openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

"controls require LDAPv3" on cn=config syncrepl
by Brandon Hume 14 Dec '11

14 Dec '11

I had a medium-size post describing some problems I'm having with an N-Way setup with 2.4.28, but I saw a post from Quanah that sent me in a new direction so I'm doing some more testing before whining about *that* problem... But meanwhile... can anyone tell me if seeing errors like the following is normal when replicating cn=config? On the provider: Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1027 fd=26 ACCEPT from IP=172.30.96.203:55371 (IP=172.30.96.202:389) Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=0 RESULT tag=97 err=0 text= Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=1 DISCONNECT tag=101 err=2 text=controls require LDAPv3 Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=1 do_search: get_ctrls failed Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 fd=27 closed (operations error) ... and on the consumer: Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrep2: rid=001 (2) Protocol error Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrepl: rid=001 rc -2 retrying (3 retries left)

4 5

N-Way Multimaster. No base DN returned from server.
by Arturo Borrero Gonzalez 14 Dec '11

14 Dec '11

Hi there. I followed the documentation in openldap website for setting up a N-Way multimaster LDAP cluster. I have two nodes, but I will be expanding to 3 or 4 in a near future. When doing an ldapsearch, I get all the server data, but when accesing with ApacheDirectoryStudio (with same credentials) I get nothing. Nothing is wrong in logfiles. I guess a problem in ACLs, but it doesn't work even when binding as RootDN (and as seen in oficial documentation, rootdn is over the scope of any ACL) The replication system is working well, afaik. I've readed folk with same problems, but not exactly; here: http://www.openldap.org/lists/openldap-technical/201004/msg00195.html Anyone could take a look on this? Version: 2.4.23-7.2 My cfg (slapd.d over Debian Stable ): dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=es olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=es olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig olcRootPW: asdasd olcLimits: dn.exact="cn=admin,dc=example,dc=es" time.soft=unlimited time.hard=unl imited size.soft=unlimited size.hard=unlimited olcSyncrepl: {0}rid=003 provider="ldaps://ldap1.example.es/" binddn="cn=admin,dc= example,dc=es" bindmethod=simple credentials=asdasd se archbase="dc=example,dc=es" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider="ldaps://ldap2.example.es/" binddn="cn=admin,dc= example,dc=es" bindmethod=simple credentials=asdasd se archbase="dc=example,dc=es" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE olcDbIndex: objectClass,eduPersonEntitlement,memberUID,uid,mail eq olcAccess: {0}to dn.base="dc=example,dc=es" by dn="cn=admin,dc=example,dc=es" manage olcAccess: {1}to dn.base="cn=Subschema" by * read -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

2 1

slapd-ldap as proxy to active directory
by Juan Miscaro 14 Dec '11

14 Dec '11

Good day. I would like to use the slapd-ldap backend as a proxy to Active Directory (Windows Server 2008 R2). Firstly, AD can be queried directly: $ ldapsearch -LLL -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://ad.support.com -b cn=users,dc=support,dc=com '(sAMAccountName=jdoe)' cn sAMAccountName dn: CN=John Doe,CN=Users,DC=support,DC=com cn: John Doe sAMAccountName: jdoe Now, I have the following in slapd: ========== dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_ldap dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcDbURI: ldap://ad.support.com olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcSuffix: cn=users,dc=support,dc=com ========== But when querying via the slapd instance I don't get anything back: $ ldapsearch -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://slapd.example.com -b cn=users,dc=support,dc=com '(sAMAccountName=jdoe)' cn sAMAccountName # extended LDIF # # LDAPv3 # base <cn=users,dc=support,dc=com> with scope subtree # filter: (sAMAccountName=jdoe) # requesting: cn sAMAccountName # # search result search: 2 result: 32 No such object # numResponses: 1 I can query my normal/local DIT fine (even while authenticating as the remote AD user, which looks weird): $ ldapsearch -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://slapd.example.com -b dc=example,dc=com '(ou=People)' cn # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (ou=People) # requesting: cn # # People, example.com dn: ou=People,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What am I missing? TIA. -- /jm

2 1

Bind as an authenticated user for fetching directory information
by Jayavant Patil 14 Dec '11

14 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. On client node, in /etc/ldap.conf file, we specify binddn and bindpw. If not specified, the request will be anonymous. I have on each client machine more than 500 users. I want to send the request to server as an authenticated user but users are 500+. Then, how do I specify this in binddn and bindpw. I don't want to specify 'root' (admin) in binddn and bindpw. I have rootbinddn as root's dn and his password in /etc/ldap.secret (mode 600). As earlier said, anonymous request is creating 'I have no name!' problem while doing $ssh <user>@client, since I have given anonymous user auth access. If I specify anonymous read access, 'I have no name!' problem disappears but security is getting compromised. I think there is no problem with nscd daemon, since it is stopped or even I uninstalled that, the problem still persists. -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 2

Ldap is up, trying to get tls working.
by John Tobin 13 Dec '11

13 Dec '11

Folks, I have openldap up, it supports vsftpd, sshd, and 5 client linux machines for remote login. I would like to get tls working. I would support either ldaps [port 636], or the tls available on port 389, I am aware of the differences in implementation, and the fact that an administrator effectively has to make a decision to support one or the other in most cases. Currently: I have slapd running configured for tls under ldap [std port 389]. I am testing it on the slapd machine, with a client on the same machine. I am pointing to the same cacertificate in slapd.d [cn=config.ldif] and ldap.conf. With that in place, and the ldap.conf below: nightmare:/etc # cat ldap.conf base dc=dark,dc=net uri ldap://nightmare.dark.net # scope sub # binddn "cn=admin,dc=dark,dc=net" # bindpw jackie bind_policy soft # The user ID attribute (defaults to uid) pam_login_attribute uid pam_lookup_policy yes pam_password exop nss_schema rfc2307bis tls_reqcert never pam_filter objectClass=posixAccount ldap_version 3 nss_map_attribute uniqueMember uniqueMember ssl start_tls tls_cacert /var/lib/ldap/cacert.pem tls_cert /var/lib/server.crt tls_key /var/lib/ldap/server.key I have run ldapsearch: nightmare:/media # ldapsearch -v -x -H ldap://nightmare.dark.net:389/ -b "dc=dark,dc=net" -Z ldap_initialize( ldap://nightmare.dark.net:389/??base ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=dark,dc=net> with scope subtree # filter: (objectclass=*) # requesting: ALL # # dark.net dn: dc=dark,dc=net dc: dark o: dark objectClass: organization objectClass: dcObject # admin, dark.net dn: cn=admin,dc=dark,dc=net objectClass: organizationalRole cn: admin # Default Policy, dark.net dn: cn=Default Policy,dc=dark,dc=net objectClass: namedObject objectClass: pwdPolicy cn: Default Policy # People, dark.net dn: ou=People,dc=dark,dc=net objectClass: organizationalUnit ou: People description: People is used in mapping the /etc/passwd entries # jtobin, People, dark.net dn: uid=jtobin,ou=People,dc=dark,dc=net uid: jtobin cn: John C. Tobin objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount loginShell: /bin/ksh uidNumber: 5000 gidNumber: 100 homeDirectory: /home/jtobin gecos: John C. Tobin # defaultDNS, dark.net dn: cn=defaultDNS,dc=dark,dc=net cn: defaultDNS objectClass: top objectClass: suseDnsConfiguration suseDefaultBase: ou=DNS,dc=dark,dc=net # DNS, dark.net dn: ou=DNS,dc=dark,dc=net objectClass: top objectClass: organizationalUnit ou: DNS # search result search: 3 result: 0 Success # numResponses: 8 # numEntries: 7 nightmare:~ # ##### So I am assuming the ldapserver on ldap://nightmare.dark.net:389/ with tls works. [I looked through the message output in /var/log/message and see the ³STARTTLS² and ³TLS established tls_ssf=256²] I have done a number of similar ldapsearches. This appears to work correctly. On the client machine I now do : nightmare:/media # su - jtobin su: user jtobin does not exist nightmare:/media # /var/log/message - output...... nightmare:/var/log # tail f |grep I tls Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 op=0 STARTTLS Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept failure error=-1 id=1217, closing Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 fd=14 closed (TLS negotiation failure) Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 op=0 STARTTLS Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept failure error=-1 id=1218, closing Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 fd=14 closed (TLS negotiation failure) [if you want more of the log, I can obviously get it, but these appear to be the important parts.] This is probably a configuration error, or a logical / architecture misunderstanding, ok, I m a newbie. Do I have certificates incorrectly generated? [certificates were generated via http://www.openldap.org/faq/data/cache/185.html]. What did I do wrong? This is running openldap 2.4.26 off of Suse 12.1 milestone 5. Thanks in advance. tob

4 6

Need help regarding rfc for Jldap
by Brajabasi Padhy 12 Dec '11

12 Dec '11

Hello Sir, I'm Brajabasi from india. I wanted to use OpenLDAP for my project. I found OpeLDAP( Java version and C version) 1) OpenLDAP(Java version) compliant to RFC 2251-2256,2829-2830 2) OpenLDAP(C version) compliant ti RFC 4511-RFC 4520 RFC 4511 is the latest RFC which obseletes the RFC 2251-2256,2819-2830. Could you please suggest which version i should use for my application and why? Thanks with Regards, Brajabasi

1 0

(no subject)
by Brajabasi Padhy 12 Dec '11

12 Dec '11

1 0

Re:
by rey sebastien 12 Dec '11

12 Dec '11

Le lun. 12 déc. 2011 22:20:14 CET, Quanah Gibson-Mount a écrit : > --On Monday, December 12, 2011 9:55 PM +0100 rey sebastien > <reyman64(a)gmail.com> wrote: > >> IMHO i know this problem but i think this is better than nothing, and >> actually i have nothing. I wait for valid certificate... >> And sorry but your RTFM answer doesn't help me to resolve this problem >> with gnutls and debian, i take many hours to find a valid solution in my >> use case, and the manual doesn't help me particulary on this point. >> >> OpenLdap is a great software, but documentation it's a little "cryptic" >> for beginner like me, so i think it's easy to be rude with beginner on >> many points. > > You're using bad documentation from a questionable source, and are > pointed at the correct documentation, and have an issue with that? > That seems a little odd to me. When i add TLSCACertificateFile attribute with correct path, openldap with gnutls don't re-start.. I'm ok with Raffael, it's probably a bad idea to use the debian package, but i need one day or more to understand why an "official" package from debian create all this configuration's problem. If you want to use SSL/TLS, then > clearly you want a secure server. To blindly follow a guide that turns > off all of those security features leaves you back at square one. If > you don't understand the OpenLDAP documentation, then ask questions > about it rather than falling back to something unreliable that's going > to leave questionable state. > This is why i'm register on this mailling list, with hope some answers or experiences of other members resolve/enlight my beginner problems :) There a lot and a lot of old documentation for openLdap, with old slapd.conf configuration, old generation of certificates, incompatibility between certificate gnutls and openssl .. It's not easy to find the right and exhaustive documentation .. > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: I have no name!
by Denis Witt 12 Dec '11

12 Dec '11

On 12.12.2011 16:44, Craig White wrote: >>> I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing >>> the 'I have no name !' while I do ssh on client machine(All user info is >>> getting propagated to client machines properly (checked with getent >> are you using nscd (Name Service Cache Daemon)? If so uninstall it and the error should be gone. See google for details. >> If you want to verify before uninstall just restart/stop nscd and check if the name is shown. > FTR - I don't personally care for nscd very much but it seems that with Ubuntu 10.04 LTS that I am forced to use it or my host-based ACL's (pam_check_host_attr yes) will fail. Hi, please always reply to the list, thanks. Another "solution" might be to restart nscd every hour (or something), it seems that the cache is refreshed then and everything works fine. Bye.

3 2

decoding attrs error
by Angel L. Mateo 12 Dec '11

12 Dec '11

Hello, I have a web application that doesn't work with openldap 2.4.21. The same application is working with an old openldap 2.3.30. The problem I have is that for some reason this application performs a search with an undefined filter, the error I get in normal run is: Dec 12 13:26:47 canis21 slapd[29241]: get_filter: unknown filter type=48 In the older slapd, log is: Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SRCH base="dc=unidades,dc=vistas,dc=um,dc=es" scope=1 deref=0 filter="(?=undefined)" Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SEARCH RESULT tag=101 err=0 nentries=0 text= If I run slapd in debug mode, I get: ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0a9d3 end=0x7f23d5a0aa0d len=58 0000: 63 38 04 24 64 63 3d 75 6e 69 64 61 64 65 73 2c c8.$dc=unidades, 0010: 20 64 63 3d 76 69 73 74 61 73 2c 20 64 63 3d 75 dc=vistas, dc=u 0020: 6d 2c 20 64 63 3d 65 73 0a 01 01 0a 01 00 02 02 m, dc=es........ 0030: 00 96 02 01 00 01 01 00 30 00 ........0. >>> dnPrettyNormal: <dc=unidades, dc=vistas, dc=um, dc=es> => ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es,0) <= ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 <<< dnPrettyNormal: <dc=unidades,dc=vistas,dc=um,dc=es>, <dc=unidades,dc=vistas,dc=um,dc=es> SRCH "dc=unidades, dc=vistas, dc=um, dc=es" 1 0 150 0 0 begin get_filter ber_scanf fmt (x) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0b end=0x7f23d5a0aa0d len=2 0000: 30 00 0. get_filter: unknown filter type=48 end get_filter 0 filter: (?=undefined) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0d end=0x7f23d5a0aa0d len=0 send_ldap_disconnect 2:decoding attrs error send_ldap_response: msgid=0 tag=120 err=2 ber_flush2: 58 bytes to sd 15 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 ldap_write: want=58, written=58 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 conn=1000 op=3 DISCONNECT tag=120 err=2 text=decoding attrs error connection_closing: readying conn=1000 sd=15 for close Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical