openldap-technical

openldap-technical@openldap.org

9804 discussions

Re: RE24 testing call#3 (OpenLDAP 2.4.32)
by Neil Mcbennett 27 Jul '12

27 Jul '12

All good on Solaris 10 / SPARC On 27 July 2012 03:43, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.32 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/ > heads/OPENLDAP_REL_ENG_2_4;sf=tgz> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanaho > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: RE24 testing call#3 (OpenLDAP 2.4.32)
by devzero2000 27 Jul '12

27 Jul '12

On Fri, Jul 27, 2012 at 4:43 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.32 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/**devel/gitweb.cgi?p=openldap.** > git;a=snapshot;h=refs/<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/> > heads/OPENLDAP_REL_ENG_2_4;sf=**tgz> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > All good on RHEL 6.2/6.3 e serentos 6.2. > Thanks! > > --Quanaho > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

Openldap Problem
by Chris 27 Jul '12

27 Jul '12

Hi. I am using rhel 6.3, with sssd-1.8.0 and openldap-servers-2.4.23-26, the kernel is 2.6.32-279.2.1.el6.x86_64. The problem I'm having is I get this error message in messages file. "sssd[be[default]]: Could not start TLS encryption. TLS error -5938:Encountered end of file" I started sssd with debugging set to 9. Errors I saw in sssd_default.log is: [dp_get_options] (0x0400): Option ldap_sasl_minssf has value -1 [get_port_status] (0x1000): Port status of port 389 for server 'ibm-01.flamengro.co.za' is 'not working' When I add new users I cannot log in with the new names, a ldapseach shows them but getent passwd nothing. Not all the users show up on my other machines either. Any help will be appreciated. My slapd.conf file looks like this. /include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=flamengro,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=flamengro,dc=com" rootpw secret directory /var/lib/ldap/flamengro index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitoraccess to * by dn.exact="cn=Manager,dc=flamengro,dc=com" read by * none access to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none/ My sssd.conf file looks like this / [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = default [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 [domain/default] auth_provider = ldap cache_credentials = True ldap_id_use_start_tls = True debug_level = 9 ldap_search_base = dc=flamengro,dc=com # krb5_realm = EXAMPLE.COM chpass_provider = ldap id_provider = ldap ldap_uri = ldap://ibm-01.flamengro.co.za # krb5_kdcip = kerberos.example.com ldap_tls_cacertdir = /etc/openldap/cacerts enumerate = True ldap_sasl_canonicalize = true # krb5_server = kerberos.example.com /

4 3

Re: Openldap Problem
by devzero2000 26 Jul '12

26 Jul '12

Very often i see answer like this on rhel, in particular. So why don't tell or, better, write in some faq : the openldap version shipped and packaged with rhel is seriously borken, please don't use it. Should not be better ? regards (footnote) i am not a redhat folk 2012/7/26, Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, July 26, 2012 12:55 PM +0200 Chris <chris(a)flamengro.co.za> > wrote: > >> Hi. >> >> I am using rhel 6.3, with sssd-1.8.0 and openldap-servers-2.4.23-26, the >> kernel is 2.6.32-279.2.1.el6.x86_64. >> The problem I'm having is I get this error message in messages file. > > Upgrade to a newer version of OpenLDAP that has fixes for sssd. Upgrade to > > a version of OpenLDAP that doesn't use MozNSS for its SSL/TLS bits, and > instead uses the saner and reliable OpenSSL. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Inviato dal mio dispositivo mobile

3 2

Does OpenLDAP 2.4 support nested group
by Qian Zhang 26 Jul '12

26 Jul '12

Hi, I'd like to know in OpenLDAP 2.4, if I create a group (objectClass is posixGroup), is it possible that I create another group as the member of this group? Or I have to do this with group which has groupOfNames as its objectClass? Thanks, Qian

3 2

Re: The Last Sysadmin Prayer: Discussion Returns to Wrap and Base64 World
by Peter Gietz 24 Jul '12

24 Jul '12

Hi Angel, you might want to post feature requests (after double checking that the feature does not already exists) to the ITS (http://www.openldap.org/its/). This list is, as Howard made quite clear, not the right place. Technical discussions can be made on openldap-technical. Although it is far better to use proper LDAP libraries of a proper scripting language, I second your request for a don't base64 feature for all those admins who only use bash and pray instead of learning python or perl ;-) But we should first discuss (on openldap-technical) how exactly such a feature should work (there are binary values that you don't want to have not base64ed). And: it is even nicer to post a proper patch than a feature request to ITS Cheers, Peter Am 23.07.2012 00:36, schrieb Angel Bosch: >> De: "Howard Chu" <hyc(a)symas.com> >> This is the Developer's list. Your post is off topic and you should be >> ashamed >> of yourself for posting it here. >> > sorry for the noise, I knew this is the developer's list but after seeing all lists: > > openldap-announce OpenLDAP announcements list > openldap-bugs OpenLDAP bugs discussion list > openldap-commit OpenLDAP source repository 'commit' list > openldap-devel OpenLDAP development discussion list > openldap-fortress OpenLDAP Fortress Discussion list > openldap-technical OpenLDAP Technical Discussion list > > > I thought this belongs here because the nature of the discussion. If you want me to move this thread to another list, please let me know. > > > >> An option for LDIF wrapping was released in 2.4.24, 2011-02-10. You >> should be >> ashamed of yourself for asking for something that has already been >> available >> for over a year and a half. >> > I was using lastest Centos 6.3 packages and I assumed that there was no wrapping option, sorry about that. I see now that Centos is packaging 2.4.23. That was close. I'm really happy to see that it was finally included upstream and I can't wait to see it on packages. > > > I think rest of the complain is still valid, though. Decoding values i still an issue, and the suggestion of Michael that best way is learning other languages instead of using ldapsearch reaffirms my pov. How broken can be a simple search such as > > FULLNAME=`ldapsearch -x -LLL "(uid=$1)" gecos | grep "^gecos: " | cut -d" " -f2- ` > > ? > > > I really thought that we could start a healthy discussion about what and when a widely requested feature should be included. And judging from amount of posts/discussions I've found digging last weeks I'm pretty sure that isn't the opinion of a single undocumented obtuse sysadmin. > > Instead of being double-ashamed because of my ignorance, I'm really proud of being part of the free software community and being able to address to people I admire and respect profundly. Even when I'm wrong and even more when I hardly find the right words to explain my boss that this "creppy guy with a violin" is the main developer of this huge project. > > > àngel > > > ps: english is not my native language, excuse my strange composition > > -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72072 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

1 0

syncrepl and deleted entries
by Roman Serbski 22 Jul '12

22 Jul '12

Hello list, I'm having problems with deleted entries in a provider/consumer setup. Any hints would be greatly appreciated! ===PROVIDER=== Ubuntu 10.04.2 (lucid) OpenLDAP 2.4.21-0ubuntu5.3 (installed from packages) slapd.conf: moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ===CONSUMER=== Ubuntu 12.04 (precise) OpenLDAP 2.4.28-1.1ubuntu4 (installed from packages) slapd.conf: syncrepl rid=001 provider=ldaps://provider.domain.org:636 tls_reqcert=never searchbase="dc=domain,dc=org" filter="(objectClass=*)" bindmethod=simple binddn="cn=admin,dc=domain,dc=org" credentials=xxxxxx retry="60 +" type=refreshAndPersist scope=sub attrs="*,+" schemachecking=off interval=00:00:05:00 Everything works fine and added/modified entries from the provider are immediately replicated to the consumer, but it doesn't work with deleted entries - if I delete an entry from the provider it gets never deleted from the consumer. Debug log files could be found here: http://pastebin.com/AmXRAXHp The first part is successful entry modification, and the last one is unsuccessful deletion. The only anomaly that I can spot is at the line 131: "<= bdb_index_read: failed (-30987)", but then I don't understand how adding/modifying works... Many thanks! Roman

2 1

slapd mmr failure due to tls cert name mismatch
by Patrick Hemmer 20 Jul '12

20 Jul '12

I have 2 servers (version 2.4.31) in multi-master-replication behind a single IP. Whenever replication tries to start, it fails because the cert name does not match the hostname. ---- TLS: hostname (per5-unity-ldap02.mbox.net) does not match common name in certificate (unity-ldap.mbox.net). 5009c52e slap_client_connect: URI=ldap://per5-unity-ldap02.mbox.net Error, ldap_start_tls failed (-11) 5009c52e do_syncrepl: rid=523 rc -11 retrying (5 retries left) ---- However in the slapd configuration, I have the olcSyncrepl tls_reqcert parameter set to 'never' ---- olcSyncrepl: {0}rid=523 provider="ldap://per5-unity-ldap02.mbox.net" network-timeout=2 retry="1 10 10 60 60 +" keepalive="60:3:60" starttls=critical tls_reqcert=never bindmethod=simple timeout=2 binddn="uid=foo,cn=bar" credentials="baz" type=refreshAndPersist searchbase="dc=my,dc=domain" ---- Why is this happening? I even ran across ITS#7014 which is about this exact issue, and with tls_reqcert=allow and tls_reqcert=never, it's not supposed to happen. Thanks -Patrick

2 1

replication verification
by Boyd Duffee 20 Jul '12

20 Jul '12

Hi all, I've been dropped in a the LDAP deep end due to a retirement in the office. The documentation I have regarding dealing with the failure of a master tells me how to fail over by promoting one of the replicas and then, when the problem with the master has been sorted, to re-configure it as a replica. My problem is with his following line When it is fully synchronised with the temporary master it can then be re-instated as the master. How do I know when it has fully synchronised? I'm running openldap v2.4.16, but I don't seem to have syncrepl in my path. Where should I be starting? thanks, -- Boyd Duffee Keele University (01782) 734225 Student Facing Systems It kind of makes me sad that all the dystopian capabilities are being created, but are mainly being used for advertising instead of the hot-evil-cool dystopia we were promised - phantomfive

3 3

Re[10]: Searching few domains for one uid
by kefast＠o2.pl 20 Jul '12

20 Jul '12

> --On Saturday, July 14, 2012 12:42 PM +0200 kefast(a)o2.pl wrote: >> Ok, thanx, I do understand that, but my point is, where I can put >> those "" in configuration files ? On a client side set BASE "" and in >> slapd.conf >> >> database bdb >> suffix "" >> rootdn "cn=admin" >> >> ? >> >> How persisly set config files (client, server) to search for all of >> those domains You listed. > Use an empty base. > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration I can not import an ldif with an empty base on an server side. slapadd -v -b 'dc=""' -l ./root.ldif slapadd: slap_init invalid suffix ("dc=""") slapadd -v -b 'dc=' -l ./root.ldif slapadd: slap_init invalid suffix ("dc=") slapadd -v -b "dc=" -l ./root.ldif slapadd: slap_init invalid suffix ("dc=") slappadd -v -b "dc=" -l ./root.ldif slapadd: slap_init invalid suffix ("dc=") slapadd -v -b "dc=''" -l ./root.ldif slapadd: slap_init no backend for "dc=''" -- Pozdrowienia, kefast(a)o2.pl

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical