openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

extract response controls after ldap_sasl_interactive_bind_s()
by Michael Ströder 04 Dec '11

04 Dec '11

HI! Disclaimer: I'm not a C programmer. I'd like to evaluate response controls (e.g. ppolicy) also when doing a SASL bind. I'm using python-ldap which in turn uses OpenLDAP C API's function ldap_sasl_interactive_bind_s(). But currently there's no way to extract the server's response controls. The server I'm testing with is returning the ppolicy response control and others. I looked at clients/tools/common.c but it seems to me it also uses ldap_sasl_interactive_bind_s() and no response controls are extracted. Do I have to use ldap_get_option(ld,LDAP_OPT_SERVER_CONTROLS) separately? Does that work? Ciao, Michael.

2 5

RWM
by W.Siebert＠t-systems.com 03 Dec '11

03 Dec '11

Hello, the slapd-meta backend (OpenLDAP version: 2.4.26 and 2.4.28) has an own rewriting module. If I want to use rewriting and remaping, do I have to install rwm-overlay although I have meta installed? My predecessor recently left the company. How can I check which backends and overlays are already installed? Kind regards Waldemar

1 0

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 02 Dec '11

02 Dec '11

Ok will give that a try stay tuned. Jeffrey On Thu, Dec 1, 2011 at 11:39 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 01, 2011 9:38 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >>> Humm that didn't seem to work. I'm rebuilding so I'll give that another >>> try. >> >> >> Finally got to do another test. I tested by changing the permissions >> of the replication account permissions and tried restarting with slapd >> -c rid=<number> where the number is the id of the rid= definition in >> the olcSyncrepl configuration. It didn't seem to work (Note the >> permission changes were just what attributes the account could see) >> >> Just for grins I also tried rid=0 and rid by itself. None seemed to >> work. I'm guessing I'm just doing something wrong but not sure what it >> is. > > > Well, rid can't be zero. rid has to be the rid you selected in the replica > for that master connection. Looking at test058, it looks like the correct > syntax is to use -c rid=<rid>,csn=0 > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Failure while importing an exported ldif file
by Axel Birndt 02 Dec '11

02 Dec '11

Hi @All, now while my ldapserver is working on my testmachine, i'am trying to import my ldif files. I read the thread http://www.openldap.org/lists/openldap-software/200711/msg00069.html but the import isn't working for me. abirndt@lvps83-169-33-218:~/openldap_2axels-company$ sudo slapadd -F /etc/ldap/slapd.d -n 0 -l dc_2axels-company_dc_de_export.ldif slapadd: line 1: database (cn=config) not configured to hold "dc=2axels-company,dc=de" slapadd: line 1: database (cn=config) not configured to hold "dc=2axels-company,dc=de" abirndt@lvps83-169-33-218:~/openldap_2axels-company$ sudo slapadd -F /etc/ldap/slapd.d -n 0 -l cn_config_export.ldif I created my backupfiles with the following commands: sudo slapcat -b cn=config -F /etc/ldap/slapd.d/ >cn_Config_export.ldif sudo slapcat -b dc=2axels-company,dc=de -F /etc/ldap/slapd.d/ >dc_2axels-company_dc_de_export.ldif I'am also looking in google for solving this, but in my mind i haven't the right keywords... Could anyone give me a hint or a link for reading, how to import the created ldif files from above to a new ldap-server? -- Gruß Axel ------------------------------

2 4

Re: memberof overlay deployment
by Bryce Powell 02 Dec '11

02 Dec '11

Hi, I tried the method suggested by Marco to populate memberOf attributes of existing entries: >> How would you recommend getting memberof values populated in the existing directory? > If you can afford a sequence of: > stop -> slapcat -> drop db -> slapadd > Everything gets populated as desired. I tried this and the directory was restored minus the memberOf attributes. I used the following commands on version 2.4.11 (yes, I know I have to upgrade ...) : /usr/local/sbin/slapcat -l data_20111201.ldif (..drop db..) /usr/local/sbin/slapadd -c -v -l data_20111201.ldif 'Manual' group membership updates do result in the memberOf attributes getting updated, so I know the overlay is working. Thanks, Bryce Powell

5 5

Security between server and client nodes.
by Jayavant Patil 02 Dec '11

02 Dec '11

Hi, I am using openLDAP-2.4.19-4 on fedora 12 machine. I want to make server secure from client nodes so that clients don't hack the server node. Hack in the sense that one client doesn't even read the data of another client, client doesn't tamper the server directory information or try to spoof the server. Does anybody have any suggestions how to avoid these things in openLDAP? Thanks in advance. -- Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 14

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 01 Dec '11

01 Dec '11

On Wed, Nov 23, 2011 at 10:13 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, November 23, 2011 9:26 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >> read that already: >> >> my original question was the following: >> >> Granted the above issues might be explained away in that we don't yet >> have enough ram on the machines yet, however it does seem to present >> us with a problem when we notice the discrepancy, how do we during run >> time re-sync the data from the provider server? I have tried the slapd >> -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any >> good. (I've tried several different values of csn=0 >> csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) > > > Regardless of RAM limitations, you should never have an inconsistent > database. However, so far, the only replication mechanism I've seen > guarantee this is delta-syncrepl. This may be better in the upcoming > OpenLDAP 2.4.27 for syncrepl. > > If you read the slapd man page for the -c option, it is quite clear: > > Use only the rid part to force a full reload. Humm that didn't seem to work. I'm rebuilding so I'll give that another try. > > >> from man slapadd >> >> LIMITATIONS >> Your slapd(8) should not be running when you do this to ensure >> consis- tency of the database. >> >> So how can I have slapd run, respond to what data it has currently yet >> understand that it will update all it's data with the source provider >> updating, adding, removing entries as necessary without removing the >> database first? > > I don't understand why you would want slapd to respond with completely bogus > data to any clients doing queries. If you're going to force reload the > replica anyway, it makes much more sense to use slapadd from the master > rather than trying to do it via syncrepl, which can take numerous amounts of > time longer than doing it via slapadd, and during that entire time period, > you have the possibility of sending out significantly erroneous data. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

[***** SPAM 3.5 *****] Re: pwdCheckModule not loaded
by Raffael Sahli 01 Dec '11

01 Dec '11

Is OpenLDAP compiled with enable-modules? You should see something in the syslog with loglevel -1 or run the daemon in forderground. Are you sure your daemon reads the config file and not a config db? Clément OUDOT <clem.oudot(a)gmail.com> schrieb: >Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : >> Sorry ... >> My outbox contains the mail with list, could be some problem with my >> mailclient html vs txt >> >> It shows as text so I hope list will be kept... > >Fail. > >> I'm using Ubuntu 11.10 >> And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap >> /usr/local/libexec >> Which are the directories I installed the modules to. >> There was no error in logging but also no pwdCheckModule >> > >Sorry, no other idea. Maybe someone else can help you. > >Clément. >

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > Sorry ... > My outbox contains the mail with list, could be some problem with my > mailclient html vs txt > > It shows as text so I hope list will be kept... Fail. > I'm using Ubuntu 11.10 > And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap > /usr/local/libexec > Which are the directories I installed the modules to. > There was no error in logging but also no pwdCheckModule > Sorry, no other idea. Maybe someone else can help you. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 16:33, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > I already did that after your last mail > > => no effect > > Must there one modulepath or are there multiple possible > It seems like the second one but I better ask ... Please keep the list in copy! man slapd.conf: modulepath <pathspec> Specify a list of directories to search for loadable modules. Typically the path is colon-separated but this depends on the operating system. The default is /home/clement/Programmes/openldap/libexec/openldap, which is where the standard OpenLDAP install will place its modules. Clément.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical