openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

Trying make a replication
by rodrigo tavares 03 Aug '12

03 Aug '12

Hello ! I have a troubles with replication slapd. Some logs #log of consumer Aug 2 16:21:37 serversamba slapd[1832]: slapd starting Aug 2 16:21:37 serversamba slapd[1832]: slap_client_connect: URI=ldap://10.26.7.46:389 DN="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" ldap_sasl_bind_s failed (49) Aug 2 16:21:37 serversamba slapd[1832]: do_syncrepl: rid=123 rc 49 retrying #logs of provider Aug 2 16:21:32 defensoria slapd[6345]: slapd starting Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 fd=13 ACCEPT from IP=10.26.7.45:57491 (IP=0.0.0.0:389) Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=0 BIND dn="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=0 RESULT tag=97 err=49 text= Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=1 UNBIND Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 fd=13 closed My provider: moduleload syncprov.la moduleload back_monitor.la moduleload back_bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 My costumer: syncrepl rid=123 provider=ldap://10.26.7.46:389 type=refreshOnly interval=01:00:00:00 searchbase="dc=defensoria,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="cn,sn,ou,telephoneNumber,title,l" schemachecking=off bindmethod=simple binddn="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" credentials=galo When I make this under command, it´s run : ldapsearch -x -v -H 'ldap://10.26.7.46' -b 'dc=defensoria,dc=mg,dc=gov,dc=br' -D 'uid=syncrepl,ou=defensoria,dc=defensoria,dc=mg,dc=gov,dc=br' -W Any suggestion ? Thanks ! Rodrigo Faria Tavares

2 1

Re: What will happen if a user is a member of a group, but has another group as its primary group
by Dan White 03 Aug '12

03 Aug '12

(CCing the list) On 08/03/12 11:31 +0800, Qian Zhang wrote: >I am just wondering if there is a well-known rule for this use case, >I'd like to follow the general acceptable way. So most of people think >user1 should not log into the machine in this case, I will ingore >gidNumber and only care about memberUid attribute. Personally, I prefer to place authorization attributes within the user's dn, rather than to maintain groups for the same purpose, but I have done it both ways in the past. Using 'nssov-pam userhost [...]' would be a good way to do that. -- Dan White

1 0

import ldif does not work
by Karntol Dernsef 02 Aug '12

02 Aug '12

Hi list, I am fighting with openldap for some time now and I can't get it to work. I started clean. I've followed this tutorial, and everything works fine. I used followed the example and only changed dc=company,dc=com into dc=mycompany,dc=org. Then I want to import this file, because I am busy with a WebSphere book from Packtpub, and I need to follow along and setting up a LDAP server with these contents: -------------------------- dn: o=mycompany.org objectclass: top objectclass: organization o: mycompany.org dn: ou=users,o=mycompany.org objectclass:organizationalunit ou: users description: generic users branch dn: ou=groups,o=mycompany.org objectclass:organizationalunit ou: groups description: generic groups branch dn: ou=roles,o=mycompany.org objectclass:organizationalunit ou: roles description: generic roles branch dn: cn=wasadmin,ou=roles,o=mycompany.org cn: wasadmin uid: wasadmin objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: wasadmin sn: wasadmin givenname: wasadmin title: wasadmin description: WAS Administrator dn: cn=ldapbind,ou=users,o=mycompany.org cn: ldapbind uid: ldapbind objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: ldapbind sn: ldapbind givenname: ldapbind title: ldapbind description: ldapbind dn: cn=Bob Jackson,ou=users,o=mycompany.org cn: Bob Jackson uid: bjackson mail: bjackson(a)mycompany.org objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: password sn: Jackson givenname: Bob telephonenumber: 123456789 title: WAS Administrator description: LDAP test user dn: cn=Mary Smith,ou=users,o=mycompany.org cn: Mary Smith uid: msmith mail: msmith(a)mycompany.org objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: password sn: Smith givenname: Mary telephonenumber: 123456789 title: WAS Administrator description: LDAP test user dn: cn=wasadmins,ou=groups,o=mycompany.org objectclass: groupofnames cn: wasadmins description: WAS Admins # add the group members all of which are # assumed to exist under people member: cn=Bob Jackson,ou=users,o=mycompany.org member: cn=Mary Smith,ou=users,o=mycompany.org member: cn=wasadmin,ou=roles,o=mycompany.org But when I want to import, I get this: [root@CentOS-01 cn=config]# ldapadd -W -D cn=admin,dc=mycompany,dc=org -v -x -f /tmp/mycompanyorg.ldif ldap_initialize( <DEFAULT> ) Enter LDAP Password: add objectclass: top organization add o: mycompany.org adding new entry "o=mycompany.org" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge When I do this: [root@CentOS-01 cn=config]# ldapsearch -xLLWD cn=admin,dc=mycompany,dc=org -b dc=mycompany,dc=org dn Enter LDAP Password: version: 1 No such object (32) Something tells me it's wrong. So, a friend who helped me said I had to create the company first, and that I should use dc=company,dc=org instead of o=company.org. I had to create the company first in the LDAP he said, so he passed me this file: # usergroups.ldif # # dn: dc=mycompany,dc=org dc: company objectClass: top objectClass: domain dn: ou=users,dc=mycompany,dc=org ou: Users objectClass: top objectClass: organizationalUnit description: Central location for UNIX users dn: ou=groups,dc=mycompany,dc=org ou: Groups objectClass: top objectClass: organizationalUnit description: Central location for UNIX groups # EOF But I can't add that: [root@CentOS-01 cn=config]# ldapadd -W -D cn=admin,dc=mycompany,dc=org -v -x -f /tmp/usergroup.ldif ldap_initialize( <DEFAULT> ) Enter LDAP Password: add dc: company add objectClass: top domain adding new entry "dc=mycompany,dc=org" ldap_add: Naming violation (64) additional info: value of single-valued naming attribute 'dc' conflicts with value present in entry I hope I will ever solve this, I can't complete my study now and have wasted hours and hours on this ldap problem. I hope you can help me out.. Karntol

2 2

AW: modify search base dn depending on search filter
by Robert Eikermann 02 Aug '12

02 Aug '12

Yes, I use rwm and the meta backend. But I'm not fixed to that ----- Ursprüngliche Nachricht ----- Von: Gavin Henry Gesendet: 01.08.2012 23:39 An: Robert Eikermann Cc: openldap-technical(a)openldap.org Betreff: Re: modify search base dn depending on search filter > Hi, > > can please someone give me a hint, how to change the search base dn > depending on the search filter. If someone searches “cn=a@b” at a fixed base > like dc=local I want to rewrite this search to cn=a with search base > “dc=b,dc=local” Hi Robert, Did you read man slapo-rwm ? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API news? http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api

1 0

modify search base dn depending on search filter
by Robert Eikermann 01 Aug '12

01 Aug '12

Hi, can please someone give me a hint, how to change the search base dn depending on the search filter. If someone searches "cn=a@b" at a fixed base like dc=local I want to rewrite this search to cn=a with search base "dc=b,dc=local" Thanks for help Robert

2 1

ACL to replicate a single value of an attribute
by Andrei BĂNARU 01 Aug '12

01 Aug '12

Hi, Is it possible to create an ACL entry that will allow only the first value of an attribute to be read ( an example would be nice ) ? For example having userPassword with a first value using MD5 hashing and a second value as plain text. We plan on replicating that object but we don't want to include the plain text value of the attribute userPassword. Using another attribute to store the user's password is out of the question. We need to add plain text passwords for some users in a country that use Active Directory ( AD password sync ). Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

2 1

Issue with dynlist overlay
by Patrick Hemmer 31 Jul '12

31 Jul '12

So I just ran across an undocumented issue with slapo-dynlist. I'm not sure if this is a bug, or just missing in the documentation. The issue is that if the entry being dynamically added to the parent entry has the objectClass slapo-dynlist is configured to use, that entry is not dynamically added to the parent. For example: ---- olcOverlay=dynlist,olcdatabase=hdb,cn=config objectClass: olcDynamicList objectClass: olcOverlayConfig olcDlAttrSet: groupOfURLs memberUrl ---- dn: cn=parent,dc=example,dc=com objectClass: groupOfNames objectClass: groupOfURLs member: uid=foo,dc=example,dc=com memberUrl: ldap:///cn=child,dc=example,dc=com dn: cn=child,dc=example,dc=com objectClass: groupOfNames objectClass: groupOfURLs member: uid=bar,dc=example,dc=com --- In the above example, I would "member: uid=bar,dc=example,dc=com" to be added to cn=parent,dc=example,dc=com, but it isn't. Now the documentation clearly states recursion is not allowed, so if cn=child were to have a 'memberUrl', this memberUrl would not be expanded. But this is not what is being done here, cn=child has no memberUrl present. It also behaves perfectly fine if I pull the "objetClass: groupOfURLs" off cn=child. So is this supposed to behave this way? If so can the documentation be updated to indicate this restriction? If not I'd be happy to open an ITS on the issue. -Patrick

2 5

Special characters in distinguished name
by chris_news＠arcor.de 31 Jul '12

31 Jul '12

Hello, are special characters, especially German umlauts, acceptable in the distinguished name? I've accidentally discovered that CPAN's Net::LDAP::Entry module doesn't support them (in the distinguished name). Other attributes are escaped correctly. Thank you in advance. Chris

5 5

Advice for distributing schemas for OpenLDAP
by ghudson＠mit.edu 30 Jul '12

30 Jul '12

MIT krb5 has an LDAP back end for its KDC, which uses its own schema. Currently, we distribute just a .schema file for OpenLDAP, which isn't very friendly to a DS using back-config and slapd.d. I have some questions about how we might do better. 1. For initial installs, I take it we should distribute a .ldif file which can be loaded with ldapadd. If we continue to use our .schema file as the master source file for the time being, then I assume we'll want to convert that to the .ldif file using slaptest. If we do that, should we remove the {n} prefix from the cn of the converted output, along with the metadata entries at the end, to match the style of the .ldif files in servers/slapd/schema? 2. If someone is upgrading to a version of krb5 which has new stuff added to the schema, how should we facilitate that upgrade? I don't think the .ldif file mentioned above would be of much use, since ldapadd will refuse to change an existing entry and ldapmodify wants to see change records. One option is to distribute an LDIF file with a bunch of idempotent modify operations to upgrade the schema. Looking at RFC 2849, I'm not sure you can idempotently create an LDAP entry with LDIF (so this input file couldn't be used for initial installs), but perhaps it's a viable option to bring the olc* attributes on an existing schema entry up to date. Has anyone done something like this before, and is there a good way to generate such an ldapmodify input file from either a .schema file or its attrval-record .ldif equivalent? Another option is to distribute delta LDIF files for each specific upgrade. That seems less friendly to OS packagers, who would then have to identify which upgrades to apply, but perhaps it's a better approach for reasons I don't know yet. If it is the best option, again, is there a good way to generate such delta LDIF files automatically? Thanks for any advice, and apologies if I missed anything in the documentation or mailing list archives.

3 2

Translucent Proxy to filter users
by Joel Eidsath 30 Jul '12

30 Jul '12

Hello, I'm trying to use our corporate openldap server for authentication to an application server (Github Enterprise) that does not support any "memberof" filters for allowed users. As a workaround, I am looking into a translucent proxy server that would only return a subset of users. Github Enterprise would only "see" a few hundred users instead of thousands. Is this doable? Is there a better solution? Joel Eidsath

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical