openldap-technical

openldap-technical@openldap.org

2 participants
9852 discussions

ldap bind response
by Gustavo Rios 23 Mar '22

23 Mar '22

Hi folks ? I am writing an ldap library for accessing openldap server. I have written a function that implements an ldap bind request and decode the openldap response. The program output is given below. sioux@etosha:~/msc/it/cnf/ldap/programs/ldp$ ./ldp 127.0.0.1.389 30 c 2 1 3 61 7 a 1 0 4 0 4 0 Tag: 48, Length: 12 Left: 12 bytes ================================ Tag: 2, Length: 1 Left: 10 bytes Value: 3 ================================ Tag: 97, Length: 7 Left: 7 bytes My question is: how to "read" de last seven bytes ? I have read the ldap rfc but it is still confusing. May you help me ? Thanks a lot! -- The lion and the tiger may be more powerful, but the wolves do not perform in the circus

1 0

slapi plug-in does not work after update of OpenLDAP from 2.4 to 2.6.1
by Matthias Apitz 23 Mar '22

23 Mar '22

Hello, We're running since ages with an OpenLDAP server 2.4 a plugin which publishes changes (add, modify, delete) in LDAP to an Identity Management Server (IDM). The plugin is written in C and configured in slpad.conf as a shared lib: plugin postoperation /opt/openldap-2.6.1/lib64/idm.so idm_init "IDM Plugin" 10.23.33.52 3001 The function idm_init() registers static C functions the supposed way: int idm_init(Slapi_PBlock * pb) { int rc = LDAP_SUCCESS; log("idm-plugin:","now in idm_init()\n"); // first call, create new list and register the functions ... rc |= slapi_pblock_set( /* Plug-in API version */ pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_CURRENT_VERSION); rc |= slapi_pblock_set( /* Plug-in description */ pb, SLAPI_PLUGIN_DESCRIPTION, (void *) &desc); rc |= slapi_pblock_set( /* Modify function */ pb, SLAPI_PLUGIN_POST_MODIFY_FN, (void *) modify_user); ... // read arguments and add list entry rc |= read_arguments(pb); log("idm-plugin", "idm_init() return rc:%d\n", rc); return rc; } The function for modify_user() will later publish the change via network and without going into the details the start of the function looks like this: static int modify_user(Slapi_PBlock * pb) { Slapi_Entry *entry; log("idm-plugin:", "now in modify_user\n"); if (slapi_pblock_get(pb, SLAPI_SEARCH_TARGET, &entry) != LDAP_SUCCESS) { log("IDM-Connector Plugin", "entry modified, but couldn't get entry"); return -1; } ... The problem is, that after an update in LDAP this function is not called. The log shows only the attach and initialisation of the plugin but no further actions: 03/16/22 10:52:26 idm-plugin:: now in idm_init() 03/16/22 10:52:26 IDM-Connector Plugin: idm_init: Initializing plugin 03/16/22 10:52:26 idm-plugin:: now in read_arguments() 03/16/22 10:52:26 IDM Plugin: added idm connector: ip=10.23.33.52, port=3001 03/16/22 10:52:26 idm-plugin: idm_init() returns rc:0 03/16/22 10:52:26 plugin_pblock_new: Registered plugin OCLC-IDM-Connector-Notifier 1.0 [OCLC.org] (Notify the OCLC IDM-Connector of changes) As I said, with OpenLDAP 2.4 this works fine. It does not work anymore with 2.6.1. Is there some change in the slapi interface of which we are not aware off? What could be done as debugging/logging to nail this down? Thanks in advance and Regards matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, http://www.unixarea.de/ +49-176-38902045 Public GnuPG key: http://www.unixarea.de/key.pub

5 5

Re: RE26 testing call #1 (OpenLDAP 2.6.2)
by Nick Folino 23 Mar '22

23 Mar '22

Looking good on Fedora 35 On Tue, Mar 22, 2022 at 1:21 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the first testing call for OpenLDAP 2.6.2. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.2 Engineering > Added libldap support for OpenSSL 3.0 (ITS#9436) > Added slapd support for OpenSSL 3.0 (ITS#9436) > Fixed ldapdelete to prune LDAP subentries (ITS#9737) > Fixed libldap to drop connection when non-LDAP data is received > (ITS#9803) > Fixed libldap to allow newlines at end of included file (ITS#9811) > Fixed slapd slaptest conversion of olcLastBind (ITS#9808) > Fixed slapd to correctly init global_host earlier (ITS#9787) > Fixed slapd bconfig locking for cn=config replication (ITS#9584) > Fixed slapd usage of thread local counters (ITS#9789) > Fixed slapd to clear runqueue task correctly (ITS#9785) > Fixed slapd syncrepl handling of new sessions (ITS#9584) > Fixed slapd to clear connections on bind (ITS#9799) > Fixed slapd syncrepl ODSEE replication of unknown attr (ITS#9801) > Fixed slapd-asyncmeta memory leak in keepalive setting (ITS#9802) > Fixed slapd-ldap memory leak in keepalive setting (ITS#9802) > Fixed slapd-meta SEGV on config rewrite (ITS#9802) > Fixed slapd-meta ordering on config rewrite (ITS#9802) > Fixed slapd-meta memory leak in keepalive setting (ITS#9802) > Fixed slapd-monitor SEGV on shutdown (ITS#9809) > Added slapo-autoca support for OpenSSL 3.0 (ITS#9436) > Added slapo-otp support for OpenSSL 3.0 (ITS#9436) > Fixed slapo-pcache SEGV on shutdown (ITS#9809) > Fixed slapo-ppolicy operation handling to be consistent (ITS#9794) > Build Enviornment > Add ability to override default compile time paths (ITS#9675) > Fix compiliation with certain versions of gcc (ITS#9790) > Fix compilation with openssl exclusions (ITS#9791) > Fix warnings from make jobserver (ITS#9788) > Documentation > admin26 Document new lloadd features (ITS#9780) > Fixed slapd.conf(5)/slapd-config(5) syncrepl sizelimit/timelimit > documentation (ITS#9804) > Fixed slapd-sock(5) to clarify "sockresps result" behavior > (ITS#8255) > > > > Regards, > Quanah >

1 0

OpenLDAP proxy for samba-usage
by lists＠zxt10d.de 22 Mar '22

22 Mar '22

Hello :) Hopefully I'm not completly wrong on this ml, as its not only ldap related, but also samba related. I work at a Chair of a german university. University uses a central LDAP-system for all students, employees, scientists, scientific guests, etc., providing an unique UID for all these peoples, plus many more information. My idea was: setting-up a local OpenLDAP-proxy, so that people of our Chair get access to ressources (eg. via samba) using their unique UID and password, but without setting-up an AD. Many system here are owned by the Chair or University, but lots of students are using their own laptop, so using a AD (and adding them) is not very handy for them ... so, something like a stand-alone samba-server with authentification versus ldap. Is there a chance to get this running? There is no chance to add the schema on a proxy? What I did so far: - I can establish a connection to the central LDAP-system using /etc/pam_ldap.conf uri ldaps://ldap.DOMAIN.de host ldap.DOMAIN.de base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de ldap_version 3 binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de bindpw PASSWORD pam_password crypt ssl start_tls ssl on - I configured /etc/libnss-ldap.conf, and a 'getent passwd' shows all local users plus the members uri ldaps://ldap.DOMAIN.de host ldap.DOMAIN.de base ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de ldap_version 3 binddn cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de bindpw PASSWORD - I also configured /etc/ldap/slapd.conf for proxy usage (I think I did ...), but I learned 2 days ago I can't add any schemata on a proxy ... # Schema includes include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # include /etc/ldap/schema/misc.schema include /etc/ldap/schema/openldap.schema # # # Module modulepath /usr/lib/ldap moduleload back_ldap.la moduleload back_hdb.la moduleload back_mdb moduleload rwm moduleload pcache.la moduleload memberof.la # # Main settings pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args conn_max_pending 1000 sockbuf_max_incoming 4194303 logfile /var/log/ldap/logfile.log #loglevel stats conns filter loglevel any sizelimit unlimited limits * size.pr=0 size.prtotal=none tool-threads 1 # readonly on access to * by * read # # Database defs (proxy to AD) database ldap chase-referrals no rootdn ou=CHAIR,ou=hosts,dc=DOMAIN,dc=de suffix "dc=DOMAIN,dc=de" uri ldap://localhost/ uri ldap://ldap.DOMAIN.de/ uri ldaps://ldap.DOMAIN.de/ acl-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes idassert-bind bindmethod=simple binddn="cn=CHAIRCODE,ou=SECURITY,dc=DOMAIN,dc=de" credentials="PASSWORD" starttls=yes #cancel abandon overlay pcache #proxycache hdb 100000 3 1000 100 proxycache mdb 100000 3 1000 100 pcachePersist TRUE proxyAttrset 0 mail uid gecos proxyTemplate (sn=) 0 3600 proxyTemplate (&(sn=)(givenName=)) 0 3600 #cachesize 20 index objectClass eq index cn,sn,uid,mail pres,eq,sub pcacheAttrset 0 1.1 pcacheTemplate (&(|(objectClass=))) 0 3600 pcacheTemplate (objectClass=*) 0 3600 pcacheAttrset 1 displayname pcacheTemplate (objectClass=*) 1 3600 pcacheAttrset 2 memberOf pcacheTemplate (objectClass=*) 2 3600 conn-ttl 3600 # directory /var/lib/ldap Testing the config works: root@ldap:~# /usr/sbin/slapd -Tt -f /etc/ldap/slapd.conf config file testing succeeded 62398f56 mdb_opinfo_get: err Permission denied(13) root@ldap:~# (I have no idea which Permission is denied) slapd can be started via /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf ldapsearch works fine using '-h localhost' or '-H ldap://ldap.DOMAIN.de', so I think the basic config is not bad at all ... Thanks in advance! Cheers, Torsten

1 0

Re: Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Am Mi., 16. März 2022 um 21:39 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 10:23 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > > > We are still using the bdb backend and the latest 2.4.59 (don't ask, > > it will be replaced soon) and I remember, a "few" years ago, I had > > problems with slapcat and online databases, because the server was > > stucking for a while and answers were delayed .. > > (The Admin Guide tells, that "Backups are managed slightly differently" > > ...) Secondly, while offline, I can copy the whole database directory > > including the transaction logs .. > > Ah, ok. Yes, you could set up a read-only consumer node to take backups > from. I'd highly prioritize moving to a supported release of OpenLDAP with > the back-mdb backend as well (I see you say it should be replaced soon). :) > Quanah, thanks for guiding me! Meike

1 0

Re: Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Am Mi., 16. März 2022 um 19:31 Uhr schrieb Quanah Gibson-Mount <quanah(a)fast-mail.org>: > > > > --On Wednesday, March 16, 2022 7:59 PM +0100 Meike Stone > <meike.stone(a)googlemail.com> wrote: > > > Hello, > > > > what is the right solution to backup a Mirromode setup? > > I've a simple setup with two servers, running in mirromode and a > > virtual IP is moved on "request" between the two servers (nodes). The > > DNS-Name of the virtual IP is used for the client ldap requests. The > > server certificate is issued to the DNS name of the virtual IP, but > > has two SANs for the both node names. The node names will be used for > > replication in mirrormode. Everything is running well. > > Can I set up a third (readonly) server, who only replicates the > > Database from the "mirromode cluster'' using the DNS-Name without > > problems and then shutdown slapd temporarily and splacat the database? > > You don't need to shut down slapd to slapcat the database, so I'm not clear > what the concern is here? You should just do a periodic slapcat. > We are still using the bdb backend and the latest 2.4.59 (don't ask, it will be replaced soon) and I remember, a "few" years ago, I had problems with slapcat and online databases, because the server was stucking for a while and answers were delayed .. (The Admin Guide tells, that "Backups are managed slightly differently" ...) Secondly, while offline, I can copy the whole database directory including the transaction logs .. Thanks Meike

2 1

Backup Mirrormode setup
by Meike Stone 16 Mar '22

16 Mar '22

Hello, what is the right solution to backup a Mirromode setup? I've a simple setup with two servers, running in mirromode and a virtual IP is moved on "request" between the two servers (nodes). The DNS-Name of the virtual IP is used for the client ldap requests. The server certificate is issued to the DNS name of the virtual IP, but has two SANs for the both node names. The node names will be used for replication in mirrormode. Everything is running well. Can I set up a third (readonly) server, who only replicates the Database from the "mirromode cluster'' using the DNS-Name without problems and then shutdown slapd temporarily and splacat the database? Thanks Meike

2 1

migrate from RedHat openldap 2.4 to LTB OpenLdap 2.5
by Aaron Bennett 15 Mar '22

15 Mar '22

Hi, I'm moving from a two-node CentOS 7 cluster running essentially the RedHat openldap-servers build (which I rebuild to use OpenSSL, but otherwise, left alone). I've provisioned a new Rocky Linux 8 system and have installed OpenLDAP 2.5 from the LTB repository, and have moved the old slapd.d directory out of the way and put the slapd.d directory from the old servers in place. If I try to run slapd-cli status, it throws this: olcAttributeTypes: value #8 olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" config error processing cn={5}samba,cn=schema,cn=config: olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" slapcat: bad configuration directory! olcAttributeTypes: value #8 olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" config error processing cn={5}samba,cn=schema,cn=config: olcAttributeTypes: Inconsistent duplicate attributeType: "pwdMustChange" slapcat: bad configuration directory! Looking here: https://ltb-project.org/documentation/migrate_openldap_ltb_24_openldap_ltb_…, it looks like there's more going on. Does anyone have any input as to how to accomplish this? I do need to bring the old data in, ideally without having to make changes to the samba scheme under the hood. Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 5

olcLastBind default to true
by Erik de Waard 14 Mar '22

14 Mar '22

$OpenLDAP: slapd 2.5.11 Hi, i've a weird case where olcLastBind defaults to TRUE. When using convert (slaptest) method. and explicit lastbind to off/false has no effect. #Initialize slapd with convert method slaptest -f /etc/openldap/slapd.conf.init -F /etc/openldap/slapd.d/ slapcat -n0 | grep LastBind olcAttributeTypes: ( OLcfgDbAt:0.22 NAME 'olcLastBind' EQUALITY booleanMatch S olcLastMod $ olcLastBind $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcRea olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE olcLastBind: TRUE Tested with minimal config: # stand-alone slapd config include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema #include /etc/openldap/schema/test.schema # allow big PDUs from anonymous (for testing purposes) sockbuf_max_incoming 4194303 moduleload back_ldap ####################################################################### # database definitions ####################################################################### database config database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap lastbind off database monitor Best regards,

2 1

syncprov-sessionlog-source cn=accesslog
by Michael Ströder 14 Mar '22

14 Mar '22

HI! I wonder what the operational requirements are when using syncprov-sessionlog-source cn=accesslog instead of the in-memory session log. E.g. what about configured logpurge? What happens if the accesslog DB is completely deleted? Ciao, Michael.

3 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical