openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Generated fields from static rules ?
by Yoann Gini 17 Oct '12

17 Oct '12

Hello, I’m new on this list. I actually try to configure a LDAP server to manage my identities (and use Kerberos as authentication backend). In my goal, I want to minimize information that need to be set by administrator to create entry. Here is a basic example : dn: uid=yoann,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: posixAccount cn: Yoann Gini gidNumber: 20 homeDirectory: /home/users/yoann sn: Gini uid: yoann uidNumber: 2000 givenName: Yoann loginShell: /usr/local/bin/zsh mail: yoann(a)example.com userPassword: {SASL}yoann(a)EXAMPLE.COM As you can see, they have many redundant informations… What I looking for is a way to fix some field for posixAccount or *,ou=people,dc=example,dc=com. For example, userPassword should be construct with a static text, a ldap entry and a global variable… {SASL}$uid$#KRB_REALM#. Like the mail : $uid$#domain# If you have any suggestion :-) Yoann

2 2

Re: mdb_stat question
by Roman Rybalko 17 Oct '12

17 Oct '12

17.10.2012 04:19, Howard Chu пишет: > Have a look at mdb_stat in git mdb.master commit > 617769bce5bcac809791adb11301e40d27c31566 > > Use options -e and -f, that should give you everything you want. > Feedback appreciated, I doubt this is its final form yet. > Thanks! Nice tool! But how would I determine storage usage percent? ((Number of pages used)-(Free pages))/(Max pages)*100 or just (Number of pages used)/(Max pages)*100 ? I mean is there possible a situation when (Number of pages used)==(Max pages) and (Free pages)!=0 ? root@log:~# mdb_stat -e /mnt/data/ldap/2 Environment Info Map address: (nil) Map size: 15032385536 Page size: 4096 Max pages: 3670016 Number of pages used: 1042935 Last transaction ID: 2802459 Max readers: 126 Number of readers used: 18 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 12 root@log:~# mdb_stat -f /mnt/data/ldap/2 Freelist Status Tree depth: 3 Branch pages: 7 Leaf pages: 673 Overflow pages: 1 Entries: 2745 Free pages: 140824 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 12 root@log:~# -- WBR, Roman Rybalko

2 1

mdb_stat question
by Frank Swasey 16 Oct '12

16 Oct '12

If I've failed to find this on the mailinglist or in my google searches, I am sorry. However, as I'm experimenting with using mdb for the backend with OpenLDAP-2.4.33 on RHEL 6.3, I'm wondering what am I looking for when I run mdb_stat and it tells me: Page size: 4096 Tree depth: 2 Branch pages: 1 Leaf pages: 2 Overflow pages: 0 Entries: 59 -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

3 4

Three issues with rwm overlay and olcExtraAttrs
by k3kk0n3n k3kk0n3n 16 Oct '12

16 Oct '12

[Resending this as the first one didn't seem to appear on the mailing list, I apologize if this creates a duplicate.] Hi, I believe I have found 3 issues related to the rwm overlay and the extra_attrs (or olcExtraAttrs) setting written to fix the issues described in ITS#6513 ( http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6513;selectid=6513…). The description is long but I tried to provide as much information as possible. I am hoping someone can test and confirm the issues or tell me what I'm doing wrong if there in fact is no issue. I'm running version 2.4.32 on Ubuntu 10 and Debian Squeeze. 1) The documentation in the slapd-config manpage is incorrect. The olcExtraAttrs setting is said to be a global configuration setting when in reality it seems to be database specific. In the slapd.conf manpage, the corresponding setting (extra_attrs) is listed as being database-specific. I believe that is correct although I have not checked it. 2) olcExtraAttrs does not seem to work with the rwm overlay (like in ITS#6513). With the rwm overlay present, ACIs are not evaluated when requesting a specific attribute, regardless of whether olcExtraAttrs is specified or not. In order to apply the ACI, you can pass the ACI attribute name in the search. I'm providing a configuration file that can be used to reproduce the problem as well as some search examples to demonstrate the issue. ----Configuration file---- dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /usr/local/var/run/slapd.pid olcArgsFile: /usr/local/var/run/slapd.args #olcLogLevel: -1 olcToolThreads: 1 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcRequires: authc dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleload: back_hdb olcModuleLoad: rwm dn: olcOverlay=rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: pass olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcExtraAttrs: OpenLDAPaci olcAccess: to attrs=userpassword by anonymous auth olcAccess: to dn.base="dc=example,dc=com" by * search olcAccess: to * by self manage by dynacl/aci=OpenLDAPaci manage ----Note---- To disable the rwm overlay, comment the following 4 lines in the config: dn: olcOverlay=rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm ----Test data---- dn: dc=example,dc=com objectClass: dcObject objectClass: top objectClass: organization dc: example o: example dn: cn=a,dc=example,dc=com objectClass: top objectClass: person cn: a sn: a userPassword: pass dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b userPassword: pass OpenLDAPaci: 1#entry#grant;r,s,c;[all]#access-id#cn=a,dc=example,dc=com ----Search examples---- Without rwm, requesting the whole object (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com # b, example.com dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b # numResponses: 2 # numEntries: 1 Without rwm, requesting an attribute (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn # b, example.com dn: cn=b,dc=example,dc=com sn: b # numResponses: 2 # numEntries: 1 With rwm, requesting the whole object (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com # b, example.com dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b # numResponses: 2 # numEntries: 1 With rwm, requesting an attribute (notice the object is not returned here): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn # numResponses: 1 With rwm, requesting an attribute and openldapaci (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn openldapaci # b, example.com dn: cn=b,dc=example,dc=com sn: b OpenLDAPaci: 1#entry#grant;r,s,c;[all]#access-id#cn=a,dc=example,dc=com # numResponses: 2 # numEntries: 1 3) The last issue came up when I was attempting to set up a certain kind of access control logic. It is highly similar to the previous problem but it doesn't involve ACIs. The issue is caused by the rwm overlay somehow blocking the ACL from accessing unrequested attributes just like in the previous case. olcExtraAttrs was created to fix this issue but I assume it would not fully solve the problem in my case. I have naturally not been able to test it due to the fact that I haven't gotten olcExtraAttrs to work. The access control logic I was attempting to set up was such that objects could contain 2 new attributes: 'rights' and 'requiredRights', both being multivalued strings. 'requiredRights' tells what rights are required to access the object in question, and 'rights' tells what rights each object has. If the user's 'rights' and the target objects 'requiredRights' have at least one common string, access is granted. Fairly simple. The ACL used to evaluate access is as follows: to * by set="this/requiredRights & user/rights" read This method works unless I use the rwm overlay. I'm guessing the attributes required to evaluate the ACLs are somehow dropped and cannot be used. olcExtraAttrs would (if it worked) automatically add the needed attributes to the target object but, to my understanding, not to the user object. The user's attributes would however be needed to evaluate the set shown earlier. The trick used in the last of the previously shown search examples does not work in this case. I can provide requiredRights and rights as additional attributes in the search and I assume requiredRights is returned for access control to use but rights isn't as it is an attribute of the user object. I don't have a cleaned-up version of the config at this time but one could be created if needed.

1 0

Open LDAP sometimes "Can't contact LDAP server"
by amicale.salmson＠free.fr 15 Oct '12

15 Oct '12

Hello all, I developed a PHP application which use slapd. Sometimes, I have the message "Can't contact LDAP server", but sometimes it works (almost half the time) Just before it hangs, I see the following message: -------------------------------------------------- daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_read(20): input error=-2 id=1530, closing. connection_closing: readying conn=1530 sd=20 for close daemon: removing 20 conn=1530 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: -------------------------------------------------- Sometimes, I also see theses messages: -------------------------------------------------- slapd[9635]: connection_close: deferring conn=1582 sd=22 connection_input: conn=1593 deferring operation: binding -------------------------------------------------- I use : - debian 6.0.5 - slapd 2.4.23-7.2 - OpenSSL 0.9.8o 01 Jun 2010 SSL certificats generated with XCA : - openssl x509 -text -in /etc/ssl/pki/ca.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA Netscape Comment: xca certificate - openssl x509 -text -in /etc/ssl/pki/server.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment Netscape Cert Type: SSL Server Netscape Comment: xca certificate Certificats import: ----- BEGIN /etc/ssl/pki/ldap/ldap.ldif ----- dn: cn=config replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/pki/ca.crt - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/pki/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/pki/server.pem ----- END /etc/ssl/pki/ldap/ldap.ldif ----- ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/pki/ldap/ldap.ldif I don't see at all where the problem can comes from because it works half the time. Can anyone help me? Regards, sms

2 1

OpenLDAP Binding and MD5 Hex Authentication
by S K 15 Oct '12

15 Oct '12

Hi, I am able to bind to LDAP server using MD5 Base 64,SHA1,SHA2 encoding but not using MD5 Hex encoding. Can somebody please let me know which I get error 49 when binding using MD5 Hex encoded passwords. Thanks, SK

2 1

Re: openldap-technical Digest, Vol 59, Issue 15
by amicale.salmson＠free.fr 15 Oct '12

15 Oct '12

Hello, How can I find this informations? I didn't find any information about binding by using the command: #/usr/sbin/slapcat -n 0 -l output.ldif Command result: http://pastebin.com/4ihGjLXf # cat /etc/ldap/ldap.conf URI ldaps:/// BASE dc=sms,dc=fr TLS_CACERT /etc/ssl/pki/fr.sms.ca.crt TLS_REQCERT never cat /etc/default/slapd SLAPD_CONF= SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_PIDFILE= SLAPD_SERVICES="ldaps:/// ldapi:///" SLAPD_SENTINEL_FILE=/etc/ldap/noslapd SLAPD_OPTIONS="" Does anyone have an ideai why it works half the time? Thanks, sms. ----- Mail original ----- De: "25Dollar Tech" <25dollartechhelp(a)gmail.com> À: "amicale salmson" <amicale.salmson(a)free.fr> Envoyé: Lundi 15 Octobre 2012 14:11:36 Objet: Re: openldap-technical Digest, Vol 59, Issue 15 Hello you must check in your bind details from conf or ldif file Message: 2 Date: Mon, 15 Oct 2012 12:57:56 +0200 (CEST) From: amicale.salmson(a)free.fr To: openldap-technical(a)openldap.org Subject: Open LDAP sometimes "Can't contact LDAP server" Message-ID: < 258228487.277539862.1350298676206.JavaMail.root(a)zimbra63-e11.priv.proxad.net > Content-Type: text/plain; charset=utf-8 Hello all, I developed a PHP application which use slapd. Sometimes, I have the message "Can't contact LDAP server", but sometimes it works (almost half the time) Just before it hangs, I see the following message: -------------------------------------------------- daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_read(20): input error=-2 id=1530, closing. connection_closing: readying conn=1530 sd=20 for close daemon: removing 20 conn=1530 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: -------------------------------------------------- Sometimes, I also see theses messages: -------------------------------------------------- slapd[9635]: connection_close: deferring conn=1582 sd=22 connection_input: conn=1593 deferring operation: binding -------------------------------------------------- I use : - debian 6.0.5 - slapd 2.4.23-7.2 - OpenSSL 0.9.8o 01 Jun 2010 SSL certificats generated with XCA : - openssl x509 -text -in /etc/ssl/pki/ca.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA Netscape Comment: xca certificate - openssl x509 -text -in /etc/ssl/pki/server.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment Netscape Cert Type: SSL Server Netscape Comment: xca certificate Certificats import: ----- BEGIN /etc/ssl/pki/ldap/ldap.ldif ----- dn: cn=config replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/pki/ca.crt - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/pki/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/pki/server.pem ----- END /etc/ssl/pki/ldap/ldap.ldif ----- ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/pki/ldap/ldap.ldif I don't see at all where the problem can comes from because it works half the time. Can anyone help me? Regards, sms ------------------------------ _______________________________________________ openldap-technical mailing list openldap-technical(a)openldap.org http://www.openldap.org/lists/mm/listinfo/openldap-technical End of openldap-technical Digest, Vol 59, Issue 15 ************************************************** -- Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/ Email: 25dollartechhelp(a)gmail.com

1 0

ACI module
by Brian Empson 14 Oct '12

14 Oct '12

Is it possible to load ACI support as a module? It would really help when installing from a precompiled package, all of which seem to turn off this very powerful feature. (I really like it anyway)

2 1

MDB Status
by Howard Chu 13 Oct '12

13 Oct '12

For those who haven't been following along, support for OpenLDAP's MDB (memory-mapped database) library is also available for several other open source projects, including Cyrus SASL (sasldb mech), Heimdal Kerberos (hdb module), SQLite3, OpenDKIM, and MemcacheDB. A work-in-progress patch for Postfix is also available, with a final version coming soon. A backend for SQLite4 is also in the works. A port of Android (JellyBean) for the Motorola Droid4 using MDB/SQLite3 is in progress (since my current phone is a Droid4). Other projects are also in progress and will be announced in the near future. The current list is also posted on http://highlandsun.com/hyc/mdb/ - feel free to suggest other projects. OpenLDAP MDB completely outclasses other embedded databases (like Oracle BerkeleyDB, Google LevelDB, SQLite, Kyoto Cabinet) from every angle: performance, efficiency, reliability, administrative ease, simplicity, whatever. With MDB not only have we made the world's fastest LDAP server even faster, but we can also make anything else that uses a database even better. I'll also be presenting an updated talk on MDB at LinuxCon Europe in Barcelona, November 7. http://events.linuxfoundation.org/events/linuxcon-europe/schedule -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

How indexes used with search
by Roman Rybalko 13 Oct '12

13 Oct '12

I'd like to understand how indexes are used with search. I've found some info http://www.openldap.org/doc/admin24/tuning.html#Understanding how a search works <http://www.openldap.org/doc/admin24/tuning.html#Understanding%20how%20a%20s…> but that's not very precise. Suppose there is a search like (&(attr1=value1)(attr2=value2)), attr1 and attr2 are indexed. As far as I understand, this search fetches objectIDs from the index on attr1, than the objectIDs from the index on attr2, than, according to operation "and" ("&"), objectIDs that present in BOTH sets are determined (using some set-intersection algorithm). When the search is "or" (|(...)(...)), the objectIDs from both sets are joined and duplicates are removed (using some set-union algorithm). If there is no index on attribute, the resulting objectID set is determined by bare iterate-and-compare on all the objects, or so. Am I right? Could anyone advice some docs on this? -- WBR, Roman Rybalko

3 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical