openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

Re: nslcd and Ubuntu 10.04
by Adam Wolfe 27 Sep '12

27 Sep '12

Many thanks, Christopher. I'm on nslcd 0.7.2 right now. Definitely a place to start. Very appreciated. Christopher Wood <christopher_wood(a)pobox.com> wrote: >http://ubuntuforums.org/showthread.php?t=1633524 > >http://lists.arthurdejong.org/nss-pam-ldapd-users/2011/msg00082.html > >My fix was to "apt-get source nslcd" on a Debian Squeeze box, then use those files to build a new deb on Ubuntu and shove the result in my repository. Presto, working nslcd on Ubuntu 10.04. > >On Wed, Sep 26, 2012 at 04:46:30PM -0400, Adam Wolfe wrote: >> I'm having trouble keeping my servers connected to our openLDAP server. >> >> All through syslog I see messages like this: >> >> Sep 26 14:06:01 hostname nslcd[930]: [2aeb87] connected to LDAP server >> [1]ldaps://ldap.domain.com/ >> Sep 26 14:07:01 hostname nslcd[930]: [aae0a3] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [74310e] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [aae0a3] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [b2a65f] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [b2a65f] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [74310e] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] connected to LDAP server >> [2]ldaps://ldap.domain.com/ >> >> I'm at the point where I want to start blaming the server, but this is >> happening on all the new servers I am bringing up (Ubuntu 10.04) and not >> on the older servers (8.04). >> Everything seems fine and we can sudo and su with our ldap accounts and >> then out of no where "so-and-so is not in the sudoers file". A simple "id >> user" re-establishes the connection and all is well again for a while. >> >> Has anyone else ran into this and finally, permanently made it work? >> >> References >> >> Visible links >> 1. file:///tmp/ldaps:/ldap.domain.com/ >> 2. file:///tmp/ldaps:/ldap >

2 1

LDAP URI
by Emmanuel Dreyfus 26 Sep '12

26 Sep '12

Hi When feeding a LDAP URI to ldap_url_parse(), I understand some characters may need to be escaped in filters in order to get a litteral: * => \2a ( => \28 ) => \29 \ => \5c / => \2f Reading the man page, I understand %-encoding is not mandatory, but it is of course required for ?, and obviously for %. ? -> %3F % -> %25 Are there other characters that should be %-encoded? -- Emmanuel Dreyfus manu(a)netbsd.org

6 12

Re: Ldap search that must work
by Amol Kulkarni 26 Sep '12

26 Sep '12

Hi, I had faced similar issue once - the cause was the index on the attribute was corrupt. Reindexing solved the issue. In your case, reindexing the uidnumber attribute should solve the issue. Amol. ----- Original Message ----- From: Aitor Garcia Ortega - Tempel.es Sent: 09/26/12 05:24 PM To: openldap-technical(a)openldap.org Subject: Ldap search that must work I'm feeling som kind of stupid I'm running openldap-servers-2.4.23-26.el6_3.2.x86_64 under Centos 6.3. Using ldapsearch I get this result: ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uid=aitiddnet)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uid=aitiddnet) > # requesting: ALL > # > > # aitiddnet, People, Iddover, Net > dn: uid=aitiddnet,ou=People,o=Iddover,c=Net > uid: aitiddnet > cn: Aitor Garcia Ortega - Iddover.net > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: inetLocalMailRecipient > userPassword:: ************** > shadowLastChange: 14363 > shadowMax: 99999 > shadowWarning: 7 > uidNumber: 546 > gidNumber: 546 > gecos: Aitor Garcia Ortega - Iddover.net > mailLocalAddress: aitor.garcia(a)iddover.net > mailHost: localhost > homeDirectory: /home/aitiddnet > loginShell: /bin/bash > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 But this seconf ldap serch don't work # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uidNumber=546) > # requesting: ALL > # > > # search result > search: 2 > result: 0 Success I really don't undertand. In another server with CentOS release 5.6 (Final), openldap-servers-2.3.43-12.el5_6.7 and the same database it works well... # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@r300te1 ~]# ldapsearch -h 172.16.6.1 -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # aitiddnet, People, Iddover, Net dn: uid=aitiddnet,ou=People,o=Iddover,c=Net uid: aitiddnet cn: Aitor Garcia Ortega - Iddover.net objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetLocalMailRecipient userPassword:: ***************** shadowLastChange: 14363 shadowMax: 99999

2 1

slapd: do_syncrepl: rid=010 rc -2 retrying (4 retries left)
by Roman Rybalko 26 Sep '12

26 Sep '12

slapd[21334]: do_syncrepl: rid=010 rc -2 retrying (4 retries left) olcSyncrepl: {0}rid=010 provider=ldap://ldap binddn="cn=config" bindmethod=simple credentials=XXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 slapd-2.4.23 on master & slave This happens when the slave server is restarted. If make some change to cn=config, then the error disappear. I didn't find any explanation about rc -2. What this is about? -- WBR, Roman Rybalko

1 0

TLS error on startup
by Brian Empson 26 Sep '12

26 Sep '12

Hello, I'm having an issue starting up slapd with TLS enabled. I tried to search for the error code but I couldn't find any GnuTLS error codes that match. Here are the log entries that appear: Sep 25 21:07:05 dir0 slapd[15018]: main: TLS init def ctx failed: -1 Sep 25 21:07:05 dir0 slapd[15018]: DIGEST-MD5 common mech free Sep 25 21:07:05 dir0 slapd[15018]: slapd stopped. Sep 25 21:07:05 dir0 slapd[15018]: connections_destroy: nothing to destroy. Is there a way to check and see if this build is enabled with TLS support? I installed it from a package manager rather than compiling it. Here are the TLS portions of the config: # SSL TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ssl/ca.pem TLSCertificateFile /etc/openldap/ssl/server.pem TLSCertificateKeyFile /etc/openldap/ssl/server.key TLSVerifyClient demand Here are the files listed: (I changed the permissions during troubleshooting) [09/25/12 9:16PM][root@dir0 /etc/openldap]# ls -lah ssl total 12 drw------- 2 _openldap _openldap 512B Sep 25 19:59 . drwxr-xr-x 4 root wheel 512B Sep 25 19:54 .. -rwxrwxrwx 1 _openldap _openldap 3B Sep 25 20:08 digits.srl -rwxrwxrwx 1 _openldap _openldap 887B Sep 25 19:56 server.key -rwxrwxrwx 1 _openldap _openldap 904B Sep 25 20:08 server.pem -rwxrwxrwx 1 _openldap _openldap 684B Sep 25 19:57 server.req [09/25/12 9:16PM][root@dir0 /etc/openldap]# ls -lah /etc/ssl total 170 drwxr-xr-x 4 root wheel 512B Sep 25 19:52 . drwxr-xr-x 27 root wheel 2.5K Sep 24 20:50 .. -rw-r--r-- 1 root wheel 912B Sep 23 16:30 ca.crt -rw-r--r-- 1 root wheel 912B Sep 25 19:52 ca.pem -rw-r--r-- 1 root wheel 17B Sep 23 17:51 ca.srl -r--r--r-- 1 root bin 147K Feb 12 2012 cert.pem drwxr-xr-x 2 root wheel 512B Feb 12 2012 lib -r--r--r-- 1 root bin 1.6K Feb 12 2012 openssl.cnf drwx------ 2 root wheel 512B Sep 23 16:29 private -rw-r--r-- 1 root wheel 1.0K Sep 25 19:52 privkey.pem -r--r--r-- 1 root bin 1005B Feb 12 2012 x509v3.cnf Is this an issue with the build I'm running? (SSL not enabled or?) Thanks! Brian

4 3

Ldap search that must work
by Aitor Garcia Ortega - Tempel.es 26 Sep '12

26 Sep '12

I'm feeling som kind of stupid I'm running openldap-servers-2.4.23-26.el6_3.2.x86_64 under Centos 6.3. Using ldapsearch I get this result: ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uid=aitiddnet)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uid=aitiddnet) > # requesting: ALL > # > > # aitiddnet, People, Iddover, Net > dn: uid=aitiddnet,ou=People,o=Iddover,c=Net > uid: aitiddnet > cn: Aitor Garcia Ortega - Iddover.net > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: inetLocalMailRecipient > userPassword:: ************** > shadowLastChange: 14363 > shadowMax: 99999 > shadowWarning: 7 > uidNumber: 546 > gidNumber: 546 > gecos: Aitor Garcia Ortega - Iddover.net > mailLocalAddress: aitor.garcia(a)iddover.net > mailHost: localhost > homeDirectory: /home/aitiddnet > loginShell: /bin/bash > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 But this seconf ldap serch don't work # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uidNumber=546) > # requesting: ALL > # > > # search result > search: 2 > result: 0 Success I really don't undertand. In another server with CentOS release 5.6 (Final), openldap-servers-2.3.43-12.el5_6.7 and the same database it works well... # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@r300te1 ~]# ldapsearch -h 172.16.6.1 -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # aitiddnet, People, Iddover, Net dn: uid=aitiddnet,ou=People,o=Iddover,c=Net uid: aitiddnet cn: Aitor Garcia Ortega - Iddover.net objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetLocalMailRecipient userPassword:: ***************** shadowLastChange: 14363 shadowMax: 99999

1 0

ldapsearch stalling when performing searches with a large number of results
by Mark Cairney 25 Sep '12

25 Sep '12

Hi, I've been finding that ldapsearch will freeze when performing searches with a large (typically >10,000) number of results. As far as I can tell this does not appear to be related to server load as according to iostat and top the servers don't appear to be stressed and the servers continue to respond to incoming requests. I'm running OpenLDAP 2.4.30 with BDB 4.8.30 in multi-master mode with syncrepl if this makes any difference. I have tried upgrading to 2.4.32 but this appears to be exhibiting the same behaviour. In terms of the size of the database I've got about 300,000 entries and my bdb database files are currently taking up 5.6G. The servers themselves are 4xquad-cores with 24GB RAM. Has anyone else seen this behaviour or should I file an ITS? /**************************** Mark R Cairney ITI UNIX Section Information Services Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk ****************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

3 2

Invalid Credentials when using ldappasswd
by Matej Mailing 25 Sep '12

25 Sep '12

Hi all, I have installed open LDAP utilities on Ubuntu 12.04 via apt-get install. I have version 2.4.28-1.1ubuntu4 installed. I can connect successully to the LDAP via phpldapadmin with login cn=admin,dc=mydomain,dc=net and my administrator password. I want to create an administrator for the SOGo login with the following ldif file: "dn: ou=accounts,dc=domain,dc=net objectClass: organizationalUnit ou: accounts dn: uid=adminsogo,ou=accounts,dc=domain,dc=net objectClass: top objectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson uid: adminsogo cn: SOGo Administrator mail: sogo(a)domain.net sn: Administrator givenName: SOGAdmin " When running ldapadd -f admin.ldif -x -W -D cn=admin,dc=domain,dc=net and after entering the administrator password (the same I use to log-in into phpldapadmin), I get: "adding new entry "ou=accounts,dc=domain,dc=net" adding new entry "uid=sogadmin,ou=accounts,dc=domain,dc=net" I assume that everything is OK at this point. The problem is when I enter: ldappasswd -h localhost -x -W -D cn=admin,dc=domain,dc=net,uid=sogadmin,ou=accounts,dc=domain,dc=net -s newpass I have to enter the LDAP password and I enter my administrator password, but always get the output: "ldap_bind: Invalid credentials (49)" When doing "dapsearch -x -h localhost -b "dc=domain,dc=net" -s sub "objectclass=*"" I can see that an object sogadmin is created: "..... dn: uid=adminsogo,ou=accounts,dc=domain,dc=net objectClass: top objectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson uid: adminsogo cn: SOGo Administrator mail: sogo(a)domain.net sn: Administrator givenName:: U09HQWRtaW4g ..." What should I check to get past this "ldap_bind: Invalid credentials (49)" when trying to ldappasswd of a new user? I am pretty sure this must be some basic thing, but I am really a beginner in the LDAP field .. I have spent few days already trying to solve this and any help will be very appreciated. Thanks for any ideas in advance. Regards, Matej

2 2

slapd: way of configuration
by Tobias Hachmer 24 Sep '12

24 Sep '12

Hello list, I want to know what the recommended way is to configure slapd. I'm using openldap package 2.4.28 under ubuntu precise. As default there is no /etc/ldap/slapd.conf and the whole configuration is located under /etc/ldap/slapd.d/ in ldif format. 1. Must I use ldapmodify to change slapd configuration in cn=config backend or can I just change configuration directives directly in the appropriate ldif file under /etc/ldap/slapd.d/cn=config/* ? If the latter, have I to restart slapd after configuration changes? 2. Will the old school way to configure slapd via slapd.conf be deprecated and not available at all in future? Thanks and kind regards, Tobias Hachmer

6 8

Mac Ldap Client login problem
by cbulist 24 Sep '12

24 Sep '12

Hi, I'm trying to configure a Mac client(OS X 10.7.2) with my Openldap server (2.4.23). I configured Directory Utility with my LDAPv3 support and see that Network Account Server on green status. After that I can do: su <username> or id <username> in terminal and I'm able to login or view the data of the user. The problem is when I reset the Mac and I try to login from the initial GUI login screen it does not permit me. I checked the openldap server log and I see the requested without any error. Do I have to do something in Mac's PAM file? I really appreciate any help with this problem. Thanks in advance.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical