openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

sasl bind error -1 because of socket error 54
by Max Kunz 07 Aug '12

07 Aug '12

Hello, i try to bind to an server using the ldap_sals_bind_s function. The Host is not localhost, but is accessible via internet. I'v tested the connection with a java based ldap browser. When i try to do this using my simple c++ program, it fails with error -1. Here is what the program actually do: //initialize returns success result = ldap_initialize( &ld, host); result = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, LDAP_VERSION3); //set this option only after successful bind? result = ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER); //the synchronous bind function returns -1 server down result = ldap_sasl_bind_s(ld, root_dn, LDAP_SASL_SIMPLE, &credential, NULL,NULL, &serverReturnedCredentials); When I use the asynchronous ldap_sals_bind() function, it returns 0 ldap_success. (I`m also able to create a simple socket to this particular server and port). The error -1 comes from the following ldap_result() function. The problem here is that the socket throws a sock_errno 54 (connection reset by peer). Someone an idea why the connection always will be disturbed? Thanks for any help best regards, Max

2 1

Referral to single attributes
by Florian Götz 07 Aug '12

07 Aug '12

Hi, maybe someone has experienced the same problem. Take the following example. You would like to use one LDAP server (replicated of course) for multiple Domains. Like ou=users,ou=department1,dc=company,dc=de ou=users,ou=department2,dc=company,dc=de ou=users,ou=maindep,dc=company,dc=de ... Each department has its own domain, all users are part of maindep, some of those users are part of dep1 too and some of dep2. So you have the maindep tree for the general use (uid and password for things like mail, vpn and a genereal purpose domain) and the smaller dep1 or dep2 for the use with the workstations of the department. The uid of a user is always the same across the trees (uid=mikecharlie,ou=dep1,... = uid=mikecharlie,ou=maindep). The single departments are responsible for their users (creation and deletion of accounts in their subtrees). The maindep-Tree gets managed by IT center staff. Now every department could work with their domain and users (and only those) , but all users would have a general "account" for stuff that doesnt belong to their department alone. The big problem is the sync of the passwords from subtree to subtree (dep1 to maindep or dep2 to maindep). Our users get confused if they have password1 for the login at a workstation and password2 for mail etc. But the departments want to have their own domains where they have the control who is able to login or not, BUT they want to have syncronized passwords. Is there a possibility to refer to single attributes? Like uid=mikecharlie,ou=dep1,dc=company,dc=de -> userPassword -> look at uid=mikecharlie,ou=maindep,dc=hs-mannheim,dc=de -> userPassword. Best regards Flo -- Mit freundlichen Grüßen Florian Götz ----------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

1 0

MDB configuration admin guide
by Yajuvendra Singh 06 Aug '12

06 Aug '12

Hi Experts, I have just started working on openldap and configured my openldap with MDB. I am not able to locate the MDB configuration and admin guide which talks about administration of openldap with mdb. I am not clear about the configuration or changes i need to do to change my release from BDB to MDB. Can anyone point me where i can find these document. Thanks and Regards, Yajuvendra

2 1

personalization
by Jignesh Patel 06 Aug '12

06 Aug '12

I have a requirement to support personalization. I didn't find many articles to do that. Please point me some of the articles related to it. -Jignesh

2 1

ACL processing: subtractive privs (using control continue)
by Dora Paula 06 Aug '12

06 Aug '12

Hi List, just another short question regarding incremental privileges, given the following acl: access to dn.subtree="o=test" attrs=description by self =dxcsraz continue by users -z by * none Subtracting "z" results in the access mask "=dxcsr". As I expected the resulting access mask to be "=dxcsra", I would like to know whether "=dxcsr" is the correct result, and if so, why? Many thanks again! A small testbed containing sample ldif data, ldapmodify test command and the produced slapd.log (level 128) follows here: sample ldif data: =============== dn: o=test objectClass: organization objectClass: top o: test dn: ou=persons,o=test objectClass: organizationalUnit objectClass: top ou: persons dn: cn=PersonA,ou=persons,o=test objectClass: person objectClass: top cn: PersonA sn: PersonA userPassword:: UGVyc29uQQ== test command using ldapmodify: ============================= deepee@test:~$ /opt/openldap-acl/bin/ldapmodify -x -H "ldap://localhost:1389" -D "cn=PersonA,ou=persons,o=test" -w PersonA <<EOF dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: PersonA1 EOF modifying entry "cn=PersonA,ou=persons,o=test" ldap_modify: Insufficient access (50) slapd.log level 128: ================= 501fb8b7 => access_allowed: result not in cache (userPassword) 501fb8b7 => access_allowed: auth access to "cn=PersonA,ou=persons,o=test" "userPassword" requested 501fb8b7 => dn: [1] o=test 501fb8b7 => acl_get: [1] matched 501fb8b7 => acl_get: [2] attr userPassword 501fb8b7 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "userPassword" requested 501fb8b7 => acl_mask: to value by "", (=0) 501fb8b7 <= check a_dn_pat: self 501fb8b7 <= check a_dn_pat: users 501fb8b7 <= check a_dn_pat: anonymous 501fb8b7 <= acl_mask: [3] applying auth(=xd) (stop) 501fb8b7 <= acl_mask: [3] mask: auth(=xd) 501fb8b7 => slap_access_allowed: auth access granted by auth(=xd) 501fb8b7 => access_allowed: auth access granted by auth(=xd) 501fb8b7 => access_allowed: result not in cache (description) 501fb8b7 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 501fb8b7 => dn: [1] o=test 501fb8b7 => acl_get: [1] matched 501fb8b7 => acl_get: [1] attr description 501fb8b7 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 501fb8b7 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 501fb8b7 <= check a_dn_pat: self 501fb8b7 <= acl_mask: [1] applying =wrscxd (continue) 501fb8b7 <= acl_mask: [1] mask: =wrscxd 501fb8b7 <= check a_dn_pat: users 501fb8b7 <= acl_mask: [2] applying -z (stop) 501fb8b7 <= acl_mask: [2] mask: =rscxd 501fb8b7 => slap_access_allowed: add access denied by =rscxd 501fb8b7 => access_allowed: no more rules BTW: Replacing the first by clause using "self write" or "self =dxcsrw", also results in "=dxcsr" JFF: Replacing the second by clause using "users -a", the test results in the above mask (=dxcsr), too.

2 1

new versions
by Friedrich Locke 06 Aug '12

06 Aug '12

Hi folks, i have noticed openldap keeps releasing new versions from time to time. I have not noticed changes in protocol specification. So why does openldap release new versions ? Isn't it mature enough yet ? I am asking cause i am used to djb tools like qmail and djbdns and they don't change since a long time ago. Please, don't get me wrong. I am no saying one approach is better than another, i am just curious about openldap. Thanks.

4 3

ACL processing: additive privs (using control continue)
by Dora Paula 06 Aug '12

06 Aug '12

Hi list, just a short question about "continue" and additive privileges, given the following acl statement: access to dn.subtree="o=test" attrs=sn by users =s continue by group/groupOfNames/member="cn=readers,ou=groups,o=test" +r If the current user's bindDn isn't a member of the group "cn=readers,..." or the group's entry does not exist, the previously set privilege "=s" will be reset to "none"? As the slapd.access man page just gives a "silly" and an "even more silly" example regarding "continue" I'm not sure this is the intended behavior. Attached you'll find my minimalistic testbed: slapd.conf sample ldif data two ldapsearch commands (including their slapd.log level 128) I'm using openldap MASTER. Thank you very much. Cheers Dora

4 9

slapcat not printing dn
by Frank Swasey 03 Aug '12

03 Aug '12

I'm using OpenLDAP 2.4.31 which I locally compiled on RHEL 6.3 64-bit. Last night as part of the nightly update process, a slapcat of the main suffix. There were 312,576 dn's in this database, and the last 4,794 entries printed were written out with in the form: dn: objectClass: groupOfNames cn: COURSE-201209-92184 member: uid=notreal,ou=people,dc=uvm,dc=edu structuralObjectClass: groupOfNames entryUUID: 1ee49f30-245e-4804-9be9-9faf0bb7f0c5 creatorsName: cn=theboss,dc=uvm,dc=edu createTimestamp: 20120803002051Z entryCSN: 20120803002051.460963Z#000000#000#000000 modifiersName: cn=theboss,dc=uvm,dc=edu modifyTimestamp: 20120803002051Z which is (as far as I know) not valid. I believe there has to be a dn value (and this morning, slapcat's performed are showing dn's in the output). I am using back-hdb to store this database. This is on the master server which has 10 replicas pulling changes off it using delta-syncrepl. A quick search of the ITS system shows ITS#6365 which hasn't been updated since February 2010 that seems to indicate the same (though in that one it was completely consistent) issue with an hdb database and slapcat. Any ideas? I have never seen this happen before, but I did just move to both OpenLDAP 2.4.31 and RHEL6 (was previously running OpenLDAP 2.4.28 plus fixes on RHEL5u8 64-bit). -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

Troubles with LDAP SYNC and doubt
by rodrigo tavares 03 Aug '12

03 Aug '12

Hello ! I sent a email to list saying about troubles in LDAP SYNC, this error was:ldap_sasl_bind_s failed (49) I found my error. I change for binddn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br". So its is replicating. I have a doubt: the interval=01:00:00:00 This value is one hour ? Thanks ! Rodrigo Faria

3 2

What will happen if a user is a member of a group, but has another group as its primary group
by Qian Zhang 03 Aug '12

03 Aug '12

Hi, In my OpenLDAP server, it is possible to set a user as a member of a group, but it has another group as its primary group (I am using "LDAP Admin" as LDAP client tool). For example, in group1, I can see user1 as its "memberUid" attribute, but the "gidNumber" attribute of user1 is group2. I'd like to know if this is a reasonable configuration, and in this case, should I consider user1 as the member of group2 too? For example, if I configure a machine to only allow gruop2 to login, can user1 log into that machine? BTW, I do not know how to configure PAM to only allow a group or some groups to login the machine, if anyone can tell me the steps, it will be really appreciated! Thanks, Qian

4 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical