openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: circularly MMR Replication ?
by Meike Stone 19 Feb '12

19 Feb '12

> If you've got 5 hosts, Each host should connect to 3 other hosts for a mesh > network wherein any node can fail and the others remain online without > requiring every host be connected to every other host. Ok, But what is a/the recommended replication setup? It depends on the requirements if availability but also on the bandwidth between the loaction, hardware. If I configure such setup, it is much more complex like a circle. The hardware and bandwidth using for each server increases a lot. We also want use one load balancer (one vrrp pair) in each location. So each master has additionally a few ro slaves! The application separates write and read access to two vips on the load balancer. If the load balancer can't reach the local master, all further request (ro and rw) are directed to the closest remote location and LDAP-Servers. I also saw the last mail from Howard in the openldap-devel ml regarding "ITS#7052" and ITS#6024. So I'm absolutely unsure, what I should configure! Are there recommendations or practical experiences? > If any one host > should be considdered a true master, you're better off with a standard star > topology where all updates go to the master. You mean "If only one host ..."? then I understand this recommendation Thanks Meike

2 2

Changing schema OID values in cn=config
by Nick Milas 17 Feb '12

17 Feb '12

Hello, In my config there is: DN: cn={5}postfix,cn=schema,cn=config objectClass: olcSchemaConfig cn: {5}postfix olcAttributeTypes: {0}( 1.3.6.1.4.1.25260.1.000 NAME 'mailacceptinggeneralid' DESC 'Defines an address that we accept mail for' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.25260.1.001 NAME 'maildrop' DESC 'Defines the address mail goes to' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.25260.1.002 NAME 'mailacceptinguser' DESC 'Defines if this user accepts mail' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.25260.1.003 NAME 'aliasInactive' DESC 'A flag, for marking the alias as not in use' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.25260.1.1.100 NAME 'virtualaccount' DESC 'Holds mail info for a virtual account' STRUCTURAL MUST ( owner $ mailacceptinggeneralid $ maildrop $ cn ) MAY ( description $ aliasInactive ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.25260.1.1.101 NAME 'maillist' DESC 'Virtual account for holding mailing list info' STRUCTURAL MUST ( mailacceptinggeneralid $ maildrop $ cn ) MAY ( owner $ description $ aliasInactive ) ) olcObjectClasses: {2}( 1.3.6.1.4.1.25260.1.1.102 NAME 'mailAccount' DESC 'Email account details' AUXILIARY MUST ( mailacceptinguser $ maildrop $ cn ) MAY ( mailacceptinggeneralid $ aliasInactive ) ) olcObjectClasses: {3}( 1.3.6.1.4.1.25260.1.1.105 NAME 'virtualbox' DESC 'Mailbox for system use' STRUCTURAL MUST ( owner $ mail $ uid $ cn ) MAY description ) When I try to change attribute OID value, for example: 1.3.6.1.4.1.25260.1.000 to 1.3.6.1.4.1.25260.1.0 (using a visual LDAP client) then the server hangs and will not restart. (I had to restore from backup and restart.) What is the recommended way to do this change? Thanks, Nick

4 14

Re: problems populating hdb
by stefano 16 Feb '12

16 Feb '12

now it's okay. i deleted with rm .../ldap/* and i added with slapadd the init.ldif. now i'va the corrects entries! thanks (for the moment, see you soon!) On 02/15/2012 04:54 PM, anax wrote: > Ciao Stefano > > your ldif file cannot be inserted into the DIT via slapadd, use > ldapadd ... > > your entries in dn: dc=nodomain may have been created when you > installed the ldap-server. > > you can find out what the naming-context of your DIT is by > ldapsearch -h localhost -x -b '' -s base objectclass=* namingContexts > > adjust the "-h localhost" parameter. > > suomi > > On 02/15/2012 04:28 PM, stefano wrote: >> Hi. >> >> i'm installing a ldap server on debian squeeze server. my goal is to >> assign to every users of different groups a username and password. >> my slapd.conf is: >> >> include /etc/ldap/schema/core.schema >> include /etc/ldap/schema/cosine.schema >> include /etc/ldap/schema/nis.schema >> include /etc/ldap/schema/inetorgperson.schema >> pidfile /var/run/slapd/slapd.pid >> argsfile /var/run/slapd/slapd.args >> loglevel none >> modulepath /usr/lib/ldap >> moduleload back_hdb >> sizelimit 500 >> >> backend hdb >> database hdb >> suffix "dc=pippo,dc=it" >> rootdn "cn=admin,dc=pippo,dc=it" >> rootpw {SSHA}ho2O8N4lyVnAIi6E/7kQrGl9U9iuGLbC >> directory "/var/lib/ldap" >> #index: definisce quali informazioni indicizzare per un accesso più >> veloce ai dati >> index objectClass eq >> #lastmod: richiede che il server memorizzi nel db le info relative >> all'ultima modifca di un oggetto >> lastmod on >> #checkpoint: frequenza con cui scarica su disco il registro delle >> transazioni >> checkpoint 512 30 >> #le impostazioni più sofisticate relative ai berkeleyDB si trovano nel >> file /var/lib/ldap/DB_CONFIG >> >> >> i created my first ldif file, init.ldif. i added the following >> information: >> >> dn: dc=pippo,dc=it >> objectClass: dcObject >> objectClass: organizationalUnit >> dc: pippo >> ou: pippo.it >> >> dn: o=Iuss,dc=pippo,dc=it >> objectClass: Organization >> o: Iuss >> >> dn: ou=Amministratori,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Amministratori >> >> dn: ou=Professori,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Professori >> >> dn: ou=Stud_Iuss,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Stud_Iuss >> >> dn: ou=Stud_Medicina,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Stud_Medicina >> >> dn: uid=stefano,ou=Amministratori,o=Iuss,dc=pippo,dc=it >> objectClass: inetOrgPerson >> uid: nome >> sn: cognome >> cn: nome cognome >> >> >> if i run >> >> slapadd -l init.ldif -b "dc=pippo","dc=it" >> >> i get the following result: >> >> => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair >> already exists (-30995) >> => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already >> exists (-30995) >> slapadd: could not add entry dn="dc=pippo,dc=it" (line=1): txn_aborted! >> DB_KEYEXIST: Key/data pair already exists (-30995) >> _### 16.07% eta none elapsed none spd 11.8 k/s >> >> then with: >> >> slapcat -b "dc=pippo","dc=it" >> >> i can see this: >> >> dn: dc=nodomain >> objectClass: top >> objectClass: dcObject >> objectClass: organization >> o: nodomain >> dc: nodomain >> structuralObjectClass: organization >> entryUUID: 805b9568-e687-1030-82d7-a7960b556dcd >> creatorsName: cn=admin,dc=nodomain >> createTimestamp: 20120208100040Z >> entryCSN: 20120208100040.557042Z#000000#000#000000 >> modifiersName: cn=admin,dc=nodomain >> modifyTimestamp: 20120208100040Z >> >> dn: cn=admin,dc=nodomain >> objectClass: simpleSecurityObject >> objectClass: organizationalRole >> cn: admin >> description: LDAP administrator >> userPassword:: e1NTSEF9ZVJjelJ0cS9UWWFiMDR2N3o5TUlvWHZaaDBESUNPZko= >> structuralObjectClass: organizationalRole >> entryUUID: 805c070a-e687-1030-82d8-a7960b556dcd >> creatorsName: cn=admin,dc=nodomain >> createTimestamp: 20120208100040Z >> entryCSN: 20120208100040.559953Z#000000#000#000000 >> modifiersName: cn=admin,dc=nodomain >> modifyTimestamp: 20120208100040Z >> >> dn: dc=pippo,dc=it >> objectClass: dcObject >> objectClass: organizationalUnit >> dc: pippo >> ou: pippo.it >> structuralObjectClass: organizationalUnit >> entryUUID: 90734578-e8ca-1030-8109-57345a76d294 >> creatorsName: >> createTimestamp: 20120211070546Z >> entryCSN: 20120211070546.162263Z#000000#000#000000 >> modifiersName: >> modifyTimestamp: 20120211070546Z >> >> why do i have the first error? >> why there are not the others informations about the tree? >> >> thanks >> >> stefano >

1 0

canonical way to force full refresh in 2.4.28 / n-way multimaster
by Aaron Bennett 16 Feb '12

16 Feb '12

Hi, I'm preparing to rollout 2.4.28 with n-way multimaster (in this case, it's really 2-way multimaster but could become more), and I'm looking to clarify what the exact canonical way to force a full refresh. Here's what I've come up with: By "full refresh" I mean, blow away whatever is on machine Y with whatever's on machine X. olcServerID: 1 ldaps://animal.clarku.edu olcServerID: 2 ldaps://zoot.clarku.edu olcSyncrepl: {0}rid=001 provider=ldaps://animal.clarku.edu binddn="DN OF REPLICATION USER" bindmethod=simple credentials=<PASSWORD> searchbase="dc=clarku,dc=edu" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldaps://zoot.clarku.edu binddn="DN OF REPLICATION USER " bindmethod=simple credentials=<PASSWORD> searchbase="dc=clarku,dc=edu" type=refreshAndPersist retry="5 5 300 5" timeout=1 1. Stop slapd on zoot. 2. slapcat > ocrap-backup.ldif 3. rm -rf /var/lib/ldap/* on zoot 4. SLAPD_OPTIONS="-c \"rid=001,sid=001\"" /etc/init.d/slapd start Then wait and it will refresh. Is this correct? Is there some easier way? Is there a way to do it without the rm -rf ? After it's done, do I need to restart slapd again without the -c option? Thanks, and if I'm doing something stupid, I'm happy to look stupid in exchange for knowledge. :) --- Aaron Bennett Manager of Systems Administration Clark University ITS

2 1

Valid RDN or not ?
by Emmanuel Lécharny 16 Feb '12

16 Feb '12

Hi guys, I have read the RFC carefully, and still can't decide if such a RDN is valid : cn=test1+cn=test2 AFAICT, yes, but OpenLDAP reject the creation of an entry with such a RDN. I may have missed something in the 20+ RFCs and hundred of pages, is anyone able to tell me where in the RFC it's explicitely sad that it's not a valid RDN ? Many thanks ! PS : I can live with the fact that OpenLDAP reject such a RDN, it's not a big deal, I just want to be sure that the LDAP API we are working on should accept or not such a RDN. -- Regards, Cordialement, Emmanuel Lécharny www.iktek.com

1 1

password policy
by Christian Bösch 16 Feb '12

16 Feb '12

hi, i want to force a password change for a user. therefor i set pwdreset: true but to change the password, bind attempts are still allowed. i thinks thats the reason why a user with pwdreset=true still can login to an apache webresource which is protected with ldap authentication. is there a way to prohibit that? i want the user to only allow the password change. /thanks,chris

3 3

authentification issue with clear text password
by Szilard Gyorgy 15 Feb '12

15 Feb '12

HI Can anybody help me with the next issue ? ldapcompare -D "uid=testuser,ou=Users,dc=domain,dc=net" -w test "uid=testuser,ou=Users,dc=domain,dc=net" -v userPassword:test ldap_initialize( <DEFAULT> ) DN:uid=testuser,ou=Users,dc=domain,dc=net, attr:userPassword, value:test Compare Result: Compare False (5) FALSE BUT ldapcompare -D "uid=testuser,ou=Users,dc=domain,dc=net" -w test "uid= testuser,ou=Users,dc=domain,dc=net" -v userPassword::e1NTSEF9L0NFMERQNTVtOU82T09HK1AzQVdNZG9nU2x6Z0FwTGw= ldap_initialize( <DEFAULT> ) DN:uid= testuser,ou=Users,dc=domain,dc=net, attr:userPassword, value::e1NTSEF9L0NFMERQNTVtOU82T09HK1AzQVdNZG9nU2x6Z0FwTGw= Compare Result: Compare True (6) TRUE I know that the problem is not with ldapcompare but I can't figure our where it is. Thank You, Szilard Gyorgy

4 6

problems populating hdb
by stefano 15 Feb '12

15 Feb '12

Hi. i'm installing a ldap server on debian squeeze server. my goal is to assign to every users of different groups a username and password. my slapd.conf is: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 backend hdb database hdb suffix "dc=pippo,dc=it" rootdn "cn=admin,dc=pippo,dc=it" rootpw {SSHA}ho2O8N4lyVnAIi6E/7kQrGl9U9iuGLbC directory "/var/lib/ldap" #index: definisce quali informazioni indicizzare per un accesso più veloce ai dati index objectClass eq #lastmod: richiede che il server memorizzi nel db le info relative all'ultima modifca di un oggetto lastmod on #checkpoint: frequenza con cui scarica su disco il registro delle transazioni checkpoint 512 30 #le impostazioni più sofisticate relative ai berkeleyDB si trovano nel file /var/lib/ldap/DB_CONFIG i created my first ldif file, init.ldif. i added the following information: dn: dc=pippo,dc=it objectClass: dcObject objectClass: organizationalUnit dc: pippo ou: pippo.it dn: o=Iuss,dc=pippo,dc=it objectClass: Organization o: Iuss dn: ou=Amministratori,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Amministratori dn: ou=Professori,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Professori dn: ou=Stud_Iuss,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Stud_Iuss dn: ou=Stud_Medicina,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Stud_Medicina dn: uid=stefano,ou=Amministratori,o=Iuss,dc=pippo,dc=it objectClass: inetOrgPerson uid: nome sn: cognome cn: nome cognome if i run slapadd -l init.ldif -b "dc=pippo","dc=it" i get the following result: => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30995) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30995) slapadd: could not add entry dn="dc=pippo,dc=it" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30995) _### 16.07% eta none elapsed none spd 11.8 k/s then with: slapcat -b "dc=pippo","dc=it" i can see this: dn: dc=nodomain objectClass: top objectClass: dcObject objectClass: organization o: nodomain dc: nodomain structuralObjectClass: organization entryUUID: 805b9568-e687-1030-82d7-a7960b556dcd creatorsName: cn=admin,dc=nodomain createTimestamp: 20120208100040Z entryCSN: 20120208100040.557042Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20120208100040Z dn: cn=admin,dc=nodomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9ZVJjelJ0cS9UWWFiMDR2N3o5TUlvWHZaaDBESUNPZko= structuralObjectClass: organizationalRole entryUUID: 805c070a-e687-1030-82d8-a7960b556dcd creatorsName: cn=admin,dc=nodomain createTimestamp: 20120208100040Z entryCSN: 20120208100040.559953Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20120208100040Z dn: dc=pippo,dc=it objectClass: dcObject objectClass: organizationalUnit dc: pippo ou: pippo.it structuralObjectClass: organizationalUnit entryUUID: 90734578-e8ca-1030-8109-57345a76d294 creatorsName: createTimestamp: 20120211070546Z entryCSN: 20120211070546.162263Z#000000#000#000000 modifiersName: modifyTimestamp: 20120211070546Z why do i have the first error? why there are not the others informations about the tree? thanks stefano

2 1

Error - not compiled with SASL support
by Gaurav Gugnani 15 Feb '12

15 Feb '12

Hello All, I'm *trying to implement SASL on the openldap of version 2.4.26.* First we install the openldap and then we install the necessary packages of cyrus-sasl. *Packages of cyrus-sasl:* (installed in below mentioned order) cyrus-sasl-lib-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-devel-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-plain-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-ldap-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-md5-2.1.22-5.el5_4.3.x86_64.rpm After then i set up the SASL with proper ACL's (having the steps and also i setup the same on some other box where it running fine) *Steps:* *1> *Modify /usr/lib64/sasl2/slapd.conf *# SASL Configuration pwcheck_method: auxprop auxprop_plugin: slapd mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5* *2> *Modify $LDAP_HOME/etc/openladp/slapd.conf *password-hash {CLEARTEXT} authz-regexp uid=(.*),cn=DIGEST-MD5,cn=auth uid=$1,ou=System,o=xyz* but it throws all together different error to me: /u01/app/openldap/product/2.4.26/etc/openldap> ldapwhoami -Y DIGEST-MD5 ldapwhoami: not compiled with SASL support And similar errors for ldapsearch and other commands. It suggests to me that some package installation is not proper. Can any one guide me on this. Thanks and Regards, Gaurav Gugnani

5 7

SASL authentication
by Rakesh Aggarwal 15 Feb '12

15 Feb '12

Hi! I am using OpenLDAP 2.4.26 and trying DIGEST-MD5 authentication using "ldapwhoami". I get the error "SASL(-13): user not found: no secret in database". While specifying the user with -U option, bind DN was showing empty in the server's trace. I have tried specifying complete DN with -D option but the result is the same error. User were added using sasldblistusers2 command. sasldblistusers shows the users though it has appended the hostname where I issued the add command from. What am I missing? Can someone point me to working instructions as the documentation for configuring SASL with openLdap seems really sparse? Thanks -Rakesh

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical