openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 23 Nov '12

23 Nov '12

> >> I'm afraid to increase the cachesize in DB_CONFIG: > > > ch_realloc means the system ran out of memory. Increasing the DB_CONFIG > cachesize will run you out of memory more quickly. I'm sitting JUST NOW in front of the LDAP Server and slapcat/slapadd the database to reorganize .. (database is almost 4 years old) 2 hours ago, booth servers crashed again ... I can't belief, that 16G RAM not enough for 1500000 entires/objects ... I need about 5G for set_cache_size (DB_CONFIG) and the other RAM (11G) is for shared memory and the other caches (cachesize, dncachesize, idlcachesize). How much need the three caches? And if to less cache, the machines should run slower, but not run out of memory? > > The best thing for you to do would be to upgrade to OpenLDAP 2.4.33 and > switch to using back-mdb. Softwareupdate is possible not before january 2013. I was wrong with the version, we use 2.4.31 I'm looking to mdb since a few month, but is it usable for production? > > If you are not capable of doing that, I would suggest you use tcmalloc as an > alternative memory allocator to glibc, and reduce your entry cachesize and > idlcachesize. If you can reclaim enough space, you should increase your > DB_CONFIG cachesize, as that is the most important element of performance > with back-bdb/hdb. Yes, not before january 2013 ... Hope after reorganization, slapd runs more stable... The only thing I can do for now. Thanks Meike

2 1

slapd crashes with ch_realloc of X bytes failed
by Meike Stone 23 Nov '12

23 Nov '12

Hello, since a short time, my slapd crashes often. I have two servers running in MM replication. I use openldap version 2.4.30 (for updates are only dedicated timeslots...) The loglevel is set to 256 I see some strange messages in my log before the slapd crashes: "ch_realloc of 986032 bytes failed" --- "ch_malloc of 294896 bytes failed" --- "bdb(ou=root): txn_checkpoint: failed to flush the buffer cache: Cannot allocate memory" --- "ch_malloc of 34159 bytes failed" What does they mean, how can I solve this problem The System has 16GByte RAM, no other service is running there. The Database size is about 1500000 entires and the size of the ldif is about 2Gbyte Because of the memory messages, I reduced the cachesize 1000000 dncachesize 1000000 idlcachesize 3000000 to cachesize 750000 dncachesize 750000 idlcachesize 2250000 but the problem exist still again. I can't believe, that the memory is insufficient. Sysstat is running, and I see enough cache memory (about 5GByte all time), and the Swap (2GByte) is almost not used (about 2MByte). vm.swappiness is set to default (60), so the Swap should used more before the memory is running out. OOM Kill is enabled via SYSRQ (signalling of processes), so slapd should terminated by the kernel ... My configuration: == DB_CONFIG ================================== set_cachesize 2 0 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE == slapd.conf ================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov moduleload back_monitor sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 8 serverID <001|002> database bdb suffix "ou=demo" rootdn "cn=admin" directory /var/lib/ldap loglevel 256 cachesize 750000 dncachesize 750000 idlcachesize 2250000 cachefree 500 dirtyread dbnosync shm_key 7 checkpoint 4096 15 index objectClass,entryUUID,entryCSN eq index cn eq,sub index ... own indexes syncrepl rid=<001|002> provider=ldap://master-<01|02> type=refreshAndPersist keepalive=360:10:5 retry="5 5 300 +" searchbase="ou=demo" attrs="*,+" overlay syncprov mirrormode TRUE syncprov-checkpoint 100 5 database monitor ========================================== (I know, dirtyread and dbnosync are not recommended..) Additional I see messages like: "bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995)" Should I care about it? Thanks Meike

3 4

OpenLDAP 2.4.32 back_sql Oracle 10 - error executing at_query (?)
by Barros, Nuno Alexandre Freire, Vodafone Portugal 23 Nov '12

23 Nov '12

Hi. I'm having trouble against an Oracle 10 database using: - Solaris 10 Sparc - OpenLDAP 2.4.32 - unixODBC 2.2.14 - Oracle Instant Client 10.2.0.5.0 I get this errors: 50ae749e backsql_oc_get_attr_mapping(): error executing at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" for objectClass "inetOrgPerson" with param oc_id=1 50ae749e Return code: -1 50ae749e <==backsql_load_schema_map() 50ae749e backsql_db_open(): schema mapping failed, exiting 50ae749e backend_startup_one (type=sql, suffix="app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone"): bi_db_open failed! (1) when I use this configuration file: bash-3.2# cat ldap.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/conf/inetorgperson.schema pidfile /app/users/ldap/slapd.pid argsfile /app/users/ldap/slapd.args idletimeout 0 threads 32 timelimit 5 modulepath /opt/csw/libexec/openldap moduleload back_sql.la ####################################################################### # sql database definitions ####################################################################### database sql suffix "app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone" rootdn "vfsid=root,app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone" rootpw cu906B2H04cNE #dbname ORACLE10_FREE dbname ORACLE10 dbuser EREXTENSION dbpasswd ERSINPRD subtree_cond "UPPER(ldap_entries.dn) LIKE CONCAT('%',UPPER(?))" insentry_stmt "INSERT INTO ldap_entries (id,dn,oc_map_id,parent,keyval) VALUES (ldap_entry_ids.nextval,?,?,?,?)" upper_func UPPER has_ldapinfo_dn_ru no readonly on access to * by dn="vfsid=root,app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone" read by users read by * auth So I added this line to ldap.conf (oc_map_id=1 instead of oc_map_id=?) and this way I'm able to start LDAP: at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=1" But then I get other issues related to the character "?" for example I'm unable to get results from the database if I use that character: 50afc6d1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM accounts,customer_attributes_values_t WHERE accounts.id=? AND customer_attributes_values_t.account_id=accounts.id and customer_attributes_values_t.attribute_id = 83' 50afc6d1 Return code: -1 50afc6d1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM ldap_entry_objclasses,ldap_entries,accounts WHERE accounts.id=? AND ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entries.keyval=accounts.id and ldap_entries.oc_map_id=1' 50afc6d1 Return code: -1 Strange thing is that I have other machine which I'm migrating that works fine against same Oracle database but it uses: - Solaris 9 - OpenLDAP 2.3.24 - unixODBC 2.2.12 - Oracle Instant Client 10.2.0.3.0 I may try to downgrade to the "working" versions of unixODBC and Oracle Instant Client but I prefer to keep the ones I installed in the new machine. Same thing regarding OpenLdap version. Anyway I would like to understand the issue I'm facing instead of changing versions of software. Does someone know (and understand) what's going on with this? Thanks, Nuno Barros

1 0

MSYS build and POSIX regex
by Anton Malov 23 Nov '12

23 Nov '12

Trying to build openldap with msys and mingw using distribution from http://nuwen.net/mingw.html The problem is the configure script can not find regex library and provides following output: checking for regex.h... yes checking for library containing regfree... no configure: error: POSIX regex required. But the distribution contains precompiled pcre library and regex.h contains regfree function declaration. What is going wrong?

2 1

ldif, a person with city and country
by Jobst Schmalenbach 23 Nov '12

23 Nov '12

Hi Sorry, new member and just started using ldap (openldap). I am not sure whether I can ask this question here as the name of the list specifies "technical", if not please tell me list(s) where I can do so. For starters I have read the O'reilly book, I tried to figure out my questions using the help in the FAQ's, I searched to net ... but I am a little out of my depth in the moment. I am trying to get LDAP to work to help authentication in wordpress and moodle, with wordpress being the main part and moodle uses LDAP for the authentication (subscription based) and some info for each student from LDAP. So far I can add entries to LDAP from wordpress, I can login to wordpress using LDAP. I have got it to work to allow access to moodle when the correct username (uid) and password is found in LDAP but I want to add some info about each student to LDAP, one the country and the other being the city (and later some more). So far I can add enough information for subscribers (billing address, uid, telephone etc) using the standard schemas and object classes, but I need a little mode info for each. This is what I have: dn: dc=MyDomain,dc=com,dc=au dc: MyDomain objectClass: domain dn: o=Subscriptions,dc=MyDomain,dc=com,dc=au o: Subscriptions objectClass: organization dn: ou=moodle,o=Subscriptions,dc=MyDomain,dc=com,dc=au ou: moodle objectClass: organizationalUnit dn: uid=gemma, ou=moodle, o=Subscriptions, dc=MyDomain, dc=com, dc=au objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: emailPerson objectclass: NameViewPerson cn=Gemma Turtle sn=Turtle givenName=Gemma Turtle uid=gemma countryCode=AU I end up with an error "invalid structural object class chain", which I think means the country needs to be higher up the tree, but then I would have to create the tree branches for every country (for each person)? Subscribers will come from different countries and countless cities (which I haven't added yet) as this is part of the target audience. I am not sure how to structure this. Are there any ldif file around I can have a look that deal with subscriptions like this? Jobst

3 4

OpenLDAP Proxy to AD of User Objects with full/correct schema
by Mailing Lists 23 Nov '12

23 Nov '12

I know this list gets a large number of questions about Active Directory integration and this one is no different. I've tried to do as much research as possible on my own but still have a few un-answered questions and issues, so i'm adding yet another AD question to the list. Sorry in advance. My initial foray into OpenLDAP was to use it to store the idmaps created by Samba, so that mapped user and group IDs were identical between file servers. As I thought about it more, I realized we could use LDAP to centralize our Linux users, groups, and access to other LDAP-enabled applications. The point of all this is, that I don't need to proxy Active Directory (and its schema) in its entirety, I really just want to use it as a central repository for user info and authentication. So, I guess, my first question is: Is this a viable use case? All signs seem to point to yes, but I just want to make sure. I currently have a proxy database configured that is successfully proxying/querying our AD infrastructure. From what I've read, OpenLDAP 2.3 and newer have the ability to proxy unknown schemas, but will be not be able to do any advanced filtering because the schema is unknown. My question is, given a full export of the AD schema from CN=Schema,CN=Configuration,DC=corp,DC=whatever,DC=com via LDIFDE, is there a way to leverage this to re-create parts of the AD schema so that OpenLDAP can perform native filtering? I'm primarily only interested in the user objects (ObjectClass=user). I know that all of this might be easier if I was to use ADAM/ADLDS and/or scrape the Samba4 schema, but i'd like to do it myself just for the education it provides and because I'm trying to implement just the bare minimum to our users. I've also seen the AD/Outlook Global Address List entry in the FAQ, but that involves editing the OpenLDAP provided .schema files. If possible, i'd like to keep all of these AD related schemas within their own files and keep the OpenLDAP provided ones untouched. Thanks for the help, -Dave

4 5

Fail to pass the basic functionality testing (test058-syncrepl-asymmetric)
by Jackie Zhang 22 Nov '12

22 Nov '12

Hi, I installed the newest openldap-2.4.33 on my Linux machine. I run the test in the tests directory. And I received the following error (attached below). Mainly: ERROR: Second site1 backend not replicated to central master I can replay it everytime by executing "./run -b hdb test058-syncrepl-asymmetric". Using hdb or mdb leads to the same result. Is anybody know what is this problem? Is there something wrong on my installation? Thank you very much! Best regards, Jackie Zhang ============test058-syncrepl-asymmetric================== Cleaning up test run directory leftover from previous run. Running ./scripts/test058-syncrepl-asymmetric for bdb... running defines.sh Initializing master configurations... Initializing search configurations... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Starting site1 master slapd on TCP/IP port 9012... Using ldapsearch to check that site1 master is running... Starting site2 master slapd on TCP/IP port 9013... Using ldapsearch to check that site2 master is running... Starting central search slapd on TCP/IP port 9014... Using ldapsearch to check that central search slapd is running... Starting site1 search slapd on TCP/IP port 9015... Using ldapsearch to check that site1 search slapd is running... Starting site2 search slapd on TCP/IP port 9016... Using ldapsearch to check that site2 search slapd is running... Adding schema on ldap://localhost:9011/... Adding schema on ldap://localhost:9012/... Adding schema on ldap://localhost:9013/... Adding schema on ldap://localhost:9014/... Adding schema on ldap://localhost:9015/... Adding schema on ldap://localhost:9016/... Adding database config on central master... Adding database config on site1 master... Adding database config on site2 master... Adding access rules on central master... Adding access rules on site1 master... Adding access rules on site2 master... Adding database config on central search... Adding database config on site1 search... Adding database config on site2 search... Populating central master... Adding syncrepl on site1 master... Adding syncrepl on site2 master... Using ldapsearch to check that site1 master received changes... Using ldapsearch to check that site2 master received changes... Populating site1 master... Populating site2 master... Stopping site1 master... Adding syncrepl on central master... Using ldapsearch to check that central master received site2 entries... Using ldapmodify to modify central master... Restarting site1 master slapd on TCP/IP port 9012... Using ldapsearch to check that site1 master is running... Using ldapsearch to check that central master received site1 entries... Using ldapsearch to check that site1 master received central master update... Using ldapsearch to check that site2 master received central master update... Adding syncrepl consumer on central search... Adding syncrepl consumer on site1 search... Adding syncrepl consumer on site2 search... Using ldapsearch to check that central search received changes... Using ldapsearch to check that site1 search received changes... Using ldapsearch to check that site2 search received changes... Checking contextCSN after initial replication... Using ldapmodify to modify first backend on central master... Using ldapsearch to check replication to central search... Using ldapsearch to check replication to site1 search... Using ldapsearch to check replication to site2 search... Checking contextCSN after modify of first backend on central master... Using ldapmodify to modify second backend on central master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to site1 master... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of second backend on central master... Using ldapmodify to modify first backend on site1 master... Using ldapsearch to check replication to site1 search... Using ldapsearch to check replication to site2 master... Using ldapsearch to check no replication to site2 search... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of first backend on site1 master... Using ldapmodify to modify second backend on site1 master... Using ldapsearch to check replication to site1 search... Using ldapsearch to check no replication to central master... Checking contextCSN after modify of second backend on site1 master... Using ldapmodify to modify first backend on site2 master... Using ldapsearch to check replication to central master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to site1 master... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of first backend on site2 master... Using ldapmodify to modify second backend on site2 master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to central master... Checking contextCSN after modify of second backend on site2 master... Stopping central master and site2 servers to test start with emtpy db... Starting site2 master slapd on TCP/IP port 9013... Using ldapsearch to check that site2 master slapd is running... Starting site2 search slapd on TCP/IP port 9016... Using ldapsearch to check that site2 search slapd is running... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Using ldapsearch to check that site2 master received base... Using ldapsearch to check that site2 search received base... Waiting 1 seconds for syncrepl to receive changes... Checking contextCSN after site2 servers repopulated... Adding syncrepl of second site1 master backend on central master... Using ldapsearch to check that central master received second site1 backend... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Waiting 3 seconds for syncrepl to receive changes... Waiting 4 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ERROR: Second site1 backend not replicated to central master Restarting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Waiting 1 seconds for slapd to start... Using ldapsearch to check that central master received second site1 backend... Using ldapsearch to check that central search received second site1 backend... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Waiting 3 seconds for syncrepl to receive changes... Waiting 4 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ERROR: Second site1 backend not replicated to central search Restarting central search slapd on TCP/IP port 9014... Using ldapsearch to check that central search slapd is running... Waiting 1 seconds for slapd to start... Using ldapsearch to check that central search received second site1 backend... Running 1 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 2 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 3 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 4 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 5 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 6 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 7 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 8 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 9 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 10 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... No race errors found after 10 iterations Found 2 errors >>>>>> Exiting with a false success status for now

1 0

slapo-rwm overlay and backend databases
by Bryce Powell 22 Nov '12

22 Nov '12

Hi, The OpenLDAP 2.4 documentation states: "When using slapd.conf(5), overlays that are configured before any other databases are considered global, as mentioned above. In fact they are implicitly stacked on top of the frontend database. They can also be explicitly configured as such: database frontend overlay <overlay name>" I currently use slapo-rwm, defined as a global declaration in slapd.conf, to provide bindDN rewrites to a remote LDAP server via slapo-ldap (LDAP proxy database). Is it possible then, if I'm interpreting the documentation correctly, to additionally stack a rewrite/remap overly in each defined database section? The objective would be to achieve database specific rewrites that are not applicable to all defined databases. e.g. database ldap suffix "dc=abc,dc=local" uri "ldap://172.11.250.200/" overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchEntryDN rwm-rewriteRule "^cn=(.+)?\\\\2C(.+)?,ou=users,dc=abc,dc=local$" "cn=$1_$2,ou=users,dc=abc,dc=local" ":@" [...etc.] database ldap suffix "dc=xyz,dc=local" uri "ldap://172.11.250.201/" overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchEntryDN rwm-rewriteRule <some other rewrite rule here> [...etc.] If this is possible, does the configuration allow one to define the overlay at the "backend" level, so that it applies to all databases of the same type? e.g. backend ldap overlay rwm rwm-rewriteEngine on database ldap suffix "dc=abc,dc=local" uri "ldap://172.11.250.200/" rwm-rewriteContext searchEntryDN rwm-rewriteRule "^cn=(.+)?\\\\2C(.+)?,ou=users,dc=abc,dc=local$" "cn=$1_$2,ou=users,dc=abc,dc=local" ":@" [...etc.] database ldap suffix "dc=xyz,dc=local" uri "ldap://172.11.250.201/" rwm-rewriteContext searchEntryDN rwm-rewriteRule <some other rewrite rule here> [...etc.] Thanks Bryce Powell

2 1

Password policy
by jeevan kc 22 Nov '12

22 Nov '12

Hello I want to enable password policy on Openldap 2.4.30(to all users. I see that the ppolicy.ldif and ppolicy.schema are listed under /usr/local/etc/openldap/schema but are not present on /usr/local/etc/openldap/slapd.d/cn=config folder. So do I need to add the policy.ldif to the cn=config folder ? Is there like specific procedure to do that or can I add manually with ldapadd ? Also how do I enable that schema to all users ? Please help. Jeevan

4 5

Re: OpenLDAP-Client TLS
by Martin.Heinzmann＠belden.com 20 Nov '12

20 Nov '12

Little update...i managed to get it to work :-) It looks like it was the option "LDAP_OPT_X_TLS_ALLOW" i have to set. Unfortunately i did it on the wrong position in my code. Now this option is the first thing i do, even prior the initialization. Nevertheless "LDAP_START_TLS_S" returns 3 errors: 1.unable to get local issuer certificate, 2. certificate not trusted, 3.unable to verify the first certificate. I think the 2nd and 3rd appear because the server uses a self signed certificate? One question i still have on my mind. I am only able to compile my client by including the library "sasl2" although i am not using "ldap_sals_bind" or anything like that. Is it possible expel sasl from my program or do i have to use that library? Regards Martin DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical