openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

Problem in connecting OpenLDAP server with PostgreSQL DB
by SHEKHAR PODICHETI 26 Mar '13

26 Mar '13

Hello, I compiled and installed openldap-2.4.34 by enabling the back-sql. I installed PostgreSQL database , created the users in DB as per the OpenLDAP Admin guide. However, OpenLDAP server is unable to start and connect to the PostgreSQL database. I got a following problem while I was running a sample SQL read operation from the PostgreSQL DB. root@DevelopmentServer:~/Shekhar/OpenLDAP/openldap-2.4.34/tests#<https://mail.ril.com/owa/UrlBlockedError.aspx>SLAPD_USE_SQL=pgsql ./run sql-test000 Cleaning up test run directory leftover from previous run. Running ./scripts/sql-test000-read for bdb... running defines.sh Starting slapd on TCP/IP port 9011... Testing SQL backend read operations... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ldapsearch failed (255)! kill: 57: No such process root@DevelopmentServer:~/Shekhar/OpenLDAP/openldap-2.4.34/tests#<https://mail.ril.com/owa/UrlBlockedError.aspx> Regards, Shekhar Podicheti

1 0

Openldap Chaining help
by jeevan kc 26 Mar '13

26 Mar '13

HelloI've set up a chaining overlay on the slave server. I think I followed the proper procedures but every time I try to update entries (delete,add,change)the slave server I get LDAP error code 8 - Strong Authentication Required. How can I modify entries on the slave without getting the error? I've openldap 2.4.30 installed on Red Hat and my configuration is as follows. Any help would be appreciated.dn: olcDatabase={0}ldapobjectClass: olcLDAPConfigobjectClass: olcChainDatabaseolcDatabase: {0}ldapolcDbURI: "ldap://lap00621.cov.vinex.com"olcDbStartTLS: none starttls=noolcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=vinex,c=us" credentials="l4s3rj3t" keepalive=0:0:0olcDbRebindAsUser: FALSEolcDbChaseReferrals: TRUEolcDbTFSupport: noolcDbProxyWhoAmI: FALSEolcDbProtocolVersion: 3olcDbSingleConn: FALSEolcDbCancel: abandonolcDbUseTemporaryConn: FALSEolcDbConnectionPoolMax: 16olcDbSessionTrackingRequest: FALSEolcDbNoRefs: FALSEolcDbNoUndefFilter: FALSEstructuralObjectClass: olcLDAPConfigentryUUID: df6c7dc4-26a0-1032-829d-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321182829ZentryCSN: 20130321182829.558457Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321182829Z dn: olcOverlay={0}chainobjectClass: olcOverlayConfigobjectClass: olcChainConfigolcOverlay: {0}chainolcChainCacheURI: FALSEolcChainMaxReferralDepth: 1olcChainReturnError: TRUEstructuralObjectClass: olcChainConfigentryUUID: 8a6734ba-2685-1032-8293-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321151250ZentryCSN: 20130321151250.505781Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321151250Z

1 0

OpenLDAP + Active Directory User and Password Sync
by Suman Karki 26 Mar '13

26 Mar '13

This is what I am looking for: 1. Any User Added to Active Directory shall be added to OpenLDAP as well and any password modified from Active Directory should be modified in OpenLDAP as well - where OpenLDAP would be used for System Auth in a Linux environment. 2. Any User Added to OpenLDAP should be added to Active Directory along with the same credentials and any password modified in OpenLDAP should be modified in Active Directory as well.

1 0

unique olcOverlay: pb in configuration
by Alessandro Dentella 25 Mar '13

25 Mar '13

Hi, I have been struggling to understand how to configure unique overlay and I can't understand the error message I receive. Adding the overlay ================== And I'm trying to add Unique Overlay as:: dn: olcOverlay={0}unique,olcDatabase={1}hdb changetype: add objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {0}unique olcUniqueURI: ldap:///?mail?sub that fails with error:: test-acomea:~# ldapmodify -D cn=admin,cn=config -w isi -f ,ldapvi-test-acomea-3996.ldif adding new entry "olcOverlay={0}unique,olcDatabase={1}hdb" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I can't really understand which is the syntax error, my setup is below. Dscription of setup =================== I have a database to which I need to add unique constraint to the 'mail' field. I loaded uniqu module in cn-config:: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}unique and I have a db defined as:: test-acomea:~# ldapsearch -xLLL -D cn=admin,cn=config -b cn=config -W olcSuffix=dc=acomea,dc=it dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=acomea,dc=it ... Thanks in advance sandro *:-) PS: Any pointer to examples is very appreciated

2 2

Help me "Ldap Replication"
by hash 25 Mar '13

25 Mar '13

Hi, sorry to ask simple question, since i am newbie in ldap. I am trying to setup ldap replication provider and consumer, i am using RHEL 6 with openldap-2.4.23-26.el6.x86_64. The problem is the data is not being synchronozing. i am using cn=config. here is the config of provider. [root@hmslogbnc3 slapd.d]# more cn\=config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/schema/schema_convert.conf olcConfigDir: /etc/openldap/slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSizeLimit: unlimited olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: e683e806-2680-1032-8d81-bf9693325536 creatorsName: cn=config createTimestamp: 20130321143937Z entryCSN: 20130321143937.560581Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130321143937Z [root@hmslogbnc3 cn=config]# more olcDatabase\=\{1\}bdb.ldif dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=secure-mail,dc=belgacom olcAccess: {0}to attrs=userPassword by dn.base="cn=admin,dc=secure-mail,dc=be lgacom" write by dn.children="ou=administrators,dc=secure-mail,dc=belgacom" write by anonymous auth olcAccess: {1}to * by dn.base="cn=admin,dc=secure-mail,dc=belgacom" write by dn.base="cn=replica,dc=secure-mail,dc=belgacom" write by dn.children="ou=ad ministrators,dc=secure-mail,dc=belgacom" write by users read by anonymous r ead olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=secure-mail,dc=belgacom olcRootPW:: ***** olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /openldap olcDbCacheSize: 20000 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 20000 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: srcIP eq,approx,sub olcDbIndex: finalDestination eq,sub olcDbIndex: policy eq olcDbIndex: customerId eq olcDbIndex: dc eq,approx,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: e68469de-2680-1032-8d8d-bf9693325536 creatorsName: cn=config createTimestamp: 20130321143937Z entryCSN: 20130321143937.560581Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130321143937Z [root@hmslogbnc3 cn=config]# [root@hmslogbnc3 cn=config]# more cn\=module\{0\}.ldif dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}syncprov.la structuralObjectClass: olcModuleList entryUUID: e683edd8-2680-1032-8d82-bf9693325536 creatorsName: cn=config createTimestamp: 20130321143937Z entryCSN: 20130321143937.560581Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130321143937Z When i tried to start the consumer server i am getting the log daemon: activity on 1 descriptor daemon: listen=7, new connection on 12 daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: added 12r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: 12r daemon: read active on 12 conn=1000 fd=12 ACCEPT from IP=10.48.12.42:33557 (IP=0.0.0.0:389) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 38 02 01 01 60 33 02 08...`3. ldap_read: want=50, got=50 0000: 01 03 04 25 63 6e 3d 72 65 70 6c 69 63 61 2c 64 ...%cn=replica,d 0010: 63 3d 73 65 63 75 72 65 2d 6d 61 69 6c 2c 64 63 c=secure-mail,dc 0020: 3d 62 65 6c 67 61 63 6f 6d 80 07 72 33 70 6c 69 =belgacom..r3pli 0030: 63 61 ca ber_get_next: tag 0x30 len 56 contents: ber_dump: buf=0x7fc7f4002660 ptr=0x7fc7f4002660 end=0x7fc7f4002698 len=56 0000: 02 01 01 60 33 02 01 03 04 25 63 6e 3d 72 65 70 ...`3....%cn=rep 0010: 6c 69 63 61 2c 64 63 3d 73 65 63 75 72 65 2d 6d lica,dc=secure-m 0020: 61 69 6c 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 80 ail,dc=belgacom. 0030: 07 72 33 70 6c 69 63 61 .r3plica op tag 0x60, time 1364215962 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: conn=1000 op=0 do_bind daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL ber_scanf fmt ({imt) ber: ber_dump: buf=0x7fc7f4002660 ptr=0x7fc7f4002663 end=0x7fc7f4002698 len=53 0000: 60 33 02 01 03 04 25 63 6e 3d 72 65 70 6c 69 63 `3....%cn=replic 0010: 61 2c 64 63 3d 73 65 63 75 72 65 2d 6d 61 69 6c a,dc=secure-mail 0020: 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 80 07 72 33 ,dc=belgacom..r3 0030: 70 6c 69 63 61 plica ber_scanf fmt (m}) ber: ber_dump: buf=0x7fc7f4002660 ptr=0x7fc7f400268f end=0x7fc7f4002698 len=9 0000: 00 07 72 33 70 6c 69 63 61 ..r3plica >>> dnPrettyNormal: <cn=replica,dc=secure-mail,dc=belgacom> => ldap_bv2dn(cn=replica,dc=secure-mail,dc=belgacom,0) <= ldap_bv2dn(cn=replica,dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=replica,dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=replica,dc=secure-mail,dc=belgacom)=0 <<< dnPrettyNormal: <cn=replica,dc=secure-mail,dc=belgacom>, <cn=replica,dc=secure-mail,dc=belgacom> conn=1000 op=0 BIND dn="cn=replica,dc=secure-mail,dc=belgacom" method=128 do_bind: version=3 dn="cn=replica,dc=secure-mail,dc=belgacom" method=128 ==> bdb_bind: dn: cn=replica,dc=secure-mail,dc=belgacom bdb_dn2entry("cn=replica,dc=secure-mail,dc=belgacom") => bdb_dn2id("cn=replica,dc=secure-mail,dc=belgacom") <= bdb_dn2id: got id=0x4b7 entry_decode: "cn=replica,dc=secure-mail,dc=belgacom" <= entry_decode(cn=replica,dc=secure-mail,dc=belgacom) => access_allowed: result not in cache (userPassword) => access_allowed: auth access to "cn=replica,dc=secure-mail,dc=belgacom" "userPassword" requested => acl_get: [1] attr userPassword => acl_mask: access to entry "cn=replica,dc=secure-mail,dc=belgacom", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=admin,dc=secure-mail,dc=belgacom <= check a_dn_pat: ou=administrators,dc=secure-mail,dc=belgacom <= check a_dn_pat: anonymous <= acl_mask: [3] applying auth(=xd) (stop) <= acl_mask: [3] mask: auth(=xd) => slap_access_allowed: auth access granted by auth(=xd) => access_allowed: auth access granted by auth(=xd) conn=1000 op=0 BIND dn="cn=replica,dc=secure-mail,dc=belgacom" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=replica,dc=secure-mail,dc=belgacom" to "cn=replica,dc=secure-mail,dc=belgacom" send_ldap_result: conn=1000 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1000 op=0 RESULT tag=97 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read active on 12 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 81 c1 02 01 02 63 40 0.....c@ ldap_read: want=188, got=188 0000: 04 1a 64 63 3d 73 65 63 75 72 65 2d 6d 61 69 6c ..dc=secure-mail 0010: 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 0a 01 00 0a ,dc=belgacom.... 0020: 01 00 02 01 00 02 01 00 01 01 00 87 0b 6f 62 6a .............obj 0030: 65 63 74 63 6c 61 73 73 30 06 04 01 2a 04 01 2b ectclass0...*..+ 0040: a0 7a 30 5a 04 18 31 2e 33 2e 36 2e 31 2e 34 2e .z0Z..1.3.6.1.4. 0050: 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e 31 04 3e 1.4203.1.9.1.1.> 0060: 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 2c 63 0<....4rid=100,c 0070: 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 39 30 sn=2013032214590 0080: 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 30 30 3.816096Z#000000 0090: 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 30 1c #000#000000...0. 00a0: 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 33 ..2.16.840.1.113 00b0: 37 33 30 2e 33 2e 34 2e 32 01 01 ff 730.3.4.2... ber_get_next: tag 0x30 len 193 contents: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008c0 end=0x7fc7f8000981 len=193 0000: 02 01 02 63 40 04 1a 64 63 3d 73 65 63 75 72 65 ...c@..dc=secure 0010: 2d 6d 61 69 6c 2c 64 63 3d 62 65 6c 67 61 63 6f -mail,dc=belgaco 0020: 6d 0a 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 m............... 0030: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 06 04 ..objectclass0.. 0040: 01 2a 04 01 2b a0 7a 30 5a 04 18 31 2e 33 2e 36 .*..+.z0Z..1.3.6 0050: 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e .1.4.1.4203.1.9. 0060: 31 2e 31 04 3e 30 3c 0a 01 03 04 34 72 69 64 3d 1.1.>0<....4rid= 0070: 31 30 30 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 100,csn=20130322 0080: 31 34 35 39 30 33 2e 38 31 36 30 39 36 5a 23 30 145903.816096Z#0 0090: 30 30 30 30 30 23 30 30 30 23 30 30 30 30 30 30 00000#000#000000 00a0: 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e ...0...2.16.840. 00b0: 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 1.113730.3.4.2.. 00c0: ff . op tag 0x63, time 1364215962 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008c3 end=0x7fc7f8000981 len=190 0000: 63 40 04 1a 64 63 3d 73 65 63 75 72 65 2d 6d 61 c@..dc=secure-ma 0010: 69 6c 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 0a 01 il,dc=belgacom.. 0020: 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b 6f ...............o 0030: 62 6a 65 63 74 63 6c 61 73 73 30 06 04 01 2a 04 bjectclass0...*. 0040: 01 2b a0 7a 30 5a 04 18 31 2e 33 2e 36 2e 31 2e .+.z0Z..1.3.6.1. 0050: 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e 31 4.1.4203.1.9.1.1 0060: 04 3e 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 .>0<....4rid=100 0070: 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 ,csn=20130322145 0080: 39 30 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 903.816096Z#0000 0090: 30 30 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 00#000#000000... 00a0: 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 0...2.16.840.1.1 00b0: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... >>> dnPrettyNormal: <dc=secure-mail,dc=belgacom> => ldap_bv2dn(dc=secure-mail,dc=belgacom,0) <= ldap_bv2dn(dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=secure-mail,dc=belgacom)=0 <<< dnPrettyNormal: <dc=secure-mail,dc=belgacom>, <dc=secure-mail,dc=belgacom> SRCH "dc=secure-mail,dc=belgacom" 0 0 0 0 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008f0 end=0x7fc7f8000981 len=145 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 06 04 ..objectclass0.. 0010: 01 2a 04 01 2b a0 7a 30 5a 04 18 31 2e 33 2e 36 .*..+.z0Z..1.3.6 0020: 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e .1.4.1.4203.1.9. 0030: 31 2e 31 04 3e 30 3c 0a 01 03 04 34 72 69 64 3d 1.1.>0<....4rid= 0040: 31 30 30 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 100,csn=20130322 0050: 31 34 35 39 30 33 2e 38 31 36 30 39 36 5a 23 30 145903.816096Z#0 0060: 30 30 30 30 30 23 30 30 30 23 30 30 30 30 30 30 00000#000#000000 0070: 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e ...0...2.16.840. 0080: 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 1.113730.3.4.2.. 0090: ff . end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008fd end=0x7fc7f8000981 len=132 0000: 00 06 04 01 2a 04 01 2b a0 7a 30 5a 04 18 31 2e ....*..+.z0Z..1. 0010: 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 3.6.1.4.1.4203.1 0020: 2e 39 2e 31 2e 31 04 3e 30 3c 0a 01 03 04 34 72 .9.1.1.>0<....4r 0030: 69 64 3d 31 30 30 2c 63 73 6e 3d 32 30 31 33 30 id=100,csn=20130 0040: 33 32 32 31 34 35 39 30 33 2e 38 31 36 30 39 36 322145903.816096 0050: 5a 23 30 30 30 30 30 30 23 30 30 30 23 30 30 30 Z#000000#000#000 0060: 30 30 30 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 000...0...2.16.8 0070: 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 40.1.113730.3.4. 0080: 32 01 01 ff 2... => get_ctrls ber_scanf fmt ({m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f8000907 end=0x7fc7f8000981 len=122 0000: 30 5a 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0Z..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 31 04 3e 30 3c 4203.1.9.1.1.>0< 0020: 0a 01 03 04 34 72 69 64 3d 31 30 30 2c 63 73 6e ....4rid=100,csn 0030: 3d 32 30 31 33 30 33 32 32 31 34 35 39 30 33 2e =20130322145903. 0040: 38 31 36 30 39 36 5a 23 30 30 30 30 30 30 23 30 816096Z#000000#0 0050: 30 30 23 30 30 30 30 30 30 01 01 ff 30 1c 04 17 00#000000...0... 0060: 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 33 37 33 2.16.840.1.11373 0070: 30 2e 33 2e 34 2e 32 01 01 ff 0.3.4.2... ber_scanf fmt (m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f8000923 end=0x7fc7f8000981 len=94 0000: 00 3e 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 .>0<....4rid=100 0010: 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 ,csn=20130322145 0020: 39 30 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 903.816096Z#0000 0030: 30 30 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 00#000#000000... 0040: 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 0...2.16.840.1.1 0050: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) ber_scanf fmt ({i) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f8000925 end=0x7fc7f8000963 len=62 0000: 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 2c 63 0<....4rid=100,c 0010: 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 39 30 sn=2013032214590 0020: 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 30 30 3.816096Z#000000 0030: 23 30 30 30 23 30 30 30 30 30 30 01 01 ff #000#000000... ber_scanf fmt (m) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f800092a end=0x7fc7f8000963 len=57 0000: 04 34 72 69 64 3d 31 30 30 2c 63 73 6e 3d 32 30 .4rid=100,csn=20 0010: 31 33 30 33 32 32 31 34 35 39 30 33 2e 38 31 36 130322145903.816 0020: 30 39 36 5a 23 30 30 30 30 30 30 23 30 30 30 23 096Z#000000#000# 0030: 30 30 30 30 30 30 01 01 ff 000000... ber_scanf fmt (b) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f8000960 end=0x7fc7f8000963 len=3 0000: 00 01 ff ... ber_scanf fmt (}) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f8000963 end=0x7fc7f8000963 len=0 daemon: activity on:ber_scanf fmt ({m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f8000963 end=0x7fc7f8000981 len=30 0000: 00 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 ....2.16.840.1.1 0010: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... ber_scanf fmt (b) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f800097e end=0x7fc7f8000981 len=3 0000: 00 01 ff ... => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) <= get_ctrls: n=2 rc=0 err="" attrs: * + conn=1000 op=1 SRCH base="dc=secure-mail,dc=belgacom" scope=0 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=* + daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL ==> limits_get: conn=1000 op=1 self="cn=replica,dc=secure-mail,dc=belgacom" this="dc=secure-mail,dc=belgacom" => bdb_search bdb_dn2entry("dc=secure-mail,dc=belgacom") => access_allowed: search access to "dc=secure-mail,dc=belgacom" "entry" requested => acl_get: [2] attr entry => acl_mask: access to entry "dc=secure-mail,dc=belgacom", attr "entry" requested => acl_mask: to all values by "cn=replica,dc=secure-mail,dc=belgacom", (=0) <= check a_dn_pat: cn=admin,dc=secure-mail,dc=belgacom <= check a_dn_pat: cn=replica,dc=secure-mail,dc=belgacom <= acl_mask: [2] applying write(=wrscxd) (stop) <= acl_mask: [2] mask: write(=wrscxd) => slap_access_allowed: search access granted by write(=wrscxd) => access_allowed: search access granted by write(=wrscxd) base_candidates: base: "dc=secure-mail,dc=belgacom" (0x00000001) => test_filter PRESENT => access_allowed: search access to "dc=secure-mail,dc=belgacom" "objectClass" requested => acl_get: [2] attr objectClass => acl_mask: access to entry "dc=secure-mail,dc=belgacom", attr "objectClass" requested => acl_mask: to all values by "cn=replica,dc=secure-mail,dc=belgacom", (=0) <= check a_dn_pat: cn=admin,dc=secure-mail,dc=belgacom <= check a_dn_pat: cn=replica,dc=secure-mail,dc=belgacom <= acl_mask: [2] applying write(=wrscxd) (stop) <= acl_mask: [2] mask: write(=wrscxd) => slap_access_allowed: search access granted by write(=wrscxd) => access_allowed: search access granted by write(=wrscxd) <= test_filter 6 send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_intermediate: err=0 oid=1.3.6.1.4.1.4203.1.9.1.4 len=2 send_ldap_response: msgid=2 tag=121 err=0 ber_flush2: 37 bytes to sd 12 0000: 30 23 02 01 02 79 1e 80 18 31 2e 33 2e 36 2e 31 0#...y...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e .4.1.4203.1.9.1. 0020: 34 81 02 a1 00 4.... ldap_write: want=37, written=37 0000: 30 23 02 01 02 79 1e 80 18 31 2e 33 2e 36 2e 31 0#...y...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e .4.1.4203.1.9.1. 0020: 34 81 02 a1 00 4.... conn=1000 op=1 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Here is the consumer config. [id828684@hmslogbnc4 slapd.d]$ more cn\=config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/schema/schema_convert.conf olcConfigDir: /etc/openldap/slap.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSizeLimit: unlimited olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 [id828684@hmslogbnc4 cn=config]$ more olcDatabase\=\{2\}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=secure-mail,dc=belgacom olcAccess: {0}to * by dn.base="cn=admin,dc=secure-mail,dc=belgacom" write by dn.base="cn=replica,dc=secure-mail,dc=belgacom" read by users read by anonymous read olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=secure-mail,dc=belgacom olcRootPW:: dGVzdA== olcSyncUseSubentry: FALSE olcSyncrepl: rid=100 provider=ldap://hmslogbnc3.bc:389 bindmethod=simple timeout=0 network-timeout=0 binddn="cn=replica,dc=secure-mail,dc=belgacom" credentials="r3plica" keepalive=0:0:0 searchbase= "dc=secure-mail,dc=belgacom" scope=base attrs="*,+" schemachecking=on type=refreshAndPersist interval=00:00:01:00 retry="5 5 300 +" syncdata=default olcMirrorMode: FALSE olcMonitoring: TRUE olcDbDirectory: /home/hmslog/data/ldap olcDbCacheSize: 20000 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 20000 olcDbIndex: objectClass eq olcDbIndex: finalDestination eq,sub olcDbIndex: dc eq,approx,sub olcDbIndex: srcIP eq,approx,sub olcDbIndex: customerId eq olcDbIndex: policy eq olcDbIndex: entryCSN,entryUUID eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 Any help will be appreciated. Thanks Regards KM HASHIM,

2 1

Help me for " LDAP Sync Replication with Active Directory from Openldap side"
by Suman Karki 25 Mar '13

25 Mar '13

I am running open ldap server in redhat server, and active directory in win server 2008. I have admin access to both servers. The thing is that i have to sync both server, like from openldap i could access active directory data. Can it be possible? If possible then then please give me some information that i could proceed this task. I have tried some thing like using openldap admin guide syncrepl rid=001 provider=ldap://IP of AD server/ binddn="cn=replicator,dc=suretecsystems,dc=com" bindmethod=simple credentials=Password of AD server searchbase="dc=suretecsystems,dc=com" type=refreshAndPersist retry="5 5 300 5" I don't how much i am right. Or is there any different way? Please help me to solve this.

6 10

Re: Help me for " LDAP Sync with Active Directory from Openldap side"
by Mark Pröhl 25 Mar '13

25 Mar '13

please discuss this on the list. I do not fully understand why you need synchronization. If it is because your LDAP client (i.e. liferay) only supports one LDAP-URI but you have two different user directories (AD and OpenLDAP), than there would be no need for synchronization: OpenLDAP could be used to integrate both directories under one URL (e.g. by meta backend) On 25.03.2013 10:02, Suman Karki wrote: > thank you for your reply. And i need some help that can perform my task. > > I am using liferey for web hosting. Which is http://www.liferay.com/ > > I am managing liferay's user accounts with open ldap server. > > And i need to sync AD to Open Ldap . > > So through one Open Ldap server configuration i can access both > servers user account. > > I have admin access to both server. > > Just, I need to sync AD to Open Ldap server for user account accessing. > > > > > > On 3/25/13, Mark Pröhl <mark(a)mproehl.net> wrote: >> on 25.03.2013 06:57, Suman Karki wrote: >>> I am running open ldap server in redhat server, and active directory >>> in win server 2008. >>> I have admin access to both servers. >>> >>> The thing is that i have to sync both server, like from openldap i >>> could access active directory data. >>> >>> >>> So anybody tell me how can we synchronize both server, any solutions ? >>> or it will be better if anyone provide me some tutorials or better >>> give me some documentation? >>> >>> please i need to solve this problem as soon as possible. >>> >> can you describe your requirements a little bit more? I.e. >> >> - which attributes do you need to be synchronized? >> - do you need to synchronize from AD to OpenLDAP >> or from OpenLDAP to AD or in both directions? >> - do you need passwords to be synchronized? >> >> BTW: OpenLDAP can be configured as a (caching) LDAP >> proxy to Active Directory. Configuring that is much >> more simple than synchronization with AD. >> >> For synchronization you will need some kind of >> 3rd-party product, like the SPML based solution >> mentioned here: >> http://www.openldap.org/lists/openldap-technical/201303/msg00167.html >> >> -- >> Mark Pröhl >> mark(a)mproehl.net >> www.kerberos-buch.de >> >>

1 0

Help me for " LDAP Sync with Active Directory from Openldap side"
by Suman Karki 25 Mar '13

25 Mar '13

I am running open ldap server in redhat server, and active directory in win server 2008. I have admin access to both servers. The thing is that i have to sync both server, like from openldap i could access active directory data. So anybody tell me how can we synchronize both server, any solutions ? or it will be better if anyone provide me some tutorials or better give me some documentation? please i need to solve this problem as soon as possible.

2 1

Re: openldap-technical Digest, Vol 64, Issue 24
by Suman Karki 24 Mar '13

24 Mar '13

Help me for " LDAP Sync Replication with Active Directory from Openldap side" If any person is willing to help me and require more detail about this problem i will reply that.

1 0

trouble with slapo-pcache
by btb＠bitrate.net 24 Mar '13

24 Mar '13

hi- i'm having a few different issues with slapo-pcache. i did a bit of searching in the its and did not find any items which seemed to match my symptoms. i'm using 2.4.31, on ubuntu 12.10. the first is that i so to not be able to add, via ldapadd, additional olcPcacheTemplate attributes to the config entry. i was able to add the first one using ldapadd, but subsequent modify operations to add another complain "no equality matching rule": >ldapsearch -LLLZZxWH 'ldap://localhost/' -D 'cn=config' -b 'olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config' -s base Enter LDAP Password: dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(uid=)" 0 3600 >cat template.ldif dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config changetype: modify add: olcPcacheTemplate olcPcacheTemplate: "(cn=)" 0 3600 >ldapadd -ZZxWH 'ldap://localhost/' -D 'cn=config' -f template.ldif Enter LDAP Password: modifying entry "olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcPcacheTemplate: no equality matching rule Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 STARTTLS Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 RESULT oid= err=0 text= Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 fd=12 ACCEPT from IP=127.0.0.1:32916 (IP=0.0.0.0:389) Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 fd=12 TLS established tls_ssf=128 ssf=128 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 BIND dn="cn=config" method=128 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 29 20:01:32 dsa1 slapd[8250]: connection_input: conn=1003 deferring operation: binding Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 MOD dn="olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config" Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 MOD attr=olcPcacheTemplate Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 RESULT tag=103 err=18 text=modify/add: olcPcacheTemplate: no equality matching rule Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=3 UNBIND Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 fd=12 closed adding the attribute "manually" [e.g. slapcat, modify ldif, slapadd] seems to be fine: >ldapsearch -LLLZZxWH 'ldap://localhost/' -D 'cn=config' -b 'olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config' -s base Enter LDAP Password: dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(objectclass=)" 0 3600 olcPcacheTemplate: "(uid=)" 0 3600 my second problem is with caching when slapo-nssov is involved. it appears to not cache [QUERY NOT ANSWERABLE/QUERY NOT CACHEABLE] when a query occurs via nss: >getent passwd flash flash:x:2013:2013:flash gordon:/home/flash:/bin/bash Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on: Oct 31 08:42:15 deepfield slapd[12862]: 11r Oct 31 08:42:15 deepfield slapd[12862]: Oct 31 08:42:15 deepfield slapd[12862]: daemon: read active on 11 Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: connection_get(11) Oct 31 08:42:15 deepfield slapd[12862]: connection_get(11): got connid=0 Oct 31 08:42:15 deepfield slapd[12862]: nssov: connection from uid=0 gid=0 Oct 31 08:42:15 deepfield slapd[12862]: nssov_passwd_byname(flash) Oct 31 08:42:15 deepfield slapd[12862]: str2filter "(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: AND Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter_list Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: EQUALITY Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:42:15 deepfield slapd[12862]: EQUALITY Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on: Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: Oct 31 08:42:15 deepfield slapd[12862]: end get_filter_list Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: query template of incoming query = (&(objectClass=)(uid=)) Oct 31 08:42:15 deepfield slapd[12862]: QUERY NOT ANSWERABLE Oct 31 08:42:15 deepfield slapd[12862]: QUERY NOT CACHEABLE Oct 31 08:42:15 deepfield slapd[12862]: =>ldap_back_getconn: conn 0xb51f8ee8 fetched refcnt=1. Oct 31 08:42:15 deepfield slapd[12862]: => ldap_back_munge_filter "(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:42:15 deepfield slapd[12862]: <= ldap_back_munge_filter "(&(objectClass=posixAccount)(uid=flash))" (0) Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: >>> dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:42:15 deepfield slapd[12862]: <<< dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net>, <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:42:15 deepfield slapd[12862]: send_ldap_result: conn=-1 op=0 p=0 Oct 31 08:42:15 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" although i believe i have a matching query template defined in the config: dn: olcDatabase={2}ldap,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {2}ldap olcSuffix: dc=example,dc=net olcLastMod: TRUE olcReadOnly: TRUE olcRootDN: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net olcMonitoring: TRUE olcDbURI: ldap://dsa1.example.net/ olcDbStartTLS: start tls_cacert="/etc/pki/trusted_roots/example_networks_roo t_ca-cert.pem" tls_reqcert="demand" olcDbACLBind: bindmethod=simple binddn="cn=slapd,ou=deepfield,ou=services,ou=a ccounts,dc=example,dc=net" credentials="xxxxxxxxxxxxxxx" s tarttls="critical" tls_cacert="/etc/pki/trusted_roots/example_networks_root _ca-cert.pem" tls_reqcert="demand" olcDbIDAssertBind: bindmethod=simple binddn="cn=slapd,ou=deepfield,ou=services ,ou=accounts,dc=example,dc=net" credentials="xxxxxxxxxxxxxxx" structuralObjectClass: olcLDAPConfig entryUUID: f24e435a-b35a-1031-8f37-336141b7bc90 creatorsName: cn=config createTimestamp: 20121026014812Z entryCSN: 20121031023501.089672Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121031023501Z dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(objectClass=)" 0 3600 olcPcacheTemplate: "(uid=)" 0 3600 olcPcacheTemplate: "(&(objectClass=)(uid=))" 0 3600 olcPcacheBind: "(uid=)" 0 60 "sub" "dc=example,dc=net" structuralObjectClass: olcPcacheConfig entryUUID: ddb05d7e-b4fa-1031-811e-353e11fff366 creatorsName: cn=config createTimestamp: 20121028032528Z entryCSN: 20121030002115.179177Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121030002115Z dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheDatabase objectClass: olcMdbConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}mdb olcDbDirectory: /var/lib/ldap/example.net/ olcLastMod: TRUE olcMaxDerefDepth: 15 olcDbNoSync: FALSE olcDbIndex: certfingerprint eq olcDbIndex: cn eq olcDbIndex: default eq olcDbIndex: description eq olcDbIndex: entrycsn eq olcDbIndex: entryuuid eq olcDbIndex: gidnumber pres,eq olcDbIndex: host eq olcDbIndex: iphostnumber eq olcDbIndex: ipserviceport eq olcDbIndex: ipserviceprotocol eq olcDbIndex: mail eq olcDbIndex: maillocaladdress eq olcDbIndex: member eq olcDbIndex: memberof eq olcDbIndex: memberuid eq olcDbIndex: objectclass eq olcDbIndex: rfc822mailmember eq olcDbIndex: sudoUser eq olcDbIndex: uid pres,eq,sub olcDbIndex: uidnumber pres,eq olcDbMode: 0600 olcDbSearchStack: 16 structuralObjectClass: olcMdbConfig entryUUID: 88b37716-b590-1031-8c75-439de7087923 creatorsName: cn=config createTimestamp: 20121028211650Z entryCSN: 20121029021315.039143Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121029021315Z dn: olcOverlay={1}nssov,olcDatabase={2}ldap,cn=config objectClass: olcNssOvConfig objectClass: olcOverlayConfig objectClass: olcConfig olcOverlay: {1}nssov olcNssMap: group uniquemember member olcNssPam: authz2dn hostservice olcNssPamSession: sshd olcNssPamSession: login structuralObjectClass: olcNssOvConfig entryUUID: 47ecaef0-b73e-1031-8761-9f0bff5d3212 creatorsName: cn=config createTimestamp: 20121031003305Z entryCSN: 20121031003305.637051Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121031003305Z and if i perform the same query using ldapsearch: >ldapsearch -LLLZZxH 'ldap://localhost/' -D 'uid=flash,ou=people,ou=accounts,dc=example,dc=net' -w 'test' '(&(objectClass=posixAccount)(uid=flash))' dn: uid=flash,ou=people,ou=accounts,dc=example,dc=net initials: fg givenName: flash loginShell: /bin/bash uidNumber: 2013 gidNumber: 2013 uid: flash objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: extensibleObject c: us homeDirectory: /home/flash sn: gordon cn: flash gordon displayName: flash_gordon mail: user(a)example.com it does seem to cache it: Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: slap_listener_activate(8): Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 busy Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: >>> slap_listener(ldap:///) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: listen=8, new connection on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: added 18r (active) listener=(nil) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 fd=18 ACCEPT from IP=127.0.0.1:37220 (IP=0.0.0.0:389) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x77, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 do_extended Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 31 08:55:37 deepfield slapd[12862]: do_extended: oid=1.3.6.1.4.1.1466.20037 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 STARTTLS Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_extended: err=0 oid= len=0 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_response: msgid=1 tag=120 err=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 RESULT oid= err=0 text= Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): unable to get TLS client DN, error=49 id=1003 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 fd=18 TLS established tls_ssf=128 ssf=128 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x60, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 do_bind Oct 31 08:55:37 deepfield slapd[12862]: >>> dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: <<< dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net>, <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 BIND dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" method=128 Oct 31 08:55:37 deepfield slapd[12862]: do_bind: version=3 dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" method=128 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: ndn: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: oc: "(null)", at: "(null)" Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: found entry: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: mdb_entry_get: rc=0 Oct 31 08:55:37 deepfield slapd[12862]: str2filter "(uid=flash)" Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: Lock QC index = 0xb867e250 Oct 31 08:55:37 deepfield slapd[12862]: Base of added query = dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: QUERY ANSWERABLE (answered 5 times) Oct 31 08:55:37 deepfield slapd[12862]: => mdb_search Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" "entry" requested Oct 31 08:55:37 deepfield slapd[12862]: <= root access granted Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access granted by manage(=mwrscxd) Oct 31 08:55:37 deepfield slapd[12862]: base_candidates: base: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" (0x00000004) Oct 31 08:55:37 deepfield slapd[12862]: => test_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" "uid" requested Oct 31 08:55:37 deepfield slapd[12862]: <= root access granted Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access granted by manage(=mwrscxd) Oct 31 08:55:37 deepfield slapd[12862]: <= test_filter 6 Oct 31 08:55:37 deepfield slapd[12862]: pc_bind_search: cache is stale, reftime: 1351688135, current time: 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: =>ldap_back_getconn: conn=1003 op=1: lc=0xb38f9788 inserted refcnt=1 rc=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 BIND dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" mech=SIMPLE ssf=0 Oct 31 08:55:37 deepfield slapd[12862]: do_bind: v3 bind: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: pc_setpw: CACHING BIND for uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify: uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify_internal: 0x00000004: uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: <= acl_access_allowed: granted to database root Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify_internal: replace userPassword Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_encode(0x00000004): uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_encode(0x00000004): uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify: updated id=00000004 dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_response: msgid=2 tag=97 err=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x63, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=2 do_search Oct 31 08:55:37 deepfield slapd[12862]: >>> dnPrettyNormal: <dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: <<< dnPrettyNormal: <dc=example,dc=net>, <dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: SRCH "dc=example,dc=net" 2 0 Oct 31 08:55:37 deepfield slapd[12862]: 0 60 0 Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: AND Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter_list Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: end get_filter_list Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: filter: (&(objectClass=posixAccount)(uid=flash)) Oct 31 08:55:37 deepfield slapd[12862]: attrs: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:55:37 deepfield slapd[12862]: ==> limits_get: conn=1003 op=2 self="uid=flash,ou=people,ou=accounts,dc=example,dc=net" this="dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: query template of incoming query = (&(objectClass=)(uid=)) Oct 31 08:55:37 deepfield slapd[12862]: Entering QC, querystr = (&(objectClass=posixAccount)(uid=flash)) Oct 31 08:55:37 deepfield slapd[12862]: Lock QC index = 0xb867e350 Oct 31 08:55:37 deepfield slapd[12862]: Base of added query = dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: QUERY ANSWERABLE (answered 1 times) Oct 31 08:55:37 deepfield slapd[12862]: => mdb_search Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x1 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: what am i doing wrong? -ben

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical