openldap-technical

openldap-technical@openldap.org

9897 discussions

dsaOperation attributes, relax control and syncrepl
by Clément OUDOT 01 Jun '12

01 Jun '12

Hello, an attribute declared 'dsaOperation' in the schema is not replicated with Syncrepl, this behavior was coded some years ago and it seems right. Today, I updated such attribute (pwdFailureTime) with the relax control and noticed the modification has been replicated. I just wanted to know if this behavior was expected with the relax control, or if this is an issue (the test was done with OpenLDAP 2.4.31). Thanks, Clément OUDOT.

2 3

About not enoguh space - unable to allocate memory for transaction detail
by emiliano ricci 31 May '12

31 May '12

Hello. I have this error: unable to allocate memory for transaction detail - not enoguh space when I try to modify an entry. Any help? Regards Emiliano

1 0

shadowMax
by zingalo 31 May '12

31 May '12

good morning, I've a question about password managing in ldap with samba. I've seen that samba schema's attributes don't have effect on password managing. Only shadowAccount's attribute do it. So i changed shadowMax to "0" for a user and at the next login it tells me "You are required to change your password immediately (password aged) LDAP administrator password: " After entering ldap admin's password it tells me "Authentication token manipulation error". Why? the admin'password is correct, am sure Thanks

2 3

Re: ~*~ [spam] Re: OpenLDAP freeze
by Quanah Gibson-Mount 30 May '12

30 May '12

--On Wednesday, May 30, 2012 7:35 PM +0300 Ioan Indreias <indreias(a)gmail.com> wrote: >> One other thing I would note is that you have failed to provide your >> OpenLDAP configuration (either slapd.conf for a slapcat -n 0 of your >> cn=config DB). > > Actually I have provided the slapd.conf file in my first mail - please > find attached what I have sent at that time. Please keep replies on the list. I looked back at the start of the thread and didn't see any attachments. In any case, I have the following comments and questions. Comments: a) Why are you setting serverID? You aren't doing MMR, or if you are, you have not configured it correctly (There is no mirrormode line set). b) Get rid of the filters=... line in syncrepl config. Just use the default. c) Your attrs=... line in the syncrepl config is invalid. Remove it and just use the default. Questions: a) What kind of filesystem is /storage, where you are storing the databases? b) if you remove the "logold" line from your accesslog configuration, do the deadlocks still occur? --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Good afternoon to all! I am a newbie and I'm installing and configuring my first ldap server for my company. I want to use LDAP as an authentication method on my intranet ( Drupal) and as authentication for ssh. I have read that's what I need to have the attribute 'host' but this attribute is incompatible with 'person', so I can not have fields (name, surname, phone, email) and host. Can you help solve it? Thank you very much!

2 1

Very quick pointer
by Tim Watts 30 May '12

30 May '12

Hi :) My LDAP skillz are (very) slowly coming along - thanks to good folk here, I think I have figured out ACLs and I have managed to get rwm/relay to emulate an old tree structure (well enough) whilst being able to design a better structure for our department. My next question is just a request for a pointer. My understanding of LDAP authentication is very limited. What I would like to do is a 2 phase transition to kerberos (which I do understand): 1) Rig OpenLDAP so all password changes get sent to the kerberos server but do not use it for authentication. In the meantime we will continue authenticate with the SSHA1 hashes in the user's LDAP entry. 2) After some time (months) when everyone has eventually done a password change, the Kerberos server will be well enough in sync. Now I would like to switch OpenLDAP to using kerberos on the backend (ie for binds etc) and I will purge the SSHA1 hashes. ================== I most interested in some pointers for stage 1) is someone could be kind enough to help me out - is there a particular name for this mechanism, or a module that handles this kind of stuff? ================== 2) I think I can probably google for myslef (keywords SASL and/or GSSAPI and/or LDAP+Kerberos. I've had a skim but did not notice an obvious way to handle 1) without 2) I apologise if it's a dumb question :-o Many thanks in advance :) Cheers Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

6 11

Re: Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Thank you for your answer. I'm reading the book published by O'Reilly, LDAP System Administration. However, the world of LDAP is very large and used for many tasks. I am creating my content tree and I can define it in many ways. And I know how to do it or not. Only that. I'm not that person who prefers to ask to learn. Still, thanks! 2012/5/30 Turbo Fredriksson <turbo(a)bayour.com> > On Wed, 30 May 2012 16:58:54 +0200, Carlos Barrero Martínez wrote: > >> Thank you Turbo. >> >> I'm going to see this page to learn more about ldap. However... can >> you tell me how can I do it (attributes host and personal attributes)? >> > > I can, but I'm not going to... And the reason is that LDAP is _way_ to > complicated to teach in a mail or two... > > You really (really, really!!) need to get to the grips on the basics before > you continue. And the others on the list will basically tell you the same > thing. We've all been through this so many times before... > > My HOWTO, but mostly my book, is designed for this specific purpose - teach > beginners the basics and then some. > >

1 0

Re: Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Thank you Turbo. I'm going to see this page to learn more about ldap. However... can you tell me how can I do it (attributes host and personal attributes)? Thanks! 2012/5/30 Turbo Fredriksson <turbo(a)bayour.com> > On Wed, 30 May 2012 15:46:37 +0200, Carlos Barrero Martínez wrote: > >> I am a newbie and I'm installing and configuring my first ldap server >> for my company. >> > > Have a look at http://www.bayour.com/LDAPv3-**HOWTO.html<http://www.bayour.com/LDAPv3-HOWTO.html> > -- > ... but you know as soon as Oracle starts waving its wallet at a Company > it's time to run - fast. > /illumos mailing list >

1 0

acl filter using attribute memberof
by Dorit 30 May '12

30 May '12

1 0

Multi-Master Replication
by Brian Carpio 29 May '12

29 May '12

Hi, I'm currently using Ubuntu 10.04 (I've set this up on RHEL 5.x but the config is way different in Ubuntu). Anyway, at first I figured I had everything working. When I made an update to ldap01 I immediately saw the change on ldap02. However, if I take down slapd on ldap02 (or 01) and I add LDAP entries into ldap01, then bring ldap02's slapd process back online I never see the entries created while slapd was down on ldap02. New entries continue to propigate between ldap01 and ldap02 and long as both servers have the slapd process running, but the entries created when slapd was down on ldap02 never propagate to 02. Here are my configs and ldap versions: ii slapd 2.4.21-0ubuntu5.7 OpenLDAP server (slapd) ---- /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif ----- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 deacdc79 dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=net" write by * none olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=net" write b y * read structuralObjectClass: olcDatabaseConfig entryUUID: 19eb3cc6-3898-1031-954c-351a2fbb42e9 creatorsName: cn=config createTimestamp: 20120522202605Z olcSyncrepl: {0}rid=001 provider="ldap://ldap-01:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple b inddn="cn=admin,dc=example,dc=net" credentials="secret" olcSyncrepl: {1}rid=002 provider="ldap://arch-ldap-02:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple b inddn="cn=admin,dc=example,dc=net" credentials="secret" olcMirrorMode: TRUE entryCSN: 20120528195647.027315Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120528195647Z ---- /etc/ldap/slapd.d/cn=config/olcDatabase={0}config/olcOverlay={0}syncprov.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 807029fa dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 3be00cb6-3dee-1031-8f60-519aa1b6f74f creatorsName: cn=admin,dc=example,dc=net createTimestamp: 20120529152514Z entryCSN: 20120529152514.987191Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120529152514Z ---- /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 1b0a3130 dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=net" write b y * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=net olcRootPW:: e1NTSEF9Ni9IZWJCczRTbmJQYlc4NHFOMWxHWUI5NVNoVUl4U20= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 19ebfdc8-3898-1031-9554-351a2fbb42e9 creatorsName: cn=config createTimestamp: 20120522202605Z olcSyncrepl: {0}rid=001 provider="ldap://ldap-01:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="dc=example,dc=net" attrs="*,+" bindmeth od=simple binddn="cn=admin,dc=example,dc=net" credentials="secret" olcSyncrepl: {1}rid=002 provider="ldap://ldap-02:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="dc=example,dc=net" attrs="*,+" bindmeth od=simple binddn="cn=admin,dc=example,dc=net" credentials="secret" olcMirrorMode: TRUE entryCSN: 20120528195647.026244Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120528195647Z ----- /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb/olcOverlay={0}syncprov.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 807029fa dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 3be00cb6-3dee-1031-8f60-519aa1b6f74f creatorsName: cn=admin,dc=example,dc=net createTimestamp: 20120529152514Z entryCSN: 20120529152514.987191Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120529152514Z

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical