openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

openldap user login
by Jayavant Patil 07 Dec '11

07 Dec '11

Hi, I am using openldap-2.4.19-4 on fedora 12 machine. In order to protect roobindpw, I removed that from /etc/ldap.conf and written it in /etc/ldap.secret with root access only. Now, /etc/ldap.conf file (with permissions 644) contents w.r.t. bind are as follows: # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=root,dc=abc,dc=com # The credentials to bind with. # Optional: default is no credential. #bindpw cluster # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=root,dc=abc,dc=com but now when I do $ssh ldap_6@client-node-name, I get the following message: id: cannot find name for user ID 514 id: cannot find name for user ID 514 [I have no name!@client-node-name ~]$ when i do $id on client node I get the followng: uid=514 gid=514(ldap_6) groups=514(ldap_6) Any idea what could be the problem? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 4

Fixed : SHELL env variable not red
by Olivier 07 Dec '11

07 Dec '11

Just to update on that : I have received this RedHat update notification last night : Synopsis openldap bug fix and enhancement update updated : 06/12/11 Subject Updated openldap packages that fix number of bugs and add various enhancements are now available for Red Hat Enterprise Linux 6. Description ... https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Tech… I updated and the loginShell variable is now properly used over authentication ( with no change on my initial configuration). I also see that many TLS issues that I have faced in the passed seem to have been fixed : I'm going to check that. Best, --- olivier On Thu, Dec 1, 2011 at 3:00 PM, Olivier <ldap(a)guillard.nom.fr> wrote: > > Hello, > > I have configured nss/pam on a REDHAT6 box to authenticate users > against an ldap : it works but I have a problem with getting my favorite > user shell when I log in. > > The "loginShell" shell attribute sounds to not been used to provide users > with their favorite shell when they log in : may be I misunderstood the > usage of this "posixAccount" attribute ? > > Thanks for your help, see below for additional indications : > > $ ssh olivier(a)redhatbox.example.fr > olivier(a)redhatbox.example.fr's password: < MY LDAP PASSWORD> > > RHN Satellite kickstart on 2011-06-16 > > ##################### > # redhatbox.example.fr # > # # > # Hello # > ##################### > > > sh-4.1$ grep olivier /etc/passwd > <returns nothing (no local entry for olivier)> > > -sh-4.1$ pwd > > /home/olivier (my home directory found in ldap) > > -sh-4.1$ env | grep -i shell > SHELL=/bin/sh ( my shell user environnment is not picked in ldap) > > sh-4.1$ ldapsearch -D uid=olivier,ou=staff,ou=people,dc=example,dc=fr > -W uid=olivier > > Enter LDAP Password: < MY LDAP PASSWORD> > > # olivier, staff, people, example.fr > dn: uid=olivier,ou=staff,ou=people,dc=example,dc=fr > cn: Olivier G > gidNumber: 18000 > homeDirectory: /home/olivier > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: shadowAccount > sn: olivier > uid: olivier > uidNumber: 1000 > shadowLastChange: 15282 > loginShell: /bin/tcsh > givenName: Olivier > mail: olivier(a)example.fr > userPassword:: xxxxxxxxxxxxxxxxxxxxxxx > > -sh-4.1$ cat /etc/shells > /bin/sh > /bin/bash > /sbin/nologin > /bin/tcsh (my favorite shell is allowed) > /bin/csh > > ANY HELP ??? > > > Thanks > > --- > Olivier

1 0

openldap with Ipv6 link local ip?
by Richard Knight 06 Dec '11

06 Dec '11

Is it possible to use an IPv6 Link-Local ip with openlap clients? address would be of the form ldaps://[fe80::abcd:346:123%eth0]:636 where %eth0 is the interface specifier Richard

2 1

Adding many users together
by Andreas Rudat 06 Dec '11

06 Dec '11

Hello, I have 100 users which I have to add into my ldap database, how can I do that? With a ldif file? Like that? dn: cn=John Doe, ou=Rochester, o=IBM, c=US objectclass: person objectclass: inetOrgPerson objectclass: top objectclass: organizationalPerson objectclass: ePerson cn: John Doe sn: Doe uid: jdoe userpassword: secretpass I think its realy horrible if I want to add 100 users in this way? thanks

4 4

memberof overlay deployment
by Asplund Marko 06 Dec '11

06 Dec '11

Hi, I'm planning on deploying the memberof overlay feature in our OpenLDAP v2.3 directory and I'd like to get some practical advice on this. So far, I've done some testing in my test environment. I've added an overlay directive in slapd.conf: overlay memberof and imported group info to populate data. memberof queries appear to be working fine. Is there something else I should consider in addition? What would be the best way to get the memberof attribute values populated in the production database? Should I reimport all the data? What would be the best way for doing that? Or is it possible to somehow get the attribute values populated without reimporting? marko

5 7

slapd hanging - meta backend - Solaris 10
by Lincoln Souzek 05 Dec '11

05 Dec '11

Hello, I've seen a couple of instances where slapd becomes unresponsive, apparently because the threads are waiting on a backend meta DB. We're running slapd 2.4.23 on Solaris 10 (update 11/06). We have 128 threads configured and when I attach with truss, I see 130 allocated, most of which look like this: /53: lwp_park(0x00000000, 0) (sleeping...) When I run pstack against the PID, the stack for almost all of the threads looks like one of the two threads below, both of which are somewhere within meta_back_search: ----------------- lwp# 20 / thread# 20 -------------------- fee40408 lwp_park (0, 0, 0) 00140e64 ldap_build_search_req (110f0c0, 599eb90, 2, 79db010, 79db0a0, 0) + 2c 001412bc ldap_pvt_search (110f0c0, 599eb90, 2, 79db010, 79db0a0, 0) + d4 000cd494 ???????? (3f45d70, f4fffd58, f4fff478, f4fff294, 0, 2b822c0) 000cd7fc meta_back_search (3f45d70, f4fffd58, 2, 2, 24d400, 0) + 1e0 000a0928 ???????? (3f45d70, f4fffd58, f4fff8e0, 28ff20, 2ac1b8, 14) 000a12dc ???????? (f4fff8e0, f4fffd58, 2, 2, 24d400, 28ff20) 000a3950 overlay_op_walk (8000, f4fffd58, 8000, 28fe18, 28ff20, 818) + 4c 000a3ae4 ???????? (3f45d70, f4fffd58, 2, 1e6000, a3ba0, 28fe18) 00041e08 fe_op_search (3f45d70, f4fffd58, 3f45e70, f4fffad8, 1ee5f8, 1ee6f0) + 3f8 00041528 do_search (3f45d70, f4fffd58, fee6cbc0, 1e6000, 16ec00, f4fffad8) + 590 0003f8e4 ???????? (f4fffe08, 3f45d70, fee6cbc0, fe2d4400, 2683c8, 0) 0013ca30 ???????? (2683b8, f5000000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) ----------------- lwp# 21 / thread# 21 -------------------- fee40408 lwp_park (0, 0, 0) 0013e5c8 ldap_result (10ea3b0, 43e, 2, f47ff488, f47ff290, 0) + 3c 000cddf0 meta_back_search (53fe5b8, f47ffd58, 2, 2, 0, 1) + 7d4 000a0928 ???????? (53fe5b8, f47ffd58, f47ff8e0, 28ff20, 2ac1b8, 14) 000a12dc ???????? (f47ff8e0, f47ffd58, 2, 2, 24d400, 28ff20) 000a3950 overlay_op_walk (8000, f47ffd58, 8000, 28fe18, 28ff20, 818) + 4c 000a3ae4 ???????? (53fe5b8, f47ffd58, 2, 1e6000, a3ba0, 28fe18) 00041e08 fe_op_search (53fe5b8, f47ffd58, 53fe6b8, f47ffad8, 1ee5f8, 1ee6f0) + 3f8 00041528 do_search (53fe5b8, f47ffd58, fee6cbc0, 1e6000, 16ec00, f47ffad8) + 590 0003f8e4 ???????? (f47ffe08, 53fe5b8, fee6cbc0, fe2d4800, 2683c8, 0) 0013ca30 ???????? (2683b8, f4800000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) I took a core dump while the process was running but I'm not really sure how to proceed from here. Is there any way to get more information on what was happening with these threads at the time? In either case, is this a situation that should be handled with a general timeout directive? We currently only have a network-timeout and a bind timeout specified: network-timeout 3 timeout bind=3 Thanks, Lincoln

2 1

ldap_add_s - mods.mod_values empty
by Sean Ryan 05 Dec '11

05 Dec '11

Hello, Firstly, I hope this is the correct list Relevant versions: O/S: Debian Etch (server) - Debian Lenny (client) Slapd : OpenLDAP: slapd 2.3.30 Client libs : libldap2 (debian) I'm seeing some problems using the ldap_add_s function call - For some reason the mods.mod_values array *appears* to be empty - slapd reports that it's missing values for the attribute type and wireshark confirms that to be the case (partial extract below). addRequest entry: macaddress=002145ccfadf,dc=nodomain attributes: 2 items Item macaddress type: macaddress vals: 0 items The below is the partial source code involved. Code : char * vals[LdapDefaults::MAX_MODS][2]; ACE_DEBUG((LM_DEBUG, "(%t) Add Entry %s:%s %D \n", tempName, tempValue)); vals[loopcount][0] = new char [LdapDefaults::MAX_OPTION_LEN]; vals[loopcount][1] = 0; opTypes[loopcount] = new char [LdapDefaults::MAX_OPTION_LEN]; mod[loopcount].mod_op = 0; strcpy (opTypes[loopcount], tempName); strcpy (vals[loopcount][0], tempValue); mod[loopcount].mod_type = new char [LdapDefaults::MAX_OPTION_LEN]; strcpy (mod[loopcount].mod_type ,opTypes[loopcount]); mod[loopcount].mod_values = vals[loopcount]; loopcount ++; ++ nvpBegin ; for (int counter = 0 ; counter < loopcount ; counter ++) { mods[counter] = &mod[counter]; mods[counter]->mod_values = sn_values; ADA_DEBUG ((LM_DEBUG, "Value == %s\n", mods[counter]->mod_values[0])); } mods[loopcount] = 0; errCode = ldap_add_s(pld, tempDn , mods) ; addRequest entry: macaddress=002145ccfadf,dc=nodomain attributes: 2 items Item macaddress type: macaddress vals: 0 items There are a couple of curious things here. 1. Assigning mod->mod_values to a statically declared array ( char *sn_values[] = { "Jensen", NULL }; mods[counter]->mod_values = sn_values;) does not change the behavior 2. Debugging the contents of mods[i]->mod_values[0] immediately before and after the call to ldap_add_s shows that the correct values as being present in the structure. 3. Building a standalone test application and directly linking my library produced works as expected. Any thoughts on how to debug this further much appreciated. Thanks Sean

1 0

Re: LDAP query to Active Directory backend
by Khaled Blah 05 Dec '11

05 Dec '11

Thanks for your reply, Michael! I should have mentioned that I have tested this code with an OpenLDAP server (2.4.23) and a Lotus Notes server (ver. 8) and both of them return UTF-8 encoded data (like I expected it). The only difference are the parameters which I use to start the query on these backends (bind DN, filter, etc...). Regards, Khaled

1 1

rootDSE
by W.Siebert＠t-systems.com 04 Dec '11

04 Dec '11

Hello, is it posible to add an attribute to rootDSE? regards Waldemar

2 1

Re: RWM
by masarati＠aero.polimi.it 04 Dec '11

04 Dec '11

> Hello, > > the slapd-meta backend (OpenLDAP version: 2.4.26 and 2.4.28) has an own > rewriting module. If I want to use rewriting and remaping, do I have to > install rwm-overlay although I have meta installed? not sure what you mean by "installed"; if you mean "loaded" when built as run-time loadable modules, then the answer is "no". The two modules (back-meta and slapo-rwm) are orthogonal. p.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical