openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

Syncrepl replication does not work always
by Efstathios Xagoraris 07 Jun '12

07 Jun '12

Hello to everyone, I have a working OpenLDAP setup ( 2.3.43 - Centos 5.8 RPM ) with a Master LDAP and consumers worldwide across datacenters. I also monitor if directories from Consumers are in Sync with the master. Consumers sometimes fail to communicate with master ldap and replicate.Syncrepl retry interval does not work at that time. If i restart consumer LDAP service everything works as expected,changes replicate successfully. My consumer interval is 1 minute but when the directories are not in sync i dont see syncrepl messages in my logs. My logs: Jun 7 02:22:12 xxx slapd[26433]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT (Normal ...) Jun 7 02:23:12 xxx slapd[26433]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT (Normal ...) >From now on .. syncrepl does not appear on logs, i got only that line Jun 7 02:27:22 xxx slapd[26433]: do_syncrep1: rid 007 ldap_sasl_bind_s failed (-1) I restart ldap service and everything works as expected Jun 7 17:06:40 xxx slapd[4397]: syncrepl_entry: rid 007 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 7 17:06:40 xxx slapd[4397]: syncrepl_entry: rid 007 be_search (0) Jun 7 17:06:42 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT Jun 7 17:07:44 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT Jun 7 17:08:45 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT My consumers config: syncrepl rid=007 provider=ldaps://master:636 bindmethod=simple binddn="cn=xxx,dc=xxx,dc=xxx" credentials=xxxx searchbase="dc=xxx,dc=xxx" scope=sub schemachecking=on #type=refreshAndPersist #retry="30 20 60 +" type=refreshOnly interval=00:00:01:00 updateref ldaps://master And my master config: database bdb suffix "dc=xxx,dc=xxx" rootdn "cn=xxx,dc=xxx,dc=xxx" rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname,gecos,description eq,pres,sub index uidNumber,gidNumber,uniqueMember,homeDirectory,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub loglevel 256 16384 logfile /var/log/ldap.log overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 At the same time,when my directories are not in sync,my consumer in the same datacenter as the master is always in sync.This is fixed when i restart ldap service on consumers.Replication works for some hours after the restart and the interval consumers do not replicate is kind of random. Maybe a network issue as passing through firewall to reach consumers in other datacenters ? I have also tried changing the type of syncrepl to refreshAndPersist and the issue still exists. It seems this issue is similar to this ( http://www.openldap.org/lists/openldap-technical/200905/msg00024.html ) but i thought pull bashed syncrepl from refreshOnly should not be impacted from states being dropped. << This sort of problem with long-lived connections is often due to state being dropped from IP-level devices. >> Thanks a lot everyone

3 3

there is no schema by the directory
by Daniel Peinado Lopez 07 Jun '12

07 Jun '12

Hello, I have installed openldap in Fedora. First I deleted the openldap installation. (var/lib/ldap and etc/openldap) Then I wrote: yum reinstall openldap-client openldap-server openldap I configured slapd.conf with my domain, the root password with slappasswd, ldap.conf with my BASE and HOST. I copied the DB_CONFIG.example to /var/lib/ldap. I did my base.ldif of the structure of my LDAP and "ldapadd" everything succesfully. I use jXplore and Apache Directory Studio to manage my LDAP from Windows, because it´s installed in one server. The problem is that when I try to add users it says I have no schema. Apache Directory Studio creates its own schema, and I can add data. But after that schema disapears and I can't work with jXplorer. Thank you very much * * Daniel Peinado López *IANT - APPLIED NGN-TECHNOLOGIES **Turn-Key VoIP/UC Solutions and More... *Fon: +49 (5331) 6794 400 Fax: +49 (5331) 6794 499 Mail: daniel.peinado(a)iant.de <jan.schumacher(a)iant.de> Web: www.iant.de <http://www.iant.de/en/startseite> IANT is eZuce <http://www.ezuce.com/> Elite Partner for EMEA IANT is Member of GROUPLINK <http://www.grouplink.de/>

2 1

bind as users logging/authenticating into solaris with ldap client configured
by curious penguin 06 Jun '12

06 Jun '12

My solaris machine is configured to authenticate to an openldap server but is currently binding anonymously. How do I reconfigure its ldap client to bind as the user that its trying to query from the ldap server?

1 0

Pass-though Authentication with Saslauthd and Kerberos
by Jeff B 06 Jun '12

06 Jun '12

I'm attempting to get pass-though auth to work against saslauthd and kerberos and while the problem seems to be in sasl I think it's most likely to be seen in this type of configuration with opendap which I why I chose this mailing list. When I run testsaslauthd it works but when I run ldapsearch it fails. But the curious thing is where it is failing. in doing straces of saslauthd and packet traces I've found that when ldapsearch calls salsauthd, and not when I run saslauthd kerberos does not deliver the AS-REP packets till just after saslauthd times out. I can't find any difference in how I'm invoking saslauthd with testdaslauthd and how ldapsearch is invoking saslauthd. However the packet traces are quite different as you will see below. I've seen these kind of errors here and there on google but no resolutions that I can find. (http://www.openldap.org/lists/openldap-software/200602/msg00278.html) Centos 6 openldap-2.4.23-15.el6_1.3.x86_64 openldap-clients-2.4.23-15.el6_1.3.x86_64 openldap-servers-2.4.23-15.el6_1.3.x86_64 openldap-devel-2.4.23-15.el6_1.3.x86_64 krb5-server-1.9-9.el6_1.2.x86_64 krb5-server-ldap-1.9-9.el6_1.2.x86_64 krb5-workstation-1.9-9.el6_1.2.x86_64 krb5-libs-1.9-9.el6_1.2.x86_64 cyrus-sasl-2.1.23-8.el6.x86_64 cyrus-sasl-lib-2.1.23-8.el6.x86_64 cyrus-sasl-gssapi-2.1.23-8.el6.x86_64 cyrus-sasl-plain-2.1.23-8.el6.x86_64 cyrus-sasl-devel-2.1.23-8.el6.x86_64 My slapd.conf contains nothing regarding kerberos / sasl / pass-through authentication. I'm using a slapd.conf file for the time being till i get it all worked out and plan on converting it to a cn=config configuration. In my DIT the userPassword field contains: {SASL}myuser@MYREALM where myuser and my realm are replaced with the proper values. /etc/sasl2/slapd.conf: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux /etc/sysconfig/saslauthd KRB5_KTNAME=/etc/krb5.keytab SOCKETDIR=/var/run/saslauthd MECH=kerberos5 Which builds a daemon command line of: /usr/sbin/saslauthd -m /var/run/saslauthd -a kerberos5 My system keytab is: /etc/krb5.keytab (root.ldap 0640) host/my.hostname@realm ldap/my.hostname@realm My socket parent dir is: /var/run/saslauthd (root.ldap 0770) When I run testsaslauthd I get a packet trace between saslauthd and kerberos is all UDP and works: > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ < AS-REP > TGS-REQ < TGS-REP When I run ldapsearch the packet trace between saslauthd and kerberos is UDP and TCP communication. None of the kerberos replies come back for 18 seconds, the time it takes saslauthd to time out. > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ > TCP SYN < TCP SYN, ACK > TCP ACK > TCP AS-REQ < TCP ACK > AS-REQ > AS-REQ > TCP FIN, ACK <-- saslauthd times out and the AS-REPS all come back at once. < AS-REP < AS-REP < AS-REP < TCP AS-REP > TCP RST an strace of saslauthd supports this timeout theory as it shows the the timeouts and backoffs. I can't find any info regarding saslauthd and TCP or UDP or timeouts like this. Any ideas?

5 7

Wildcard and Internal Domain
by Leonardo 06 Jun '12

06 Jun '12

Dear Colleagues. I attempted implementing certificates with wildcard to my internals servers. I have a Internal Certification Authority and it certificate was distributed to ours Browsers on Workstations that have a need to access the servers by Web Browser. I generated a certificate with wildcard for my servers and when i access the servers by web browser the following message is showed "O servidor v221t001.prevnet usa um certificado de segurança inválido. O certificado é válido somente para *.prevnet. (Código do erro: ssl_error_bad_cert_domain)". I would like some help to solve it problem. I thank everyone for attention.

2 3

slaptest conversion of acl regex's drops backslashes
by Nick Milas 06 Jun '12

06 Jun '12

Hi, I used slaptest to convert a set of ACLs from standard to dynamic format using slaptest. I noticed that backslashes (used to escape characters) in regexes are silently dropped after conversion. For example: access to dn.regex="^dc=\b\d{1,3}\.\d{1,3}\.\d{1,3}\b\.in-addr\.arpa,ou=dns,dc=example,dc=com$" by group.exact="cn=Admins,ou=Groups,dc=example,dc=com" write becomes: olcAccess: {xx}to dn.regex="^dc=\b\d{1,3}\.\d{1,3}\.\d{1,3}\b\.in-addr\.arpa,ou=dns,dc=example,dc=com$" by group/groupOfNames/member.exact="cn=admins,ou=groups,dc=noa,dc=gr" write Is this expected behavior? Or am I doing something wrong? Please advise. Thanks, Nick

2 6

ACL rule match if client certificate was used?
by Patrick Hemmer 05 Jun '12

05 Jun '12

Is there any way to create an ACL rule which will match if a client certificate was used on the connection or not? I'd like to do an ACL such as to attrs=userPassword by peername.ip="1.2.3.0%255.255.255.0" auth by client_ssf="64" auth Also set olcTLSVerifyClient=try This will let our internal network authenticate against ldap without needing a client cert, but anyone outside our internal network must have one. We would then use our own CA to create certificates for all the clients and tell OpenLDAP to trust only that CA. Obviously client_ssf doesnt exist, but is there another way of accomplishing this goal? -Patrick

3 4

openldap gssapi bind
by Sajid K 05 Jun '12

05 Jun '12

hi, i'm writing an AD client for mac i'm able to get a kerberos ticket and can also bind to AD using ldap_gssapi_bind and everything works fine I can do searches modify/create attributes etc. when I unbind and try to bind to a different server, it hangs in a "select" call inside openldap lib. even though I've successfully got a TGS ticket before binding. I'm using heimdal for kerberos implementation. I also have cyrusSASL in the project. in one of my test environments it tries to go back to old "server" to get ticket. so I'm assuming there is some sort of caching involved here. before rebinding I always delete the credential cache file and krb5.conf and re create them for new server. I'm not using an conf file with openldap. What could be going on is there some kind of caching somewhere in library? there are no errors when unbinding and I can also see a call getting to server when I unbind. Thanks..

3 2

Re: Replication and user password change
by Hugo Deprez 04 Jun '12

04 Jun '12

Hello, I am trying to do some quite the same thing : trying to send failed authentification made on the consumer to the master. I am using ppolicy overlay. I added the following to the consumer : # Referal updateref ldaps://master.domain.fr ppolicy_forward_updates When I add this on the consumer, accounts are not anymore locked on failed authentification. pwdFailureTime are not register or sent to the master.. Should I use slapo-chain too ? Regards, Hugo On 6 April 2012 18:12, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, April 06, 2012 3:57 PM +0200 Jacques Foucry > <jacques.foucry(a)novasparks.com> wrote: > >> On 04/04/2012 05:59 PM, anax wrote: >> >> Hello, >> >>> updateref ldap://ldapmaster.symas.com >>> >>> http://www.openldap.org/doc/admin24/replication.html#Replication%20Techn >>> ology >> >> >> Well after reading the docs, I made some test on a VM. >> >> My goal is to allow users to change there password. >> >> I have a working replication VM. On this VM I can login with my LDAP >> password (PAM on this VM is client of the replica). >> >> When I try to change the password, using the passwd cmd this error occurs: > > > I suggest you look at slapo-chain. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 4

ACL control with break
by Nick Milas 04 Jun '12

04 Jun '12

At slapd.access we read (about the control keywords): One useful application is to easily grant write privileges to an updatedn that is different from the rootdn. In this case, since the updatedn needs write access to (almost) all data, one can use access to * by dn.exact="cn=The Update DN,dc=example,dc=com" write by * break as the first access rule. As a consequence, unless the operation is performed with the updatedn identity, control is passed straight to the subsequent rules. I have the following question. If below the above ACL we add another ACL like: access to dn.subtree="ou=people,dc=example,dc=com" by dn.exact="cn=Some Other DN,dc=example,dc=com" by * none ...doesn't this mean that the second ACL will override the first, so that "The Update DN" will no longer have access to the whole DIT (as was intended), since, based on the second ACL, "The Update DN"does not have access to "ou=people" branch? If this is the case, then the first ACL is not enough, but care must be taken to avoid any privilege revocation(s) from "The Update DN", by following ACLs. Or the existence of the former rule means that access has been *definitively decided* for "The Update DN" (i.e. "by" clause match(es) in the first ACL) and any subsequent access statements (later ACLs) can affect *ONLY* other users (i.e. whatever "by" clause matches, *except* "The Update DN")?? This is what I understand from the statement "As a consequence, unless the operation is performed with the updatedn identity, control is passed straight to the subsequent rules." Can you please clarify which is the case? Thanks, Nick

3 9

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical