openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: Question on LDAP Schema(s) for Intranet Mail Routing
by Nick Milas 09 Feb '12

09 Feb '12

On 9/2/2012 7:08 μμ, Charles T. Brooks wrote: > I wish I could help more than I have, Nick, but as far as I know there > is no useable RFC standard for mail routing that covers real world > needs. Working pragmatic implementations are based on someone's > interpretation of an expired internet draft, at best. > > I would love for someone to prove me wrong, though! Thanks Charles, First, the reason I started this new thread is that the whole discussion we had was under an irrelevant subject. Second, your advice re. the Lachman / Laser / Sendmail schema was very insightful. After reading the associated draft, I found that I could improve my setup by implementing it (at least to some extent), following your suggestions and experience. Note: In the meantime, I found this: http://www.qmail-ldap.org/wiki/index.php/Qmail.schema. I agree that real world needs vary enormously, yet it is very helpful to avoid re-inventing the wheel. Adding a safe schema with some objectClasses and attributes which seem to cover a range of needs re. ldap-based MTAs, aids both design and implementation. The qmail-ldap schema adds some really helpful and needed attributes, like mailForwardingAddress (also mentioned in Lachman draft) and accountStatus (and even mailQuotaSize; I am using an irrelevant attribute to store this info at the moment). Since I am already using misc.schema file and the basic attributes are available (inetLocalMailRecipient objectClass with mailLocalAddress, mailHost, mailRoutingAddress attributes), I am tempted to manually add selectively attributes from the qmail schema. In order to avoid messing things, I am hoping this thread might attract some more experienced users here, like you, to provide some ideas on how to proceed. (My applications to use these attributes are mainly Postfix/Dovecot.) All advice will be welcome. Thanks, Nick

1 0

Question on LDAP Schema(s) for Intranet Mail Routing
by Nick Milas 09 Feb '12

09 Feb '12

Hello, In file misc.schema, included in the standard OpenLDAP distribution, we read about the Lachman/Laser mail routing schema (which defines inetLocalMailRecipient objectClass with mailLocalAddress, mailHost, mailRoutingAddress attributes, drafted e.g. here: http://www.sendmail.org/m4/laser.txt): # Not recommended for production use! # Use with extreme caution! #----------------------------------------------------------- # draft-lachman-laser-ldap-mail-routing-02.txt !!!EXPIRED!!! # (a work in progress) and: # ...Contents of this file are # subject to change (including deletion) without notice. Question 1: Should this schema be considered now, after all these years, as being stable and a solid basis for implementation? If so, perhaps in next releases these comments could/should be removed? Question 2: As far as I can tell, qmail-ldap schema is also used around for the same purpose. It seems this can be found in different versions, as the initial one had problems (ref.: http://www.openldap.org/lists/openldap-software/200304/msg00378.html). This schema is a considerably extended version of the Lachman/laser one. So: 2.a: Is there some kind of draft elaborating on this schema? 2.b: Is there some official and working (with no issues) version of the schema? 2.c: If 2.b is No, where can we find even an unofficial, yet corrected/working version of the schema? I've only found a reference here: http://www.openldap.org/lists/openldap-software/200304/msg00418.html but no the schema itself. Also, I don't know if we can trust the one here: http://www.zytrax.com/books/ldap/ape/qmail.html (which interestingly mentions that "This schema is released with a standard OpenLDAP distribution" but I haven't seen it in the schema directory of OpenLDAP distros). Thanks, Nick

1 0

circularly MMR Replication ?
by Meike Stone 09 Feb '12

09 Feb '12

Hello, I have 5 different locations and want use MMR. I could configure the replication in a chain, but if on *in* the chain fails, the complete replication fails. So is it a good idea to configure/organize the replication circularly? If one of the "replication member" fails, the replication between the others should still work. Thanks for help Meike

1 0

Compound query question - organization with cn vs. o?
by Matthew M. DeLoera 08 Feb '12

08 Feb '12

Hello, Apologies if this isn't the appropriate list. Searched archives but didn't manage to find anything that seemed related… This query does not return any results: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(cn=Domain Users))(&(objectClass=organization)(o=Domain Users))) But, this query does: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(cn=Domain Users))(&(objectClass=organization)(cn=Domain Users))) Since RFC 2256 defines organization as STRUCTURAL, with o as MUST, and does not associate cn at all, I'm stumped. FYI, there exists a groupOfNames object with cn=Domain Users. I guess, why would my organization (3rd) clause matter at all? Since the groupOfNames object satisfies the groupOfNames (1st) clause, I was expecting it to be returned regardless of whether the subsequent 2 clauses match anything. And out of curiosity, this query fails: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(o=Domain Users))(&(objectClass=organization)(cn=Domain Users))) My guess is that if a subsequent clause specifies an attribute that's not defined for an objectClass, the query fails even if the first clause is known to be good? If that's how things work, I can deal with that. But I just can't find any documentation that clarifies this (or I'm totally missing something super obvious!). Can anyone explain this to me, or point me to some docs that I should go read? Is there a missing piece of info that I should mention? Any suggestions would be really, really appreciated! Regards, - Matthew

2 1

Chinese characters in mail search causes failed assertion in slapd
by Alfie John 08 Feb '12

08 Feb '12

Hi guys, When searching for Chinese names in the "to:" field under Thunderbird, I get an assertion failing in slapd. I see that this is because the "mail" attribute in the default schema is of type "IA5 String" but the Chinese name that I'm searching for falls outside the character set. The work around I have is to modify the "mail" attributetype in the core.schema from: attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) to: attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) Can anyone see a problem with the above, or is there a better way of accomplishing this? Thanks Alfie -- Alfie John alfiej(a)opera.com

4 10

Password-less operation
by Jean-Luc Wasmer 08 Feb '12

08 Feb '12

Hi, The user db on my system is stored in LDAP and integrated with PAM and NSS. The LDAP db also contain address book data for each user. I would like to be able to call ldap utilities (e.g. ldapsearch) without having the user to enter his/her password everytime. I would also like for scripts running as those users to have access to the respective LDAP entries. I noticed ldapsearch supports SASL binds, so I was wondering if that could be used in conjunction with Kerberos to accomplish my goal (from what I understand, the kinit command would have to be called before ldapsearch). Is there any other way to do this? Thanks, Jean-Luc

3 2

RE: Chinese characters in mail search causes failed assertion in slapd
by Alfie John 07 Feb '12

07 Feb '12

On Tue, Feb 7, 2012, at 11:34 AM, Charles T. Brooks wrote: > Non-english character sets are going to become part of hostnames and > DNS. That's inevitable. > > Mail addresses are based on DNS hostnames. > > Ergo, mail attributes will one day need to support all possible > characters. Thanks for that. It makes sense and it was enough to convince me to submit a bug. Alfie -- Alfie John alfiej(a)opera.com

2 1

SYNC_ID_SET missing?
by Marc Patermann 07 Feb '12

07 Feb '12

Hi, on a consumer with two replicated databases I get this on startup: # grep sync Feb 7 17:16:52 rfas099 slapd[4263]: Config: ** successfully added syncrepl rid=401 "ldap://master.foo.de" Feb 7 17:16:52 rfas099 slapd[4263]: line 124 (syncrepl ***) Feb 7 17:16:52 rfas099 slapd[4263]: Config: ** successfully added syncrepl rid=402 "ldap://master.foo.de" Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - REFRESH_DELETE There is do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - SYNC_ID_SET for one database, but not for the other. From the list archive I got this: "The SYNC_ID_SET messages in this case are the provider telling the consumer what entries it has, so the consumer can delete entries not present on the provider. This is normal operation in some situations. It shouldn't happen too often if you specify a sufficient sessionlog size on the provider." http://www.openldap.org/lists/openldap-technical/201104/msg00079.html So, if there is no SYNC_ID_SET for a database, is this a bad sign? Marc

1 0

Non-personal mail accounts
by Nick Milas 07 Feb '12

07 Feb '12

Hello, We are storing user accounts in OpenLDAP. Main classes used are: objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: eduPerson User email address(es) is (are) stored in the "mail" attribute and are also used by Postfix (which uses virtual accounts based on LDAP). I would like to define some email accounts (with associated email addresses) which do NOT belong to a particular user; so, in these accounts a mail attribute would not be associated (both conceptually and practically) with a person objectClass. Is there a suggestion on which existing objectClass(es) (and associated schemas, if applicable) should we use for such use? I thought of "account" (defined in cosine.schema), but it does not accept a mail attribute. The idea would be to use something like an extended "account" objectClass, (or "account" itself, with some additional auxiliary class to define an email address) together with simpleSecurityObject to allow definition of a password. Any experiences, suggestions will be appreciated. Thanks, Nick

2 1

dynlist and DSA IT Control
by Angel L. Mateo 07 Feb '12

07 Feb '12

Hello, I have an openldap using dynlist to get some attributes of the entries. When I manually performs search, I can get these attributes (obtained through the dynlist overlay) without any problem, but when an application (a CAS server to be precise) tries to do the same search, with the same bind dn, I can't see those attributes. I have used wireshark to check any difference and I have found that the only difference between my search and the one made by the application is that this one use a control parameter in the search, to be precise the control 2.16.840.1.113730.3.4.2.. Then I have checked and I have realized that if I used the -M option then I get the same behaviour and I can't get the attributes from the dynlist overlay. As far as I know I can't configure this behaviour in my application (although I'm also looking for any way to configure CAS not to use that control), so, why openldap does not use the dynlist overlay when this dsa it control is used? Is there any way to change this behaviour? Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical