openldap-technical

openldap-technical@openldap.org

9 participants
9866 discussions

MDB configuration admin guide
by Yajuvendra Singh 06 Aug '12

06 Aug '12

Hi Experts, I have just started working on openldap and configured my openldap with MDB. I am not able to locate the MDB configuration and admin guide which talks about administration of openldap with mdb. I am not clear about the configuration or changes i need to do to change my release from BDB to MDB. Can anyone point me where i can find these document. Thanks and Regards, Yajuvendra

2 1

personalization
by Jignesh Patel 06 Aug '12

06 Aug '12

I have a requirement to support personalization. I didn't find many articles to do that. Please point me some of the articles related to it. -Jignesh

2 1

ACL processing: subtractive privs (using control continue)
by Dora Paula 06 Aug '12

06 Aug '12

Hi List, just another short question regarding incremental privileges, given the following acl: access to dn.subtree="o=test" attrs=description by self =dxcsraz continue by users -z by * none Subtracting "z" results in the access mask "=dxcsr". As I expected the resulting access mask to be "=dxcsra", I would like to know whether "=dxcsr" is the correct result, and if so, why? Many thanks again! A small testbed containing sample ldif data, ldapmodify test command and the produced slapd.log (level 128) follows here: sample ldif data: =============== dn: o=test objectClass: organization objectClass: top o: test dn: ou=persons,o=test objectClass: organizationalUnit objectClass: top ou: persons dn: cn=PersonA,ou=persons,o=test objectClass: person objectClass: top cn: PersonA sn: PersonA userPassword:: UGVyc29uQQ== test command using ldapmodify: ============================= deepee@test:~$ /opt/openldap-acl/bin/ldapmodify -x -H "ldap://localhost:1389" -D "cn=PersonA,ou=persons,o=test" -w PersonA <<EOF dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: PersonA1 EOF modifying entry "cn=PersonA,ou=persons,o=test" ldap_modify: Insufficient access (50) slapd.log level 128: ================= 501fb8b7 => access_allowed: result not in cache (userPassword) 501fb8b7 => access_allowed: auth access to "cn=PersonA,ou=persons,o=test" "userPassword" requested 501fb8b7 => dn: [1] o=test 501fb8b7 => acl_get: [1] matched 501fb8b7 => acl_get: [2] attr userPassword 501fb8b7 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "userPassword" requested 501fb8b7 => acl_mask: to value by "", (=0) 501fb8b7 <= check a_dn_pat: self 501fb8b7 <= check a_dn_pat: users 501fb8b7 <= check a_dn_pat: anonymous 501fb8b7 <= acl_mask: [3] applying auth(=xd) (stop) 501fb8b7 <= acl_mask: [3] mask: auth(=xd) 501fb8b7 => slap_access_allowed: auth access granted by auth(=xd) 501fb8b7 => access_allowed: auth access granted by auth(=xd) 501fb8b7 => access_allowed: result not in cache (description) 501fb8b7 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 501fb8b7 => dn: [1] o=test 501fb8b7 => acl_get: [1] matched 501fb8b7 => acl_get: [1] attr description 501fb8b7 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 501fb8b7 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 501fb8b7 <= check a_dn_pat: self 501fb8b7 <= acl_mask: [1] applying =wrscxd (continue) 501fb8b7 <= acl_mask: [1] mask: =wrscxd 501fb8b7 <= check a_dn_pat: users 501fb8b7 <= acl_mask: [2] applying -z (stop) 501fb8b7 <= acl_mask: [2] mask: =rscxd 501fb8b7 => slap_access_allowed: add access denied by =rscxd 501fb8b7 => access_allowed: no more rules BTW: Replacing the first by clause using "self write" or "self =dxcsrw", also results in "=dxcsr" JFF: Replacing the second by clause using "users -a", the test results in the above mask (=dxcsr), too.

2 1

new versions
by Friedrich Locke 06 Aug '12

06 Aug '12

Hi folks, i have noticed openldap keeps releasing new versions from time to time. I have not noticed changes in protocol specification. So why does openldap release new versions ? Isn't it mature enough yet ? I am asking cause i am used to djb tools like qmail and djbdns and they don't change since a long time ago. Please, don't get me wrong. I am no saying one approach is better than another, i am just curious about openldap. Thanks.

4 3

ACL processing: additive privs (using control continue)
by Dora Paula 06 Aug '12

06 Aug '12

Hi list, just a short question about "continue" and additive privileges, given the following acl statement: access to dn.subtree="o=test" attrs=sn by users =s continue by group/groupOfNames/member="cn=readers,ou=groups,o=test" +r If the current user's bindDn isn't a member of the group "cn=readers,..." or the group's entry does not exist, the previously set privilege "=s" will be reset to "none"? As the slapd.access man page just gives a "silly" and an "even more silly" example regarding "continue" I'm not sure this is the intended behavior. Attached you'll find my minimalistic testbed: slapd.conf sample ldif data two ldapsearch commands (including their slapd.log level 128) I'm using openldap MASTER. Thank you very much. Cheers Dora

4 9

slapcat not printing dn
by Frank Swasey 03 Aug '12

03 Aug '12

I'm using OpenLDAP 2.4.31 which I locally compiled on RHEL 6.3 64-bit. Last night as part of the nightly update process, a slapcat of the main suffix. There were 312,576 dn's in this database, and the last 4,794 entries printed were written out with in the form: dn: objectClass: groupOfNames cn: COURSE-201209-92184 member: uid=notreal,ou=people,dc=uvm,dc=edu structuralObjectClass: groupOfNames entryUUID: 1ee49f30-245e-4804-9be9-9faf0bb7f0c5 creatorsName: cn=theboss,dc=uvm,dc=edu createTimestamp: 20120803002051Z entryCSN: 20120803002051.460963Z#000000#000#000000 modifiersName: cn=theboss,dc=uvm,dc=edu modifyTimestamp: 20120803002051Z which is (as far as I know) not valid. I believe there has to be a dn value (and this morning, slapcat's performed are showing dn's in the output). I am using back-hdb to store this database. This is on the master server which has 10 replicas pulling changes off it using delta-syncrepl. A quick search of the ITS system shows ITS#6365 which hasn't been updated since February 2010 that seems to indicate the same (though in that one it was completely consistent) issue with an hdb database and slapcat. Any ideas? I have never seen this happen before, but I did just move to both OpenLDAP 2.4.31 and RHEL6 (was previously running OpenLDAP 2.4.28 plus fixes on RHEL5u8 64-bit). -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

Troubles with LDAP SYNC and doubt
by rodrigo tavares 03 Aug '12

03 Aug '12

Hello ! I sent a email to list saying about troubles in LDAP SYNC, this error was:ldap_sasl_bind_s failed (49) I found my error. I change for binddn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br". So its is replicating. I have a doubt: the interval=01:00:00:00 This value is one hour ? Thanks ! Rodrigo Faria

3 2

What will happen if a user is a member of a group, but has another group as its primary group
by Qian Zhang 03 Aug '12

03 Aug '12

Hi, In my OpenLDAP server, it is possible to set a user as a member of a group, but it has another group as its primary group (I am using "LDAP Admin" as LDAP client tool). For example, in group1, I can see user1 as its "memberUid" attribute, but the "gidNumber" attribute of user1 is group2. I'd like to know if this is a reasonable configuration, and in this case, should I consider user1 as the member of group2 too? For example, if I configure a machine to only allow gruop2 to login, can user1 log into that machine? BTW, I do not know how to configure PAM to only allow a group or some groups to login the machine, if anyone can tell me the steps, it will be really appreciated! Thanks, Qian

4 7

Trying make a replication
by rodrigo tavares 03 Aug '12

03 Aug '12

Hello ! I have a troubles with replication slapd. Some logs #log of consumer Aug 2 16:21:37 serversamba slapd[1832]: slapd starting Aug 2 16:21:37 serversamba slapd[1832]: slap_client_connect: URI=ldap://10.26.7.46:389 DN="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" ldap_sasl_bind_s failed (49) Aug 2 16:21:37 serversamba slapd[1832]: do_syncrepl: rid=123 rc 49 retrying #logs of provider Aug 2 16:21:32 defensoria slapd[6345]: slapd starting Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 fd=13 ACCEPT from IP=10.26.7.45:57491 (IP=0.0.0.0:389) Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=0 BIND dn="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=0 RESULT tag=97 err=49 text= Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=1 UNBIND Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 fd=13 closed My provider: moduleload syncprov.la moduleload back_monitor.la moduleload back_bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 My costumer: syncrepl rid=123 provider=ldap://10.26.7.46:389 type=refreshOnly interval=01:00:00:00 searchbase="dc=defensoria,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="cn,sn,ou,telephoneNumber,title,l" schemachecking=off bindmethod=simple binddn="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" credentials=galo When I make this under command, it´s run : ldapsearch -x -v -H 'ldap://10.26.7.46' -b 'dc=defensoria,dc=mg,dc=gov,dc=br' -D 'uid=syncrepl,ou=defensoria,dc=defensoria,dc=mg,dc=gov,dc=br' -W Any suggestion ? Thanks ! Rodrigo Faria Tavares

2 1

Re: What will happen if a user is a member of a group, but has another group as its primary group
by Dan White 03 Aug '12

03 Aug '12

(CCing the list) On 08/03/12 11:31 +0800, Qian Zhang wrote: >I am just wondering if there is a well-known rule for this use case, >I'd like to follow the general acceptable way. So most of people think >user1 should not log into the machine in this case, I will ingore >gidNumber and only care about memberUid attribute. Personally, I prefer to place authorization attributes within the user's dn, rather than to maintain groups for the same purpose, but I have done it both ways in the past. Using 'nssov-pam userhost [...]' would be a good way to do that. -- Dan White

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical