openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

Start a nNew thread

rid tracking
by Sven Jourgensen 28 Mar '13

28 Mar '13

Is there any way to get a master to divulge the rid of each slave that is using it to keep in sync?

3 4

RE24 testing call (OpenLDAP 2.4.35)
by Quanah Gibson-Mount 28 Mar '13

28 Mar '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.35 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

Chaining
by jeevan kc 27 Mar '13

27 Mar '13

HelloI've set up a chaining overlay on the slave server. I think I followed the proper procedures but every time I try to update entries (delete,add,change)the slave server I get LDAP error code 8 - Strong Authentication Required. How can I modify entries on the slave without getting the error? I've openldap 2.4.30 installed on Red Hat and my configuration is as follows. Any help would be appreciated. dn: olcDatabase={0}ldapobjectClass: olcLDAPConfigobjectClass: olcChainDatabaseolcDatabase: {0}ldapolcDbURI: "ldap://lap00621.cov.vinex.com"olcDbStartTLS: none starttls=noolcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=vinex,c=us" credentials="l4s3rj3t" keepalive=0:0:0olcDbRebindAsUser: FALSEolcDbChaseReferrals: TRUEolcDbTFSupport: noolcDbProxyWhoAmI: FALSEolcDbProtocolVersion: 3olcDbSingleConn: FALSEolcDbCancel: abandonolcDbUseTemporaryConn: FALSEolcDbConnectionPoolMax: 16olcDbSessionTrackingRequest: FALSEolcDbNoRefs: FALSEolcDbNoUndefFilter: FALSEstructuralObjectClass: olcLDAPConfigentryUUID: df6c7dc4-26a0-1032-829d-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321182829ZentryCSN: 20130321182829.558457Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321182829Z dn: olcOverlay={0}chainobjectClass: olcOverlayConfigobjectClass: olcChainConfigolcOverlay: {0}chainolcChainCacheURI: FALSEolcChainMaxReferralDepth: 1olcChainReturnError: TRUEstructuralObjectClass: olcChainConfigentryUUID: 8a6734ba-2685-1032-8293-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321151250ZentryCSN: 20130321151250.505781Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321151250Z

3 2

Translucent + ProxyCache
by Kevin Vargo 27 Mar '13

27 Mar '13

Hi, Has anyone been able to get Translucent Proxy (slapo-translucent) working with Proxy Cache (slapo-pcache)? I'm using v2.4.31, and the translucent is working great to mix in some attributes specific to that server. Problem is we're converting the "upstream" LDAP to Back-SQL which ends up mighty slow in some use-cases. It would be great to be able to cache the results from the translucent's back-LDAP call. I've tried placing the pcache overlay in various places, but either it the server doesn't start and yields a: no structural objectClass add function error, which may/not be related; or the service starts fine, but doesn't appear to hit the cache at all. Looks like someone tried a while ago, but I can't find any answer: http://www.openldap.org/lists/openldap-software/200803/msg00004.html Perhaps the back-ldap implementation under slapo-translucent isn't fully-functional for some reason? Thanks, Kevin

1 0

Replicating more than 1 subtree from a single master
by Carlo Santos 27 Mar '13

27 Mar '13

Hi, I have a single master and single slave replication setup. Is it possible to replicate different subtrees. I have thought of the following ways to do this: Given we have root node dc=my,dc=ldap with 2 subtrees cn=subtree1,dc=my,dc=ldap and cn=subtree2,dc=my,dc=ldap - use the dn's of the subtrees as searchbases - Assuming that the cn attribute is propagated under the subtrees, use the filter attribute. - A mix of both. Are all of these possible? Or is it even possible to replicate multiple subtrees from a single master?

1 0

Quick setup replica with openldap-2.4.33
by Takashi Komatsubara 27 Mar '13

27 Mar '13

Hi team, This is my first time to post a question. Please forgive me if I am making miss-posting. I have a big ldap master which is based on openldap-2.4.33. The mdb file size is 50 GB. In order to setup an replica server quickly, can we copy the mdb and config to the replica server? files: data/ldap/mdb/db/data.mdb data/ldap/config/cn=config data/ldap/config/cn=config/.... Thank you very much, Takashi.

3 5

Kinda stuck
by Spyros Mailinglists 26 Mar '13

26 Mar '13

Hello all, New to the list, so be tolerant ? :-) I am trying to build an ubuntu server 12.04 with openldap and samba. I want openldap to handle aspects of the server like having a centrilized user management and samba , naturally, for the shares. In an ideal scenario, I would like this box to be able to authenticate LAN users and create shares depending on each users' priviledges. Anywhoo, I've been trying to built this for about three months now. I cannot get it to work. At the moment I am stuck on smbldap-tools and the (infamous ?) configure.pl script. I've tried tons of howto's and manuals on the topic from the net. But once I am stuck, I cannot continue past the aformentioned point. Would anyone know of any resources out there ? If you have any pointers, please share . . . . Thank you very much, spyros

2 1

Re: openldap-2.4.32 su-ok, rlogin-fails
by Joe Phan 26 Mar '13

26 Mar '13

Hi Doug, Thank you so much for your help. With your questions, I double checked credential levels and authentication methods, and luckily, I found the solution for my problem. Error recap: On the Client Machine, when su from one user to another, /var/log/authlog shows the following error: Mar 22 09:03:53 apggd08dev login: [ID 316739 auth.error] pam_ldap: no legal authentication method configured Solution: Reconfigure Client again using credentialLevel and serviceAuthenticationMethod attributes. apggd08dev# ldapclient -v manual -a defaultsearchbase=dc=pg,dc=dtveng,dc=net \ > -a domainname=pg.dtveng.net \ > -a credentialLevel=anonymous \ > -a serviceAuthenticationMethod=pam_ldap:simple xxx.xxx.xxx.xxx where xxx.xxx.xxx.xxx is LDAP server IP. Now, I am able to rlogin/telnet/ssh to the client machine (Native Solaris LDAP Client) using a user account defined from LDAP Server. "su" from from one user to another also works well. Thanks, Joe ________________________________ From: Doug Leavitt <doug.leavitt(a)oracle.com> To: Joe Phan <joeanhphan(a)yahoo.com> Sent: Wednesday, March 20, 2013 12:20 PM Subject: Re: openldap-2.4.32 su-ok, rlogin-fails No. SSL is not required for authentication. But if you are using pam_ldap without SSL, your passwords are sent over TCP/IP in the clear. Alternatively you can use pam_unix authentication and have the password hashes sent over the wire (like in NIS) and have the unix client do the authentication. This usually requires that you store the passwords in the LDAP server in {crypt} format. On 03/20/13 14:07, Joe Phan wrote: Hi Doug, > >Do you know if it is required to have SSL for authentication? In other word, do I need to configure SSL Tunnel? >Do I need to change pam.conf on LDAP Server? > >Link: http://www.softpanorama.info/Net/Directories/ldap.shtml >"Because our LDAP service requires SSL connections before allowing authentication, it is necessary to connect to the LDAP server using SSL" > > >Thanks, >Joe > > > > >________________________________ > From: Doug Leavitt <doug.leavitt(a)oracle.com> >To: Joe Phan <joeanhphan(a)yahoo.com> >Sent: Tuesday, March 19, 2013 3:08 PM >Subject: Re: openldap-2.4.32 su-ok, rlogin-fails > > >You probably need to correct your pam settings in pam.conf. >See the pam_ldap man page for more details. I suspect you >need to change the setting to look more like this: > # Authentication management for login service is stacked. > # If pam_unix_auth succeeds, pam_ldap is not invoked. > # The control flag "binding" provides a local overriding > # remote (LDAP) control. The "server_policy" option is used > # to tell pam_unix_auth.so.1 to ignore the LDAP users. > > login auth requisite pam_authtok_get.so.1 > login auth required pam_dhkeys.so.1 > login auth required pam_unix_cred.so.1 > login auth binding pam_unix_auth.so.1 server_policy > login auth required pam_ldap.so.1 > >If your system is set up for anonymous connections may or may not >be an issue depending on your servers acl setups. > >I am referring to the configuration supplied into ldapclient (aka what is in >/var/ldap/ldap_client_file, and presumably ldap_cred_file is you have bind >credentials into the ldap server). > >When we setup DSEE servers we usually recommend at least proxy >credentials and at least simple bind, or more depending on your security >needs. Your needs may vary. > >Doug. > >On 03/19/13 15:32, Joe Phan wrote: >Hi Doug, >> >> >>Thank you for looking at this. >> >>apggd08dev# ldaplist -l passwd jphan >>dn: uid=jphan,ou=people,dc=pg,dc=dtveng,dc=net >> objectClass: top >> objectClass: posixAccount >> objectClass: shadowAccount >> objectClass: posixGroup >> cn: jphan >> uid: jphan >> uidNumber: 2003 >> gidNumber: 203 >> homeDirectory: /export/home/jphan >> loginShell: /usr/bin/csh >> gecos: Joe Phan 310-964-4125 >> shadowLastChange: 0 >> shadowMax: 0 >> shadowWarning: 0 >> userPassword: {SSHA}/... >> >>Also how is your system configured w.r.t anonymous connections? <== Yes, I believed that I configured the system for anonymous connections. Do you know how to verify it? >>What are you credential levels and authentication methods being used in your configuration? <== Not sure about credential levels; I am using PAM for authentication. At the beginning, I don't have SASL/TLS. >> >> >> >>Sorry for unclear answers if existed, b/c I am new to LDAP and PAM. >>Please show me where or which area I should verify the system. >>Thank you so much, >> >> >>Joe Phan >> >> >> >>________________________________ >> From: Doug Leavitt <doug.leavitt(a)oracle.com> >>To: Joe Phan <joeanhphan(a)yahoo.com> >>Sent: Tuesday, March 19, 2013 12:27 PM >>Subject: Re: openldap-2.4.32 su-ok, rlogin-fails >> >> >>What happens if you try: >> >>ldaplist -l passwd jphan >> >>Also how is your system configured w.r.t anonymous connections? >>What are you credential levels and authentication methods being used >>in your configuration? >> >> >>Doug. >> >>On 03/18/13 19:01, Joe Phan wrote: >>Hi, >>> >>> >>> >>>I configured a machine to be LDAP Server (openldap-2.4.32) on Solaris 10. Adding users/groups to LDAP Server seems to be ok. >>> >>> >>> >>>From a second machine, I configured it to be LDAP Client using command "ldapclient manual -v -a defaultsearchbase=dc=pg,dc=dtveng,dc=net -a domainname=pg.dtveng.net 10.26.82.16". It was successful. /var/ldap/ldap_client_file contains appropriate LDAP Server information. >>>Openldap-2.4.32 is not installed on the Client Machine. >>> >>> >>>I updated PAM configuration on Client Machine for su and rlogin, results are listed below: >>>- rlogin into Client Machine using root - OK >>>- rlogin into Client Machine using "jphan" user - Fails >>> >>>- After login to Client Machine as root, su from root to "jphan" user - OK (Note: jphan user does not exist in Client Machine /etc/passwd, jphan user exists in LDAP Server) >>> >>>- From "jphan" user, su to another user - Fails >>> >>> >>>Could someone please take a look at the configuration for rlogin PAM below to see if the configuration is correct. >>>Please let me know if there is anything missing from my setup. >>>Do I need to configure pam.conf on LDAP Server machine as well? >>> >>> >>> >>>Any help is greatly appreciated. >>>Best regards, >>>Joe Phan >>> >>> >>> >>> >>> >>>Downloaded and installed following packages from SunFreeWare.com to LDAP Server: >>>openldap-2.4.32-sol10-sparc-local.gz >>>db-4.7.25.NC-sol10-sparc-local.gz >>>gcc-3.3.2-sol10-sparc-local.gz >>>libgcc-3.3-sol10-sparc-local.gz >>>libtool-2.4.2-sol10-sparc-local.gz >>>openssl-1.0.1c-sol10-sparc-local.gz >>>sasl-2.1.25-sol10-sparc-local.gz >>> >>> >>>Client Machine configuration: >>>- /etc/nsswitch.conf: >>>passwd: files ldap >>>group: files ldap >>>shadow: files ldap >>> >>> >>>- /etc/pam.conf: >>>apggd08dev# more pam.conf >>># >>>login auth requisite pam_authtok_get.so.1 >>>login auth required pam_dhkeys.so.1 >>>login auth required pam_unix_cred.so.1 >>>#login auth required pam_unix_auth.so.1 >>>login auth sufficient pam_unix_auth.so.1 >>>login auth required pam_dial_auth.so.1 >>>login auth required pam_ldap.so.1 debug >>># >>># rlogin service (explicit because of pam_rhost_auth) >>># >>>rlogin auth sufficient pam_rhosts_auth.so.1 >>>rlogin auth requisite pam_authtok_get.so.1 >>>rlogin auth required pam_dhkeys.so.1 >>>rlogin auth required pam_unix_cred.so.1 >>>#rlogin auth required pam_unix_auth.so.1 >>>rlogin auth sufficient pam_unix_auth.so.1 >>>rlogin auth required pam_ldap.so.1 debug >>># >>># Kerberized rlogin service >>># >>>krlogin auth required pam_unix_cred.so.1 >>>krlogin auth binding pam_krb5.so.1 >>>krlogin auth required pam_unix_auth.so.1 >>># >>># rsh service (explicit because of pam_rhost_auth, >>># and pam_unix_auth for meaningful pam_setcred) >>># >>>rsh auth sufficient pam_rhosts_auth.so.1 >>>rsh auth required pam_unix_cred.so.1 >>># >>># Kerberized rsh service >>># >>>krsh auth required pam_unix_cred.so.1 >>>krsh auth binding pam_krb5.so.1 >>>krsh auth required pam_unix_auth.so.1 >>># >>># Kerberized telnet service >>># >>>ktelnet auth required pam_unix_cred.so.1 >>>ktelnet auth binding pam_krb5.so.1 >>>ktelnet auth required pam_unix_auth.so.1 >>># >>># PPP service (explicit because of pam_dial_auth) >>># >>>ppp auth requisite pam_authtok_get.so.1 >>>ppp auth required pam_dhkeys.so.1 >>>ppp auth required pam_unix_cred.so.1 >>>#ppp auth required pam_unix_auth.so.1 >>>ppp auth sufficient pam_unix_auth.so.1 >>>ppp auth required pam_dial_auth.so.1 >>>ppp auth required pam_ldap.so.1 debug >>># >>># Default definitions for Authentication management >>># Used when service name is not explicitly mentioned for authentication >>># >>>other auth requisite pam_authtok_get.so.1 >>>other auth required pam_dhkeys.so.1 >>>other auth required pam_unix_cred.so.1 >>>#other auth required pam_unix_auth.so.1 >>>other auth sufficient pam_unix_auth.so.1 >>>other auth required pam_ldap.so.1 debug >>># >>># passwd command (explicit because of a different authentication module) >>># >>>#passwd auth required pam_passwd_auth.so.1 >>>passwd auth sufficient pam_passwd_auth.so.1 >>>passwd auth required pam_ldap.so.1 debug >>># >>># cron service (explicit because of non-usage of pam_roles.so.1) >>># >>>cron account required pam_unix_account.so.1 >>># >>># Default definition for Account management >>># Used when service name is not explicitly mentioned for account management >>># >>>other account sufficient pam_ldap.so.1 debug >>>other account requisite pam_roles.so.1 >>>other account required pam_unix_account.so.1 >>># >>># Default definition for Session management >>># Used when service name is not explicitly mentioned for session management >>># >>>other session required pam_unix_session.so.1 >>># >>># Default definition for Password management >>># Used when service name is not explicitly mentioned for password management >>># >>>other password required pam_dhkeys.so.1 >>>other password requisite pam_authtok_get.so.1 >>>other password requisite pam_authtok_check.so.1 >>>other password required pam_authtok_store.so.1 >>> >>> >>> >>> >>>jphan user info: >>>apggd04dev# ldapsearch -x -b 'dc=pg,dc=dtveng,dc=net' 'uid=jphan' >>># extended LDIF >>># >>># LDAPv3 >>># base <dc=pg,dc=dtveng,dc=net> with scope subtree >>># filter: uid=jphan >>># requesting: ALL >>># >>> >>># jphan, people, pg.dtveng.net >>>dn: uid=jphan,ou=people,dc=pg,dc=dtveng,dc=net >>>objectClass: top >>>objectClass: posixAccount >>>objectClass: shadowAccount >>>objectClass: posixGroup >>>cn: jphan >>>uid: jphan >>>uidNumber: 2003 >>>gidNumber: 203 >>>homeDirectory: /export/home/jphan >>>loginShell: /usr/bin/csh >>>gecos:: Sm9lIFBoYW4gMzEwLTk2NC00MTI1IA== >>>shadowLastChange: 0 >>>shadowMax: 0 >>>shadowWarning: 0 >>>userPassword:: ....= >>> >>># search result >>>search: 2 >>>result: 0 Success >>> >>># numResponses: 2 >>># numEntries: 1 >>> >>> >> >> > >

1 0

[LMDB] Append To Value
by Yucheng Low 26 Mar '13

26 Mar '13

Hi, I am considering using LMDB to store a dynamic graph structure, and it will be very helpful to support "append to value" having the same semantics as "append" in Kyoto Cabinet. http://fallabs.com/kyotocabinet/api/classkyotocabinet_1_1BasicDB.html#a23e7… For instance, if I were to store an adjacency list representation of a graph in LMDB, I would use vertex ID as the key, and the value is a vector of 64-bit IDs. To insert an edge into the graph will simply require appending 8 bytes to the end of the vector. Re-reading and re-writing the entire value will be somewhat excessive (and will actually change the asymptotic runtime of the insertion). This is also one of those situations where a batch append might be useful. For instance, if I have an edge list on file which is too large to retain in memory. To convert it to an adjacency list in LMDB will require batch-append. Batch-writes are insufficient since that will require me to cache at least, large parts of the adjacency list in memory, and the original edge list could be ordered arbitrarily. The actual graph representation I am thinking of is somewhat more intelligent than a straight adjacency list, but similar concepts hold. I have tried looking through the lmdb source to try to implement append myself, but the put logic is somewhat complicated... Yucheng

2 3

about openldap over udp
by Guo Star 26 Mar '13

26 Mar '13

Hi, i am a freshman on openldap. Now, i can login my openldap client machine, through openldap server machine authentication. And I see openldap use tcp/389 to communicate. Can I set openldap over udp/389 ? Thank a lot. Best Regard, Star Guo >From Guangzhou, China.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical