openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

unable to load back-perl module
by Benin Technologies 24 Mar '13

24 Mar '13

Hi, I'm unable to load the back-perl backend module, I get "lt_dlopenext failed: (back_perl.la) file not found" But back_perl.la is there though, and I can load other modules without problem (back_hdb.la, back_sql.la, ...) Any idea what's going on ? My slapd.conf : # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload back_sql.la moduleload back_perl.la If I comment the last line, slapd starts without problem. The error message : root@ldap:~# /usr/local/libexec/slapd -u openldap -g openldap -d 256 514dbea0 @(#) $OpenLDAP: slapd 2.X (Feb 3 2013 19:41:33) $ root@ldap:/tmp/openldap-a98eb28/servers/slapd 514dbea0 lt_dlopenext failed: (back_perl.la) file not found 514dbea0 slapd stopped. 514dbea0 connections_destroy: nothing to destroy. It doesn't find back_perl.la, but the file exists though, with the same right as the other backend modules: root@ldap:/usr/local/libexec/openldap# ls -la -rwxr-xr-x 1 root staff 987 Feb 3 19:43 back_hdb.la -rwxr-xr-x 1 root staff 1026 Feb 3 19:43 back_perl.la -rwxr-xr-x 1 root staff 991 Feb 3 19:43 back_sql.la I'm using OpenLDAP 2.4.33 on Debian 6.0.4 Ben.

2 2

pwdMaxAge And pwdExpireWarning not working
by Swapnil Dubey 24 Mar '13

24 Mar '13

Hi All, I am using OpenLdap 2.4.32 on solaris 10. It seems that pwdMaxAge And pwdExpireWarning are not working. Other policies like pwdInHistory, pwdLockout seems to work fine. I cannot see either expiry message or authentication failure in logs after I wait for configured time/seconds. Can somebody help me out with this? -bash-3.00# ./ldapwhoami -x -D uid=admin,ou=People,dc=example,dc=com -W -e ppolicy Enter LDAP Password: ldap_bind: Success (0) (Password expires in 0 seconds) dn:uid=admin,ou=people,dc=example,dc=com Here is my configuration. -bash-3.00# ./ldapsearch -x -b "dc=example,dc=com" "(objectclass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com objectClass: dcObject objectClass: domain dc: example # roles, example.com dn: ou=roles,dc=example,dc=com objectClass: organizationalUnit ou: roles # people, example.com dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people # admin, people, example.com dn: uid=admin,ou=people,dc=example,dc=com objectClass: person objectClass: inetOrgPerson cn: admin displayName: Admin givenName: admin mail: admin(a)example.com sn: Admin uid: admin userPassword:: e1NTSEF9NU1WNHpuTHB2N3ZmSkcvaU44VC85QkNJMWVueU5hcDc= # utsacct_provisioner, roles, example.com dn: cn=utsacct_provisioner,ou=roles,dc=example,dc=com objectClass: groupOfUniqueNames cn: utsacct_provisioner uniqueMember: uid=admin,ou=people,dc=example,dc=com # provisioner, roles, example.com dn: cn=provisioner,ou=roles,dc=example,dc=com objectClass: groupOfUniqueNames cn: provisioner uniqueMember: uid=admin,ou=people,dc=example,dc=com # policies, example.com dn: ou=policies,dc=example,dc=com ou: policies objectClass: organizationalUnit objectClass: top # default, policies, example.com dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 2000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 Slapd.conf --------------------------------- ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext Regards, Swapnil

1 1

openldap and AD sync
by 杨峰 23 Mar '13

23 Mar '13

I had set up LDAP on linux side, I want to build a AD with Windows2008R2, and AD should sync the user information from LDAP, is there any suggestion on this?

7 8

shadowLastChange can't be read
by Maria McKinley 23 Mar '13

23 Mar '13

Hi there, I can change the shadowLastChange attribute: maria@mimi:~/sysadmin/ldap$ ldapmodify -x -v -r -W -D "cn=admin,dc=example,dc=com" -f pass.expldap_initialize( <DEFAULT> ) Enter LDAP Password: replace shadowLastChange: 15786 modifying entry "uid=chris,ou=people,dc=example,dc=com" modify complete But, I can't see it: annette:~# ldapsearch -x "uid=chris" shadowLastChange # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope subtree # filter: uid=chris # requesting: shadowLastChange # # chris, people, example.com dn: uid=chris,ou=people,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Even though this is my permission: olcAccess: {0}to attrs=shadowLastChange by self write by anonymous auth by dn= "cn=admin,dc=example,dc=com" write by * read olcAccess: {1}to attrs=userPassword by self write by anonymous auth by dn="cn= admin,dc=example,dc=com" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read Have I done something wrong with my permissions? Is there something else that could be going on here? thanks, Maria

2 1

Question about OpenLDAP integration with JMS
by Nick 22 Mar '13

22 Mar '13

Dear All, Please tell me, is there any way to integrate OpenLDAP with some JMS service (in particular - Apache ActiveMQ) to make OpenLDAP server post all changes (object creates/upadtes/deletes) to the message bus, and also to receive updates from the message bus? Best regards Nikolay

4 8

pcache overlay help
by brendan kearney 21 Mar '13

21 Mar '13

i am trying to setup the pcache overlay to cache routinely used entries in the DIT. using the below, i am able to load the pcache module: ldapmodify -QY EXTERNAL -H ldapi:/// dn: cn=module,cn=config changetype:add objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: pcache.la then i try to add some caching directives, using the below: ldapmodify -QY EXTERNAL -H ldapi:/// dn: olcOverlay={0}pcache,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcPcacheConfig objectClass: olcPcacheDatabase olcOverlay: {0}pcache olcPcache: hdb 100000 50 1000 100 olcPcacheAttrset: 0 nSRecord sOARecord pTRRecord aRecord cNAMERecord sRVRecord tXTRecord olcPcacheTemplate: "(zoneName=)" 0 3600 olcPcacheTemplate: "(&(zoneName=)(relativeDomainName=))" 0 3600 olcPcacheAttrset: 1 krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth nsaccountlock krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo olcPcacheTemplate: "(&(|(objectClass=)(objectClass=))(krbPrincipalName=))" 1 3600 olcPcacheAttrset: 2 userPassword cn gidNumber uidNumber loginShell objectClass gecos uid homeDirectory olcPcacheTemplate: "(&(objectClass=)(uid=))" 2 3600 olcPcacheAttrset: 3 cn userPassword memberUid gidNumber uniqueMember olcPcacheTemplate: "(&(objectClass=)(cn=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(memberUid=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(gidNumber=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(|(memberUid=)(uniqueMember=)))" 3 3600 i no longer have logs around the failure, but the error message indicated that the olcDbDirectory could not be found. the DN dn: olcDatabase={2}hdb,cn=config has that specified (olcDbDirectory: /var/lib/ldap), but i am missing something about pcache and the backend sharing this directive. can anyone point me in the right direction about how to get the pcache overlay setup correctly?

2 3

Crash with syncrepl refreshAndPersist and database ldap
by Raffael Sahli 20 Mar '13

20 Mar '13

Hi I run a master slapd with 2.4.33 which has a bdb and an ldap database. A slave server 2.4.33 syncs the bdb database with delta syncrepl (type=refreshAndPersist), and has the same ldap database. So my problem is, that the slave crashes very often (That could be multiple times per hour). I have to kill (9) the daemon and restart it. What I found out is, I can solve the problem with either set the type from refreshAndPersist to refreshOnly or remove the ldap database. I have the problem on other servers, which run with 2.4.31, there I disabled the ldap database on the slave. I'm not sure if it was the same, but I had same problems with 2.4.28 and earlier. So what could that be? Maybe a config problem or a bug? Thanks -- Raffael Sahli public(a)raffaelsahli.com

2 1

ldapsearch returning failure to import cert
by John Rouillard 20 Mar '13

20 Mar '13

Hi all: I am running Scientific Linux 6 (a Red Hat enterprise repackage). Until recently these machines were interacting fine with our ldap setup. We use a self signed cert for the ldap servers and deploy the CA cert in /etc/openldap/cacert.pem. However after the last series of updates ldapsearch has been failing in an interesting way and our sssd caching daemons are failing to connect to our ldaps servers. I am hoping that they are both having the same issue. The relevant installed packages are: openldap-2.4.23-26.el6_3.2.x86_64 openssl-1.0.0-27.el6_4.2.x86_64 nss-util-3.14.0.0-2.el6.x86_64 nss-3.14.0.0-12.el6.x86_64 I am using the command (lightly obscured): ldapsearch -d -1 -v -x -b uid=user,ou=people,dc=staff,dc=example,dc=com -D uid=user,ou=people,dc=staff,dc=example,dc=com -W -H ldaps://auth.staff.example.com/ This fails with the error: TLS: error: connect - force handshake failure: errno 21 - moznss error -8054 TLS: can't connect: TLS error -8054:You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Where is ldapsearch "importing" a cert? Where is it getting its other certs from? I ran strace on ldapsearch and the only cert file I can see it accessing is /etc/openldap/cacert.pem as specified in /etc/openldap/ldap.conf (not counting the /usr/lib64/libnssckbi.so file). The cert in cacert.pem is identical to the one retrieved by running: openssl s_client -connect auth.staff.example.com:636 </dev/null \ 2>/dev/null | sed -ne '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' Here is where it gets a little more interesting: I have a previous CA cert (that used an md5 message digest). If I install that as the CA, ldapsearch works for 2 of my 3 ldap servers. I have used openssl x509 -in ... -text to compare the certificates for my 3 ldap server and they look identical except where they shouldn't be (subject name, subject name digests...). The issuer, issuer digest ... fields are the same. If I use openssl verify -CAfile /etc/openldap/cacert.pem -purpose sslserver -issuer_checks ldap where ldap is the cert retrieved using s_client it validates for all three servers regardless of whether the CAfile is the older md5 or newer cert. Just to add more into the mix, our CentOS 5 boxes have no issues with any of the servers (IIUC they have an entirely different tls/cert level since they do not use Mozilla nss). Thanks for any insight or questions as the answer didn't come to me while I was writing this email 8-). -- -- rouilj John Rouillard System Administrator Renesys Corporation 603-244-9084 (cell) 603-643-9300 x 111

2 1

Re: Problems with authentication against OpenlDAP
by francesco.policastro＠selex-es.com 19 Mar '13

19 Mar '13

Hi, I made some progress, but I am still unable to do what I need. I said that ldapsearch correctly returns the record related to myself from both servers, but one of them, namely that configured with ACL's, also returns some other lines like this: # refldap://ext.domain.net/CN=Configuration,DC=ext,DC=domain,DC=net I use simple bind and these lines are returned because my servers answer on port 389. Querying the Global Catalog on port 3268 removes those lines (and authentication works fine), but GC does not return an attribute I need, i.e. the employeeID. So when the records synchronize I will get problems. I did not find a way to avoid referrals to appear in the answer. Did anyone face and solve this problem? Thanks, Francesco

1 0

None
by Nick 19 Mar '13

19 Mar '13

Dear All, Please tell me, is there support for DIT structure rules or GoverningStructureRule in current version of OpenLDAP? Best regards Nikolay

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical