openldap-technical

openldap-technical@openldap.org

2 participants
9868 discussions

weighted valsort for telephone Numbers
by Benin Technologies 12 Feb '13

12 Feb '13

Hi Quanah, I just found an old post of yours, and I'd be interested to know if and how you solved that problem, because I ran into the same need. Thanks Ben * *To*: *openldap-devel(a)OpenLDAP.org <mailto:openldap-devel%40OpenLDAP.org>* * *Subject*: *valsort & telephoneNumber* * *From*: *Quanah Gibson-Mount <quanah(a)stanford.edu <mailto:quanah%40stanford.edu>>* * Date: Mon, 28 Aug 2006 21:11:07 -0700 * Content-disposition: inline ------------------------------------------------------------------------ We would like to be able to use valsort to weight telephoneNumber values in OpenLDAP. However, modifications of that type get rejected by the SYNTAX validation for telephoneNumber because it contains {}'s. Is it reasonable to expect to be able to override the SYNTAX in this case? Should valsort be modified to do so? Basically, the desired behavior would be for the non-weighted part (i.e., the actual data) of the value to be validated via the SYNTAX rules, but the weight part at the beginning ignored. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key:http://www.stanford.edu/~quanah/pgp.html <http://www.stanford.edu/%7Equanah/pgp.html>

5 10

Mirror mode difference from N-Way Multi-Master
by Покотиленко Костик 11 Feb '13

11 Feb '13

Hi, I've red replication documentation many times, and also many related mailing list threads. Some aspects are still not clear. So: 1. Can Mirror Mode be setup across more than 2 servers, say 3 mirrors? I found one thread saying that mirror can only be setup for 2 master servers: http://www.openldap.org/lists/openldap-software/200801/msg00046.html 2. How Mirror Mode of 2 servers differs in configuration comparing to N-Way Multi-Master of 2 servers? I don't see difference in setting up Mirror vs N-Way, both should have syncprov and syncrepl, both should have ServerID and MirrorMode TRUE, what am I missing? As far as I can see there is no difference in configuration. The only distinction I can see is the "use case", as N-Way supposed to accept writes on all Masters, but Mirror only on one at a time. This is not clearly stated anywhere, so do they really differ only in proxy/balancer in front of Mirrors? If so, why can't I do 3 Mirrors with proxy/balancer in front? 3. It is clearly stated in the docs that in Mirror Mode one can't use Delta-syncrepl. Can it be used in N-Way Multi-Master? There are posts saying Delta-syncrepl is not supported in Multi-Master: http://www.openldap.org/lists/openldap-devel/200708/msg00139.html http://www.openldap.org/lists/openldap-technical/201104/msg00241.html 4. In Mirror mode, can I use UpdateRef on one mirror to direct writes to another so proxy/balancer will become not required?

4 9

What is difference between basic search and search fired by ACL check.
by Tio Teath 11 Feb '13

11 Feb '13

I'm trying to setup Set ACL via ldap proxy with proxy cache. Problem is that proxy cache are not used during ACL checking. For example, I have next ACL to the local database: olcAccess: {0}to * by self write by set="[cn=test2,ou=group,dc=remote]/member & user" write by anonymous auth by * none And at the remote LDAP server I have next entry: dn: cn=test2,ou=group,dc=remote objectClass: groupOfNames member: uid=user,ou=user,dc=local member: uid=j_doe,ou=people,dc=remote Proxy cache works perfectly when fired by basic search request, I can see it in the debug log. But when search are fired by ACL check (i.e. search to local entry, which handled by Set ACL), proxy cache are completely ignored. And I am sure about that, because I have added 'Debug( pcache_debug ...' entry in every function from servers/slapd/overlays/pcache.c and could not see any of them in the trace output, during ACL check and could see them perfectly during basic search. Here are log entries from the remote server for cache search(1) and ACL search(2): 1) 5118f601 conn=1003 op=1 SRCH base="cn=test2,ou=group,dc=remote" scope=2 deref=0 filter="(objectClass=*)" 5118f601 conn=1003 op=1 SRCH attr=member objectClass 2) 5118f706 conn=1000 op=1 SRCH base="cn=test2,ou=group,dc=remote" scope=0 deref=0 filter="(objectClass=*)" 5118f706 conn=1000 op=1 SRCH attr=member For (1), seems search are fired by pcache itself, hence attr=member objectClass. Proper search request, which are fired by myself does not contain objectClass in the requested attribute list. I have not managed to find the place in the code, where the search are fired by ACL, seems it is servers/slapd/overlays/sets.c, but there is no direct search invocation there. Could you please give me a clue how to fix this issue? P.S. I have googled this post http://www.openldap.org/lists/openldap-devel/200908/msg00018.html. Seems, it is somehow related to the issue, only in my case entry is not in hand.

1 0

integrating open ldap with kerberos and ssl
by Asmaa Ahmed 11 Feb '13

11 Feb '13

Hello, Is it possible to get an open ldap support the both way of authentication?I have a open ldap integrated already with MIT kerberos, and I wonder if I can adapt it to support SSL/TLS as well.The problem is that some applications allow only for simple binding which is not possible with Kerberos.If yes, does any one have a good tutorial for such kind of integration or some guide lines? Thanks.

1 0

valsort and telephone numbers
by Benin Technologies 10 Feb '13

10 Feb '13

Hi, Does anybody use the valsort overlay and its "weighted" method with telephone numbers ? Telephone numbers don't accept braces {} in their syntax, but the braces are used by valsort to define the attribute's weight. What's the best way around this ? An easy way would be to create a custom myMobile attribute, with syntax IA5 string (1.3.6.1.4.1.1466.115.121.1.26) instead of the telephone number syntax (1.3.6.1.4.1.1466.115.121.1.50). IA5 strings accept braces {}. But the tradeoff is that any string can be put in the myMobile attribute. The best way would be to enforce myMobile to accept only telephone numbers (syntax 1.3.6.1.4.1.1466.115.121.1.50), PLUS braces {} Can this be done ? any other idea ?

1 0

Problem with too many concurrent LDAP requests (Postfix+LDAP)
by Denis BUCHER (lists) 09 Feb '13

09 Feb '13

Dear all, I am using LDAP as backend for Postfix for all email accounts. Any email coming to the server is checked against LDAP to check if email is valid, and deliver it accordingly. It works almost perfectly but I have a big problem that arise when receiving (or sending) too many emails at the same time. It looks like slapd server is overwhelmed with too many requests at the same time, which makes postfix getting timeouts. On the postfix side hopefully it's only a "temporary lookup failure" but I want to correct that problem. In the logs I get two kind of LDAP errors : a) * postfix/trivial-rewrite: warning: dict_ldap_lookup: Search error -5: Timed out * postfix/trivial-rewrite: fatal: ldap:/etc/postfix/ldap-domains.cf(0,lock|fold_fix): table lookup problem b) * postfix/smtpd: warning: dict_ldap_connect: Unable to bind to server ldap://localhost:389 as cn=mailadmin, ou=mailservices, dc=domain, dc=ch: -5 (Timed out) If someone had a suggestion on how to optimize the LDAP server to be able to cope with the demand coming from postfix it would be great ! Denis

2 3

Using multi-value attributes for ACLs
by Andrew Heagle 08 Feb '13

08 Feb '13

Hi, At my work, we use LDAP as the backend for Puppet node definitions. Each host would have an LDAP entry specifying things like which puppet classes to apply, host specific variables, environment (which git branch to use for puppet manifests and a few other things. There are different teams that would like to be able to manage these attributes when deploying software. For example, DBA should be able to manage DB servers while QA need to be able to configure their hosts to test different software. Any hosts that DBA can manage has a role=DBA applied and likewise an QA hosts has role=QA set. Since role is multi-valued, a QA DB can have role=DBA and role=QA set on it, since both QA and DBAs might need to be able to make changes to the host. Our slapd.conf has these ACLS access to dn.subtree="ou=hosts,dc=example,dc=info" filter=(role=DBA) attrs=puppetclass,puppetvar,environment by group/groupOfUniqueNames/uniqueMember="cn=dba,ou=groups,dc=example,dc=info" write by group="cn=sysadmin,ou=ldapgroup,dc=example,dc=info" write by * read access to dn.subtree="ou=hosts,dc=example,dc=info" filter=(role=QA) attrs=puppetclass,puppetvar,environment by group/groupOfUniqueNames/uniqueMember="cn=qa,ou=groups,dc=example,dc=info" write by group="cn=sysadmin,ou=ldapgroup,dc=example,dc=info" write by * read let say a LDAP host entry looks like this: dn: cn=qadb1.int.example.info ,ou=QAServers,dc=tor,ou=hosts,dc=example,dc=info objectClass: puppetClient objectClass: device objectClass: exampleHost objectClass: dNSDomain2 cn=qadb1.int.example.info role: DBA role: QA environment: qa datacenter: tor aRecord: 10.10.12.53 dc: qadb1.int.example.info if a DBA wants to edit this entry, it hits the first ACL, sees the DBA user in the dba group and allows the change. If a QA person wants to edit the entry, it hits the first ACL, sees role=DBA, and checks the DBA group, but the QA user is not in the DBA group and rejects the change, even though the next ACL would have allowed the change, it just doesn't hit it. Is it possible to somehow use the ACLs above without have to make lots of ACL rules that combine all the possible combos, such as role=DBA, role=QA, role=DBAQA, role=DBADEV, role=DBABI, etc...? Such as adding a third entry (eg, this would work, but would like to find a more elegant solution): access to dn.subtree="ou=hosts,dc=example,dc=info" filter=(role=DBAQA) attrs=puppetclass,puppetvar,environment by group/groupOfUniqueNames/uniqueMember="cn=dba,ou=groups,dc=example,dc=info" write by group/groupOfUniqueNames/uniqueMember="cn=qa,ou=groups,dc=example,dc=info" write by group="cn=sysadmin,ou=ldapgroup,dc=example,dc=info" write by * read Thanks, Andrew

2 2

Re: Delta replication don't starts if consumer supports SSL?
by paler cryptkeeper 08 Feb '13

08 Feb '13

Mmmm.. the fact is that is *in the consumer* that I had to disable ldaps, not on the provider, the provider is now supporting ldap and ldaps; if I enable ldaps in the consumer, replication does not start, even when specifying provider=ldap://provider-host:389.. One more thing that results strange to me is that if I put a wrong configuration under syncrepl on the consumer, the server does not start and logs some messages, but If the configuration is fine, the server starts but the replication does not, and nothing gets logged, in the consumer nor in the provider.. thanks! 2013/2/6 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Wednesday, February 06, 2013 6:33 PM -0200 paler cryptkeeper < > paler.cryptkeeper(a)gmail.com> wrote: > > >> Hi. >> >> Today I had to set up two OpenLDAP instances (2.4.33), with delta >> replication under SSL/TLS, something pretty common, I think. >> The installation (from source), initializing and TLS support setup went >> fine, and both, provider and consumer, started up without problems, and >> searches did well on both, with ldapd and ldaps. However, the replication >> never started. After a while (almost 2.5 hours!! and so many slapd.conf >> files..) I tried to start the consumer without ldaps support, only ldap, >> and the replication started perfectly! Is this normal? Could be something >> with the config? The only thing that changed between a not working state >> and a working one was that if 'slapd -d 256 -h "ldap:/// ldaps:///"' was >> used, replication didn't start, and with only 'slapd -d 256' the >> replication started normally.. I repeat that with the first option, >> beside replication, everything else worked fine, even searches using >> ldaps.. >> It's something I could not explain to or customer.. can someone explain >> it to me? :) >> Thanks! >> > > Likely it couldn't negotiate the SSL connection. I would guess you failed > to set the cert options in the syncrepl line. Since you provide no detail > into your configuration, all I can do is guess. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Cuando crees que ya has llegado al piso y que no puedes caer mas bajo, descubres que hay un subsuelo...

1 0

Enforce TLS?
by Patrick Lists 07 Feb '13

07 Feb '13

Hi, I've gone through slapd.access a couple of times but I can't wrap my head around the mountain of information. IMHO that man page could do with a few more examples for us mere mortals :-) FYI: I was not able to find what ssf=<n>, transport_ssf=<n>, tls_ssf=<n>, sasl_ssf=<n> mean and which possible values (+ meaning of those values) I can set them too. Missing info? Goal: allow 127.0.0.1 and ::1 non-TLS access and all other connections must use TLS. Anyone perhaps have an example that can get me started? Thanks! Patrick

2 2

import Certificate to userCertificate
by Алексей 07 Feb '13

07 Feb '13

*Hello. I have a problem with importing certificate to OPENLDAP. I had exported a Certificate from Active Directory and then tried to import it into userCertificate attribute. The system show me error because i didn't use binary in file ldif. After I had done correction of file "ldif", I received message value #0 normalization failed. When I change a SYNTAX of userCertificate from 1.3.6.1.4.1.1466.115.121.1.8 to 1.3.6.1.4.1.1466.115.121.1.40 the file was importing well, and LDAP Browser show me data in attribute userCertificate as Certificate. I could also export data from OPENLDAP. And now question: what difference between 1.3.6.1.4.1.1466.115.121.1.8 and 1.3.6.1.4.1.1466.115.121.1.40, and which of syntax is more correct to use in my case? In case if 1.3.6.1.4.1.1466.115.121.1.8 is more correct how can i understand where i make mistake? I was trying to import Certificate as base64. As example userCertificate;binary:: MIIHcjCCBxygAwIBAgIQQAAAANG9zQ1Jv2ZMAM6FJDANBgkrBgEEAZxWAQIFADCBgjETMBEGCgmSJo... * * With regards, * * Aleksey *

3 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical