -W Enter LDAP Password: ldap_bind: Invalid credentials (49) I am sure to use my LDAP password. I try with -d1 to have debug, and I reach to right server. What's going wrong? Thanks in advance for your help, regards, Jacques -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

3 5

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 8:04 PM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> I want to preserve the operational attributes from the ldapsearch ldif >> (created with '+' '*'). >> But I saw, that a ldapsearch ldif with operational attributes has a >> more operational attributes than from the slapcat ldif. > > > An ldapsearch generated and slapcat generated LDIF of the same db will be > identical for *,+ for ldapsearch. So your statement doesn't really make > much sense. I compared it and found this three additional attributes are in the ldapsearch, but not in slapcat: - entryDN - subschemaSubentry - hasSubordinates It seems, that slapcat ignores this values or at least, it does not complain... Kindly regards Meike

1 0

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 7:51 PM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> 2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>> >>> --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone >>> <meike.stone(a)googlemail.com> wrote: >>> >>>> Hello, >>>> >>>> >>>> is it possible to use a ldif-backup with operation attributes >>>> (ldapsearch ... '+' '*') with slapadd, to save the operation >>>> attributes, if no slapcat backup is available? Are there any concerns? >>> >>> >>> >>> If you can't get a slapcat backup, how would you get a ldapsearch backup? >>> >> >> That's a a ldif created from a colleague, before the database on the >> test system was deleted.. >> I want to simulate some documented test from this colleague, but ony >> the ldif exist and no slapcat. > > > So slapadd it. slapadd will automatically generate the operational attrs. > > I want to preserve the operational attributes from the ldapsearch ldif (created with '+' '*'). But I saw, that a ldapsearch ldif with operational attributes has a more operational attributes than from the slapcat ldif. Is it possible with this ldif, to create the database like my colleague it used? Thanks Meike

4 4

Post-clone Cleanup of Hostname on Version Query
by Kim, Robert 30 May '13

30 May '13

I've been cloning servers with LDAP server set up on them and the process has been working fine but when I recently queried the version with slapd -V, the hostname of the original server shows up. I tried re-running make and make install with no luck. How can I change the hostname that shows up on the version query without redoing the whole installation? OpenLDAP 2.4.30 Red Hat 5.7 Robert Kim Staff Systems Engineer Lockheed Martin IS&GS National/Defense 3100 Zanker Rd San Jose, CA 95134 408-473-4260 Office 408-505-8717 Cell

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical