openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

critical applications
by Friedrich Locke 09 Aug '12

09 Aug '12

Dear friends, i am planning to use openldap 2.4.26 and bdb 4.6.21v0 for mission critical application mailing system. I tried some time ago i tried to implement a mail server using qmail, qmail-ldap patch, openldap and bdb but while time passed and email were coming and going, slapd was eating all system memory and needed to be restart. I wonder if someone in the mailing list have used such technologies so far and with which degree of success ? Thanks in advance for your time and cooperation. Best regards. []s gustavo.

2 1

doubt
by Luiz Guilherme Nunes Fernandes 09 Aug '12

09 Aug '12

Dear, i have one doubt, after running slaptest, the error is displayed: slapo-ppolicy cannot be global slaptest: bad configuration file! ########################## My config: # Slapd.conf # Converter slapd.conf para diretório slapd.d # slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d # schema Padrão include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema # schema adicionais include /etc/openldap/schema/collective.schema include /etc/openldap/schema/corba.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/pmi.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/qmail.schema include /etc/openldap/schema/sudo.schema # Permitir o protocolo LDAPv2 allow bind_v2 # Arquivo de informação de processos slapd pidfile /var/run/slapd/slapd.pid # Lista de argumentos que são repassados ao servidoe slapd argsfile /var/run/slapd/slapd.args # Nivel de logs loglevel 256 modulepath /usr/lib/ldap/ moduleload back_bdb.la moduleload ppolicy.la # Politicas de senhas overlay ppolicy ppolicy_default "cn=StandardPolicy,dc=abc" ppolicy_use_lockout # Limites Aplicado a toda as buscas no LDAP, Tamanho e Tempo Limite (Segundos) sizelimit 500 # Número de CPUs Utilizada para criar indíces tool-threads 1 # Banco de Dados backend bdb database bdb # Raiz da estrutura hierarquica da base OpenLdap suffix "dc=abc" # Conta admin da base OpenLdap rootdn "cn=admin,dc=abc" # Senha da conta admin OpenLdap # slappasswd -h {SSHA} -s novasenha -v # novasenha = ####### rootpw ######### # Diretório do banco de dados # Obs: Altere a permissão do diretório "chown -R ldap /var/lib/ldap" directory "/var/lib/ldap" # Quantidade de memória RAM para o cache (2Mb) dbconfig set_cachesize 0 2097152 0 # Núḿero de objetos que podem ser bloqueados ao mesmo tempo dbconfig set_lk_max_objects 1500 # Número de bloqueios dbconfig set_lk_max_locks 1500 # Número de travas dbconfig set_lk_max_lockers 1500 # Opções de indexação para a base #index objectClass eq index uid eq # Armazena o tempo e data das entradas modificadas lastmod on # Checagem periódica da base de dados checkpoint 512 30 # Controle de acessos à base de dados access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=abc" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=abc" write by * read Thanks for attention. -- <<<<<<<<<<<<<<<<<<<------------------------------>>>>>>>>>>>>>>>>>>> -=| A idéia de um fim que termina em um início. |=- Att. ♪ ♫ Luiz Guilherme Nunes Fernandes ♫ ♪ <<<<<<<<<<<<<<<<<<<------------------------------>>>>>>>>>>>>>>>>>>>

2 1

Newbie Question about adding 2nd entry for admin
by Tech Only 09 Aug '12

09 Aug '12

Hello, I am a newbie. Trying to learn ldap. Is it possible to add second admin user to openldap? Like manager/admin? If yes, please post the ldif entry. If this is a wrong forum please let me know where I can post it? Thanks, ST

2 1

ACL: access to all values vs. to value
by Dora Paula 09 Aug '12

09 Aug '12

Hi list, is there a possibility to create an acl statement that grants access to any (unknown) value of an attribute but denys access to all values of the same attribute? For example: # allow this: dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description description: PersonA's description # deny this: dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description - Thank you very much.

1 0

LDAP Entry with gecos
by rodrigo tavares 09 Aug '12

09 Aug '12

Hello ! I create one samba user with command: smbldap-useradd -a xbox -c "Game XBOX" -S "Sell games" -d /home/xbox -s /bin/false Then I type: smbldap-passwd xbox #define password ldap user smbpasswd -a xbox # create user samba So. I can to make login in my domain. I checked atributtes gecos is: SystemUser. After I log in domain, in the top menu windows show:System User. I changed this value gecos, but each login the gecos show System User. It´s no changed never. This command in line 2, not define gecos in LDAP, give default with "System user". If i change the value gecos in LDAP before te fist login, the gecos is with value correct. Any sugesstion ? Thanks. Rodrigo Faria

2 2

openldap + qmail + openbsd
by Friedrich Locke 09 Aug '12

09 Aug '12

Dear fellows, i am planning to build a mail server and would like to use the following technologies : OpenBSD 5.1 amd64 qmail-ldap-1.03-20120221 qmail-1.03 Does anybody here run an environment like ? Are you aware of buggy stuf like openldap eating all system memory while qmail connect/disconnect to it (slapd) ? Is there any problem with the latest ldap patch release to be applied to stock qmail-1.03 ? Thanks a lot for your time and cooperation. []s gustavo. PS: Anyone from Brazil in this mailing list ? Using such technologies ?

1 0

got into a "checksum error" situation
by Jeff Dickens 08 Aug '12

08 Aug '12

I was following an Ubuntu howto at https://help.ubuntu.com/12.04/serverguide/openldap-server.html ,which has served me well so far, and I was working on the part where TLS is set up. I made an ldif file like: dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/grackle_slapd_cert.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/grackle_slapd_key.pem and, well, I blew it.. I initially had a typo in it, and the server cert and key weren't where I said they were. I ran ldapmodify to load the ldif file above: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/certinfo.ldif Then I tried to restart slapd, and perhaps unsurprisingly it did not restart. Aug 8 16:41:30 grackle slapd[1660]: @(#) $OpenLDAP: slapd (Jul 26 2012 00:10:41) $#012#011buildd@aatxe :/build/buildd/openldap-2.4.28/debian/build/servers/slapd Aug 8 16:41:30 grackle slapd[1660]: main: TLS init def ctx failed: -1 Aug 8 16:41:30 grackle slapd[1660]: slapd stopped. Aug 8 16:41:30 grackle slapd[1660]: connections_destroy: nothing to destroy. So I thought I just fix my ldif file, which I did, and then run ldapmodify again. But no, that clearly wasn't going to work because slapd wasn't running. Not knowing what else to do, I removed the lines containing "olcTLS" from /etc/ldap/slapd.d/cn=config.ldif. Then I was able to restart slapd (congratulating myself) and then re-ran my ldapmodify command to enter the correct locations of the cert and key. But I still get a checksum error in syslog: Aug 8 17:04:53 grackle slapd[2028]: slapd starting Aug 8 17:05:01 grackle slapd[2028]: ldif_read_file: checksum error on "/etc/ldap /slapd.d/cn=config.ldif" I haven't even tried to see if I have TLS working, but I have two questions: #1. How should I have recovered from this (human) error? What I did didn't seem to work out very well. and #2. How do I un-screw my config and resolve the checksum problem? Thanks in advance for any assistance. -- * Jeff Dickens* IT Manager 978-632-1513

1 0

Virtual view using slapd-relay: dn mapping failure
by Guillaume Rousse 08 Aug '12

08 Aug '12

Hello list. I'm trying to provide a virtual view of the user branch in my legacy ldap directory. Basically, the real branch uses 'localLogin' as login attribute, and not 'uid', as usual, which unfortunatly breaks hard-coded rules in some applications. This configuration creates a virtual 'ou=users' branch, mapped on actual 'ou=people', with real 'localLogin' attribute mapped to 'uid', and real 'uid' one removed: # virtual database database relay suffix ou=users,dc=domain relay ou=people,dc=domain overlay rwm rwm-suffixmassage ou=people,dc=domain rwm-map attribute uid localLogin rwm-map attribute uid access to dn.subtree="ou=users,dc=domain" attrs=userPassword by anonymous auth access to dn.subtree="ou=users,dc=domain" by * read # main database database bdb suffix "dc=domain" However, the actual 'uid' attribute is also used as RDN in the actual branch, and bind operation fails, because DN mapping is incomplete: uid=rousse,ou=users,dc=domain -> uid=rousse,ou=people,dc=domain Wheras I'd need this, where somethingelse is the value for the actual 'uid' attribute: uid=rousse,ou=users,dc=domain -> uid=somethingelse,ou=people,dc=domain I read rwm man page carefully, but it is a bit tough to understand. So, how am I supposed to achieve this ? -- BOFH excuse #219: Recursivity. Call back if it happens again.

1 1

(no subject)
by 非人協會 08 Aug '12

08 Aug '12

Dear All, I am new to ldap, I would like to have your kindness assistance in setting up the directory. We are working on move our old ldap server to a new openldap server, I have install the openldap in Solaris 10 x86 successfully. However I am not able to browse the content using the ldap browser, it shows "Invalid Credentials". this is what we change in slapd.conf suffix "o=Cname" rootdn "cn=Manager,ou=Dname,o=Cname" rootpw password This is what we have in slapd.ldif olcSuffix: o=Cname olcRootDN: cn=Manager,ou=Dname,o=Cname olcRootPW: password Herewith is the debug log 5021e2df daemon: activity on 1 descriptor 5021e2df slap_listener_activate(8): 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df >>> slap_listener(ldap:///) 5021e2df daemon: select: listen=8 busy 5021e2df daemon: listen=8, new connection on 12 5021e2df daemon: activity on 1 descriptor 5021e2df daemon: added 12r (active) listener=0 5021e2df conn=1002 fd=12 ACCEPT from IP=10.122.39.115:54220 (IP=0.0.0.0:389) 5021e2df daemon: waked 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL 5021e2df daemon: activity on 1 descriptor 5021e2df daemon: activity on:5021e2df 12r5021e2df 5021e2df daemon: read activity on 12 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df connection_get(12) 5021e2df connection_get(12): got connid=1002 5021e2df connection_read(12): checking for input on id=1002 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL ber_get_next ldap_read: want=8, got=8 0000: 30 2f 02 01 04 60 2a 02 0/...`*. ldap_read: want=41, got=41 0000: 01 03 04 1b 63 6e 3d 4d 61 6e 61 67 65 72 2c 6f ....cn=Manager,o 0010: 75 3d 44 6e 61 6d 65 2c 6f 3d 43 6e 61 6d 65 80 u=Dname,o=Cname. 0020: 08 70 61 73 73 77 6f 72 64 .password ber_get_next: tag 0x30 len 47 contents: ber_dump: buf=83e3f10 ptr=83e3f10 end=83e3f3f len=47 0000: 02 01 04 60 2a 02 01 03 04 1b 63 6e 3d 4d 61 6e ...`*.....cn=Man 0010: 61 67 65 72 2c 6f 75 3d 44 6e 61 6d 65 2c 6f 3d ager,ou=Dname,o= 0020: 43 6e 61 6d 65 80 08 70 61 73 73 77 6f 72 64 Cname..password 5021e2df op tag 0x60, time 1344398047 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable 5021e2df daemon: activity on 1 descriptor 5021e2df conn=1002 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=83e3f10 ptr=83e3f13 end=83e3f3f len=44 0000: 60 2a 02 01 03 04 1b 63 6e 3d 4d 61 6e 61 67 65 `*.....cn=Manage 0010: 72 2c 6f 75 3d 44 6e 61 6d 65 2c 6f 3d 43 6e 61 r,ou=Dname,o=Cna 0020: 6d 65 80 08 70 61 73 73 77 6f 72 64 me..password ber_scanf fmt (m}) ber: ber_dump: buf=83e3f10 ptr=83e3f35 end=83e3f3f len=10 0000: 00 08 70 61 73 73 77 6f 72 64 ..password 5021e2df >>> dnPrettyNormal: <cn=Manager,ou=Dname,o=Cname> 5021e2df daemon: waked => ldap_bv2dn(cn=Manager,ou=Dname,o=Cname,0) <= ldap_bv2dn(cn=Manager,ou=Dname,o=Cname)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Manager,ou=Dname,o=Cname)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,ou=dname,o=cname)=0 5021e2df <<< dnPrettyNormal: <cn=Manager,ou=Dname,o=Cname>, <cn=manager,ou=dname,o=cname> 5021e2df conn=1002 op=0 BIND dn="cn=Manager,ou=Dname,o=Cname" method=128 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df do_bind: version=3 dn="cn=Manager,ou=Dname,o=Cname" method=128 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL 5021e2df ==> bdb_bind: dn: cn=Manager,ou=Dname,o=Cname 5021e2df bdb_dn2entry("cn=manager,ou=dname,o=cname") 5021e2df => bdb_dn2id("o=cname") 5021e2df <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) 5021e2df send_ldap_result: conn=1002 op=0 p=3 5021e2df send_ldap_result: err=49 matched="" text="" 5021e2df send_ldap_response: msgid=4 tag=97 err=49 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 04 61 07 0a 01 31 04 00 04 00 0....a...1.... ldap_write: want=14, written=14 0000: 30 0c 02 01 04 61 07 0a 01 31 04 00 04 00 0....a...1.... 5021e2df conn=1002 op=0 RESULT tag=97 err=49 text= 5021e2df daemon: activity on 1 descriptor 5021e2df daemon: activity on:5021e2df 12r5021e2df 5021e2df daemon: read activity on 12 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df connection_get(12) 5021e2df connection_get(12): got connid=1002 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL 5021e2df connection_read(12): checking for input on id=1002 ber_get_next ldap_read: want=8 error=Connection reset by peer 5021e2df ber_get_next on fd 12 failed errno=131 (Connection reset by peer) 5021e2df connection_read(12): input error=-2 id=1002, closing. 5021e2df connection_closing: readying conn=1002 sd=12 for close 5021e2df connection_close: conn=1002 sd=12 5021e2df daemon: removing 12 5021e2df daemon: activity on 1 descriptor 5021e2df conn=1002 fd=12 closed (connection lost) 5021e2df daemon: waked 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL Any help would be greatly appreciated Thanks and Regards, Donald

1 0

sasl bind error -1 because of socket error 54
by Max Kunz 07 Aug '12

07 Aug '12

Hello, i try to bind to an server using the ldap_sals_bind_s function. The Host is not localhost, but is accessible via internet. I'v tested the connection with a java based ldap browser. When i try to do this using my simple c++ program, it fails with error -1. Here is what the program actually do: //initialize returns success result = ldap_initialize( &ld, host); result = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, LDAP_VERSION3); //set this option only after successful bind? result = ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER); //the synchronous bind function returns -1 server down result = ldap_sasl_bind_s(ld, root_dn, LDAP_SASL_SIMPLE, &credential, NULL,NULL, &serverReturnedCredentials); When I use the asynchronous ldap_sals_bind() function, it returns 0 ldap_success. (I`m also able to create a simple socket to this particular server and port). The error -1 comes from the following ldap_result() function. The problem here is that the socket throws a sock_errno 54 (connection reset by peer). Someone an idea why the connection always will be disturbed? Thanks for any help best regards, Max

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical