openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

Can a Shadow Server "Proxy" UpdateRef?
by Ben Rockwood 20 May '11

20 May '11

I want to shadow my directory into multiple locations. I'd like to use updateref to provide a way to make writes back to the master. The problem is that updateref hands a new LDAP URI back to the client who then tries to connect to the appropriate server... this is a problem if the client does not have access to connect directly to the referred server. In my case the shadow server has access to the master but the clients do not (private subnet). Is there a way for the shadow server to send the write operation to the master itself, as though its proxying it, rather than returning a referral to the client? benr.

2 2

Objects that have no objectClass ?
by Torsten Schlabach (Tascel eG) 20 May '11

20 May '11

Hi all! I am querying an Active Directory, using the ldapsearch utility provided by OpenLDAP. Normally, for each entry that ldapsearch returns, I am used to finding at least one line which starts with dn: and one (or more) which start with objectClass:. This is the case for the majority of the objects which I can find in the given AD tree, but I can spot at least one which does have a dn: and a couple of other attributed (in other words: the entry exists) but just no objectClass. Any idea how this is possible? Regards, Torsten

2 1

Re: MirrorMode vs MultiMaster Questions
by Ben Rockwood 19 May '11

19 May '11

Looking even more at the code and the commit history, it turns out that in 2006 when MirrorMode was added it was in fact called "multimaster"... the name was simply changed to mirrormode later with no major changes to the code. So, it really looks like MirrorMode is MultiMaster, the only difference being a 2 node multimaster shadows only its peer, whereas a 3+ node multimaster shadows multiple. This is perhaps best seen in the modify code, where if the configuration is not SINGLE_SHADOW (ie: MultiMaster) it passes a referral instead of accepting the operation. Therefore, the language in the docs is more specific than I realized. "Active/Active MirrorMode" and "N-Way MultiMaster" are accurate and if you omit them you miss the point. The real point here is that in MirrorMode you're told to only send writes to a single node. I want a 2-Way Multimaster in which I can send writes to either. And it in practice you can, but you're not (according to the docs) supposed to. Its like the authors didn't trust their own synchronization code. I can only infer that there might be problems in high write environments to 2 nodes... from which I further infer that for environments using LDAP for NIS-Replacement where writes are very rare its not a practical problem. In this type of setup I just want basic HA, I don't want load balancers and multiple shadows, just 2 slapds in A/A config. benr. On 5/16/11 2:32 AM, Marcel van Dorp wrote: > Hi, > > I'm investigating the same thing. I found some interesting docs on > www.zytrax.com/books/ldap > > On 05/16/2011 10:24 AM, Ben Rockwood wrote: > > I'm having some problems understanding the subtleties of MirrorMode vs > > MultiMaster configurations. Any help with the following questions would > > be helpful: > > > 1) It looks like the only real difference between a MirrorMode and > > Multimaster configuration is whether or not the RIDs are different. In > > MirrorMode both sides have the same rid, in Multimaster they are > > different. Is that so? > > - From what I understand, with mirrormode=FALSE the consumers are > readonly, and updates are referred back to the provider. > > with mirrormode=TRUE, the consumers are mirrors of the provider, and > updates can be processed locally. The multimaster config (using > syncrepl) then updates all other masters. > > > > 2) Passing through the code, "MirrorMode" is really "Single Master" and > > MultiMaster is just "not Single Master". But the code path to determine > > whether it is single master or not confuses me. How does slapd actually > > determine this? > > > During startup, the deamon is provided with the URI to listen on. I'm on > Debian, where this is configured in /etc/default/slapd. Doing a 'ps ax > |grep slapd' shows this: > > 7741 ? Ssl 0:00 /usr/sbin/slapd -h ldap://127.0.0.1:389/ > ldap://hostname.domain.com/ ldaps://hostname.domain.com/ ldapi:/// -g > openldap -u openldap -F /etc/ldap/slapd.d/ > > The serverID also refers to this URI, to determine the local process > (after all, serverIDs will also be syncrepl'd): > > olcServerID: 11 ldaps://hostname.domain.com/ > olcServerID: 12 ldaps://another.domain.com/ > olcServerID: 13 ldaps://thirdhost.domain.com/ > > > > > 3) For MultiMaster, the docs show using syncrepl to replicate cn=config > > and the directory (or directories if you have more than one) > > independently. Is it really necessary to replicate cn=config if the > > configuration isn't changing? (What I'm really looking for here is to > > find out if there is state information in cn=config thats being used or > > if its simply a good idea to ensure the configs are the same by using > > syncrepl.) > > > The main issue for me, is that I need to have the ACLs in sync, and > those are in cn=config. I'm still working on this, so please bear with > me if above info is not completely correct. > > Regards, > > Marcel > > > > Thanks, > > > benr. > > >

3 2

one-to-many rwm objectclass map
by Ron Peterson 19 May '11

19 May '11

I'm trying to map a single objectclass to more than one objectclass using the rwm overlay. e.g. myclass -> inetOrgPerson -> eduPerson ...because 'myclass' contains some attributes I want to rewrite to attributes belonging to inetOrgPerson, and some attributes I want to rewrite to attributes belonging to eduPerson. The attribute rewriting seems to happen OK even if the resultant object presented by back-ldap doesn't include an objectclass that includes the relevant attributes, but I'd prefer to present something that appears more strictly correct. Is there another overlay I should use instead? I control the source directory, so one workaround would be to simple add some dummy objectclasses to my original objects. Then I could do something like: rwm-map objectClass inetOrgPerson myclass rwm-map objectClass eduPerson dummyclass Is there a better way? TIA -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

1 0

LDAP startTLS is taking time
by Sayantan Ray 18 May '11

18 May '11

Hi, During initial communication setup with LDAP server with TLS on we are doing: ldap_initialize() ldap_set_option() ldap_start_tls_s() ldap_sasl_bind_s() and We are running the LDAP server remotely We observed that ldap_start_tls_s() is taking around 15 sec time to execute. Anybody has any idea why this is taking this much time? Please help Thanks, Sayantan Ray

2 1

Restricted Active Directory Proxy for SaaS Vendors
by Nanoic Dalflanlun 17 May '11

17 May '11

I am trying to setup an OpenLDAP server in my DMZ to proxy requests from Software as a Service vendors to my internal Active Directory domain. Specifically, I want to disallow anonymous access; make access read only; and restrict access to return only displayName, distinguishedName, mail, proxyAddresses, member, memberOf, mailNickname, and homeMDB. I also need to provide authentication capability for single sign on at the vendor. I don't think I have a proper understanding of OpenLDAP's ACLs, yet, so I am probably missing some things. I may even be approaching this completely wrong. I suspect I need to add "auth" access somewhere. Currently, I receive "result: 50 Insufficient access" when I try to query the OpenLDAP server. I don't have an authentication trace yet from the SaaS vendor, but it if it work like Cisco Ironport, it will try to bind to the LDAP server using the user's supplied credentials and look for a success, then switch back to using the LDAP query account. Thanks for any assistance, Nanoic -------------------------Begin slapd.conf------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/saas.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args logfile /var/log/openldap.log loglevel none #Disallow anonymous binds disallow bind_anon #### Define access to Active Directory database ldap # Set proxy to read-only readonly on suffix "dc=example,dc=com" rootdn "dc=example,dc=com" rebind-as-user #List domain controllers to access. ldap for non-SSL/debug & ldaps for SSL/production uri "ldap://DomainController1" uri "ldap://DomainController2" lastmod off # set chase-referrals to no to keep from querying all DCs chase-referrals no ### access lists # Allow defined access to Active Directory, deny all others. access to dn.subtree="dc=example,dc=com" attrs=displayName,distinguishedName,mail,proxyAddresses,member,mailNickname,homeMDB by dn.exact="CN=saasqueryacct,OU=Service Accounts,DC=example,DC=com" read by * none # Deny access to all undefined resources by all undefined users access to * by * none -------------------------End slapd.conf------------------------- -------------------------Begin saas.schema------------------------- attributetype ( 1.2.840.113556.1.2.210 NAME 'proxyAddresses' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) attributetype ( 1.2.840.113556.1.2.244 NAME 'homeMDB' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' ) attributetype ( 1.2.840.113556.1.2.447 NAME 'mailNickname' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) -------------------------End saas.schema-------------------------

1 0

problem making a copy of ldap
by deconya 17 May '11

17 May '11

Hi guys I'm making a openldap slave server of my PDC server and I installed ubuntu 9.04 with openldap 2.4.15. I just copy /etc/ldap/ and I check it, but fails when starts. Logs (syslog) said: slapd[30344]: @(#) $OpenLDAP: slapd 2.4.15 (Jul 30 2010 00:41:48) $ ^Ibuildd@palmer:/build/buildd/openldap-2.4.15/debian/build/servers/slapd slapd[30344]: config error processing olcOverlay={0}syncprov,olcDatabase={0}config,cn=config: slapd[30344]: slapd stopped. slapd[30344]: connections_destroy: nothing to destroy. I check all permissions and are the same of my PDC server. Any guide to make it correctly? Thanks And best Regards

2 4

authentication problem
by Mohammad D 17 May '11

17 May '11

Hi all I have installed openldap 2.4.23 on windows server 2003. when I run this query on ldapsearch: ldapsearch -h directory.verisign.com -b "cn=<*>" "(o=*)" "certificaterevocationlist" I get the following error: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: I installed MIT kerberos but it did not solve the problem. any one know whats the issue and how can it be solved?

5 8

AD and Openldap integration
by Darouichi, Aziz 17 May '11

17 May '11

Hi, We are in the final stage of single sign on project. We are looking to integrate Active directory with LDAP. But our MS Domain ppolicy is different than LDAP ppolicy. My question is do the policies have to be identical for the integration to work? Thanks, Aziz

1 0

LDAP with Canon IRC2380
by Metropolitan College <Eric Kom> 17 May '11

17 May '11

Hi all! Please I wanna know if it's possible to bind OpenLDAP server to Canon Printer machine so users can authenticate before use? -- -- YouTruly Eric Kom System Administrator - Metropolitan College 2 Hennie Van Till, White River, 1240 erickom(a)kom.za.net | erickom(a)namekom.co.za | erickom(a)erickom.co.za www.kom.za.net | www.kom.za.org | www.erickom.co.za Key fingerprint: 513E E91A C243 3020 8735 09BB 2DBC 5AD7 A9DA 1EF5

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical