openldap-technical

openldap-technical@openldap.org

2 participants
9868 discussions

problem with ldap group check in squid
by Fuhrmann, Marcel 03 Feb '13

03 Feb '13

Hello, i'm trying to to configure squid to use a ldap (ADS 2008) group check to give access to the internet. The squid mailing list couldn't help me. Maybe you can. /usr/lib64/squid/squid_ldap_group -d -v3 -b 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' -f \ '(&(sAMAccountName=%v)(memberOf=cn=%a,ou=USERGRUPPEN,dc=DOMAIN,dc=LOCAL))' -D cn=LDAP,cn=USERS,dc=DOMAIN,dc=LOCAL \ -w PASSWORT -h DOMAINCONTROLLER testuser internet Connected OK group filter '(&(sAMAccountName=testuser) (memberOf=cn=internet,ou=USERGROUPS,dc=DOMAIN,dc=LOCAL))', searchbase 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' ERR The user TESTUSER is in OU3. The group INTERNET is in a OU called USERGROUPS. TESTUSER is member of INTERNET. But it doesn't work. Can somebody give me advice? Thanks a lot -- Marcel

1 1

Hello!!
by Bob Fitch 03 Feb '13

03 Feb '13

http://www.bellacroquercreations.com/components/com_content/yaid352.php Bob Fitch 2/3/2013 5:35:12 AM _____

1 0

slapd-meta and tls_reqcert=allow
by Jim Vanes 01 Feb '13

01 Feb '13

I'm using OpenLDAP 2.4.23-26 from Centos 6. I seem to be hitting a configuration issue regarding slapd-meta and SSL/TLS. Here is my meta config: database meta suffix "dc=virtual,dc=local" rootdn "cn=root,dc=virtual,dc=local" rootpw password # Local uri ldap://localhost/dc=ds1,dc=virtual,dc=local suffixmassage "dc=ds1,dc=virtual,dc=local" "dc=lab,dc=local" idassert-bind bindmethod=simple binddn="cn=root,dc=lab,dc=local" credentials=password #Remote AD server uri ldap://10.33.63.125:389/dc=ad1,dc=virtual,dc=local tls start suffixmassage "dc=ad1,dc=virtual,dc=local" "dc=mslab,dc=local" idassert-bind bindmethod=simple binddn="CN=Sync,CN=Users,DC=lab,DC=local" credentials="Password1" starttls="yes" tls_reqcert="allow" It seems as though tls_reqcert="allow" is ignored for the remote AD server. If set that variable in the ldap.conf everything works fine. But shouldn't the above function as an override to the default of 'demand'? The behaviour is the same when I change the above to use SSL instead. Another thing I noticed was that adding tls_crlcheck="none" to my idassert-bind line causes slaptest to fail..not sure if this is related or not. /etc/openldap/slapd.conf: line 68: "idassert-bind <args>": unable to parse field "tls_crlcheck=none". slaptest: bad configuration file! I must be misunderstanding the docs. Any help would be appreciated.

3 4

missing entry in slapcat backup
by Meike Stone 01 Feb '13

01 Feb '13

Hello dear List, I tried to import a slapcat backup from our production machine in a test environment and got following message: debld02:~ # time slapadd -w -q -f /etc/openldap/slapd.conf -l /backup.ldif 50f98421 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 09m18s spd 4.6 M/s Closing DB...Error, entries missing! entry 1156449: ou=a,ou=b,ou=c,ou=root First I did not noticed this message, but now I see the database is broken, because the node "ou=a" is missing. So my questions: - What ist the origin for such orphaned nodes (In MMR, it happens and I see a few glue records, but in my backup this one node is complete missing...)? - How can I prevent from such entires and how can I recognize them without importing? - How can I remove this entry (esp. in production DB without downtime), because a delete show following messages: ~ # ldapdelete -x -h localhost -w password -D cn=admin,ou=root 'cn=cname,ou=a,ou=b,ou=c,ou=root' ldap_delete: Other (e.g., implementation specific) error (80) additional info: could not locate parent of entry and if I try to add this missing node, then I get: ldapadd -x -h localhost -w password -D"cn=admin,ou=root" -f test.ldif adding new entry ou=a,ou=b,ou=c,ou=root ldap_add: Already exists (68) Thanks for help Meike

4 11

Duplicate attributeType: "2.5.4.35"
by rodrigo tavares 01 Feb '13

01 Feb '13

Hello, In my samba.schema, added the atribute userPassword. attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 2.5.4.35 NAME 'userPassword' DESC 'RFC2256/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128}) Then, i excute command slapindex -v. root@fileserver02:/etc/ldap/schema# slapindex -v WARNING! Runnig as root! There's a fair chance slapd will fail to start. Check file permissions! /etc/ldap/schema/samba.schema: line 195 attributetype: Duplicate attributeType: "2.5.4.35" slapindex: bad configuration file! What´s wrong ? Rodrigo

3 4

server-side sub-search
by Benin Technologies 31 Jan '13

31 Jan '13

Hi, Is it possible to do a server-side sub-search before returning the data to the client ? Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | --> cn=Jane Doe | |-- objectClass=inetOrgPerso |-- cn=Jane Doe |-- mobile : 11223344 | --> cn=secretary | |-- objectClass=organizationalRole |--cn=secretary |--telephoneNumber=12345678 |--roleOccupant=cn=Jane Doe,dc=mycompany,dc=com I'd like to return, in a single search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 Can this be done ? Ben

2 2

Search speed regarding BDB_IDL_LOGN and order in search filter
by Meike Stone 31 Jan '13

31 Jan '13

Hello, I'm sorry, but I want to ask again for clarifying. First question: - An index slot is loosing precision if the search result for an (indexed) attribute is larger than 2^16. Then the search time is going to increase a lot. - I can change this via BDB_IDL_LOGN. - But if I have a directory, that holds 200.000 employees with '(ObjectClass=Employees)', the result is larger than 2^16 and it is slow. - lets say, the employees are distributed over 4 continents and the DIT is structured geographical eg.: o=myOrg, c=us (100,000 employees) o=myOrg, c=gb ( 30,000 employees) o=myOrg, c=de ( 25,000 employees) o=myOrg, c=br ( 45,000 employees) Can i prevent it this problem with index slot size, if I change the search base to "o=myOrg, c=gb", because there are only 30,000 employees. This takes me to the second question: "How is a search filter evaluated?" Lets say, I combine three filter via "and" like '(&(objectlass=Employees)(age=30)(sex=m))' and the all attributes are indexed. Each filter results: (objectlass=Employees) => 200,000 entries (age=30) => 10,000 entries (sex=m) => 3,000 entries Does the order matter regarding speed, is it better to form the filter like this? '(&(sex=m)(age=30)(objectlass=Employees))' Thanks Meike

2 2

CLOSE_WAIT TCP connection
by Vanpeer 31 Jan '13

31 Jan '13

Hello, Could you please help me to understand the problem that i didn't really resolv.. I have my openldap platform which has been working well OpenldapServer : 2.3.39 Openldapclient : RedHat 5.x with nss_ldap and pam_ldap.so release 253-51 All my servers were configured with : /etc/nsswitch.conf /etc/ldap.conf and /etc/pam.d/sshd The user authentification with ssh connection is perfect. The filter of authorisation host connection is ok too. Everything is ok. But i've recently realized that i have a lot of TCP CLOSE_WAIT connexion from differents servers to my OpenLdapServer. These connexions are somethings like : tcp 1 0 IP_CLIENT:44633 OPENLDAP_SERVER:389 CLOSE_WAIT 3321/crond off (0.00/0/0) tcp 1 0 IP_CLIENT:44674 OPENLDAP_SERVER:389 CLOSE_WAIT 2426/nagios off (0.00/0/0) tcp 1 0 IP_CLIENT:44956 OPENLDAP_SERVER:389 CLOSE_WAIT 4652/ntpd off (0.00/0/0) ..... And so on .. I have ~20 TCP CLOSE_WAIT connection to OPENLDAP_SERVER I don't understand when these applications tried to connect to OPENLDAP server and why i have TCP persistent connexion. Meanwhile, I only have SSHD configured to use pam_ldap.so ... Someone can help me please ?!? Thanks by advance for your answer and i m sorry about my English

1 0

indexing with mdb
by anil beniwal 30 Jan '13

30 Jan '13

Hi i am using openldap 2.4.33 on rhel 6.3 with large mdb database size. We are using it for last few weeks, now we want to add index few attributes. What approach we should take, so that there is no downtime. How we can check the status if indexing is complete or not ? with both dynamic and static config We are using flat file configuration. Anil

1 0

Kerberos/LDAP integration
by Asmaa Ahmed 30 Jan '13

30 Jan '13

Hello, I am trying to integrate Kerberos to my Openldap server, and I am following pretty much the instructions from there 'http://www.rjsystems.nl/en/2100-d6-kerberos-openldap-client.php'But still can't get it work to connect the client server to the LDAP one after the integration!I can see this error in my logs:Jan 30 17:27:17 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:17 mail nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...Jan 30 17:27:18 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:18 mail nscd: nss_ldap: could not search LDAP server - Server is unavailable Thanks.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical