openldap-technical

openldap-technical@openldap.org

9804 discussions

modify search base dn depending on search filter
by Robert Eikermann 01 Aug '12

01 Aug '12

Hi, can please someone give me a hint, how to change the search base dn depending on the search filter. If someone searches "cn=a@b" at a fixed base like dc=local I want to rewrite this search to cn=a with search base "dc=b,dc=local" Thanks for help Robert

2 1

ACL to replicate a single value of an attribute
by Andrei BĂNARU 01 Aug '12

01 Aug '12

Hi, Is it possible to create an ACL entry that will allow only the first value of an attribute to be read ( an example would be nice ) ? For example having userPassword with a first value using MD5 hashing and a second value as plain text. We plan on replicating that object but we don't want to include the plain text value of the attribute userPassword. Using another attribute to store the user's password is out of the question. We need to add plain text passwords for some users in a country that use Active Directory ( AD password sync ). Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

2 1

Issue with dynlist overlay
by Patrick Hemmer 31 Jul '12

31 Jul '12

So I just ran across an undocumented issue with slapo-dynlist. I'm not sure if this is a bug, or just missing in the documentation. The issue is that if the entry being dynamically added to the parent entry has the objectClass slapo-dynlist is configured to use, that entry is not dynamically added to the parent. For example: ---- olcOverlay=dynlist,olcdatabase=hdb,cn=config objectClass: olcDynamicList objectClass: olcOverlayConfig olcDlAttrSet: groupOfURLs memberUrl ---- dn: cn=parent,dc=example,dc=com objectClass: groupOfNames objectClass: groupOfURLs member: uid=foo,dc=example,dc=com memberUrl: ldap:///cn=child,dc=example,dc=com dn: cn=child,dc=example,dc=com objectClass: groupOfNames objectClass: groupOfURLs member: uid=bar,dc=example,dc=com --- In the above example, I would "member: uid=bar,dc=example,dc=com" to be added to cn=parent,dc=example,dc=com, but it isn't. Now the documentation clearly states recursion is not allowed, so if cn=child were to have a 'memberUrl', this memberUrl would not be expanded. But this is not what is being done here, cn=child has no memberUrl present. It also behaves perfectly fine if I pull the "objetClass: groupOfURLs" off cn=child. So is this supposed to behave this way? If so can the documentation be updated to indicate this restriction? If not I'd be happy to open an ITS on the issue. -Patrick

2 5

Special characters in distinguished name
by chris_news＠arcor.de 30 Jul '12

30 Jul '12

Hello, are special characters, especially German umlauts, acceptable in the distinguished name? I've accidentally discovered that CPAN's Net::LDAP::Entry module doesn't support them (in the distinguished name). Other attributes are escaped correctly. Thank you in advance. Chris

5 5

Advice for distributing schemas for OpenLDAP
by ghudson＠mit.edu 30 Jul '12

30 Jul '12

MIT krb5 has an LDAP back end for its KDC, which uses its own schema. Currently, we distribute just a .schema file for OpenLDAP, which isn't very friendly to a DS using back-config and slapd.d. I have some questions about how we might do better. 1. For initial installs, I take it we should distribute a .ldif file which can be loaded with ldapadd. If we continue to use our .schema file as the master source file for the time being, then I assume we'll want to convert that to the .ldif file using slaptest. If we do that, should we remove the {n} prefix from the cn of the converted output, along with the metadata entries at the end, to match the style of the .ldif files in servers/slapd/schema? 2. If someone is upgrading to a version of krb5 which has new stuff added to the schema, how should we facilitate that upgrade? I don't think the .ldif file mentioned above would be of much use, since ldapadd will refuse to change an existing entry and ldapmodify wants to see change records. One option is to distribute an LDIF file with a bunch of idempotent modify operations to upgrade the schema. Looking at RFC 2849, I'm not sure you can idempotently create an LDAP entry with LDIF (so this input file couldn't be used for initial installs), but perhaps it's a viable option to bring the olc* attributes on an existing schema entry up to date. Has anyone done something like this before, and is there a good way to generate such an ldapmodify input file from either a .schema file or its attrval-record .ldif equivalent? Another option is to distribute delta LDIF files for each specific upgrade. That seems less friendly to OS packagers, who would then have to identify which upgrades to apply, but perhaps it's a better approach for reasons I don't know yet. If it is the best option, again, is there a good way to generate such delta LDIF files automatically? Thanks for any advice, and apologies if I missed anything in the documentation or mailing list archives.

3 2

Translucent Proxy to filter users
by Joel Eidsath 30 Jul '12

30 Jul '12

Hello, I'm trying to use our corporate openldap server for authentication to an application server (Github Enterprise) that does not support any "memberof" filters for allowed users. As a workaround, I am looking into a translucent proxy server that would only return a subset of users. Github Enterprise would only "see" a few hundred users instead of thousands. Is this doable? Is there a better solution? Joel Eidsath

4 4

What will happen if there are two user with same uid in OpenLDAP server
by Qian Zhang 30 Jul '12

30 Jul '12

Hi, I have an OpenLDAP server setup, I am just wondering what will happen when I do login if there are two user in different OU but with same uid. I guess PAM is in flat mode, so when I login with the uid, I can always login as one of the two users, and have no chance to login as the other, right? If that is true, should I add a restriction that the uid of each user must be unique in the whole OpenLDAP server? Thanks, Qian

5 11

Re: slapo-chain on syncrepl slave. I simply can't get it working. Help??
by Gavin Henry 29 Jul '12

29 Jul '12

>> Remove your dn{} line. > > Sorry, which dn line do you mean? > > This? > > authzTo: {0}dn:* Yeah. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API news? http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api

3 6

slapo-chain on syncrepl slave. I simply can't get it working. Help??
by elekktretterr＠exemail.com.au 29 Jul '12

29 Jul '12

Hi, I've spent 2 days on this now and can't figure it out. Master directory (2.4.21 on FBSD 7, compiled with SASL) Slave (2.4.31 on Debian Squeeze) The goal is to eventually use TLS as both the servers are remote from one to another, but for the sake of simplicity during testing i'm not using TLS at this stage. RefreshAndPersist replication is setup and working Master config(not complete, but related parts): authz-policy to database bdb suffix cn=accesslog directory /db/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database bdb suffix "dc=webgate,dc=net,dc=au" rootdn "cn=Manager,dc=webgate,dc=net,dc=au" rootpw deleted password-hash {SSHA} directory /var/db/openldap-data mode 0600 cachesize 2000 # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=userPassword by self write by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by * auth access to dn.base="ou=zones,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=dns,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=zones,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=dns,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=emails,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=postfix,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=emails,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=postfix,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=users,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=users,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=groups,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=groups,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=virtualhosts,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=httpd,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=virtualhosts,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=httpd,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to * by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by users read by anonymous none by * none Slave config: overlay chain chain-uri ldap://xxx:389/ chain-rebind-as-user Yes chain-idassert-bind bindmethod="simple" binddn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" credentials="xxx" mode="self" chain-return-error Yes access to attrs=userPassword,shadowLastChange by anonymous auth by * none access to dn.base="" by * read access to * by * read # syncrepl directives syncrepl rid=0 provider=ldap://xxx:389 bindmethod=simple binddn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" credentials=deleted searchbase="dc=webgate,dc=net,dc=au" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://xxx cn=replicator contains: dn: cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au objectClass: top objectClass: inetOrgPerson cn: replicator sn: replicator userPassword:: xxx authzTo: {0}dn:* No matter what I change, when I run ldapmodify on slave ldapmodify -x -D "cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" -W -f test_update.ldif modifying entry "uid=xxx,ou=emails,dc=webgate,dc=net,dc=au" ldap_modify: Strong(er) authentication required (8) I run the server with -d 1 to see what's going on and it seems even if i change chain-idassert-bind binddn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" to anything that doesn't even exist in the directory it never gets used... The only thing that makes a difference from the chain-* directives is the chain-return-error Yes, setting it to "no" makes it return just the referral address What am I doing wrong??? Thanks Petr

2 3

RE24 testing call#3 (OpenLDAP 2.4.32)
by Quanah Gibson-Mount 27 Jul '12

27 Jul '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.32 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/ heads/OPENLDAP_REL_ENG_2_4;sf=tgz> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanaho -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical