openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

dynlist, memberof,and authentication
by Richard Pijnenburg 28 Sep '12

28 Sep '12

Hi all, I've created a group with the dynlist overlay to create dynamic groups. Now i want to implement authentication with it but seem to be unable to search on it with nss-pam-lib or sssd. Before i start configuring all that stuff i wanted to see what search/filter string i need to make and been playing around to get the member. When i search with base the dynamic group i get all the members/ # ldapsearch -x -b 'cn=prod,ou=isp,ou=acl,dc=ispavailability,dc=com' dn: cn=prod,ou=isp,ou=acl,dc=ispavailability,dc=com objectClass: groupOfURLs cn: prod memberURL: ldap:///cn=sysadmin,ou=isp,ou=groups,dc=ispavailability,dc=com?memb er?sub? member: uid=richard,ou=people,dc=ispavailability,dc=com So i thought i'll create a search string for the cn and the member. # ldapsearch -x '(&(cn=prod)(member=uid=richard,ou=people,dc=ispavailability,dc=com))' And i get nothing.... So i thought about using the memberof overlay with it. # ldapsearch -x uid=richard memberof I get the static group trough the memberof overlay but not the dynamic group. Am i missing something or am i trying to do something that's simply not possible? Cheers. Richard

3 3

Implementing ACL, using non-local groups
by Tio Teath 27 Sep '12

27 Sep '12

Is it possible to implement ACL, using groups which are accessed via ldap-proxy, i.e. non-local groups? I've managed to setup authentication for users, which are in remote LDAP server only, but looks like remote groups are ignored in case of using 'group.exact=' statement.

2 1

(no subject)
by Tio Teath 27 Sep '12

27 Sep '12

1 0

Re: nslcd and Ubuntu 10.04
by Adam Wolfe 27 Sep '12

27 Sep '12

Many thanks, Christopher. I'm on nslcd 0.7.2 right now. Definitely a place to start. Very appreciated. Christopher Wood <christopher_wood(a)pobox.com> wrote: >http://ubuntuforums.org/showthread.php?t=1633524 > >http://lists.arthurdejong.org/nss-pam-ldapd-users/2011/msg00082.html > >My fix was to "apt-get source nslcd" on a Debian Squeeze box, then use those files to build a new deb on Ubuntu and shove the result in my repository. Presto, working nslcd on Ubuntu 10.04. > >On Wed, Sep 26, 2012 at 04:46:30PM -0400, Adam Wolfe wrote: >> I'm having trouble keeping my servers connected to our openLDAP server. >> >> All through syslog I see messages like this: >> >> Sep 26 14:06:01 hostname nslcd[930]: [2aeb87] connected to LDAP server >> [1]ldaps://ldap.domain.com/ >> Sep 26 14:07:01 hostname nslcd[930]: [aae0a3] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [74310e] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [aae0a3] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [b2a65f] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [b2a65f] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [74310e] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] connected to LDAP server >> [2]ldaps://ldap.domain.com/ >> >> I'm at the point where I want to start blaming the server, but this is >> happening on all the new servers I am bringing up (Ubuntu 10.04) and not >> on the older servers (8.04). >> Everything seems fine and we can sudo and su with our ldap accounts and >> then out of no where "so-and-so is not in the sudoers file". A simple "id >> user" re-establishes the connection and all is well again for a while. >> >> Has anyone else ran into this and finally, permanently made it work? >> >> References >> >> Visible links >> 1. file:///tmp/ldaps:/ldap.domain.com/ >> 2. file:///tmp/ldaps:/ldap >

2 1

LDAP URI
by Emmanuel Dreyfus 26 Sep '12

26 Sep '12

Hi When feeding a LDAP URI to ldap_url_parse(), I understand some characters may need to be escaped in filters in order to get a litteral: * => \2a ( => \28 ) => \29 \ => \5c / => \2f Reading the man page, I understand %-encoding is not mandatory, but it is of course required for ?, and obviously for %. ? -> %3F % -> %25 Are there other characters that should be %-encoded? -- Emmanuel Dreyfus manu(a)netbsd.org

6 12

Re: Ldap search that must work
by Amol Kulkarni 26 Sep '12

26 Sep '12

Hi, I had faced similar issue once - the cause was the index on the attribute was corrupt. Reindexing solved the issue. In your case, reindexing the uidnumber attribute should solve the issue. Amol. ----- Original Message ----- From: Aitor Garcia Ortega - Tempel.es Sent: 09/26/12 05:24 PM To: openldap-technical(a)openldap.org Subject: Ldap search that must work I'm feeling som kind of stupid I'm running openldap-servers-2.4.23-26.el6_3.2.x86_64 under Centos 6.3. Using ldapsearch I get this result: ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uid=aitiddnet)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uid=aitiddnet) > # requesting: ALL > # > > # aitiddnet, People, Iddover, Net > dn: uid=aitiddnet,ou=People,o=Iddover,c=Net > uid: aitiddnet > cn: Aitor Garcia Ortega - Iddover.net > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: inetLocalMailRecipient > userPassword:: ************** > shadowLastChange: 14363 > shadowMax: 99999 > shadowWarning: 7 > uidNumber: 546 > gidNumber: 546 > gecos: Aitor Garcia Ortega - Iddover.net > mailLocalAddress: aitor.garcia(a)iddover.net > mailHost: localhost > homeDirectory: /home/aitiddnet > loginShell: /bin/bash > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 But this seconf ldap serch don't work # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uidNumber=546) > # requesting: ALL > # > > # search result > search: 2 > result: 0 Success I really don't undertand. In another server with CentOS release 5.6 (Final), openldap-servers-2.3.43-12.el5_6.7 and the same database it works well... # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@r300te1 ~]# ldapsearch -h 172.16.6.1 -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # aitiddnet, People, Iddover, Net dn: uid=aitiddnet,ou=People,o=Iddover,c=Net uid: aitiddnet cn: Aitor Garcia Ortega - Iddover.net objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetLocalMailRecipient userPassword:: ***************** shadowLastChange: 14363 shadowMax: 99999

2 1

slapd: do_syncrepl: rid=010 rc -2 retrying (4 retries left)
by Roman Rybalko 26 Sep '12

26 Sep '12

slapd[21334]: do_syncrepl: rid=010 rc -2 retrying (4 retries left) olcSyncrepl: {0}rid=010 provider=ldap://ldap binddn="cn=config" bindmethod=simple credentials=XXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 slapd-2.4.23 on master & slave This happens when the slave server is restarted. If make some change to cn=config, then the error disappear. I didn't find any explanation about rc -2. What this is about? -- WBR, Roman Rybalko

1 0

TLS error on startup
by Brian Empson 26 Sep '12

26 Sep '12

Hello, I'm having an issue starting up slapd with TLS enabled. I tried to search for the error code but I couldn't find any GnuTLS error codes that match. Here are the log entries that appear: Sep 25 21:07:05 dir0 slapd[15018]: main: TLS init def ctx failed: -1 Sep 25 21:07:05 dir0 slapd[15018]: DIGEST-MD5 common mech free Sep 25 21:07:05 dir0 slapd[15018]: slapd stopped. Sep 25 21:07:05 dir0 slapd[15018]: connections_destroy: nothing to destroy. Is there a way to check and see if this build is enabled with TLS support? I installed it from a package manager rather than compiling it. Here are the TLS portions of the config: # SSL TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ssl/ca.pem TLSCertificateFile /etc/openldap/ssl/server.pem TLSCertificateKeyFile /etc/openldap/ssl/server.key TLSVerifyClient demand Here are the files listed: (I changed the permissions during troubleshooting) [09/25/12 9:16PM][root@dir0 /etc/openldap]# ls -lah ssl total 12 drw------- 2 _openldap _openldap 512B Sep 25 19:59 . drwxr-xr-x 4 root wheel 512B Sep 25 19:54 .. -rwxrwxrwx 1 _openldap _openldap 3B Sep 25 20:08 digits.srl -rwxrwxrwx 1 _openldap _openldap 887B Sep 25 19:56 server.key -rwxrwxrwx 1 _openldap _openldap 904B Sep 25 20:08 server.pem -rwxrwxrwx 1 _openldap _openldap 684B Sep 25 19:57 server.req [09/25/12 9:16PM][root@dir0 /etc/openldap]# ls -lah /etc/ssl total 170 drwxr-xr-x 4 root wheel 512B Sep 25 19:52 . drwxr-xr-x 27 root wheel 2.5K Sep 24 20:50 .. -rw-r--r-- 1 root wheel 912B Sep 23 16:30 ca.crt -rw-r--r-- 1 root wheel 912B Sep 25 19:52 ca.pem -rw-r--r-- 1 root wheel 17B Sep 23 17:51 ca.srl -r--r--r-- 1 root bin 147K Feb 12 2012 cert.pem drwxr-xr-x 2 root wheel 512B Feb 12 2012 lib -r--r--r-- 1 root bin 1.6K Feb 12 2012 openssl.cnf drwx------ 2 root wheel 512B Sep 23 16:29 private -rw-r--r-- 1 root wheel 1.0K Sep 25 19:52 privkey.pem -r--r--r-- 1 root bin 1005B Feb 12 2012 x509v3.cnf Is this an issue with the build I'm running? (SSL not enabled or?) Thanks! Brian

4 3

Ldap search that must work
by Aitor Garcia Ortega - Tempel.es 26 Sep '12

26 Sep '12

I'm feeling som kind of stupid I'm running openldap-servers-2.4.23-26.el6_3.2.x86_64 under Centos 6.3. Using ldapsearch I get this result: ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uid=aitiddnet)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uid=aitiddnet) > # requesting: ALL > # > > # aitiddnet, People, Iddover, Net > dn: uid=aitiddnet,ou=People,o=Iddover,c=Net > uid: aitiddnet > cn: Aitor Garcia Ortega - Iddover.net > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: inetLocalMailRecipient > userPassword:: ************** > shadowLastChange: 14363 > shadowMax: 99999 > shadowWarning: 7 > uidNumber: 546 > gidNumber: 546 > gecos: Aitor Garcia Ortega - Iddover.net > mailLocalAddress: aitor.garcia(a)iddover.net > mailHost: localhost > homeDirectory: /home/aitiddnet > loginShell: /bin/bash > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 But this seconf ldap serch don't work # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uidNumber=546) > # requesting: ALL > # > > # search result > search: 2 > result: 0 Success I really don't undertand. In another server with CentOS release 5.6 (Final), openldap-servers-2.3.43-12.el5_6.7 and the same database it works well... # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@r300te1 ~]# ldapsearch -h 172.16.6.1 -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # aitiddnet, People, Iddover, Net dn: uid=aitiddnet,ou=People,o=Iddover,c=Net uid: aitiddnet cn: Aitor Garcia Ortega - Iddover.net objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetLocalMailRecipient userPassword:: ***************** shadowLastChange: 14363 shadowMax: 99999

1 0

ldapsearch stalling when performing searches with a large number of results
by Mark Cairney 25 Sep '12

25 Sep '12

Hi, I've been finding that ldapsearch will freeze when performing searches with a large (typically >10,000) number of results. As far as I can tell this does not appear to be related to server load as according to iostat and top the servers don't appear to be stressed and the servers continue to respond to incoming requests. I'm running OpenLDAP 2.4.30 with BDB 4.8.30 in multi-master mode with syncrepl if this makes any difference. I have tried upgrading to 2.4.32 but this appears to be exhibiting the same behaviour. In terms of the size of the database I've got about 300,000 entries and my bdb database files are currently taking up 5.6G. The servers themselves are 4xquad-cores with 24GB RAM. Has anyone else seen this behaviour or should I file an ITS? /**************************** Mark R Cairney ITI UNIX Section Information Services Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk ****************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical