openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Ldap db is corupt
by Jorge Armijo 02 Jan '13

02 Jan '13

Hi my friends i have the next problem when mi server is down for electrical fails my ldap db is corrupt I need some procedure to restore de db because until this moment I restore but from a backup but i thing that is not the better strategy I realy need your help!!!!!!! Atento a sus comentarios Jorge Armijo Ingeniero de Soporte Soporte Libre Cia. Ltda. D: Hernandez de Giron Oe4-175 y Vasco de Contreras T: +593 (2) 331-9027 F: +593 (2) 243-1103 @: jorge.armijo(a)soportelibre.com www.soportelibre.com

2 1

GDM + pwdPolicy problem
by cbulist 02 Jan '13

02 Jan '13

Hi, We have a problem using Red Hat 5.7, gdm 2.16.0-59 y pwdPolicy. When an account gets pwdMaxAge limit and the user try to login using GUI the user doesn't receive any warning about expiration account, it just requests the user and password like a normal login and it fail. The warning works if the user try login by SSH. If we use pwdReset the user get the warning message and it is able to change the password. We comment pwdPolicy rules and using shadow attributes gdm works fine. We tried the same configuration with a Red Hat 6 server and everything works fine but we are not able to change our Red Hat version now. Our requirements are keep the password history and we tried pam_unix remember=3 option in /etc/pam.d/system-auth with /etc/security/opasswd but It did not work. We can go with shadow attributes as long as we keep the password history. Any idea? Thanks in advance!

2 1

olcToolthreads and slapadd -n0
by Василий Молостов 01 Jan '13

01 Jan '13

i have migrated server side config for my db and I have found some strange behavior of slapadd: I've got started migration from converting slapd.conf containing my db config and a 'tool-threads' parameter (with value above 1) into common ldif file, in which an 'olcToolThreads' was defined appropriately (i.e above 1). It was the simplest and clear step. The next step was to 'slapadd -n 0' this ldif file into an empty server config (having slapd stopped), but just at adding 'cn=config' object (which contains olcToolThreads with value > 1) 'slapadd' stuck indefinitely at shed_yelds() call (I have observed this via strace tool from ubuntu). So as a result slapadd had been in processing its operation indefinitely without any output but was capable to stop working by Ctrl-C handler. Setting olcToolThreads to 0 or 1 has solved this problem. I dont know is this a bug or my misconfiguration?

3 2

missing structuralObjectClass
by Dusty Doris 01 Jan '13

01 Jan '13

I recently migrated a client's ldap directories to new servers. I setup replication from the new servers to the old servers to do the initial build of the directory and to keep up to date with changes before the cutover. In the process we also moved from 2.4.12 to 2.4.33. I've run into an issue since then with an object that was missing a structuralObjectClass. When we try to commit modifications to that object, we received an error that says: ldap_modify: Other (e.g., implementation specific) error (80) additional info: no structuralObjectClass operational attribute Doing a search on that object with +, shows that it is in fact missing a structuralObjectClass. Other users that we can modify, show that they do have that attribute. I was able to solve this problem by doing an ldapsearch on the user and saving to an ldif, ldapdelete the user, then ldapadd the user back from the ldif file. When re-adding that user, the structuralObjectClass was created. It looks like about 50% of our objects are missing that attribute. To get those numbers, I am searching with: '(&(objectClass=*)(!(structuralObjectClass=*)))' + VS '(&(objectClass=*)(structuralObjectClass=*))' + What would be the best way for me to fix these issues on every object that is missing the structuralObjectClass? Also, in the future, would you recommend I do a slapcat/slapadd or something like that to populate a new database instead of letting syncrepl load it for me? Would that have fixed this problem from the start? Thanks for any suggestions. - Dusty Doris

2 3

Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 31 Dec '12

31 Dec '12

Hey Quanah, Thank you very much for the debugging tip! -- Using it I got further in. Now I get an error "<= str2entry: str2ad(UR1): attribute type undefined". I must be setting my external variables (such as UR1) incorrectly in my LDIF file. What is the correct syntax for setting them, please? I tried each of the following sentences, none of which worked: URI1: ldap://host1.hq.mycompany.com:389/ URI1: ldap://host1.hq.mycompany.com:389 URI1: "ldap://host1.hq.mycompany.com:389/" URI1="ldap://host1.hq.mycompany.com:389/" URI1="ldap://host1.hq.mycompany.com:389" URI1 ldap://host1.hq.mycompany.com:389/ This is the command I execute (after removing all contents from slapd.d): slapadd -d -1 -v -F /etc/openldap/slapd.d -n 0 -l /etc/openldap/nwaymmr.ldif >& output.txt For completeness I've attached my LDIF file "nwaymmr.ldif" and the output "output.txt" utilizing the first line above. Thank you very much, in advance. Fal On Sat, Dec 29, 2012 at 9:02 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, December 29, 2012 9:01 AM -0800 fal patel < > fal0patel(a)gmail.com> wrote: > > (3) Where It's Failing: >> ================= >> I first executed the following: >> >> slapadd -v -F /usr/local/etc/openldap/slapd.**d -b bdb -l mmr.ldif >> > > This is nonsensical. You are adding a cn=config DB. Thus you cannot use > a base of "bdb". Remember that -b is the suffix you are adding (in this > case, cn=config). Not the database type. > > > So I suppose I must create the database beforehand? >> > > No. But the directory (/usr/local/etc/openldap/**slapd.d) must exist > before slapadd will work. > > I would suggest you run: > > slapadd -d -1 -v -F /usr/local/etc/openldap/slapd.**d -n 0 -l mmr.ldif > > So you can see exactly why it is failing. My guess is you didn't create > the directory. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Rewrite dn ?
by ST Wong 31 Dec '12

31 Dec '12

Hi, I'm newbie to openldap 2.4, and planning to setup an ldap proxy using ldap backend + remap overlay so that user can bind as cn=xxx,dc=my,dc=com, while at the backend ldap, the object looks like following: dn: uid=yyy,dc=my,dc=com objectclass: inetorgperson objectclass: dcobject cn=xxx uid=yyy mail=xxx(a)my.com ... Is it possible? Thanks a lot. Rgds

1 0

Admin user has two passwords
by Wiebe Cazemier 31 Dec '12

31 Dec '12

Hi, I tried changing the password for the admin user in my OpenLDAP tree, but now I can log in with both. When I do this: ldapsearch -vxZZH ldap://ldap.domain.tld/ -D "cn=admin,dc=domain,dc=tld" -W Entering a wrong password makes it fail, but entering the old or new password both work. I thought maybe it used the root account, so in an attempt to fix this, I tried setting the rootpw with this: # cat change-rootpw.ldif dn: olcDatabase={0}config,cn=config replace: olcRootPW olcRootPW: {SSHA}some hash ldapmodify -v -Y EXTERNAL -H ldapi:/// -f change-rootpw.ldif But that didn't fix it. I'm quite confused. Any help is appreciated. Regards, Wiebe

3 6

Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 30 Dec '12

30 Dec '12

Hi Bernd and Dieter, Thank you very much for your advice. Unfortunately, however, I still haven't succeeded in getting N-way MMR to work. So, to get it straight in my mind, I've written it up in 3 parts below -- (1) Problem Statement and Requirements, (2) My Implementation Attempt, and (3) Where It's Failing. (1) Problem Statement and Requirements: ============================== Need N-Way Multi-Master OpenLDAP Replication for 3 nodes. LDAP Writes are infrequent, but can occur to any of the 3 nodes. No need for high performance. No need for ACID transactions. There is no database or anything at all at present, so it's a clean slate for development. slapd.conf(5) will not be used at all. Only slapd-config will be used for configuring. The only back-end that will be used is bdb. The only replication mechanism is syncrepl in Provider Push mode of operation, ie., refreshAndPersist, which is initiated by a Consumer. (Consumer Pull mode of operation, ie. refreshOnly, will not be used at all.). So, once the Provider services the Consumer’s search request, Provider locally persists the synchronization search. There will be no maintaining of any Provider session log store. Thus only the Present phase of the refresh synchronization will be used. (not the Delete phase at all). Database creation will be performed off-line (to ensure database is not accessed while being created!). (not on-line). Thus the database creation tools that will be used are slapadd, slapcat, slaptest etc. (not ldapadd, ldapmodify etc.) In fact, there being no database to begin with, for slapadd I must use the "-b suffix" to specify which database to add entries to. slapadd -b bdb (not the "slapadd -n 0" parameter to specify the zero-th database.). (2) My Implementation Attempt: ========================== I have copy-pasted the exact text from the OpenLDAP 2.4 Administrator's Guide, Section 18.3.3 "N-Way Multi-Master" (with my only changes being to my user variables), as follows: #################################### # mmr.ldif #################################### # This sets up the config database: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # second and third servers will have a different olcServerID obviously: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret dn: cn=config objectClass: olcGlobal cn: config olcServerID: 3 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # This sets up syncrepl as a provider (since these are all masters): dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: syncprov.la # Now we setup the first Master Node # (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): URI1="ldap://ldap.node1.mycompany.com" URI2="ldap://ldap.node2.mycompany.com" URI3="ldap://ldap.node3.mycompany.com" dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 olcServerID: 3 $URI3 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 add: olcMirrorMode olcMirrorMode: TRUE # Now start up the Master and a consumer/s; # also add the above LDIF to the first consumer, second consumer etc. # It will then replicate cn=config. # You now have N-Way Multimaster on the config database. # We still have to replicate the actual data, not just the config; # so add to the master # (all active and configured consumers/masters will pull down this config, # as they are all syncing). # Also, replace all ${} variables with whatever is applicable to your setup: BACKEND=bdb BASEDN="dc=ldapservice,dc=hq,dc=mycompany,dc=com" MANAGERDN="cn=Admins,$BASEDN" PASSWD=secret dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./db olcRootDN: $MANAGERDN olcRootPW: $PASSWD olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited size.soft=unlimited olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov # Note: All of your servers' clocks must be tightly synchronized using e.g. NTP. # Note: URLs specified in olcSyncRepl directives are the servers URLs to replicate from. # These must exactly match the URLs slapd listens on (-h in Command-Line Options). # Otherwise slapd may attempt to replicate from itself, causing a loop. (3) Where It's Failing: ================= I first executed the following: slapadd -v -F /usr/local/etc/openldap/slapd.d -b bdb -l mmr.ldif But that was a fiasco, saying "slapadd: slap_init invalid suffix ("bdb") ". So I suppose I must create the database beforehand? So then I created the database (by running slapd using slapd.conf with "database config" and "rootpw config" directives commented out); then I stopped the slapd service and executed the following: slapadd -v -F /usr/local/etc/openldap/slapd.d -n 0 -l mmr.ldif That failed too, saying "slapadd: could not add entry dn="cn=config" (line=1)". So then I tried: slapadd -v -F /usr/local/etc/openldap/slapd.d -n 1 -l mmr.ldif That failed too, saying "slapadd: database doesn't support necessary operations". So then I tried: slapadd -v -F /usr/local/etc/openldap/slapd.d -n 2 -l mmr.ldif That failed too, saying "slapadd: line 1: database #2 (dc=ldapservice,dc=hq,dc=mycompany,dc=com) not configured to hold "cn=config"; did you mean to use database #0 (cn=config)?". Of course, when I try any other number for n it says "Database number selected via -n is out of range. Must be in the range 0 to 2 (the number of configured databases)." So, my question is: How in the world do I configure my database #0 to also include my database #2 entities? Or, alternatively, how do I configure my database #2 to also hold "cn=config"? There is an old OpenLDAP.org blog which summarises how, but doesn't describe any execution steps at all: http://blog.suretecsystems.com/archives/40-OpenLDAP-Weekly-News-Issue-5.html " *Multi-Master Replication configuration example:* This has been asked for a few times now, so I'm putting an example here for use with OpenLDAP 2.4.6, which will then be part of the main docs<http://www.openldap.org/doc> This is adapted from test050-syncrepl-multimaster<http://www.openldap.org/devel/cvsweb.cgi/tests/scripts/test050-syncrepl-mul…> A proper writeup will be in the admin guide<http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master>soon, I promise [image: ;-)] Right, the following is all in LDIF<http://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format>format and you *slapadd* them to your *cn=config* on the amount of Master nodes you have/want (using *slappasswd* of course): This sets up the config database: " I really urgently need your help with this, please. I thoroughly appreciate your help so far. Thanks Fal On Fri, Dec 28, 2012 at 9:18 AM, fal patel <fal0patel(a)gmail.com> wrote: > > > ---------- Forwarded message ---------- > From: Bernd May <bernd(a)net.t-labs.tu-berlin.de> > Date: Fri, Dec 28, 2012 at 5:07 AM > Subject: Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd > command failing > To: openldap-technical(a)openldap.org > > > From the manpage of slapadd: > > '-n dbnum Add entries to the dbnum-th database listed in the > configuration file. The -n cannot be used in conjunction with the -b > option. To populate the config database slapd-config(5), use -n 0 as it > is always the first database. It must physically exist on the > filesystem prior to this, however.' > > hth > > On 28.12.2012 09:14, fal patel wrote: > > Hi Dieter, > > > > Thank you very much, but even though I spent all day trying to figure out > > the problem I could not make any progress at all. > > > > The mmr_servers.ldif file I provided is an *exact* copy of the OpenLDAP > 2.4 > > Administrator's Guide Section 18.3.3 "N-Way Multi-Master", so if it is > not > > working it has to be a documentation error/bug in that section of the > > Administrator's Guide itself. > > Or is it the case that the variables I'm setting therein are wrong? > > > > Here are the variable values I'm setting: > > ============================ > > # Also, replace all ${} variables with whatever is applicable to your > setup: > > BACKEND=bdb > > BASEDN="dc=ldapservice,dc=hq,dc=mycompany,dc=com" > > MANAGERDN="cn=admin,$BASEDN" > > PASSWD=secret > > > > > > The slapd.conf file also is the *exact* same one that gets created at > > install-time in /usr/local/etc/openldap/ , with the only change being my > > "BDB database definitions" customisations as follows: > > ####################################################################### > > # BDB database definitions > > ####################################################################### > > > > ## added for multimaster replication (prior to running slapadd to create > > db): > > database bdb > > # suffix <DN of root of subtree you are trying to create> > > suffix "dc=ldapservice,dc=hq,dc=mycompany,dc=com" > > rootdn "cn=admin,dc=ldapservice,dc=hq,dc=mycompany,dc=com" > > rootpw secret > > # directory for index files > > directory /usr/local/var/openldap-data > > # specify which indices you want to build > > index objectClass eq > > # loglevel 64 > > > > > > Whatever I try, however, slapadd gives the same error: > > ======================================= > > ubuntu11@ubuntu11:~$ sudo slapadd -l > > /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f > > /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > > 50dd4b2a bdb_monitor_db_open: monitoring disabled; configure monitor > > database to enable > > slapadd: line 1: database #1 > > (dc=ldapservice,dc=hq,dc=practicefusion,dc=com) not configured to hold > > "cn=config"; did you mean to use database #0 (cn=config)? > > _ 3.25% eta none elapsed none spd > 833.5 > > k/s > > Closing DB... > > > > > > I didn't quite understand your instructions either: > > ================================== > > "cn=config has to be database number 0, that > > is, the first database declaration must be cn=config." > > > > In mmr_servers.ldif, the very first line is > > dn: cn=config > > > > How do I cause cn=config to be database number 0 , please? > > > > And why should I have to, unless the text in OpenLDAP 2.4 Administrator's > > Guide, Section 18.3.3 "N-Way Multi-Master" has a bug? > > > > Could you please advise? I am completely stuck. > > > > Thank you very much. > > > > Fal > > > > > > > > On Thu, Dec 27, 2012 at 3:54 AM, Dieter Klünter <dieter(a)dkluenter.de> > wrote: > > > >> Am Thu, 27 Dec 2012 02:22:18 -0800 > >> schrieb fal patel <fal0patel(a)gmail.com>: > >> > >>> Oops -- forgot to enter subject-line! > >>> > >>> > >>> On Thu, Dec 27, 2012 at 2:11 AM, fal patel <fal0patel(a)gmail.com> > >>> wrote: > >>> > >>>> Hello, > >>>> > >>>> I'm trying to accomplish Multi-Master OpenLDAP Replication for 3 > >>>> nodes, but it's not working. > >> [...] > >>>> > >>>> (1) The slapadd command, I execute, and the error message I get: > >>>> ================================================ > >>>> sudo slapadd -l /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f > >>>> /usr/local/etc/openldap/slapd.conf > >>>> -F /usr/local/etc/openldap/slapd.d [sudo] password for ubuntu11: > >>>> 50dc0b31 bdb_monitor_db_open: monitoring disabled; configure monitor > >>>> database to enable > >>>> slapadd: line 1: database #1 > >>>> (dc=ldapservice,dc=hq,dc=mycompany,dc=com) not configured to hold > >>>> "cn=config"; did you mean to use database #0 (cn=config)? > >>>> _ 2.58% eta none elapsed none > >> > >> This error is quite clear, cn=config has to be database number 0, that > >> is, the first database declaration must be cn=config. > >> This is probably due to including a slapd.conf file with a database > >> declaration. > >> > >> -Dieter > >> > >> -- > >> Dieter Klünter | Systemberatung > >> http://dkluenter.de > >> GPG Key ID:DA147B05 > >> 53°37'09,95"N > >> 10°08'02,42"E > >> > >> > > > > -- > Technische Universität Berlin - FGINET > > Bernd May > > System Administration > An-Institut Deutsche Telekom Laboratories > Sekr. TEL 16 > Ernst-Reuter-Platz 7 > 10587 BERLIN > GERMANY > > Mobile: 0160/90257737 > E-Mail: bernd(a)net.t-labs.tu-berlin.de (T-Labs work) > WWW: net.t-labs.tu-berlin.de > > > >

2 1

Forcing TLS encryption
by Wiebe Cazemier 28 Dec '12

28 Dec '12

Hi, I'm trying to get slapd to reject non-encrypted connections, but nowhere can I find how you configure it to *only* accept TLS traffic. I just confirmed that our server accepts unencrypted traffic (with ldapsearch and tcpdump). Normally, I would just close the non-SSL port with IP tables, but using the SSL port is deprecated, apparently, so I don't have that option. So, with the cn=config SSL configuration commands, like this: dn: cn=config changetype:modify replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/bla.key - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/bla.crt - replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/ca.pem Is there a param for forcing TLS? I tried: dn: cn=config changetype: modify replace: olcTLSCipherSuite olcTLSCipherSuite: TLSv1+RSA:!NULL but it doesn't work; the server doesn't start. Debug output: TLS: could not set cipher list TLSv1+RSA:!NULL. main: TLS init def ctx failed: -1 slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Nor does "olcTLSCipherSuite: HIGH" work. I looked in the openldap source code, but even there, I can't find how to do it. Slapd: 2.4.21-0ubuntu5.7 Ubuntu: Ubuntu 10.04.4 LTS Thanks, Wiebe Cazemier

5 8

add posixAccount to back-sql definition
by DavidHornung 28 Dec '12

28 Dec '12

Hello, up to now i used inetOrgPerson from the docs to auth my users via LDAP/back-sql. but in inetOrgPerson isnt a uid defined so the Object Class posixAccount would fit better. I created a table which represents the posixAccount - minimal I need uid and password. the entity integer refers to id's of table persons with mobliePhone, mail, etc. CREATE TABLE net_accounts ( id serial NOT NULL, entity integer NOT NULL, password character varying NOT NULL, uid character varying NOT NULL, CONSTRAINT "net_accounts_pkey" PRIMARY KEY (id , uid ) ) I plan to use this posixAccount to auth with Mailserver, Intranet and all other services ... How to modify the example in the docs to do this ? Thank you! David

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical