openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Help with first immersion into LDAP
by Šerých Jakub 03 May '13

03 May '13

Dear group, I would like to ask you for the little help with the newbie first immersion into LDAP. The problem is, that I need to build LDAP proxy, that will connect information from two MS ADs into one meta LDAP. But all the beginers tutorials start from the building of the new fresh LDAP database on the server, so it's very hard for me to catch the first clues... My situation: Debian with openLDAP and two Microsoft Win2008 servers with AD. The commands from Linux server: ldapsearch -x -H ldap://192.168.0.10 -D "ldap-user" -w password -b "ou=studenti,dc=student,dc=intra" and ldapsearch -x -H ldap://192.168.100.5 -D "ldap-user" -w password -b "dc=panska,dc=intra" are fully functional and returning the results I need. But when I try to config openLDAP server just to play role of proxy between the client and AD server it is not working and I cannot find why. One of my attempts to set ldap.conf: loglevel 255 database ldap suffix "ou=studenti,dc=student,dc=intra" uri "ldap://192.168.0.10/" binddn "name=ldap-user" bindpw password I'm trying the functionality by the command: ldapsearch -x -H ldap://localhost -D "ldap-user" -w password -b "ou=studenti,dc=student,dc=intra" or ldapsearch -x -H ldap://localhost "ou=studenti,dc=student,dc=intra" Could somebody give me a tip, how to set the ldap.conf to do just this simple proxying for the begining? How can I track what is going on, if the openLDAP at least tries to send something to MS AD server and if yes, what is the structure of his query (the loglevel 255 doesn't seem to be very helpfull)? Sorry for that newbie type of question and thanks in advance for any info Jakub

2 1

Checking that a change has reached all servers
by Hallvard Breien Furuseth 03 May '13

03 May '13

We have clients which must check that an update has reached all LDAP servers before they start some task. So we need to publish a list of all servers. Where would you put that list, when clients should normally not contact these servers directly (ldap-prod*.uio.no) but instead contact the load balancer sitting in front of them (ldap.uio.no)? 'altServer' in the root DSE anyway, or has someone defined another attribute? With transactional backend databases, an existing slow LDAP operation predating the change might return the old value while this quick poll sees the change. I'm content to just tell clients to wait a second after seeing the change though, unless someone has brighter ideas. Finally, has anyone written a nice little server (LDAP or otherwise) which does this - client sends a request, server checks all LDAP servers and either returns true/false or waits & retries while false? -- Hallvard

2 2

Re: ACL on create questions
by Andrew Findlay 02 May '13

02 May '13

[ Keep copying to the openldap-technical(a)openldap.org list ] On Thu, May 02, 2013 at 02:15:02PM +0000, Emmanuel Dreyfus wrote: > It almost works. My only concern is that it is possible to create an > object where LHS of DN is not in object's attributes. Like this: > > dn: foo=x,o=org > objectClass: fooClass > foo: y There was some argument about that a few years ago. I am sure that the intention of X.500 was for values in the RDN to be *chosen from* values in the entry. X.501(1988) section 8.1(g) defines an RDN: A set of attribute value assertions, each of which is true, concerning the distinguished values of a particular entry. Unfortunately, somewhere along the line one or more LDAP implementations permitted values in the RDN to be *in addition to* the values in the entry. This was a pain as it was not clear how search filters etc should behave, but some people with loud voices apparently became dependent on it. I remember someone (probably Kurt) saying at one point that the behaviour was wrong but someone had written it into the standards so it had to be supported. However, LDAP is now defined by RFC4512 which says this: 2.3.1. Relative Distinguished Names Each entry is named relative to its immediate superior. This relative name, known as its Relative Distinguished Name (RDN) [X.501], is composed of an unordered set of one or more attribute value assertions (AVA) consisting of an attribute description with zero options and an attribute value. These AVAs are chosen to match attribute values (each a distinguished value) of the entry. I read that as equivalent to the original X.501 definition, so maybe we should now treat the behaviour you see as a bug. Which version of slapd are you using? When I try this on 2.4.35 the extra value from the RDN gets copied into the entry so although the LDIF being loaded is not strictly correct it does result in a conformant entry. What does your entry look like when you read it back? Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 1

Debian Squeeze: Slapd subtree disappears, but ldapsearch finds it | unable to allocate memory for mutex; resize mutex region
by Denny Schierz 02 May '13

02 May '13

hi, on the last hour I had a very strange problem: I have a Debian Squeeze with Slapd installed and it was working a long time, but today one subtree disappears completely from the ldap browser (Apache Directory Studio). I wasn't accessible anymore, but with ldapsearch I was able to see the tree. Also I tried to add the LDIF again to the LDAP, but slapd says: "... exists ...." The only way to get it back working again, was to restore the plain BDB files from the backupjob yesterday. I absolutely don't know, what happens. The only thing I changed, I reinstalled the second LDAP (n-way master) on a new host, with a config only and let the second ldap synchronize with the main LDAP. After ~20-40 minutes the job was done and the second was up to date. That was yesterday. - The subtree was also missing on the second LDAP ... so, the synchronizing did the same ... So, I deleted all *dbd* *log* on ldap2 (after the restore from the main LDAP) and wanted to synchronizing again the full tree ... but I get many warnings: dc=...... unable to allocate memory for mutex; resize mutex region any suggestions? cu denny

7 19

ACL on create questions
by Emmanuel Dreyfus 02 May '13

02 May '13

HI Two ACL questions: 1) Is it possible to allow entry creation on a branch while preventing renaming? I understand I need to give write access to - attrs=chidren on parent - attrs=entry on created entry - attrs=<the mandatory attributes for object> Last item include the attributes used for RHS part of the DN. That suggests renaming will always be possible 2) Is it possible to make some entry values mandatory for an entry creation? e.g.: I want to enforce specific values of objectClass -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

How to configure ubuntu server with LDAP group based authentication
by Geo P.C. 02 May '13

02 May '13

By installing libnss-ldap we are able to integrate an Ubuntu server with ldap (openldap). But we are unable to configure ldap group based authentication. We need to configure in such a way that user from a particular group need only to login. Please let me know is it possible configure it and please update us the steps or any url. Thanks Geo

3 3

Need help to configure OpenLDAP!!
by pradyumna dash 02 May '13

02 May '13

Hi, Am facing an issue while configuring OpenLDAP. My suffix looks like below in the *slapd.conf* file and apart from the default schema i have used ppolicy. database bdb suffix "dc=example,dc=com,dc=in" rootdn "cn=Manager,dc=example,dc=com,dc=in" # SAG: 20100203 overlay ppolicy ppolicy_default "cn=default,ou=policies,o=test,dc=example,dc=com,dc=in" ppolicy_use_lockout I have prepared the below LDIF to add *test.ldif* ====== dn: dc=com,dc=in dc: com objectClass: top objectClass: domain dn: dc=example,dc=com,dc=in dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=com,dc=in ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=example,dc=com,dc=in ou: Group objectClass: top objectClass: organizationalUnit Am using the below command to add this LDIF file: *ldapadd -x -W -D "cn=Manager,dc=example,dc=com,dc=in" -f /opt/test.ldif* But am getting the below error. * "adding new entry "dc=com,dc=in" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge**"* Please help. Regards, /Neo

5 4

The problem of BINDDN/BINDPW in ldap.conf (2nd time)
by Madas Pál 01 May '13

01 May '13

Earlier thread: > Tianyin Xu asked, Howard Chu answered: > > > ... > > This works quite fine. Then, I write the parameters into ldap.conf as follows: > > -----------------ldap.conf----------------------- > BASE dc=ucsd,dc=edu > BINDDN cn=admin,dc=ucsd,dc=edu > BINDPW 12345 > ----------------------------------------------------- > > Then only BASE has effect. According to the ldap.conf manual, BINDDN is a > > ... > > Those were not OpenLDAP's ldap.conf. BINDPW isn't mentioned in > OpenLDAP documentation because it does not exist in OpenLDAP. Reading > non-OpenLDAP documentation and attempting to apply it to OpenLDAP > software is a pretty reliable means of confusing yourself. My question: It has been clearly stated, that BINDPW cannot be used in ldaprc (at least in the case of openldap). But it is definitely stated in the manpage of ldap.conf, that BINDDN is a legal user-only option of openldap. My ldaprc says: BASE ou=madas,dc=something BINDDN cn=admin,dc=something TLS_REQCERT allow URI ldaps://ip1.ip2.ip3.ip4 BASE and URI has its effect, BINDDN has not. Did I make a mistake? Thank you in advance. man ldap.conf: ... AUTHOR Kurt Zeilenga, The OpenLDAP Project ACKNOWLEDGEMENTS OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from University of Michigan LDAP 3.3 Release. OpenLDAP 2011/11/24 LDAP.CONF(5) ...

2 1

slapd 2.4.33 changes 'dc' to 'ou' after cn=schema,cn=config modification
by Igor Zinovik 30 Apr '13

30 Apr '13

Hello. I'm running openldap 2.4.33 with on-line configuration (slapd-config). Before running slapd with on-line configuration i developed my own schema and after that i converted old fashioned slapd.conf to slapd.d. Today i modified one attribute in my schema from this: olcAttributeTypes: {9}( 2.16.840.1.113730.3.1.217 NAME 'spamassassin' DESC 'Sp amAssassin user preferences settings' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) to this olcAttributeTypes: {9}( 2.16.840.1.113730.3.1.217 NAME 'spamassassin' DESC 'Sp amAssassin user preferences settings' SUP name ) I was binded to cn=config with DN that is not part of that tree, my dn was uid=zinovik,ou=people,dc=...,dc=ru So after that change i noticed that i see following messages while running slaptest: ldap1:~ $ sudo slaptest -vF /etc/openldap/slapd.d 51800ba4 PROXIED attributeDescription "OU" inserted. 51800ba4 PROXIED attributeDescription "DC" inserted. config file testing succeeded I pointed out that this happened because i modified entries in cn=config with modifierName not being part of cn=config namespace. But that is not a problem. Problem happens when i do following ldap1:~ $ cat example.com.ldif dn: dc=example.com,ou=Mail,dc=...,dc=ru objectClass: top objectClass: domain objectClass: amavisAccount dc: example.com amavisLocal: TRUE ldap1:~ $ ldapadd -v -ZZxWD uid=zinovik,ou=people,dc=...,dc=ru -f example.com.ldif add objectClass: top domain amavisAccount add dc: example.com add amavisLocal: TRUE adding new entry "dc=example.com,ou=Mail,dc=...,dc=ru" modify complete ldap1:~ $ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b ou=Mail,dc=...,dc=ru -s one '(&)' Enter LDAP Password: dn: dc=example.com,ou=Mail,dc=...,dc=ru objectClass: top objectClass: domain objectClass: amavisAccount ou: example.com amavisLocal: TRUE Why i do not see 'dc' attribute in this entry and why 'ou' appeared? Trace of this operation: 51800cc6 >>> dnPrettyNormal: <dc=example.com,ou=Mail,dc=...,dc=ru> 51800cc6 <<< dnPrettyNormal: <dc=example.com,ou=Mail,dc=...,dc=ru>, <dc=example.com,ou=mail,dc=...,dc=ru> 51800cc6 ==> unique_add <dc=example.com,ou=Mail,dc=...,dc=ru> 51800cc6 oc_check_required entry (dc=example.com,ou=Mail,dc=...,dc=ru), objectClass "domain" 51800cc6 oc_check_required entry (dc=example.com,ou=Mail,dc=...,dc=ru), objectClass "amavisAccount" 51800cc6 oc_check_allowed type "objectClass" 51800cc6 oc_check_allowed type "dc" 51800cc6 oc_check_allowed type "amavisLocal" 51800cc6 oc_check_allowed type "structuralObjectClass" 51800cc6 mdb_dn2entry("dc=example.com,ou=mail,dc=...,dc=ru") 51800cc6 => mdb_dn2id("dc=example.com,ou=mail,dc=...,dc=ru") 51800cc6 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 51800cc6 => mdb_entry_decode: 51800cc6 <= mdb_entry_decode 51800cc6 mdb_dn2entry("cn=ldap admins,ou=groups,dc=...,dc=ru") 51800cc6 => mdb_dn2id("cn=ldap admins,ou=groups,dc=...,dc=ru") 51800cc6 <= mdb_dn2id: got id=0xfab 51800cc6 => mdb_entry_decode: 51800cc6 <= mdb_entry_decode 51800cc6 mdb_entry_get: rc=0 51800cc6 => mdb_dn2id_add 0x1f19: "dc=example.com,ou=mail,dc=...,dc=ru" 51800cc6 <= mdb_dn2id_add 0x1f19: 0 51800cc6 => index_entry_add( 7961, "dc=example.com,ou=Mail,dc=...,dc=ru" ) 51800cc6 <= index_entry_add( 7961, "dc=example.com,ou=Mail,dc=...,dc=ru" ) success 51800cc6 => mdb_entry_encode(0x00001f19): dc=example.com,ou=Mail,dc=...,dc=ru 51800cc6 <= mdb_entry_encode(0x00001f19): dc=example.com,ou=Mail,dc=...,dc=ru 51800cc6 mdb_add: added id=00001f19 dn="dc=example.com,ou=Mail,dc=...,dc=ru" 51800cc6 send_ldap_result: conn=1000 op=2 p=3 When i try to modify attribute: dn: dc=example.com,ou=Mail,dc=...,dc=ru changetype: modify add: dc dc: example.com I get: modifying entry "dc=example.com,ou=Mail,dc=...,dc=ru" ldap_modify: Object class violation (65) additional info: attribute 'ou' not allowed Even my root object lost its 'dc' attribute somehow: ldap1: ~$ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b dc=...,dc=ru -s base '(&)' dn: dc=...,dc=ru ou: ... objectClass: organization objectClass: dcObject o: my organization If it matters i use slapd-mdb as storage backend. I did not changed 'dc' and 'ou': ldap1:~ $ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b 'cn={0}core,cn=schema,cn=config' '(&)' olcAttributeTypes|egrep -e "'(ou|dc)'" Enter LDAP Password: olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone I do not use slapo-rwm. Here are my overlays for dc=...,dc=ru: dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRefintConfig olcOverlay: {1}refint olcRefintAttribute: seeAlso olcRefintAttribute: uniqueMember olcRefintAttribute: member olcRefintNothing: cn=EMPTY dn: olcOverlay={2}unique,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {2}unique olcUniqueURI: ldap:///ou=Hosts,dc=...,dc=ru?ipHostNumber?sub olcUniqueURI: ldap:///ou=People,dc=...,dc=ru?uid,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=...,dc=ru?cn,gidNumber?sub olcUniqueURI: ldap:///ou=Mail,dc=...,dc=ru?mail,mailLocalAddress?sub dn: olcOverlay={3}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig olcOverlay: {3}syncprov olcSpCheckpoint: 200 20 olcSpSessionlog: 100

1 0

slapschema and slapd-mdb
by Igor Zinovik 30 Apr '13

30 Apr '13

Hello. Is it safe to run slapschema with slapd-mdb(5) (while slapd is running in r/w mode)?

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical