openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Fwd: ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80)
by Fabien COMBERNOUS 06 Jul '11

06 Jul '11

Here a test. I didn't receive my own mail. This mail was it received by the list ? -------- Original Message -------- Subject: ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80) Date: Tue, 05 Jul 2011 17:52:54 +0200 From: Fabien COMBERNOUS <fcombernous(a)kezia.com> To: openldap-technical(a)openldap.org Hi There, I have an openldap master (hosted by server) and an openldap replica (hosted by replica). Authentication use SASL/GSSAPI with kerberos. On the master i get the following output : server:~ admin$ kinit root Please enter the password for root(a)SERVER.LAN: server:~ admin$ ldapsearch -b cn=mounts,dc=server,dc=lan SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80) On the replica all looks fine : replica:~ admin$ kinit root Please enter the password for root(a)SERVER.LAN: server:~ admin$ ldapsearch -b cn=mounts,dc=server,dc=lan SASL/GSSAPI authentication started SASL username: root(a)SERVER.LAN SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base<cn=mounts,dc=server,dc=lan> with scope subtree # filter: (objectclass=*) # requesting: ALL # etc ... I saw some thread on mailing list that say to take care of owner, groups and permissions of files krb5.keytab and database. All looks good in this side. Any other areas to check ? Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com<http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

1 0

database monitor
by Friedrich Locke 05 Jul '11

05 Jul '11

I have configured database monitor and setted two access rules in its context. By the log messages below keep annoying me: /etc/openldap/slapd.conf: line 110: warning: cannot assess the validity of the ACL scope within backend naming context Backend ACL: access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read by * none Backend ACL: access to * by * none /etc/openldap/slapd.conf: line 123: warning: cannot assess the validity of the ACL scope within backend naming context Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context slapd starting How may i "fix" that. (Altough i used the word "fix", i know it is not a error message). Thanks in advance

3 5

problem with the ppolicy overlay
by Cyril Grosjean 05 Jul '11

05 Jul '11

2 1

dumping
by Friedrich Locke 05 Jul '11

05 Jul '11

Hi, i would like to restore data generated by slapcat. I realized some field (like userPassword) in the lidf file generated was encoded in base64. How should i restore the ldif with slapadd taking the real value string for the attribute without redefined attribute value. Thanks in advance

2 1

server side sorting
by Chris Card 05 Jul '11

05 Jul '11

Hi, this FAQ http://www.openldap.org/faq/data/cache/649.html says that openldap 2.3 doesn't support Server Side Sorting (RFC 2891). Looking at openldap 2.4.23, it seems that Server Side Sorting is now supported - is this documented somewhere? Chris

7 21

deleting tree
by Friedrich Locke 05 Jul '11

05 Jul '11

I am trying to delete a complete tree, but i got the error messages: ldap_delete: Other (e.g., implementation specific) error (80) ldap_prune: Other (e.g., implementation specific) error (80) ldap_delete: Operation not allowed on non-leaf (66) additional info: subordinate objects must be deleted first But when i remove from /etc/openldap/slapd.conf the line: index cn,uid eq I can delete perfectly. Does anybody know why?

1 0

slapd "vs." db_archive
by Peter Palmreuther 04 Jul '11

04 Jul '11

Hello, I tried to use 'db_archive' to figure, which of those many log.* files already accumulated I can safely remove. Unluckily it didn't print any name, albeit there're 170 file and according to 'fuser log.*' only the last one is held open by a process (the slapd one). After restarting slapd db_archive prints 169 file names, to be precise all but the last. So it seems slapd keeps used BDB in a state it does not release the logs for archival and removal. I assume it's me that has to configure slapd or BDB environment appropriately, but unluckily I don't know which setting would have the desired effect. Any help on this? I tried to find something in Admin Guide and man pages, but I must have missed it. I only saw auto remove settings, which is not what I was out for ... I want to remove by myself, after keeping a backup for recovery. I'm using OpenLDAP 2.4.20 compiled against Berkeley 4.7. Thank for any help, and regards, Peter

2 3

Re: cannot access entries
by ian logan 04 Jul '11

04 Jul '11

Why not adjust your logLevel to include ACL processing, its usually very informative. On Jul 4, 2011, at 1:23 PM, Friedrich Locke wrote: > This is for learning purposes, the password will not be that one on a > production system. > ypldap access is just before any other more restrictive. > > My questions still remains: how may i have a listing of entry directly > below (one level only) a given base ? > Searching with a filter is interest too. But i am being prevented. > Does anybody here know how it could be done given my access rules on > the prior email ? > > Thanks once more. > > > On Mon, Jul 4, 2011 at 4:01 PM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu> wrote: >> The ypldap access should be before the one that limits more - the more restrictive one will match first. >> >> If that account is intended as you main 'root'-ish account, it should probably be granted access to all right off the bat. >> >> Also: change your ldap password now. (I've done this; sent a password to the mailing list - dumb). >> >> - chris >> >> Chris Jacobs, Systems Administrator, Technology Services Group >> Apollo Group | Apollo Marketing & Product Development | Aptimus, Inc. >> 2001 6th Ave | Ste 3200 | Seattle, WA 98121 >> phone: 206.839-8245 | cell: 206.601.3256 | Fax: 208.441.9661 >> email: chris.jacobs(a)apollogrp.edu >> >> ----- Original Message ----- >> From: openldap-technical-bounces(a)OpenLDAP.org <openldap-technical-bounces(a)OpenLDAP.org> >> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> >> Sent: Mon Jul 04 11:19:45 2011 >> Subject: cannot access entries >> >> Hi list members, >> >> i am trying to configure accesses to my ldap server, but i am doing >> some wrong i am not aware about. The access list is below: >> >> access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userpassword >> by self read >> by anonymous auth >> by * none >> >> access to dn.one="ou=appsrv,dc=ufv,dc=br" >> by self read >> by * none >> >> access to dn.one="ou=people,dc=ufv,dc=br" attrs=userpassword >> by self read >> by anonymous auth >> by * none >> >> access to dn.one="ou=people,dc=ufv,dc=br" >> by self read >> by dn.exact="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read >> by * none >> >> access to dn.one="ou=group,dc=ufv,dc=br" >> by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read >> by * none >> >> >> ======================================= >> >> The command i am executing and its output is below >> >> sioux@gustav$ ldapsearch -x -w ypldapA4esuopdV -D >> cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -s one >> # extended LDIF >> # >> # LDAPv3 >> # base <ou=people,dc=ufv,dc=br> with scope oneLevel >> # filter: (objectclass=*) >> # requesting: ALL >> # >> >> # search result >> search: 2 >> result: 32 No such object >> >> # numResponses: 1 >> sioux@gustav$ >> >> Why am i not getting a list of entries below ou=people,dc=ufv,dc=br ? >> >> Thanks in advance. >> >> >> >> This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system. >> >> >> >

1 0

Status of support for draft-wahl-ldap-session
by Michael Ströder 04 Jul '11

04 Jul '11

HI! It seems there is support for draft-wahl-ldap-session in OpenLDAP's source since 2007 but it seems not to be enabled in a default build. Is it sufficient to compile with -DSLAP_CONTROL_X_SESSION_TRACKING or do I also have to use -DLDAP_DEVEL (because of ifdef in ldap.h). The latter does not work with 2.4.26... Should I file an ITS for it? Ciao, Michael.

1 1

cannot access entries
by Friedrich Locke 04 Jul '11

04 Jul '11

Hi list members, i am trying to configure accesses to my ldap server, but i am doing some wrong i am not aware about. The access list is below: access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth by * none access to dn.one="ou=appsrv,dc=ufv,dc=br" by self read by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.exact="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by * none access to dn.one="ou=group,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by * none ======================================= The command i am executing and its output is below sioux@gustav$ ldapsearch -x -w ypldapA4esuopdV -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -s one # extended LDIF # # LDAPv3 # base <ou=people,dc=ufv,dc=br> with scope oneLevel # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 sioux@gustav$ Why am i not getting a list of entries below ou=people,dc=ufv,dc=br ? Thanks in advance.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical