openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Simple LDAP to LDAP Integration
by Alejandro Imass 20 Apr '11

20 Apr '11

Hello, I am seeking a simple integration between OpenLDAP and MS AD. The DIT structures are completely different but the Posix UIDs are the same. The integration is very simple because all we need to do is update the corresponding UID in AD whenever an entry changes in OpenLDAP (i.e. OpenLDAP is the master here). I though it would be easy to use the overlays for this but after careful examination it is not what we need. All we need for the moment is to capture the entry write event in OpenLDAP and run an external subroutine/program/lib that connects to the AD and does the changes there. We already have the second part developed in Perl, that is, we have a Perl program that connects to AD and changes whatever we want. We now need to pass this program the data that have changed in OpenLDAP. We could turn the Perl program into an LDAP server as well so we could maybe use the overlays, so in this case, the Perl program would receive the LDAP, and translate that to AD. The other option is to use SLAPI and capture the change event and use that to connect to AD, maybe spawning a daemonized process in Perl in order not to hang OpenLDAP waiting for AD. Anyway, if anyone can give us a hand as to how to approach this and what are the best alternatives to do this integration would be great. We would gladly publish this OpenLDAP to AD integration as OpenSource. Or if anyone happens to know if this already exists (but needs to be flexible because we need to translate from one DIT structure to the other with different schemas on each). Thanks! Alex

3 3

Re: Installation openLDAP in Debian
by Jose Ildefonso Camargo Tolosa 20 Apr '11

20 Apr '11

On Wed, Apr 20, 2011 at 10:53 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 20, 2011 6:51 PM +0900 "D. R. Paudel" > <rajme690(a)gmail.com> wrote: > >> Hi, >> I tried to install openLDAP in my debian 6.0.1 Squeeze but I got problem >> as there is no slapd.conf inside /etc/ldap/ directory. Is there any easy >> process for installation and configuration for beginners. > > Modern OpenLDAP does not use slapd.conf. Please read the OpenLDAP Admin > guide. Quanah: actually, documentation is not yet complete for cn=config, I had to actually convert my slapd.conf to cn=config using slaptest in order to find out how to do the same I had on slapd.conf on cn=config. Ildefonso > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

2 1

proxy Auth and authzto
by LALOT Dominique 20 Apr '11

20 Apr '11

Hello, I tried some configuration in order to get porxyAuth working. I would like to know if it's restricted to SASL. We use PLAIN LOGIN over TLS in order to work with all auth method, SSO and so on. Could you confirm? Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

"Name forms" with slapo-constraint
by Michael Ströder 20 Apr '11

20 Apr '11

HI! I tried to use slapo-constraint on entryDN when adding new entries. Kind of poor man's name forms... constraint_attribute entryDN regex mail=[^,],departmentNumber=[0-9]+,O=MyOrg restrict="ldap:///O=MyOrg??sub?(objectClass=inetOrgPerson)" But looking at the trace log it seems this is not evaluated at all probably entryDN is not present in the added entry and not yet generated. Any hints whether that might work? Ciao, Michael.

1 0

Data aggregator
by Hugo Monteiro 20 Apr '11

20 Apr '11

Hello all, This post may be a little OT, but i'm sure this subject has bitten some of you some time. So, i'm willing to take the chance. Anyway, feel free to redirect me and this conversation elsewhere. Background: There's an LDAP infrastructure set up, which has been fed and maintained by a "in the house" made management system. This management system primary role is NOT to manage LDAP data, but it was where the data lived, some extensions where developed to provide that extra functionality. Years have passed and more and more we depend on our LDAP service. But we also have more and more the need to add other data to LDAP, which doesn't exist in the still in place management system. Changing the LDAP data model has also become a major headache since that type of change will also force maintenance to the management system accordingly. Objective: I'm currently delegated to find a modular solution that can aggregate data from several sources, relational databases, other ldap servers, flat text files, whatever, and be able to maintain a centrally managed information database which can then be exported to/served by an LDAP server. The solution could aggregate data directly into an LDAP database, or it could maintain it's own database that could be later exported to ldif, or sync to LDAP. The main purpose here would also to be able to find something that would do this, or that could be set with some minimal changes to perform as described, WITHOUT being an "in the house" solution. Sorry if it felt like i'm daydreaming, but i would love to hear peoples thoughts on this matter. Best regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

3 2

userCertificate
by Leonardo 20 Apr '11

20 Apr '11

Would i like to know if it is possible to read a certificate field directly from openldap? This certificate is stored on openldap. It attribute on OpenLDAP is userCertificate.

3 3

difficulties to stop slapd
by LALOT Dominique 20 Apr '11

20 Apr '11

Hello, Our openldap is sometimes long to stop and init scripts failed to stop. Apr 20 09:10:47 ldap1 slapd[15105]: daemon: shutdown requested and initiated. Apr 20 09:10:47 ldap1 slapd[15105]: slapd shutdown: *waiting for 0 operations/tasks to finish* Apr 20 09:*12:46 *ldap1 slapd[15105]: slapd stopped. It tooks 2 minutes to stop. So the init scrit failed and restart is not safe. An auto update on ubuntu leaves slapd in a strange state once and the cause was that long wait for 0 task to finish. Normaly, zero means immediate. Here two minutes! We have 5 glued bdb databases. Is it due to the bdb close for these databases? Is there a way to get things more reliable OpenLDAP: slapd 2.4.23 (Mar 30 2011 16:20:41) $ ^Ibuildd@crested :/build/buildd/openldap-2.4.23/debian/build/servers/slapd Description: Ubuntu 10.10 2.6.35-27-server #48-Ubuntu SMP Tue Feb 22 21:53:16 UTC 2011 x86_64 GNU/Linux libdb-4.8.so Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

cn=config replication to consumer / slave servers
by Christopher Strider Cook 19 Apr '11

19 Apr '11

I have a pair of mirror mode master servers that I would like to be able to provide cn=config replication to a series of slave servers, primarily, to keep ACLs in sync across servers. I've tried syncrepl to the cn=config of the primary servers trying to exclude certain objects and attributes to prevent the slave from also taking the syncprov role. This did not seem to work well enough as I was unable to prevent some unwanted entry or another from making it's way through and overwriting the syncrepl line itself. Alternately, I tried to setup a separate database cn=config_slave and have that snycrepl to the slave into cn=config... but that creates a naming missmatch. Is there an approved practice to achieve this, or some other pointers on avenues to explore? Thanks, Chris

3 8

memberof/accesslog overlays together
by Michael Ströder 19 Apr '11

19 Apr '11

HI! Unfortunately for privacy reasons I can't provide example data. I'm using slapo-memberof, slapo-refint and slapo-access in exactly this order. Now I'm analysing some strange things where modifications to group entries and the subsequent modifications by slapo-memberof are not correctly written to the accesslog DB. Questions: 1. Is this overlay order a correct setup? Should this work? Or should slapo-memberof be invoked after slapo-access? 2. CHANGES of release 2.4.24 lists a bunch of fixes to slapo-memberof. Any changes which possibly affect writing to accesslog DB? (I'm not sure whether we had problems like this with 2.4.23 or not though.) Ciao, Michael.

2 2

delta-syncrepl and N-Way Multi-Master
by Al 19 Apr '11

19 Apr '11

Hi All, I am researching implementation options, and am not 100% clear on whether delta-syncrepl and N-Way Multi-Master are compatible. Can you confirm or deny? If so, have people found success using this? Thanks in advance, Al

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical