openldap-technical

openldap-technical@openldap.org

12 participants
9935 discussions

OpenLDAP Windows setup
by Ashish Chawla 12 Sep '11

12 Sep '11

Hi, I installed OpenLDAP on windows XP by running the application installer. I am new to OpenLDAP and facing lots of issues while running client tools. Am not able to add new users or run utilities like slapcat.exe- it gives error: " slapcat: database doesn't support necessary operations". Can somebody tell me a quick way of adding users and organizations and also if there is a way of capturing the detailed errors. I know that I can get help from this forum only. Any help in this regard will be of great use to me. Thanks, Ashish Chawla ________________________________ ::DISCLAIMER:: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

1 0

Re: Change a user dn
by Juan Diego Calle 12 Sep '11

12 Sep '11

Ok, let me rephrase this, I have read many books, like O'reilly s LDAP system administratoro, or docs like Or http://tools.ietf.org/html/rfc4511#section-4.9, that explains this exactly The Modify DN operation allows a client to change the Relative Distinguished Name (RDN) of an entry in the Directory and/or to move a subtree of entries to a new location in the Directory. The Modify DN Request is defined as follows: ModifyDNRequest ::= [APPLICATION 12] SEQUENCE { entry LDAPDN, newrdn RelativeLDAPDN, deleteoldrdn BOOLEAN, newSuperior [0] LDAPDN OPTIONAL } Fields of the Modify DN Request are: - entry: the name of the entry to be changed. This entry may or may not have subordinate entries. - newrdn: the new RDN of the entry. The value of the old RDN is supplied when moving the entry to a new superior without changing its RDN. Attribute values of the new RDN not matching any attribute value of the entry are added to the entry, and an appropriate error is returned if this fails. I read the paragraph above, and it seems pretty straight forward, I believe I understand how it works, but when I try to apply this to what I need I dont know what to do. I can change the UID, or other fields from the users or groups, but i can change the dn. For me Openldap has being really hard to understand, it is really technical, usually i am really good at this stuff. I am pretty sure I have huge gaps of knowledge that requires more reading, and a better understanding of the standards. But that is why I usually ask here when I am stuck. This is usually the last place I resort when I dont have answers. Thanks, Juan Diego ----- Original Message ----- From: masarati(a)aero.polimi.it To: "Juan Diego Calle" <juandiego.calle(a)soportelibre.com> Cc: openldap-technical(a)openldap.org Sent: Monday, September 12, 2011 4:08:57 PM GMT -05:00 Colombia Subject: Re: Change a user dn You didn't try all combinations of parameters, you need to be exhaustive when doing trial and error, otherwise there is no guarantee you get to the right combination in a finite amount of time. Or, you can read RFC4511 and find out how to do things right the first time. p. > Hi thanks for the helo I have being tryinn a few things with ldapmodify, > > I need to modify the user from > dn: uid=user1,ou=People,dc=mydomain,dc=com, > to > dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, > > I have try some of the following attempts > > dn: uid=user1,ou=People,dc=mydomain,dc=com > changetype: modify > replace: dn > dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com > > that according to what i have read it doesnt have work, because dn is not > exactly like an attribute > > dn: uid=user1,ou=People,dc=mydomain,dc=com > changeType: modrdn > newRDN: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com > deleteOldRDN: 1 > > and this ones gives me > > modifying rdn of entry "uid=user1,ou=People,dc=mydomain,dc=com" > rename completed > ldapmodify: Invalid DN syntax (34) > additional info: invalid new RDN > > I dont know how to add an ou to the dn. > > Thanks > > > > > > ----- Original Message ----- > From: "Andrey A. Konovalov" <mudraia(a)list.ru> > To: openldap-technical(a)openldap.org > Sent: Friday, September 9, 2011 12:43:01 PM GMT -05:00 Colombia > Subject: Re: Change a user dn > >> Hi >> >> I have Openldap with samba, and some users. >> My users are part of ou=People,dc=mydomain,dc=com, >> like this, >> dn: uid=user1,ou=People,dc=mydomain,dc=com, >> >> So i wanted some of my users to be able to administer a group of users >> and be able to create users, so a friend of mine recommended me to do >> the following, create a group like this >> >> dn: cn=Admin Group1,cn=Admins,ou=People,dc=mydomain,dc=com, >> objectClass: groupOfNames >> objectClass: top >> cn: Admin Group1 >> member: uid=adming1,ou=People,dc=mydomain,dc=com, >> >> and >> >> dn: ou=Group1,ou=People,dc=mydomain,dc=com >> objectClass: organizationalUnit >> objectClass: top >> ou: U.A.A. Group1 >> >> the users of this "group" whould have to be >> >> dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, >> >> >> And with and acl I give Admin Group1 users complete control over that >> ou. >> >> >> So this seems to work. But I already have users that use my ldap, is it >> possible to change their dn, I am not clear on how to do this. >> >> Thanks, >> >> Juan Diego >> > > > Maybe, > (do it with ldapmodify, fex.) > dn: uid=user1,dc=tratata,dc=com > changeType: modrdn > newRDN: user2 > deleteOldRDN: 1 > > ??? > -- > Andrey A. Konovalov <mudraia(a)list.ru> > > >

2 1

Change a user dn
by Juan Diego Calle 12 Sep '11

12 Sep '11

Hi I have Openldap with samba, and some users. My users are part of ou=People,dc=mydomain,dc=com, like this, dn: uid=user1,ou=People,dc=mydomain,dc=com, So i wanted some of my users to be able to administer a group of users and be able to create users, so a friend of mine recommended me to do the following, create a group like this dn: cn=Admin Group1,cn=Admins,ou=People,dc=mydomain,dc=com, objectClass: groupOfNames objectClass: top cn: Admin Group1 member: uid=adming1,ou=People,dc=mydomain,dc=com, and dn: ou=Group1,ou=People,dc=mydomain,dc=com objectClass: organizationalUnit objectClass: top ou: U.A.A. Group1 the users of this "group" whould have to be dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, And with and acl I give Admin Group1 users complete control over that ou. So this seems to work. But I already have users that use my ldap, is it possible to change their dn, I am not clear on how to do this. Thanks, Juan Diego

3 3

LDAP proxy with back_ldap: (?=undefined)
by Torsten Schlabach (Tascel eG) 12 Sep '11

12 Sep '11

Hi all! I am trying to setup the simplest possible LDAP proxy with OpenLDAP. Actually, I do have a machine with one interface on a public IP address and the other one on the private network. So all I want is a pass-through of any LDAP query 1:1 from the proxy which sits on the public IP to an LDAP server which can be reached only through a private IP on our internal network. Here is my config: database ldap suffix "o=top" uri "ldap://192.168.12.34/" My problem is: The query sent to the backend server always contains a (?=undefined) condition, which leads to no objects found. In other words, the query I send to the proxy is for example: (&(?objectClass=mailalias)(dc=xxxx.yy)) The back_ldap will send to the backend server: (&(&(?objectClass=mailalias)(dc=xxxx.yy))(?=undefined)) Any idea? Regards, Torsten

3 4

Can't contact LDAP server
by Mark 09 Sep '11

09 Sep '11

I have a 2-way multi-master setup on srv1.foo.com (EDT) and srv2.foo.com (PDT). For about 2hrs this morning srv2 was syslog'ing "Can't contact LDAP server" while it was in a replication conversation with srv1: Sep 9 05:29:45 srv2 slapd[9413]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 9 05:29:45 srv2 slapd[9413]: do_syncrepl: rid=001 rc -1 retrying Sep 9 05:30:00 srv2 slapd[9413]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Sep 9 05:30:01 srv2 last message repeated 34 times Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0 ... Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:29 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:29 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) Sep 9 05:30:29 srv2 slapd[9413]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 9 05:30:29 srv2 slapd[9413]: do_syncrepl: rid=001 rc -1 retrying Sep 9 05:30:45 srv2 slapd[9413]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Sep 9 05:30:45 srv2 last message repeated 34 times Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:45 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:45 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) ... During that time no errors or closes were logged in the srv2 syslog. I tried bouncing each slapd, but the issue continued. After about 2hrs it stopped occurring. My question is: What would cause the "Can't contact LDAP server message"? The srv1 side doesn't log any error or log that the connection was closed. The text "Can't contact" would seem to imply that the error occurred during a connection attempt, but these errors seemed to occur during a active conversation. Does the srv2 side notice an read or write error on the socket and abandon the connection? I've been looking through the code trying to determine what causes that error message. Does it happen on a single read/write error? Does it retry a few times? I hate to just say "Must be a network error" without some due diligence. My env: RHEL 5.5 OpenLDAP 2.4.25 BerkeleyDB 4.8.40 OpenSSL 1.0.0d Cyrus SASL 2.1.23 2-way Multi-master ==================== #srv1 slapd.conf -> slapd.d include /appl/openldap/etc/schema/core.schema include /appl/openldap/etc/schema/cosine.schema include /appl/openldap/etc/schema/nis.schema include /appl/openldap/etc/schema/inetorgperson.schema include /appl/openldap/etc/schema/foo.com.schema argsfile /appl/openldap/var/run/slapd.args pidfile /appl/openldap/var/run/slapd.pid threads 16 tool-threads 4 idletimeout 300 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 1 ldap://srv1.foo.com:10806 modulepath /appl/openldap/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,dc=foo,dc=com database monitor rootdn cn=manager,dc=foo,dc=com database hdb rootdn cn=manager,dc=foo,dc=com suffix dc=foo,dc=com directory /appl/openldap/var/data/dc=foo,dc=com cachesize 1000 idlcachesize 3000 cachefree 5 checkpoint 128 15 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://srv1.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://srv2.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 limits dn.exact="cn=replicator,dc=foo,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ==================== #srv2 slapd.conf -> slapd.d include /appl/openldap/etc/schema/core.schema include /appl/openldap/etc/schema/cosine.schema include /appl/openldap/etc/schema/nis.schema include /appl/openldap/etc/schema/inetorgperson.schema include /appl/openldap/etc/schema/foo.com.schema argsfile /appl/openldap/var/run/slapd.args pidfile /appl/openldap/var/run/slapd.pid threads 16 tool-threads 4 idletimeout 300 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 2 ldap://srv2.foo.com:10806 modulepath /appl/openldap/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,dc=foo,dc=com database monitor rootdn cn=manager,dc=foo,dc=com database hdb rootdn cn=manager,dc=foo,dc=com suffix dc=foo,dc=com directory /appl/openldap/var/data/dc=foo,dc=com cachesize 1000 idlcachesize 3000 cachefree 5 checkpoint 128 15 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://srv1.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://srv2.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 limits dn.exact="cn=replicator,dc=foo,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

1 0

Need Help On Master-Master Replication Setup!!
by pradyumna dash 09 Sep '11

09 Sep '11

Hi, I would like to setup OpenLDAP Mater-Master replication, before that i would like to know something more about it, because i never implemented the same. Suppose i have 2 servers ldap1.example.com and ldap2.example.com I will configure M-M replication with LDAPS, in this scenario how my architecture should be? Do i need to keep it behind the loadbalancer or what are the steps to do it? How come the client will come to know if any of the server is down, it will talk to the other server, because in my ldap.conf file i will have a single URI/host entry pointing to one of the server and also how to create the certificate, do i need 2 individiual certificate 1 for ldap1 and 1 for ldap2? Please help me. Regards, Neo

2 1

Re:Slapd-meta stop at the first unreachable candidate
by Michel Gruau 09 Sep '11

09 Sep '11

I performed many new tests and provide below several new comments. I recall that of them concern the fact to perform an ldapsearch on the meta suffix while one URI is unrechable. 1/ When network-timeout is not set for the unreachable URI, then no entry is returned. Unless the URI becomes unreachable after the meta startup AND for the first request only. 2/ When network-timeout is set, then the meta always returns entries, but only from the URI which are above the unreachable URI is slapd.conf. 3/ When conn-ttl is set, the walk-around which is to perform a search below the root node in order to open the channel to the different URI, is not working. Channels are always lost after the ttl expire. 4/ I saw slightly different behaviours when the unrechable URI is the first one in slapd.conf. Most of my earlier tests were performed with an unreachable URI which is the second one in slapd.conf. 4/ Such behaviour concern the case in which the URI contains valid IP (I mean pingable) but the port is unreachable (remote ldap server is stopped or port in wrong). I mean : each time the connect error is returned very quickly from network layers. But there are other cases in which connect error is returned more slowly (for instance IP address is not "pingable" or IP address is a LB virtual IP address and the remote server is unreachable). In these later cases, the meta behaviour is greatly different. I mean the meta behaviour is quite normal and entries from all reachable URI are returned ... once the different timer have elapsed. However, this later case led me to several new problems described below. 5/ The timer which is taken into account for the connection is not the "network-timeout" parameter but the "timeout" parameter. According to the slapd-meta man page, this timeout is supposed to be intended for LDAP operations and not for the network connection step. 6/ The value of the "timeout" parameter is the only one which is taken into account, but ... only if the "network-timeout" parameter is set. In other cases, a default (and longer) timeout seems to be applied. The value of network-timeout remains meaningless, it has only to be set with any value. 7/ The "timeout" parameter which is used is not the parameter corresponding to the unreachable URI. After many tests, I discovered it is the maximum value among all "timeout" in the "database meta" section, whatever the URI is !!! Conclusions: all these parameters provide a really powerfull way to cutomize the configuration but few of them are working as excepted. Could anyone explain me whether I can provide all those details as a bug report ? Or should I wait that anyone could reproduce ? Thanks for all. Michel > Message du 05/09/11 16:31 > De : "Michel Gruau" > A : "openldap-technical openldap org" > Copie à : > Objet : Re:Slapd-meta stop at the first unreachable candidate > > Below is a sample configuration allowing to reproduce the problem : > > Three openldap data instances configured as follows: > include /opt/openldap/etc/openldap/schema/core.schema > include /opt/openldap/etc/openldap/schema/cosine.schema > include /opt/openldap/etc/openldap/schema/inetorgperson.schema > include /opt/openldap/etc/openldap/schema/nis.schema > include /opt/openldap/etc/openldap/schema/dyngroup.schema > include /opt/openldap/etc/openldap/schema/misc.schema > pidfile /opt/openldap/var/run/server1.pid > argsfile /opt/openldap/var/run/server1.args > loglevel stats > database bdb > suffix ou=orgunit,o=gouv,c=fr > directory /opt/openldap/var/server1 > > Note: server1 is changed by server2 and server3 for other instances. > > Each instance contains the following data: (only 4 entries): > dn: ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: organizationalUnit > ou: orgunit > > dn: ou=dept1,ou=orgunit,o=gouv,c=fr > ou: dept1 > objectClass: top > objectClass: organizationalUnit > > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > mail: user11(a)server1.com > cn: User 11 > uid: user11 > givenName: User > sn: 11 > > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > mail: user12(a)server1.com > cn: User 12 > uid: user12 > givenName: User > sn: 12 > > Note: user1x and dept1 are substituted in instances 2 and 3 by user2x, dept2, user3x,dept3. > > Data instances are launched using this command: > /opt/openldap/libexec/slapd -n server1 -f /opt/openldap/etc/openldap/server1.conf -h ldap://0.0.0.0:1001/ > /opt/openldap/libexec/slapd -n server2 -f /opt/openldap/etc/openldap/server2.conf -h ldap://0.0.0.0:1002/ > /opt/openldap/libexec/slapd -n server3 -f /opt/openldap/etc/openldap/server3.conf -h ldap://0.0.0.0:1003/ > > Meta instance is configured as follows: > include /opt/openldap/etc/openldap/schema/core.schema > include /opt/openldap/etc/openldap/schema/cosine.schema > include /opt/openldap/etc/openldap/schema/inetorgperson.schema > include /opt/openldap/etc/openldap/schema/nis.schema > include /opt/openldap/etc/openldap/schema/dyngroup.schema > include /opt/openldap/etc/openldap/schema/anais.schema > include /opt/openldap/etc/openldap/schema/misc.schema > pidfile /opt/openldap/var/run/meta.pid > argsfile /opt/openldap/var/run/meta.args > database meta > suffix ou=orgunit,o=gouv,c=fr > uri ldap://localhost:1001/ou=dept1,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 3 > uri ldap://localhost:1002/ou=dept2,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 4 > uri ldap://localhost:1003/ou=dept3,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 4 > > and it is launched as follows: > /opt/openldap/libexec/slapd -n meta -f /opt/openldap/etc/openldap/meta.conf -h ldap://0.0.0.0:1000/ -d 256 > > # test with the 3 servers up > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr > => entries from the three servers are returned > > # stop server 2 (kill -INT ...) and perfom a new search: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => looks good : entries from server1 and server 3 are returned > > Below are the meta instance logs: > conn=1001 fd=9 ACCEPT from IP=172.30.8.13:55048 (IP=0.0.0.0:1000) > conn=1001 op=0 BIND dn="" method=128 > conn=1001 op=0 RESULT tag=97 err=0 text= > conn=1001 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" > conn=1001 op=1 SRCH attr=dn > conn=1001 op=1 meta_back_retry[1]: retrying URI="ldap://localhost:1002" DN="". > conn=1001 op=1 meta_back_retry[1]: meta_back_single_dobind=52 > conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=4 text= > conn=1001 op=2 UNBIND > conn=1001 fd=9 closed > => looks good as nentries=4 > > # perform numerous new search without changing anything: > [root@pp-ae2-proxy2 log]# /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > => nothing returned > > Below are the corresponding logs: > conn=1002 fd=9 ACCEPT from IP=172.30.8.13:55049 (IP=0.0.0.0:1000) > conn=1002 op=0 BIND dn="" method=128 > conn=1002 op=0 RESULT tag=97 err=0 text= > conn=1002 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" > conn=1002 op=1 SRCH attr=dn > conn=1002 op=1 meta_search_dobind_init[1]: retrying URI="ldap://localhost:1002" DN="". > conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=1002 op=2 UNBIND > conn=1002 fd=9 closed > => looks bad as nentries=0 > => Only the first search after server2 stop is successfull. > > # new search but using server1 ou: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept1,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > => looks good > > # same search as earlier i.e. using root node: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > => Looks good also. It looks like all is OK but only once a channel is opened to server1 using another manner > > # new search but using server3 base object: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept3,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => looks good > > # new search but using slapd-meta base object: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => entries from server1 and server3 are returned > => this confirms lookups in server1 and server3 are not performed until a channel is opened to both of them using their repective base object > => another strange behavior : if search using server3 ou is performed before serach using server ou, then next search attempt using root node allows to retrieve entries from both server1 and server3 ... > > # new search after server2 restart: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => good, all entries are returned > > # new search after meta instance restart while server2 is already stopped > opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > => unlike the previous test case (server2 stopped while meta instance is already running) we do not see the single successfull search. > > Then, behaviour is the same i.e. search on root node works again, but only once a search has been performed using ou=dept1 and ou=dept3. > > In addition, behaviour is slightly different adding the "conn-ttl" parameter set to 3 (3 seconds). I could expose it in a new post. > > Thanks for anyone who could help to identify whether it is a misconfiguration or a bug. > > Michel Gruau > > > Message du 19/08/11 13:13 > > De : "Michel Gruau" > > A : "openldap-technical openldap org" > > Copie à : > > Objet : Slapd-meta stop at the first unreachable candidate > > > > Hello, > > It have a slapd-meta configuration as follows: > > database meta > suffix dc=com > uri ldap://server1:389/dc=suffix1,dc=com > uri ldap://server2:389/dc=suffix2,dc=com > uri ldap://server3:389/dc=suffix3,dc=com > > I performed numerous tests using "base=com" and changing the order of the above list of uri (in slapd.cnof) and I see that as soon as a candidate directory is unreachable, all other directories located below the directory in failure are not requested by the proxy. For instance, in example below: > - if server2 is down, then server 3 is not requeted > - if server1 is down, then none of the directories is requested. > > I have the felling this is a bug ... could you confirm ? > > FYI, I also tried the "'onerrr continue" config, but did not change annything > > Thanks in advance. > > Michel > > > > > > > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? > Je crée ma boîte mail www.laposte.net > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

How to replace account with inetOrgPerson?
by Mi 09 Sep '11

09 Sep '11

I am trying to add the "inetOrgPerson" objectClass, but some users already have the "account" objectClass. After a long search, I found that you cannot have both. So I am trying to remove "account", and add "inetOrgPerson". But I cannot do that either. I just get the following error : err=69 text=structural object class modification from 'account' to 'inetOrgPerson' not allowed If I just try to remove "account", I get entry failed schema check: no structural object class provided So, how can I add "inetOrgPerson" and remove "account" ? Also, I notice that I don't have "account" listed under dn: cn=schema,cn=config. What I have is: {0}core {1}cosine {2}nis {3}inetorgperson {4}samba {5}apple Thanks for any help mi PS: I just need a "mail" attribute. Maybe there is a simpler way than to add inetOrgPerson with all it's ridiculous attributes like "audio" or "carLicense" ?

9 25

pcache template doesn't allow negative assertions?
by Ron Peterson 08 Sep '11

08 Sep '11

OpenLDAP version 2.4.23 Negative assertions don't appear to work in pcacheTemplate filter expressions. Is this intentional? line 435 (pcacheTemplate (!(globalOff=)) 0 900) /local/etc/openldap/proxy/slapd.conf: line 435: unable to parse template: AttributeDescription contains inappropriate characters. slaptest: bad configuration file! Works fine without the negative assertion. - Somewhat related question. I'm attempting to use pcache to expedite the application of a filter expression used in an ACL context (ldap backend). I haven't done this before. Does pcache work for this purpose? e.g. access to dn.sub="ou=email" filter="(!(globalOff=))" ... (this is a simplification of what I'm really doing, for illustrative purposes only). -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 2

Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 08 Sep '11

08 Sep '11

Hi,I think I fixed the Database related error during openldap configure step. I have downloaded the new DB "db-4.8.26" and I configured it for unix i.e build_unix. and compiled it successfully. after this I configured the openldap-2.4.26 successfully with the following command. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2" CPPFLAGS="-I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix" --prefix=/mips/ldap --with-yielding_select=no after that I build teh dependencies successfully with the command "make depend" but when I compile I am getting the following error. /bin/sh ../../libtool  --mode=compile /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -I../../include -I../../include   -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix   -DLBER_LIBRARY -c version.c /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -I../../include -I../../include -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -DLBER_LIBRARY -c version.c -o version.o/bin/sh ../../libtool  --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2    -release 2.4 -version-info 9:1:7 -rpath /mips/ldap/lib -o liblber.la assert.lo decode.lo encode.lo io.lo bprint.lo debug.lo memory.lo options.lo sockbuf.lo stdio.lo version.lo  -lresolv rm -fr  .libs/liblber.a .libs/liblber.la .libs/liblber.laiar cru .libs/liblber.a  assert.o decode.o encode.o io.o bprint.o debug.o memory.o options.o sockbuf.o stdio.o version.oranlib .libs/liblber.acreating liblber.la(cd .libs && rm -f liblber.la && ln -s ../liblber.la liblber.la)/bin/sh ../../libtool --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -static -g -O2     -o dtest dtest.o liblber.la ../../libraries/liblutil/liblutil.a  -lresolv  /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -o dtest dtest.o  ./.libs/liblber.a ../../libraries/liblutil/liblutil.a -lresolv./.libs/liblber.a: could not read symbols: Archive has no index; run ranlib to add onecollect2: ld returned 1 exit statusmake[2]: *** [dtest] Error 1make[2]: Leaving directory `/product/wibro/premium/src/APP/Protocols/ASNGW/openldap-2.4.26/libraries/liblber'make[1]: *** [all-common] Error 1make[1]: Leaving directory `/product/wibro/premium/src/APP/Protocols/ASNGW/openldap-2.4.26/libraries'make: *** [all-common] Error 1 I thought this is because I am compiling openldap for MIPS architecture and db-4.8.26 is compiled for normal linux. So i thought I'll compile db-4.8.26 for MIPS and run the following command ../dist/configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2" and tried to compile this for MIPS, but same error is happening here also. please check the below error [vijay@trlx6 build_unix]$ make./libtool --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2  -o db_archive  \    db_archive.o util_sig.o libdb-4.8.a -lpthreadlibtool: link: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -o db_archive db_archive.o util_sig.o  libdb-4.8.a -lpthread/opt/montavista/pro/devkit/mips/fp_be/bin/../lib/gcc-lib/mips-hardhat-linux/3.3.1/../../../../mips-hardhat-linux/bin/ld: db_archive.o: Relocations in generic ELF (EM: 3)db_archive.o: could not read symbols: File in wrong formatcollect2: ld returned 1 exit statusmake: *** [db_archive] Error 1 Kindly help me where I am making mistake and how it can be fixed?? Thank you. RegardsVijay S.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical