openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

RE26 testing call #2 (OpenLDAP 2.6.3)
by Quanah Gibson-Mount 11 Jul '22

11 Jul '22

This is the second testing call for OpenLDAP 2.6.3. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.3 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap to check for NULL ld (ITS#9157) Fixed libldap memory leaks (ITS#9876) Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd lastbind replication with chaining (ITS#9863) Fixed slapd-ldap to correctly set authzid (ITS#9863) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapd-mdb indexer task with replicated config (ITS#9858) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-rwm to handle escaping special characters (ITS#9817) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Added slapo-ciboolean contrib module (ITS#9855) Fixed slapo-autogroup backwards compat (ITS#9020) Update ppm module to the 2.2 release (ITS#9846) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Regards, Quanah

2 1

RE25 testing call #2 (OpenLDAP 2.5.13)
by Quanah Gibson-Mount 11 Jul '22

11 Jul '22

This is the second testing call for OpenLDAP 2.5.13. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.13 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap memory leaks (ITS#9876) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Fixed slapo-autogroup backwards compat (ITS#9020) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Thanks! Regards, Quanah

2 1

Re: Pass-through
by Stéphane Veyret 11 Jul '22

11 Jul '22

Hello Quanah, Thank you for your answer (and sorry for double-reply, I forgot to answer to all at first time). > The way that SASL passthrough works is that you put the value {SASL} for > the userPassword. This tells slapd to pass the user authentication to SASL > to handle. You don't set an actual password value in the userPassword > attribute. Actually, I did not set a real password, only, as I saw in examples : userPassword: {SASL}user@realm (you don’t directly see it in the extracts I provided because the password there is base64 encoded). I tried setting only, as you suggested : userPassword: {SASL} but I don’t have any better result. Regards, Stéphane

2 1

dirSync syncrepl_dirsync_message: unknown attributeType member;range=1-1
by Christopher Paul 09 Jul '22

09 Jul '22

Hello OpenLDAP-Technical, I am testing the dirSync replication. I am trying to replicate Active Directory (Windows Server 2019) -> OpenLDAP 2.5.12 from symas-openldap-servers-2.5.12-1.el8.x86_64 RPM on RedHat 8.6. Group members are not replicating, and I am seeing this error: syncrepl_dirsync_message: rid=999 unknown attributeType member;range=1-1 In this case, "member" is a recognized attribute per "core.schema" and is not a problem unless sent with the range indicator, which seems not to be part of the protocol but rather be an AD "embellishment". Those responsible for AD call this "Searching Using Range Retrieval" if you care to look it up. I guess has this default now of 1500 max values for an LDAP response, and it will indicate that the attribute has greater than this number of values by sending "member;range=0-1499" instead of "member" as the attribute type in the result data if there are more than 1500 values, and subsequently, if the amount is greater than 3000, "member;range=1500-2999", etc. I also observed (using packet capture) that when using the dirSync control, all groups are sent with this range notation, even if below the limit, even if just one member, Windows Server 2019 AD DS sends a PartialAttributeList of type "member;range=1-1". Although using ldapsearch without the control only will send the range notation if the number of member values is greater than the 1500 limit. So I am wondering if anyone else has seen this? Am I doing something wrong or is this a bug? What version of Windows was the dirSync syncrepl functionality developed to work with and/or tested with? I can provide more info as needed as this issue is just testing right now in my local lab. Thanks, Chris Paul | Rex Consulting | https://www.rexconsulting.net

2 2

Pass-through
by Stéphane Veyret 09 Jul '22

09 Jul '22

Hi, In my home network, I have a MIT Kerberos installation backed by OpenLDAP. Because some of my apps do not work using GSSAPI, I would like to be able to log into them directly using LDAP. So I tried to set-up Pass-through, but with no success. Here is what I did: * compiled OpenLDAP with --enable-spasswd (actually, it’s a Gentoo installation with use flag sasl), * setup Cyrus SASL to use Kerberos, * configured /usr/lib64/susl2/slapd.conf to use saslauth, * configured OpenLDAP with SASL host and secprops., * updated my user to have “userPassword:: e1NBU0x9c3RlcGhhbmVASE9NRS5MQU4=”, * restarted. SASL seems to be working correctly: > testsaslauthd -u stephane -p mypassword 0: OK "Success." But not LDAP : > ldapwhoami -x -D "uid=stephane,ou=user,dc=home,dc=lan" -Z -W Enter LDAP Password: ldap_bind: Invalid credentials (49) It seems to even not try to contact Cyrus SASL… I searched for hours accross the Internet but could not find any clue. So if someone here could help me, I would really appreciate. My LDAP config: # config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcLocalSSF: 256 olcLogLevel: stats olcPidFile: /run/openldap/slapd.pid olcSaslHost: localhost olcSaslSecProps: none > cat /usr/lib64/sasl2/slapd.conf pwcheck_method: saslauthd mech_list: plain saslauthd_path: /var/run/saslauthd/mux Here is an extract of the log I could get while attempting to bind: TLS trace: SSL_accept:SSLv3/TLS write session ticket 62af4376 connection_read(17): unable to get TLS client DN, error=49 id=1012 62af4376 conn=1012 fd=17 TLS established tls_ssf=256 ssf=256 62af4376 daemon: activity on 1 descriptor 62af4376 daemon: activity on: 62af4376 daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af4376 daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af4376 daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 17r 62af437b daemon: read active on 17 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b connection_get(17) 62af437b connection_get(17): got connid=1012 62af437b connection_read(17): checking for input on id=1012 ber_get_next tls_read: want=5, got=5 tls_read: want=97, got=97 ldap_read: want=8, got=8 ldap_read: want=72, got=72 ber_get_next: tag 0x30 len 78 contents: ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df81074e0 end=0x7f6df810752e len=78 62af437b op tag 0x60, time 1655653243 ber_get_next tls_read: want=5 error=Resource temporarily unavailable ldap_read: want=8 error=Resource temporarily unavailable 62af437b conn=1012 op=1 do_bind 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: ber_scanf fmt ({imt) ber: 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df81074e3 end=0x7f6df810752e len=75 ber_scanf fmt (m}) ber: ber_dump: buf=0x7f6df81074e0 ptr=0x7f6df810751a end=0x7f6df810752e len=20 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b >>> dnPrettyNormal: <uid=stephane,ou=user,dc=home,dc=lan> => ldap_bv2dn(uid=stephane,ou=user,dc=home,dc=lan,0) <= ldap_bv2dn(uid=stephane,ou=user,dc=home,dc=lan)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=stephane,ou=user,dc=home,dc=lan)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=stephane,ou=user,dc=home,dc=lan)=0 62af437b <<< dnPrettyNormal: <uid=stephane,ou=user,dc=home,dc=lan>, <uid=stephane,ou=user,dc=home,dc=lan> 62af437b conn=1012 op=1 BIND dn="uid=stephane,ou=user,dc=home,dc=lan" method=128 62af437b do_bind: version=3 dn="uid=stephane,ou=user,dc=home,dc=lan" method=128 62af437b ==> mdb_bind: dn: uid=stephane,ou=user,dc=home,dc=lan 62af437b mdb_dn2entry("uid=stephane,ou=user,dc=home,dc=lan") 62af437b => mdb_dn2id("uid=stephane,ou=user,dc=home,dc=lan") 62af437b <= mdb_dn2id: got id=0xb 62af437b => mdb_entry_decode: 62af437b <= mdb_entry_decode 62af437b => access_allowed: result not in cache (userPassword) 62af437b => access_allowed: auth access to "uid=stephane,ou=user,dc=home,dc=lan" "userPassword" requested 62af437b => acl_get: [1] attr userPassword 62af437b => acl_mask: access to entry "uid=stephane,ou=user,dc=home,dc=lan", attr "userPassword" requested 62af437b => acl_mask: to value by "", (=0) 62af437b <= check a_dn_pat: cn=kerberos,ou=service,dc=home,dc=lan 62af437b <= check a_dn_pat: self 62af437b <= check a_dn_pat: anonymous 62af437b <= acl_mask: [3] applying auth(=xd) (stop) 62af437b <= acl_mask: [3] mask: auth(=xd) 62af437b => slap_access_allowed: auth access granted by auth(=xd) 62af437b => access_allowed: auth access granted by auth(=xd) 62af437b SASL Canonicalize [conn=1012]: authcid="stephane(a)HOME.LAN" 62af437b SASL Canonicalize [conn=1012]: authcid="stephane(a)HOME.LAN" 62af437b send_ldap_result: conn=1012 op=1 p=3 62af437b send_ldap_result: err=49 matched="" text="" 62af437b send_ldap_response: msgid=2 tag=97 err=49 ber_flush2: 14 bytes to sd 17 tls_write: want=36, written=36 ldap_write: want=14, written=14 62af437b conn=1012 op=1 RESULT tag=97 err=49 text= 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 17r 62af437b daemon: read active on 17 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL 62af437b connection_get(17) 62af437b connection_get(17): got connid=1012 62af437b connection_read(17): checking for input on id=1012 ber_get_next tls_read: want=5, got=5 tls_read: want=24, got=24 ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x7f6e081065d0 ptr=0x7f6e081065d0 end=0x7f6e081065d5 len=5 62af437b op tag 0x42, time 1655653243 ber_get_next tls_read: want=5, got=5 tls_read: want=19, got=19 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 62af437b ber_get_next on fd 17 failed errno=0 (Success) 62af437b connection_read(17): input error=-2 id=1012, closing. 62af437b connection_closing: readying conn=1012 sd=17 for close 62af437b connection_close: deferring conn=1012 sd=17 62af437b conn=1012 op=2 do_unbind 62af437b conn=1012 op=2 UNBIND 62af437b connection_resched: attempting closing conn=1012 sd=17 62af437b connection_close: conn=1012 sd=17 62af437b daemon: removing 17 tls_write: want=24, written=24 TLS trace: SSL3 alert write:warning:close notify 62af437b conn=1012 fd=17 closed 62af437b daemon: activity on 1 descriptor 62af437b daemon: activity on: 62af437b daemon: epoll: listen=7 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=8 active_threads=0 tvp=NULL 62af437b daemon: epoll: listen=9 active_threads=0 tvp=NULL -- Bien cordialement, / Plej kore, Stéphane Veyret

2 1

RE26 testing call #1 (OpenLDAP 2.6.3)
by Quanah Gibson-Mount 07 Jul '22

07 Jul '22

This is the first testing call for OpenLDAP 2.6.3. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.3 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap to check for NULL ld (ITS#9157) Fixed libldap memory leaks (ITS#9876) Fixed lloadd to correctly tag Notice of Disconnection (ITS#9856) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd lastbind replication with chaining (ITS#9863) Fixed slapd-ldap to correctly set authzid (ITS#9863) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapd-mdb indexer task with replicated config (ITS#9858) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-rwm to handle escaping special characters (ITS#9817) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Added slapo-ciboolean contrib module (ITS#9855) Fixed slapo-autogroup backwards compat (ITS#9020) Update ppm module to the 2.2 release (ITS#9846) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872)

3 4

RE25 testing call #1 (OpenLDAP 2.5.13)
by Quanah Gibson-Mount 07 Jul '22

07 Jul '22

This is the first testing call for OpenLDAP 2.5.13. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.13 Engineering Fixed librewrite declaration of calloc (ITS#9841) Fixed libldap memory leaks (ITS#9876) Fixed slapd kqueue support (ITS#9847) Fixed slapd delta-sync DN leak on ADD ops (ITS#9866) Fixed slapd replication with back-glue (ITS#9868) Fixed slapd-mdb to check for stale readers on MDB_READERS_FULL (ITS#7165) Fixed slapo-accesslog onetime memory leak (ITS#9864) Fixed slapo-ppolicy interaction with slapo-rwm (ITS#9871) Fixed slapo-syncprov memory leaks (ITS#9867) Fixed slapo-syncprov fallback in delta-sync mode (ITS#9823) Fixed slapo-unique to not release NULL entry (ITS#8245) Build Environment Added slapd-watcher -c contextDN option (ITS#9865) Fixed parallel builds (ITS#9840) Fixed test020 to skip back-wt (ITS#9859) Fixed slapd-watcher SID handling with single URI (ITS#9850) Fixed test043 with workaround for ITS#9878 Contrib Added slapo-emptyds contrib module (ITS#8882) Fixed slapo-autogroup backwards compat (ITS#9020) Documentation Fixed ldap_get_option(3) to clarify ldap_get/set_option restrictions (ITS#9824) Fixed slapd-ldap(5),slapd-meta(5) missing bold tag on authz parameter (ITS#9872) Regards, Quanah

3 3

Re: dynlist overlay, memberURL not working on spcified attribiutes
by Bog Dan 07 Jul '22

07 Jul '22

Thanks for your reply, I try to explain. Populating memberOf attribiute to users entry working well using this: *olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf* User entry look as follow: *dn: uid=test1,ou=people,dc=test,dc=comsambaAcctFlags: [U ]sambaPwdLastSet: 9999999999sambaNTPassword: passo: testsambaSID: S-1-5-21-3945181060-1826002392-430723570pwdPolicySubentry: cn=noexpire,ou=ppolicy,dc=test,dc=comcreateTimestamp: 20220529070624.324Zdescription: User accountuserPassword:: passsambaPwdCanChange: 1528009736sambaPwdMustChange: 0mail: test1(a)test.com <test1(a)test.com>loginShell: /bin/bashgivenName: Test1sambaLogonTime: 0sn: Testcn: Test1 TestobjectClass: posixAccountobjectClass: topobjectClass: inetOrgPersonobjectClass: personobjectClass: organizationalPersonobjectClass: sambaSamAccountobjectClass: shadowAccounthomeDirectory: /home/test1pwdChangedTime: 20220529070856.504ZgidNumber: 1002uidNumber: 1002uid: test1structuralObjectClass: inetOrgPersonentryUUID: 348cd83e-7c6a-103c-8612-1918ce7a0bc4creatorsName: cn=admin,dc=test,dc=comlabeledURI: ldap:///ou=groups,dc=test,dc=com??sub?(|(&(objectclass=groupOfUniqueNames)(uniqueMember=uid=test1,ou=people,dc=test,dc=com))(&(objectClass=posixGroup)(memberUid=test1)))entryCSN: 20220609180738.487916Z#000000#001#000000modifiersName: cn=admin,dc=test,dc=commodifyTimestamp: 20220609180738ZmemberOf: cn=devops,ou=groups,dc=test,dc=comentryDN: uid=test1,ou=people,dc=test,dc=comsubschemaSubentry: cn=SubschemahasSubordinates: FALSE* Static group entry: *cn=devops,ou=groups,dc=test,dc=comcn: devopsobjectClass: groupOfUniqueNamesobjectClass: topdescription: devops groupuniqueMember: uid=test1,ou=people,dc=test,dc=comuniqueMember: uid=test2,ou=people,dc=test,dc=com* Next what I want to do is agregate multiple groups to one virtual using this: *olcDynListAttrSet: {0}groupOfURLs memberURL member* Then I create appropiate group: *cn=testluri,ou=groups,dc=test,dc=comcn: testluriobjectClass: topobjectClass: groupOfURLsdescription: test groupmemberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* but this don't add memeber entry to this group. When I changing memberURL as follow: *memberURL: ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2))* member attribute was added to testluri group: *cn=testluri,ou=groups,dc=test,dc=comcn: testluriobjectClass: topobjectClass: groupOfURLsdescription: test groupmemberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* *member: uid=test1,ou=people,dc=test,dc=com* *member: uid=test2,ou=people,dc=test,dc=com* but this is not the goal. As I mentioned I want to agregate multiple group to one using memberOf attribute in memberURL: *memberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com)* but this not working. What I'm doing wrong? Reagrds BS śr., 29 cze 2022 o 19:17 Quanah Gibson-Mount <quanah(a)fast-mail.org> napisał(a): > > > --On Tuesday, June 28, 2022 12:18 PM +0200 Bog Dan <bsiara.cgi(a)gmail.com> > wrote: > > > > > Hi All, > > I have problem with dynlist overlay, this is my configuration: > > > > > > > > olcOverlay={1}dynlist,olcDatabase={1}mdb,cn=config > > objectClass: olcOverlayConfig > > objectClass: olcDynListConfig > > olcOverlay: {1}dynlist > > olcDynListAttrSet: {0}groupOfURLs memberURL member > > olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf > > > > > > > > First I create static group: > > > > > > cn=devops,ou=groups,dc=test,dc=com > > cn: devops > > objectClass: groupOfUniqueNames > > objectClass: top > > description: devops group > > uniqueMember: uid=test1,ou=people,dc=test,dc=com > > uniqueMember: uid=test2,ou=people,dc=test,dc=com > > > > > > > > When I create new dynamic group: > > > > cn=testluri,ou=groups,dc=test,dc=com > > cn: testluri > > objectClass: top > > objectClass: groupOfURLs > > description: test group > > memberURL: > > ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=te > > st,dc=com) > > > > > > > > I don't get any member of group. Users test1 and test2 already have > > memberOf attribute: > > > > memberOf: cn=devops,ou=groups,dc=test,dc=com > > > > > > > > When I change memberURL to use not dynamic attributes (memberOf): > > > > > > memberURL: > ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2)) > > > > > > > > users added to testluri group and dynlist works well. > > What I should do to configure dynlist with memberOf? > > I've read your email multiple times, and quite frankly I don't understand > what your end goal is. > > If your end goal is to have static groups, where memberOf is dynamically > populated on the user entries (which is the usual use case for replacing > the 2.4 memberOf), then your configs are clearly incorrect. > > Can you better explain what your end goal is? > > Thanks, > Quanah > > > >

2 1

dynlist overlay, memberURL not working on spcified attribiutes
by Bog Dan 29 Jun '22

29 Jun '22

Hi All, I have problem with dynlist overlay, this is my configuration: olcOverlay={1}dynlist,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynListConfig olcOverlay: {1}dynlist olcDynListAttrSet: {0}groupOfURLs memberURL member olcDynListAttrSet: {1}inetOrgPerson labeledURI memberOf First I create static group: cn=devops,ou=groups,dc=test,dc=com cn: devops objectClass: groupOfUniqueNames objectClass: top description: devops group uniqueMember: uid=test1,ou=people,dc=test,dc=com uniqueMember: uid=test2,ou=people,dc=test,dc=com When I create new dynamic group: cn=testluri,ou=groups,dc=test,dc=com cn: testluri objectClass: top objectClass: groupOfURLs description: test group memberURL: ldap:///ou=people,dc=test,dc=com??sub?(memberOf=cn=devops,ou=groups,dc=test,dc=com) I don't get any member of group. Users test1 and test2 already have memberOf attribute: memberOf: cn=devops,ou=groups,dc=test,dc=com When I change memberURL to use not dynamic attributes (memberOf): memberURL: ldap:///ou=people,dc=test,dc=com??sub?(|(uid=test1)(uid=test2)) users added to testluri group and dynlist works well. What I should do to configure dynlist with memberOf? Openldap 2.5.12 Regards BS

2 1

Filter string with escaped forward slash
by Jeffrey Walton 29 Jun '22

29 Jun '22

Hi Everyone, Microsoft AD requires a forward slash ('/') be escaped with "\\2f". Confer, [1, 2]. However, escaping the forward slash is not required per the RFCs (if I am parsing the RFCs correctly). I would like to know if OpenLDAP recognizes an escaped forward slash and handles it properly. I suspect OpenLDAP does since slapd is just a front-end to different directories. The reason I would like to know is for a generic encoder. If MS Active Directory, Novell eDirectory and OpenLDAP handle the escaped forward slash as expected, then it makes it easier to write the encoder. Thanks in advance, Jeff [1] https://social.technet.microsoft.com/wiki/contents/articles/5312.active-dir… [2] https://docs.microsoft.com/en-us/windows/win32/adsi/ldap-dialect

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical