openldap-technical

openldap-technical@openldap.org

22 participants
9803 discussions

slapd/slaptest fail with cyrus-sasl-2.1.25
by Markus Wernig 28 Feb '12

28 Feb '12

Hello all I have openldap-2.4.29 on x86 Solaris 11, compiled from source. It links against cyrus-sasl libraries, also compiled from source. All was working well with cyrus-sasl-2.1.23. After upgrading sasl to 2.1.25 slapd refuses to start: # /usr/local/libexec/slapd -d 8 4f4a8bad @(#) $OpenLDAP: slapd 2.4.29 (Feb 26 2012 19:45:45) $ @xfer-srv01:/opt/build.d/openldap-2/tmp/openldap-2.4.29/servers/slapd 4f4a8bad slap_sasl_init: auxprop add plugin failed 4f4a8bad slapd stopped. 4f4a8bad connections_destroy: nothing to destroy. If i downgrade cyrus-sasl again to 2.1.23, the error does not occur and slapd works normally without recompiling. I have seen bug reports about a similar problem with debian, and from that report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628237) it seemed that the problem lies with the sasl library, but should be fixed in the meantime. But still, I keep getting that error, and no configuration or compilation option (apart from totally disabling sasl) will help. Does anybody have an idea of how I could debug this further? Is this still a known issue? Thanks /markus

3 4

Re: the root of the directory tree
by stefano 28 Feb '12

28 Feb '12

ok, thanks other question: i'm working on a lan with students, teachers, some guests and a pair of administrators. i need that everyone can authenticate himself on the lan. there are some computers in a room and i want they will be powered on will appear a display to log in. the same thing for every computer that will be connect to our local network. every user will have his permissions to visit different sites, to see server resources, etc. i don't know how prepare this but for the moment am preparing the server populating it with every user. Now i need to know one thing. with the my configuration idea, is it enough to have the Simple Binding inserting only the userPassword of Person objectClass? do i need also account and simpleSecurityObject classes? On 02/28/2012 10:11 AM, Turbo Fredriksson wrote: > On Tue, 28 Feb 2012 08:02:42 +0100, stefano wrote: >> I am preparing an ldap server to allow every user to access the LAN >> only with his username and password. the root of the directorytree can >> be invented? i invented a domain amahoro.bi, can be correct? > > Sure. As long as you don't plan on publish it in any way and ONLY use > it internally, > that would work. > > Your base DN would then be: 'dc=amahora,dc=bi'. > > It's not the best of ideas (best is to register a domain name and use > that), but > functionally perfectly fine. > -- > ... but you know as soon as Oracle starts waving its wallet at a > Company it's time to run - fast. > /illumos mailing list >

4 4

the root of the directory tree
by stefano 28 Feb '12

28 Feb '12

good morning. i have a simple question for you. I am preparinganldapserverto allowevery user toaccess theLANonly withhis usernameand password.therootof thedirectorytreecanbeinvented?iinventeda domainamahoro.bi, canbecorrect? thanks

1 0

Mozilla NSS -- how to deploy intermediate certificate
by Aaron Bennett 27 Feb '12

27 Feb '12

Hello, I need to publish the GeoTrust intermediate certificate; I'm using 2.4.29 built against Mozilla NSS. In OpenSSL world, I'd use -- I think -- TLSCACertificateFile /path/to/CA-certificates. Here's what I've tried: Download GeoTrust cert from https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id… ; save as intermediate.crt Import with: # certutil -d /etc/openldap/nssdb/ -A -t ",," -n geotrust-intermediate -i intermediate.crt Certutil -L now shows: # certutil -d /etc/openldap/nssdb/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI geotrust-intermediate ,, ds.clarku.edu Pu,Pu,Pu cn=config looks like this: olcTLSCACertificateFile: geotrust-intermediate olcTLSCACertificatePath: /etc/openldap/nssdb olcTLSCertificateFile: ds.clarku.edu But still clients cannot verify the cert. Any Mozilla NSS guru's know what I'm going wrong? Thanks, Aaron

4 14

Resync DEL
by Marc Patermann 27 Feb '12

27 Feb '12

Hi, due to the "DEL don't get replicated" issue, I have inconsistent data on the consumers. I set up a test pair with a provider with current master data and a consumer with current slave data. The data set differs in a few entries which DEL were not replicated. Is there any way to get the two server on sync again other then completely delete the database and refill (by slapadd from master or full resync) on the consumer? I tried (with various combinations of 2.4.26, 2.4.28 and current pre 2.4.30) to start the consumer with "-c rid=xxx,csn=" which starts a full sync, but the (on the master not existing) objects don't get deleted (on the slave). Marc

4 7

require StartTLS
by Daniel Pocock 26 Feb '12

26 Feb '12

Is there some way to ensure that a client who connects on port 389 can do nothing without StartTLS? Or is it necessary to just disable port 389 and only listen for ldaps:/// ?

6 7

Private OID range(s) ?
by Nick Milas 26 Feb '12

26 Feb '12

Hello, I was wondering whether there exists - officially or unofficially - a range of private OIDs which can be used internally (privately) in an organization, and is not allowed for schema distribution; something like private network IP address ranges (10.0.0.0/8, etc.) The existence of such private OIDs would allow organizations to avoid registering their own OID branch, since the "private" OID range would guarrantee that these OIDs can be used internally by the organization safely and would not be included in a new schema distribution; thus, conflicts can be excluded. Any organization which would be using such a "private OID range", should not be allowed to make the associated LDAP attributes publicly available (not even searchable) in its Directory interations. Secondarily, the above would also serve as an "example" range of OIDs which could be used for communication of schema drafts. I haven't come across something like this until now. Thanks, Nick

5 10

Re: RE24 testing call#1 (2.4.30)
by Jens Vagelpohl 26 Feb '12

26 Feb '12

On Feb 24, 2012, at 19:20 , Quanah Gibson-Mount wrote: > If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.30 release, please do so. All OK on OS X 10.7.3 x86_64 against BDB 4.7.52+patches jens

2 1

Controlling access based on group membership
by Nick Milas 24 Feb '12

24 Feb '12

Hi, I have a problem of long and complex ACLs which I need to improve. Therefore, I am thinking of a way to change privilege (access) management. I have dc=example,dc=com, with branches ou=people, ou=aliases (for email use), ou=dns (dns entries), ou=Groups. In ou=Groups entries are of the form: dn: cn=TechAdmins,ou=Groups,dc=example,dc=com objectClass: groupOfNames cn: TechAdmins member: uid=jack,ou=people,dc=example,dc=com member: uid=jeff,ou=people,dc=example,dc=com I would like to be able to control access to any and all entries based on attributes (to be added to the entries) which specify a group to be used for administration. So, for example, I could add to all entries an AUXiliary objectClass (hypothetical at the moment) "AdminGroupOwnership" with (multi-valued) attributes: AdminGroups and ReadGroups, SearchGroups with values of the form: cn=<groupname>,ou=Groups,dc=example,dc=com. Members of the first would have write access, members of the second would have read access, and members of the third would have search access only. I would like to ask the list: 1. Can someone demonstrate how we should formulate an ACL which would accomplish the above? The ACL should say: access to <some entries> <some attribute> by {a DN which belongs to a Group specified in the AdminGroups attr of the entry} write by {a DN which belongs to a Group specified in the ReadGroups attr of the entry} read by {a DN which belongs to a Group specified in the SearchGroups attr of the entry} search 2. Is there an existing (included in the distribution or available from a third-party) schema or similar mechanism available (so that I don't re-invent the wheel)? Thanks in advance, Nick

3 10

How to delete openldap database
by Peter Blajev 24 Feb '12

24 Feb '12

Fresh install of openldap 2.4.23 and friends on RHEL6/CentOS6 comes with dc=my-domain,dc=com database. After starting slapd when I try to delete it the server is not willing to perform: ==== # ldapsearch -x -LLL -s base namingContexts dn: namingContexts: dc=my-domain,dc=com # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn dn: cn=config dn: cn=schema,cn=config dn: cn={0}corba,cn=schema,cn=config ... (snip) ... dn: olcDatabase={2}bdb,cn=config # ldapdelete -Q -Y EXTERNAL -H ldapi:/// -v olcDatabase={2}bdb,cn=config ldap_initialize( ldapi:///??base ) deleting entry "olcDatabase={2}bdb,cn=config" ldap_delete: Server is unwilling to perform (53) ==== I can delete /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif file before starting slapd but what is the proper way of deleting this database? Thank you -- Peter

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical