openldap-technical

openldap-technical@openldap.org

23 participants
9804 discussions

RE: pwdPolicySubentry & replication user
by Michael Starling 09 May '12

09 May '12

I also have no issues if I run syncrepl with a provider and consumer. Only mirror mode. Perhaps I'll try downgrading openLDAP. Thanks. Mike Date: Tue, 8 May 2012 16:54:25 -0400 From: brooksct(a)hbcs.org To: mlstarling31(a)hotmail.com CC: openldap-technical(a)openldap.org Subject: RE: pwdPolicySubentry & replication user I run that version without issues, but my infrastructure is still using good old reliable low-bandwidth slurpd, which is no longer supported. I don’t think syncrepl is sufficiently reliable yet, although others disagree. --Charlie From: Michael Starling [mailto:mlstarling31@hotmail.com] Sent: 2012 May 08 4:20 PM To: quanah(a)zimbra.com Cc: openldap Subject: RE: pwdPolicySubentry & replication user Re: Take the issue to Redhat Easier said than done. The policy is what it is but I didn't think it would do any harm to see if anyone has run into this issue. > Date: Tue, 8 May 2012 12:22:58 -0700 > From: quanah(a)zimbra.com > To: mlstarling31(a)hotmail.com > CC: openldap-technical(a)openldap.org > Subject: RE: pwdPolicySubentry & replication user > > --On Tuesday, May 08, 2012 3:07 PM -0400 Michael Starling > <mlstarling31(a)hotmail.com> wrote: > > > > > Unfortunately I have no choice as this is the latest available in the > > RHEL tree and my company won't allow us to deviate and compile. > > Then you will need to take issues to RedHat since your company has an > utterly broken policy. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration ------------------ CONFIDENTIALITY NOTICE --------------- This message, including any attachments, is for the sole use of the intended recipient(s) and may contain privileged confidential information protected by law. Any unauthorized review, use, disclosure or distribution of this message is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of this message. ------------------ CONFIDENTIALITY NOTICE ---------------

1 1

Questions about getting membership of a user
by ctosgh 09 May '12

09 May '12

Hi,All With openldap 2.4.x which supports memberOf overlay. I can get group info with only one search with following configs. <1> [root@/jacky/var]$cat user.ldif dn: cn=jacky,ou=users,dc=jacky,dc=com objectClass: organizationalPerson cn: jacky sn: sun userPassword: 11111111 [root@/jacky/var]$cat JackyGroup.ldif dn: cn=JackyGroup,ou=groups,dc=jacky,dc=com objectClass: groupOfNames cn: JackyGroup member: cn=jacky,ou=users,dc=jacky,dc=com <2> memberOf overlay is configured correctly <3> [root@/jacky/var]$ldapsearch -x -D "cn=root,dc=jacky,dc=com" -b "dc=jacky,dc=com" -H "ldap://x.x.x.x:389" -w xxx -s sub "(cn=jacky)" memberOf # extended LDIF # # LDAPv3 # base <dc=jacky,dc=com> with scope subtree # filter: (cn=jacky) # requesting: memberOf # # jacky, users, jacky.com dn: cn=jacky,ou=users,dc=jacky,dc=com memberOf: cn=JackyGroup,ou=groups,dc=jacky,dc=com [This is what I want] # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 My questions are here: A1: With openldap 2.4.x, if posixAccount is used to manage users, then attribute 'gidNumber' which is a number will represent user's membership. With this case, is it possible that I can get group info(DN format as above) of a user entry by ONLY one search? A2: With older openldap whihc does NOT support memberOf overlay: <1> If organizationalPerson is used to manage users, is it possible that I can get group info(DN format) of a user entry by ONLY one search? <2> If posixAccount is used to manage users, is it possible that I can get group info(DN format) of a user entry by ONLY one search?Any reply is appreciated~TIA Thanks, Jacky

1 1

pwdPolicySubentry & replication user
by Michael Starling 08 May '12

08 May '12

Consider the following password policy entry to disable password expiration. dn: cn=noexpire,ou=policies,dc=umlott,dc=lott cn: noexpire objectClass: pwdPolicy objectClass: person objectClass: top sn: Password Policy pwdAttribute: UserPassword pwdMaxAge: 0 pwdLockout: FALSE description: Non-Expiring password policy for service accounts. =============================================== The following LDIF attaches this policy to the 3 users below: dn: cn=ldapmgr,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott dn: cn=bind,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott dn: cn=replicator,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott This all works well and good when setting up my first LDAP server, however when I setup another LDAP server in mirror mode to the first server the pwdPolicySubentry attribute doesn't carry over to the the second node and I start to see this in the slapd logs: ppolicy_bind: Setting warning for password expiry for cn=replicator,ou=service,dc=umlott,dc=lott = 0 seconds What's interesting is that the other two accounts that have the noexpire policy attached carry over the pwdPolicySubentry attribute just fine to the second node. Any insight would be greatly appreciated. Mike

3 6

acl filter problem
by Dorit 08 May '12

08 May '12

2 4

Memory consumption when increasing BDB_IDL_LOGN
by Meike Stone 07 May '12

07 May '12

Hello, how does the memory usage increase if I increase the BDB_IDL_LOGN? I tried to discover and understand this by searching in the mailing list (Is there is a good guide to understand all of this?). After a search, each returned up ID from bdb is located in one slot in the IDL list. On a x86_64 system, each slot is 8Byte. Each search stack in each thread (threads in slapd.conf) gets his own IDL slots. The default value for the threads are 16. With 16 bit BDB_IDL_LOGN (default) on x86_64 with default threads, we need 64k*8*16 = 1024KB memory? If I increase the BDB_IDL_LOGN to 20 we need 512k*8*16 = 8MB? 1) Are my assumptions above correct? 2) How do I increase LDAP_PVT_THREAD_STACK_SIZE? In my tests I used "4 * 1024 * 1024 * sizeof(void *)" and all tests where running well. 3) Are there other variables to increase before compiling? 4) Here we talk about 8MB memory, did I miss something, that is not the problem today or are there other things I did not catch (other caches in memory e.g. cachesize, dncachesize, idlcachesize or shared memory ...)? 5) What is the amount overall I have to expect for memory consumption? I understand, that after adding and deleting entires, the IDs "sparse out" for one index and we loose precision (if we have after search more IDs than BDB_IDL_LOGN), because using ranges. This Problem will increase as older the database becomes. But if I increase the BDB_IDL_LOGN to my needed size (max expected returned IDs from during search a indexed attibute), the problem with "getting older" is not important for me? Thanks a lot, Meike

2 2

Cached user info?
by Braden McDaniel 07 May '12

07 May '12

I found it necessary to change the GID of a POSIX group defined in LDAP. But when I log in with a user that is a member of this group, I find that the user's group membership still reflects the old GID. At this point, I've tried removing the user from the group, and adding it back--it still comes up with the old GID when logged in (or, specifically, typing "groups" at the command prompt lists a group associated with the old GID), even though I can't see *anything* referencing the old GID in the LDAP database. I am stumped. Anyone have ideas about what might be going on here? -- Braden McDaniel <braden(a)endoframe.com>

4 8

HowTo index generalizedTimeOrderingMatch
by Meike Stone 07 May '12

07 May '12

Hello, I have in my own schema an attribute defined: attributetype (1.3.6.1.4.... NAME ('InsertTime') EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) Now I can use this and search, but it takes very long. So I want index it for searching: * greater (">=") * less ("<=") Is it possible and how can I do this? I have only seen "eq" and "pres". Thanks in advance Meike

3 3

open ldap gruop syncing
by dhanushka ranasinghe 07 May '12

07 May '12

hi guys ,,, i have a master LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=staff,dc=example,dc=com uid=user2,ou=staff,dc=example,dc=com and i want to sync this users to slave ldap server. under OU=staff , in my slave config file i used the following configuration , syncrepl rid=004 provider=ldap://masterldapserver bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="passWord" searchbase="cn=internal,ou=group,dc=example,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" sync seems to be working fine but users appers as [1] but not under OU=staff, [1] dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user1,ou=user,dc=example,dc=com is there any way sort out this issue Thank You Dhanushka

1 0

Can't login with ldap user
by zingalo 04 May '12

04 May '12

Hi, trying to login from my laptop ubuntu 11.10 using ldap user zingalo, appears a black screen and it comes back to login screen. Could you take a look of this paste of syslog please and tell me what do i have to fix? http://pastebin.com/k0dQq6NN Are many lines! Thanks

2 4

openldap to AD proxy
by Alex Samad - Yieldbroker 04 May '12

04 May '12

Hi I am still struggling with the my openldap to AD proxy connection. I have successfully connected such that I can do search when I bind to openldap with an AD dn, but I want to be able to do anon search and I want anon to map through to a dn I have created in AD which has read only rights. dn: olcDatabase={3}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcSuffix: dc=xyz,dc=com olcDburi: "ldap://ldap. xyz.com " olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no olcDbIDAssertBind: bindmethod=none binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no I have a subordinate db at ou=external, DC= xyz,DC=com I can do a ldapsearch -x -D " CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" -b " DC= xyz,DC=com" -w :) what I can't do is ldapsearch -x -b " DC= xyz,DC=com" I am thinking I want to map anon request through to the readonly DN. But still leave it such that when people bind to openldap as themselves they bind to AD as themselves How would I do that ? Thanks Alex

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical