openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Search response attribute/alias names
by Tele Fone 22 Oct '12

22 Oct '12

Hello, I've searched and think I know the answer, but... This post from several years ago is exactly my issue: www.openldap.org/its/?findid=787 See this one too: www.openldap.org/lists/openldap-software/200105/msg00160.html I would like to know if anything has changed in 10+ years. I'm in the middle of coverting from Critical Path LDAP to OpenLDAP 2.4.26. Critical Path returns the alias name (when requested in search) in search responses. Has there been a magic configuration flag added to make the transition to openldap a bit easier? I understand that openLDAP conforms to the LDAPv3 standard, but had to ask. Thanks.

1 0

ContextCSN generation
by Sven Jourgensen 22 Oct '12

22 Oct '12

I have an odd issue, where I have some new slaves that I added to my pool, they ran fine sync'ing with the master, etc. for weeks, until I added them into use (we're using an F5 frontend) whereupon they started getting a contextCSN which was larger than that of the master. How is the contextCSN generated, I thought the slave could never get ahead of the master, but it's happening consistently, it's not a transient thing, the slave gets a larger contextCSN and keeps it, until the master is updated again. master: contextCSN: 20121010154339.775633Z#000000#000#000000 slave1: contextCSN: 20121010154442.858054Z#000000#000#000000 slave2: contextCSN: 20121010154351.807575Z#000000#000#000000 As soon as I remove them from use, and update the master, they come back into sync. Thanks in advance. SJ

3 4

LDAP Architecture for CardDAV/OpenLDAP interface
by Nicolas Mora 21 Oct '12

21 Oct '12

Hello, I'm using both an OpenLDAP server and an owncloud server, both for different but convergent purposes. The OpenLDAP manages an addressbook that is used by all mail client (Thunderbird, Horde, etc.), and the owncloud server also manages an addressbook for phone numbers, addresses and stuff, this one is a CardDAV one with VCard files. My goal is to converge these 2 different back-ends into one, all the data would be stored in the LDAP server. I did some research about how to do it and I have some clue that I would like to submit to you for feedbacks. The first interrogation is about the VCard/LDAP interface. After studying the VCard format and the different LDAP schemas, mostly RFC 6350 and 2256 and the schema files in the OpenLDAP conf folder in a Debian Stable server. I think that a new schema would do the connection. All the VCard properties can be easily linked to an existing person or inetOrgPerson or another *person objectClass. And the properties that doesn't exist yet are to be created in a schema extension. Also, one or two additional properties fields per property are to be created for the VCard parameters. Actually, there are different objectClass that might be extended: person, inetOrgPerson, organizationalPerson and residentialPerson. Considering that inetOrgPerson, organizationalPerson and residentialPerson are designed for specific purposes, I think that extending the person objectClass would be the best guess, what do you think ? The second question is more about the OpenLDAP configuration to handle this need. Right now, the OpenLDAP server is only used by me as an addressbook and an authentication server, the directory looks like this: dc=babelouest,dc=org | |-ou=addressbook | | | |-cn=Address1 | |-cn=Address2 | |-[...] | |-ou=users | | | |-uid=user1 | |-uid=user2 | |[...] I would like to add another branch to allow users to add their own addressbook entries, these entries would be in read/write mode only for the owner, no one else but him should have access. The new directory would look like this: dc=babelouest,dc=org | |-ou=addressbook (global, read-only for all users) | | | |-cn=Address1 | |-cn=Address2 | |-[...] | |-ou=users | | | |-uid=user1 | |-uid=user2 | |[...] | |-ou=personnalAddressbooks (personnal addressbook entries) | | | |-uid=user1 | | | | | |-cn=Address1 | | |-cn=Address2 | | |-cn=Address3 | | | |-uid=user2 | | | | | |-cn=Address1 | | |-cn=Address2 I took a look at the Access control help page but I couldn't find how to properly set the OpenLDAP configuration like this. Can you help me configuring the slapd.conf ? Thanks in advance. /Nicolas

2 1

Dynamic configuration / admin users
by Simon Walter 20 Oct '12

20 Oct '12

Greetings, First off, I'm sorry if this is the wrong place to ask this. Please direct me to the appropriate list. Here goes with the n00b questions: Debian Squeeze is using the dynamic configuration. While I am sure there are benefits, all the documentation is for static configuration (slapd.conf). I've got a basic tree up and running and several services are using it no problem. There are several things I'd like to do, like replication. For this and some other services, SOGo for example, that don't bind anonymously, I'd like to create some more users for this. I could be mistaken, but perhaps they need some kind of admin privileges. If not, that means that any user can modify anything in the tree. I see various information about ACI and ACL and access.conf. I can't find clear documentation about how any of this relates to dynamic configurations. To conclude, how do I add additional users to a dynamic configured openldap tree and configure those users with specific access permissions? Thank you, Simon

3 3

Mirror mode replication problem
by cbulist 19 Oct '12

19 Oct '12

Hi, We have configured 2 server with openldap 2.4.23-26 version and everything is working well (ppolicy,acl etc). We implemented replication in mirror mode and it is working well. When we add/delete/modify something in serverID 1 it sync the data to serverID2 without problem but when we add/delete/modify in serverID 2 it is not sync to serverID 1. We tried to stop openldap server1 then make changes on server2 and start server 1 again in order to get the changes from server2 but it did not work. According to 2.4 guide: "When a crashed provider is repaired and restarted it will automatically catch up to any changes on the running provider and resync". We appreciate any help to try fix this problem. Thanks in advance! This is the relevant configuration directives: #Server 1 overlay syncprov syscprov-checkpoint 100 10 syscprov-sessionlog 100 serverID 1 syncrepl rid=001 provider=ldap://server2:389 bindmethod=simple binddn="cn=Manager,dc=sample,dc=com" credentials=secret searchbase="dc=sample,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #Server 2 overlay syncprov syscprov-checkpoint 100 10 syscprov-sessionlog 100 serverID 2 syncrepl rid=001 provider=ldap://server1:389 bindmethod=simple binddn="cn=Manager,dc=sample,dc=com" credentials=secret searchbase="dc=sample,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on

2 2

SSL/TLS issue
by Darouichi, Aziz 19 Oct '12

19 Oct '12

Hi, I am running Openldap-2.4.32, BD-5.3.21 and openssl-1.0.1c on RHEL 5.5. I created CA cert and singed it but when I run ldeapsearch with -ZZ I get the following error: TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 19, subject: /C=US/ST=Mass/O=Curry College/OU=Technology Center/CN=LDAP-SSL.curry.edu/emailAddress=adarouic@curry.edu, issuer: /C=US/ST=Mass/O=Curry College/OU=Technology Center/CN=LDAP-SSL.curry.edu/emailAddress=adarouic@curry.edu TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Please let me know if I missed something in my configuration. Thanks, Aziz

4 8

Virtual view of ldap subtree
by Marco Pizzoli 19 Oct '12

19 Oct '12

1 0

ldapsearch agains Tivoli Directory Server
by Alejandro Rodriguez Luna 18 Oct '12

18 Oct '12

Hi all! I have a TDS (Tivoli Directory Server) in one of my servers, every time i need to query it i need to go to another server and do it, i'd like to be able to query from my machine, but i can't using openldap, do you guys have a hint/idea/clue?? i use this from another server idsldapsearch -h ldapserver.homeluna.org -Z -K /opt/PolicyDirector/ssl/homeluna.kdb -P passw0rd -b "" -s base objectclass=* btw, My servers only accepts SSL conections. btw, i put the following values inside /etc/openldap/ldap.conf without succeed. # # LDAP Defaults # BASE l=world URI ldap://ldapserver.homeluna.org ldap://ldapserver.homeluna.org:636 PORT 636 TLS_CACERT /home/alexrl/Desktop/ldapserver.homeluna.org.cer TLS_REQCERT demand alexrl@localhost ~ $ ldapsearch -v -H ldaps://ldapserver.homeluna.org -Dcn=root -w passw0rd -bl=world uid=alex* ldap_initialize( ldaps://ldapserver.homeluna.org:636/??base ) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) ---------------------------------- Alejandro Rodriguez Luna E-mail: el_alexluna(a)yahoo.com.mx ----------------------------------

2 1

Generated fields from static rules ?
by Yoann Gini 17 Oct '12

17 Oct '12

Hello, I’m new on this list. I actually try to configure a LDAP server to manage my identities (and use Kerberos as authentication backend). In my goal, I want to minimize information that need to be set by administrator to create entry. Here is a basic example : dn: uid=yoann,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: posixAccount cn: Yoann Gini gidNumber: 20 homeDirectory: /home/users/yoann sn: Gini uid: yoann uidNumber: 2000 givenName: Yoann loginShell: /usr/local/bin/zsh mail: yoann(a)example.com userPassword: {SASL}yoann(a)EXAMPLE.COM As you can see, they have many redundant informations… What I looking for is a way to fix some field for posixAccount or *,ou=people,dc=example,dc=com. For example, userPassword should be construct with a static text, a ldap entry and a global variable… {SASL}$uid$#KRB_REALM#. Like the mail : $uid$#domain# If you have any suggestion :-) Yoann

2 2

Re: mdb_stat question
by Roman Rybalko 17 Oct '12

17 Oct '12

17.10.2012 04:19, Howard Chu пишет: > Have a look at mdb_stat in git mdb.master commit > 617769bce5bcac809791adb11301e40d27c31566 > > Use options -e and -f, that should give you everything you want. > Feedback appreciated, I doubt this is its final form yet. > Thanks! Nice tool! But how would I determine storage usage percent? ((Number of pages used)-(Free pages))/(Max pages)*100 or just (Number of pages used)/(Max pages)*100 ? I mean is there possible a situation when (Number of pages used)==(Max pages) and (Free pages)!=0 ? root@log:~# mdb_stat -e /mnt/data/ldap/2 Environment Info Map address: (nil) Map size: 15032385536 Page size: 4096 Max pages: 3670016 Number of pages used: 1042935 Last transaction ID: 2802459 Max readers: 126 Number of readers used: 18 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 12 root@log:~# mdb_stat -f /mnt/data/ldap/2 Freelist Status Tree depth: 3 Branch pages: 7 Leaf pages: 673 Overflow pages: 1 Entries: 2745 Free pages: 140824 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 12 root@log:~# -- WBR, Roman Rybalko

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical