openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Unable to perform recursive ldapdelete
by Ben Beuchler 09 Oct '12

09 Oct '12

ldapdelete -Wx -H ldapi:/// -r dc=maildomains,dc=example,dc=com Enter LDAP Password: ldap_delete: Other (e.g., implementation specific) error (80) ldap_delete: Operation not allowed on non-leaf (66) additional info: subordinate objects must be deleted first There are a couple of hundred subordinate entries under dc=maildomains,dc=example,dc=com. Am I doing something wrong or have I encountered a bug? I'm running 2.4.21 on Ubuntu 10.04.

1 0

Reasons for bi_db_open failed! (-30793) with back-mdb?
by Michael Ströder 09 Oct '12

09 Oct '12

HI! What are the possible reasons for this message? 5070a03c backend_startup_one (type=mdb, suffix="cn=accesslog,o=example"): bi_db_open failed! (-30793) I'm testing migrating an existing LDAP server with four DBs - two of them accesslog DBs - to back-mdb with RE24 c62a82b07e1bcc4c795cb5185ee9f16406b05bd9. Either slapadd fails or starting slapd fails after slapadd. Ciao, Michael.

3 3

slaptest fails to covnert overlay syncproc?
by Tim Tyler 08 Oct '12

08 Oct '12

Openldap experts? I am trying to convert a slapd.conf file to cn=config version on Redhat 6.3 running openldap 2.4.23-26. when I do the following to convert the slapd.conf file to the cn=config version, I get the following error: [root@ldap openldap]# slaptest -f slapd.conf -F slapd.d overlay "syncprov" not found slaptest: bad configuration directory! I am not loading any modules in slapd.conf as the old Centos 5 version did not require that I load any syncprov modules for syncprov to work. I think I read that it was statically included it in the binary. It always worked without the module call anyways. Do I now need to add in a line for the syncprov module in the slapd.conf file in order to get slaptest to view and convert the overlay of syncprov with the redhat 6 version of openldap? Note: Here are the following lines for synprov in my slapd.conf file: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 limits dn.exact="cn=xxxx,dc=site,dc=edu" size=unlimited time=unlimited Or is there some other issue I might be missing? Tim Tyler Network Engineer Beloit College

3 2

how to tell client to use ssf=256 instead of ssf=128
by Tobias Hachmer 08 Oct '12

08 Oct '12

Hello, I'm using openldap 2.4.28 on ubuntu server and configured TLS. I want to allow write operations only when ssf=256 is used. (security update_ssf=256) Certificates were set up with openssl CA.pl. When I connect via # ldapadd -Y EXTERNAL -ZZ -f /src/test.ldif I get this: SASL/EXTERNAL authentication started SASL username: cn=ldapadmin,............. SASL SSF: 0 adding new entry "dc=example,dc=com" ldap_add: Confidentiality required (13) additional info: stronger confidentiality required for update the log says: Oct 8 19:38:14 ldap slapd[2205]: conn=1003 fd=13 ACCEPT from IP=127.0.0.1:56698 (IP=0.0.0.0:389) Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=0 STARTTLS Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=0 RESULT oid= err=0 text= Oct 8 19:38:14 ldap slapd[2205]: conn=1003 fd=13 TLS established tls_ssf=128 ssf=128 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 BIND dn="" method=163 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 BIND authcid="cn=ldapadmin,........." authzid="cn=ldapadmin,........" Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 BIND dn="cn=ldapadmin,......." mech=EXTERNAL sasl_ssf=0 ssf=128 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 8 19:38:14 ldap slapd[2205]: connection_input: conn=1003 deferring operation: binding Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=2 ADD dn="dc=example,dc=com" Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=2 RESULT tag=105 err=13 text=stronger confidentiality required for update Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=3 UNBIND Oct 8 19:38:14 ldap slapd[2205]: conn=1003 fd=13 closed 1. Why is the client connecting with ssf=128? 2. Can I influence the ssf used by client, if yes, how? 3. Maybe a certificate issue? Thanks in advance, Tobias Hachmer

4 4

Complete re-sync in MirrorMode
by Santosh Kumar Gupta 07 Oct '12

07 Oct '12

Dear List, I set up two openldap servers in MirrorMode replication. I addeed a user in Master2 and it synced in Master1 but without userPassword. Digging into the problem I found a typo error in olcAccess for replicator user. I fixed the error and any new updates in Master2 get updated in Master1 including userPassword, but not syncing the previously replicated users. I tried running slapd with parameter -c "rid=000" but without success. Please help me to full sync Master1 without recreating db. TIA Santosh

4 3

Openldap Synchronization Issue
by Victor Silva 05 Oct '12

05 Oct '12

Hello folks, I have an ldap base running in 2 machines in a master/slave design. I've tried to do a db2ldiff but as I'm using virtual machines it took a very long time and I aborted the process with crtl C. Since them my bases no longer sync. I have the following erros logs: *[05/Oct/2012:17:44:22 -0300] - 389-Directory/1.2.9.9 B2011.244.2040 starting up [05/Oct/2012:17:44:22 -0300] - from ldbm instance init: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) [05/Oct/2012:17:44:22 -0300] - from DSE add: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) [05/Oct/2012:17:44:22 -0300] - from ldbm instance init: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) [05/Oct/2012:17:44:22 -0300] - from DSE add: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) *I've read in some other mailing lists many people had this problem but I could not pint point an appropriate solution. I don't know which other logs I can post in order to help you but I will be happy to provide them if you require more info. Regards, vfbsilva

2 1

pwdReset: TRUE not working
by Jason Cwik 05 Oct '12

05 Oct '12

Hi, I've recently configured a new openldap 2.4.32 server with the ppolicy overlay. Most of the features like lockout and minLength work fine, but I can't seem to force the user's password to expire. I've even set pwdReset: TRUE on the user's record to try and force them to reset the password, but it doesn't seem to do anything. Here's my overlay config: MBP2:~ me$ ldapsearch -h 10.242.25.158 -D "cn=root,cn=config" -x -W -b "cn=config" -s sub "olcOverlay=ppolicy" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay=ppolicy # requesting: ALL # # {1}ppolicy, {1}bdb, config dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=my,dc=domain,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 And the default pwdPolicy object: MBP2:~ me$ ldapsearch -h 10.242.25.158 -D "cn=ldapadmin,dc=my,dc=domain,dc=com" -x -W -b "ou=policies,dc=my,dc=domain,dc=com" -s sub "cn=default" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=policies,dc=my,dc=domain,dc=com> with scope subtree # filter: cn=default # requesting: ALL # # default, policies, my.domain.com dn: cn=default,ou=policies,dc=my,dc=domain,dc=com objectClass: person objectClass: top objectClass: pwdPolicy cn: default pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 pwdCheckQuality: 2 pwdExpireWarning: 0 pwdFailureCountInterval: 30 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 11555200 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: TRUE pwdSafeModify: TRUE sn: dummy value I turned on trace debugging and I do see it successfully loading cn=default,ou=policies,dc=my,dc=domain,dc=com during the bind operation, so it appears that ppolicy is running fine and loading the policy object. Any ideas?

4 3

Can not build OpenLDAP with OpenSSL in custom location
by jckidder＠aep.com 05 Oct '12

05 Oct '12

Ok, this is driving me nuts!!!! I can't build OpenLDAP with TLS support. configure fails with a TLS/SSL error. If I disable TLS everything works just fine. Everthing I can find on the net is telling me I'm doing this right but it's not working. I have OpenSSL 0.9.8x built and installed to a custom directory: /appl/openssl I have the following environment variables set: LD_LIBRARY_PATH=/appl/BerkeleyDB/lib:/appl/openssl/lib:/appl/cyrus_sasl/lib:/appl/unixODBC/lib:/appl/openldap/lib:$LD_LIBRARY_PATH CPPFLAGS="-I/appl/BerkeleyDB/include -I/appl/openssl/include/openssl -I/appl/cyrus_sasl/include -I/appl/unixODBC/include -I/appl/openldap/include -I/usr/include -DF00=42" LDFLAGS="-L/appl/BerkeleyDB/lib -L/appl/openssl/lib -L/appl/cyrus_sasl/lib -L/appl/unixODBC/lib -L/appl/openldap/lib -L/usr/lib " I run the following configure command: ./configure --prefix=/appl/openldap --enable-bdb --enable-ldap --enable-sql --enable-overlays --enable-spasswd --with-tls=openssl And I get the following output: checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no configure: error: Could not locate TLS/SSL package What am I missing?? -Jon C. Kidder American Electric Power Middleware Services 614-716-4970

2 2

What does acl-bind exactly
by General Stone 05 Oct '12

05 Oct '12

Hello, what does acl-bind exactly in ldap backend (slapd-ldap)? I don't understand the explenataion in available documentations. The manpage says "... that is internally used by the proxy to collect info related to access control ...", but which informations are needed from the remote server? Further the manpage says "The identity (...) is supposed to have read access on the target server to attributes used on the proxy for ACL checking ...", but which attributes are mean? Kind regards, Markus Martinet -- Key fingerprint = A0D9 F306 0FC0 30E7 62DB E785 A192 2A30 5CF1 224D ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Die Theorie ist immer nur so gut wie ihre Praxis. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Filter a ldap connection for a user comming from an IP source
by Mik J 05 Oct '12

05 Oct '12

Hello, I have this ACL that allows the users myadmin to list encrypted passwords access to attrs=userpassword,shadowMax,shadowExpire,sambaLMPassword,sambaNTPassword,sambaPwdLastSet by dn="uid=myadmin,ou=people,dc=mydomain,dc=org" read However this user my admin is supposed to come from one IP 1.1.1.1 only. I think that the peername directive might help to achive this task but I don't know how to associate it with the user myadmin. In conclusion I would like that the user myadmin coming from IP 1.1.1.1 be able to see the encrypted passwords. If the user myadmin comes from another IP like 2.2.2.2 he would not match the ACL and therefore not be able to see encrypted passwords. Does anyone know what is the syntax ?

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical