openldap-technical

openldap-technical@openldap.org

9804 discussions

Cannot remove LDAP entry ...
by Frank Bonnet 03 Jul '12

03 Jul '12

Hello I have a problem removing ONE ( and only ONE !!! ) entry in my directory server ldapdelete fails like the following ldap_delete: Other (e.g., implementation specific) error (80) additional info: entry index delete failed I've checked online openldap documentation and this error refers to a access rights problem, but it is not the case for my server , all db files belong to ldap:ldap which is the identity the slapd deamon runs on. the server runs 2.4.23 version on a FreeBSD 8.1-RELEASE-p5 compiled and installed from ports. ldap# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Oct 15 2010 16:35:06) $ root@ldap3.esiee.fr:/usr/ports/net/openldap24-server/work/openldap-2.4.23/servers/slapd Any help welcome thank you

2 1

bug in unique overlay
by Anton Yuzhaninov 03 Jul '12

03 Jul '12

According to slapo-unique(5) it is possible to specify several URLs in one domain (in single unique_uri dircetive). I have in my slapd.conf settings like: unique_uri ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) ldap:///ou=aliases,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) But in OpenLDAP 2.4.31 all URLs except first one is silently ignored. Debug logs show: 4ff309e3 line 208 (unique_uri ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) ldap:///ou=aliases,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)) 4ff309e3 ==> unique_new_domain <ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)> ldap_url_parse_ext(ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)) 4ff309e3 >>> dnPrettyNormal: <ou=lists,dc=example.ru,ou=mail,o=foo> 4ff309e3 <<< dnPrettyNormal: <ou=lists,dc=example.ru,ou=mail,o=foo>, <ou=lists,dc=example.ru,ou=mail,o=foo> Prblem is around this code in servers/slapd/overlays/unique.c: if ( c->line ) rc = unique_new_domain ( &domain, c->line, c ); else rc = unique_new_domain ( &domain, c->argv[1], c ); c->line is empty by some reason. c->argv[1] contains only first URL. Is anybody know how to fix this bug? Is it normal, that c->line is empty? -- Anton Yuzhaninov

3 3

overlay nssov and pass-though authentication
by Uwe Werler 02 Jul '12

02 Jul '12

Hello list, sis there a way to use pass-through authentication with saslauthd and the new nssov overlay? The only thing I got working at the moment was to use overlay pbind. But then I have to split my database 'cause I need local passwords stored in the database too. Thanks in aadvance! Uwe

1 0

overlay nssov and pass-through authentication
by Uwe Werler 02 Jul '12

02 Jul '12

1 0

New release of LinID OpenLDAP Manager
by Clément OUDOT 29 Jun '12

29 Jun '12

Hi all, I wanted to inform you that we just released a new version (0.7) of our OpenLDAP configuration web console. You can know more about this version here: https://redmine.linid.org/news/16 LinID OpenLDAP Manager is free software (AGPLv3), I hope it might be useful for some of you. Regards, Clément OUDOT.

2 2

chaining and returning errors
by Frank Van Damme 29 Jun '12

29 Jun '12

List, I'm setting up chaining. And I want to get errors, no referrals :) my olcDatabase looks like this: olcDatabase={0}ldap,olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcChainDatabase (auxiliary) objectClass: olcConfig (abstract) objectClass: olcDatabaseConfig (structural) objectClass: olcLDAPConfig (structural) objectClass: top (abstract) olcDatabase: {0}ldap olcDbIDAssertBind: bindmethod="simple" binddn="uid=lalalala" credentials="foo" mode="self" olcDbURI: ldap://example.com here is this object's parent: olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcConfig (abstract) objectClass: olcOverlayConfig (structural) objectClass: top (abstract) olcOverlay: {1}chain The problem is that I can't insert an olcChainReturnError attribute into it. The schema doesn't allow it. I tried to add the olcChainConfig objectClass to the olcDatabase={1} object, which requires me to fill in an extra attribute "olcOverlay" - I tried {1}chain and "chain" and "{0}ldap" but either give me an error 65 "invalid structural object class chain". -- Frank Van Damme No part of this copyright message may be reproduced, read or seen, dead or alive or by any means, including but not limited to telepathy without the benevolence of the author.

2 2

Re: Memberof overlay with posixGroup
by Marcio Merlone 29 Jun '12

29 Jun '12

Em 28-06-2012 12:39, Julien Soula escreveu: > On Thu, Jun 28, 2012 at 10:34:48AM -0300, Marcio Merlone wrote: >> I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and >> OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I >> created the following ldif: >> >> .../... >> >> adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" >> ldap_add: Other (e.g., implementation specific) error (80) >> additional info: member attribute="memberUid" must either >> have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID >> (1.3.6.1.4.1.1466.115.121.1.34) syntax > overlay memberof only supports DN as membership attribute (as DN and > nameUID type). I don't know any workaround for your case. Sorry for the noise, I SWEAR, I was so sure posixGroup use DN as membership, overlooked that. Thanks and best regards. -- *Marcio Merlone*

1 0

Memberof overlay with posixGroup
by Marcio Merlone 28 Jun '12

28 Jun '12

Greetings, I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I created the following ldif: root@venus:~# cat memberof.ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof - add: olcModuleLoad olcModuleLoad: refint dn: olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: {2}memberof olcMemberOfRefInt: TRUE olcMemberOfGroupOC: posixGroup olcMemberOfMemberAD: memberUid olcMemberOfMemberOfAD: memberOf dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: memberof memberuid manager owner seeAlso roleOccupant root@venus:~# And got the error: root@venus:~# ldapadd -x -D "cn=admin,cn=config" -W -f memberof.ldif Enter LDAP Password: modifying entry "cn=module{0},cn=config" adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: member attribute="memberUid" must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax root@venus:~# Is this a specific version problem, is it not doable or have I screwed something? Thanks for any help, please let me know if you need further information. Regards. -- *Marcio Merlone*

1 0

Strange TLS issue while upgrading from openldap 2.3 to 2.4
by Guillaume Rousse 28 Jun '12

28 Jun '12

Hello list. I recently faced a strange issue while upgrading from openldap 2.3 to 2.4 (from centos 5.7 to 6.2, actually): the change was transparent for every applications excepted Zimbra, for which any authentication attempt was suffering from an unexplained 30s additional delay. Just switching from explicit TLS usage on port 389 to explicit SSL usage on port 636 was enough to fix the issue. The logs shows than the delay occurs between the moment where the bind operation succeed, and the moment the client connection get closed: Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 ACCEPT from IP=128.93.142.13:41191 (IP=0.0.0.0:389) Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 STARTTLS Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 RESULT oid= err=0 text= Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 TLS established tls_ssf=256 ssf=256 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" method=128 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" mech=SIMPLE ssf=0 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 RESULT tag=97 err=0 text= ... Jun 14 11:56:34 ildapslave2 slapd[16618]: conn=2787 fd=135 closed (connection lost) Before the upgrade, the connection get closed immediatly, and there is no such delay. Using higher logging level doesn't provide additional useful details, excepted maybe more details about connection termination: Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): checking for input on id=1135 Jun 14 12:53:21 ildapslave2 slapd[7156]: ber_get_next on fd 109 failed errno=0 (Success) Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): input error=-2 id=1135, closing. I'm aware than this behaviour change may actually come from underlying libraries, such as bdb for instance, rather than openldap itself, but that's still quite a curious issue. Does anyone have a clue about this problem ? -- The more cordial the buyer's secretary, the greater the odds that the competition already has the order -- Murphy's Laws on Technology n°38

3 7

back-meta and SSL
by Peter Ga 26 Jun '12

26 Jun '12

Hello, one question to back-meta: Is it possible to have several ldaps:// URLs as entries, without client-side authentication? I.e. I just want to configure the CA cert path and connect to a ldaps repository ('normal' ssl, no starttls). I saw the section in the man page about idassert-bind, but was not completely sure they apply to ldaps URLs without authentication. Best regards, Peter

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical