openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

could not work in C++?
by owen nirvana 04 Apr '11

04 Apr '11

I try to access ldap data in C++, and write a small example which open and close ldap, compiled by g++ error is the following: error: 'ldap_init' was not decalred in this scope error: 'ldap_simple_bind_s' was not decalred in this scope error: 'ldap_unbind' was not decalred in this scope I have added extern "C" {} block. With my means, it will be compiled using gcc actually. So it work fine in gcc, it should be fine in g++. gtalk:freeespeech@gmail.com

2 2

"ldap_sasl_bind_s failed (-1)" makes me in trouble...
by Olivier Pavilla 03 Apr '11

03 Apr '11

Hi everybody I'm running on a Lenny debian 64bit an openldap server (in fact, I'm trying :-). When I do: unverre:/home/olivier# slapd -VV @(#) $OpenLDAP: slapd 2.4.17 (Jan 12 2011 14:58:43) $ @barber:/build/buildd-openldap_2.4.17-2.1~bpo50+1-amd64-2bRKLL/openldap-2.4.17/debian/build/servers/slapd So... I do this: unverre:/home/olivier# slapd -d 16383 -u openldap -g openldap It shows: [blabla] ldap_create ldap_url_parse_ext(ldaps://wtf.wtf.fr:636) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP wtf.wtf.fr:636 ldap_new_socket: 13 ldap_prepare_socket: 13 ldap_connect_to_host: Trying XXX.XXX.XXX.XXX:636 ldap_pvt_connect: fd: 13 tm: -1 async: 0 slap_client_connect: URI=ldaps://wtf.wtf.fr:636 DN="cn=replicaiufm,ou=useraccess,dc=wtf,dc=fr" ldap_sasl_bind_s failed (-1) do_syncrepl: rid=008 rc -1 retrying daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero I'm lost in translation. I do not understand WTH is wrong. What does mean "ldap_sasl_bind_s failed (-1)"? Does My certificate is wrong? Did I do something wrong or what? In this case google is absolutely not my friend. Too much results for this kind of message. Thx in advance for your help. Kind regards -- S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne - 45044 ORLEANS Cedex 1 Tel : 02-38-49-**-** , mailto:ølivier.pavilla@univ-orleans.fr http://blog.linux-squad.com -

1 0

Compiling with SLAPI support and ACL caching
by Nick Milas 03 Apr '11

03 Apr '11

Hi, I have read here: http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg249720.html that "Compiling OpenLDAP with SLAPI support means that ACL caching is disabled". My question: Is this true for current Openldap versions as well? (I'm interested in versions 2.4.22 and later.) By the way, I have seen some earlier activity (e.g. thread: http://www.openldap.org/lists/openldap-devel/200507/msg00091.html) that SLAPI support was probably getting moved to an overlay, rather than being used as a compile option (if I understand well). Is there any update re. this "transition"? Thanks, Nick Milas

1 1

Problems with 4-way multi-master
by Mark 02 Apr '11

02 Apr '11

I've been testing a 4-way multi-master setup using OpenLDAP 2.4.25 and I'm having some sporadic problems with it that I'm having difficulty diagnosing.. I have four identical RHEL 4.9 machines on the same switch (NTP syncronized to same stratum 2 servers): dual-core Xeon 5110 1.60GHz 8GB RAM 100Mb full-duplex NIC OpenLDAP 2.4.25, BDB 4.8.30, OpenSSL 1.0.0d, Cyrus SASL 2.1.23 (using no tls/ssl at this time) I start the slapds with '-d conns,sync' then commence. I ldapadd 1000 DNs to one of the servers. After all the syncing has stopped I then compare the slapd contents against each other looking for differences. Occasionally there are as much as a couple hundred DNs missing from one or more of the instances. When that happens I've noticed that the mmaster with less DNs has lost its consumer connection to a mmaster provider (confirmed using lsof and netstat) and will never attempt a re-connect, but the provider still shows the connection (using lsof and netstat). When the consumer gets in this state I can connect to its cn=config and cn=monitor backends (and browse them) but when I try to connect to its multi-master'd backend the connection attempt just hangs. It's almost like the connect succeeds but the client is waiting for a response from the server (and never gets it). Also, the consumer slapd will not respond to a 'kill -TERM' at this time and must be 'kill -KILL'd. The same thing occurs sometimes when I delete the entire tree. I've been trying to catch logging information that might help but so far nothing's jumping out at me. While I continue to try to reproduce and parse through logfiles maybe someone can look at my slapd.confs below and see if I might have configured something wrong (I'm listing the original slapd.conf files below, but I've used slaptest to convert them to slapd.d/cn=config.ldif format): HOST1 slapd.conf: include /tmp/openldap/multi-master/etc/schema/core.schema include /tmp/openldap/multi-master/etc/schema/cosine.schema include /tmp/openldap/multi-master/etc/schema/nis.schema argsfile /tmp/openldap/multi-master/var/run/slapd.args pidfile /tmp/openldap/multi-master/var/run/slapd.pid threads 16 idletimeout 0 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 001 modulepath /tmp/openldap/multi-master/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,cn=config rootpw {SSHA}yMFj3Y7KPh223NkkKLQsFeLUVm08Ckpm database monitor rootdn cn=manager,cn=monitor rootpw {SSHA}vPVSN8o8eRnLdC/bGS7yDwQGeH4BHc0R database hdb suffix dc=example,dc=com rootdn cn=manager,dc=example,dc=com rootpw {SSHA}0obbsJw5Yq2XAkdd/kS7vokaB9rrSOtI directory /tmp/openldap/multi-master/var/data/dc=example,dc=com cachesize 30000 cachefree 5 checkpoint 128 15 dncachesize 25000 idlcachesize 100000 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://host2:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://host3:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=003 provider=ldap://host4:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off HOST2 slapd.conf: include /tmp/openldap/multi-master/etc/schema/core.schema include /tmp/openldap/multi-master/etc/schema/cosine.schema include /tmp/openldap/multi-master/etc/schema/nis.schema argsfile /tmp/openldap/multi-master/var/run/slapd.args pidfile /tmp/openldap/multi-master/var/run/slapd.pid threads 16 idletimeout 0 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 002 modulepath /tmp/openldap/multi-master/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,cn=config rootpw {SSHA}yMFj3Y7KPh223NkkKLQsFeLUVm08Ckpm database monitor rootdn cn=manager,cn=monitor rootpw {SSHA}vPVSN8o8eRnLdC/bGS7yDwQGeH4BHc0R database hdb suffix dc=example,dc=com rootdn cn=manager,dc=example,dc=com rootpw {SSHA}0obbsJw5Yq2XAkdd/kS7vokaB9rrSOtI directory /tmp/openldap/multi-master/var/data/dc=example,dc=com cachesize 30000 cachefree 5 checkpoint 128 15 dncachesize 25000 idlcachesize 100000 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://host1:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://host3:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=003 provider=ldap://host4:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off HOST3 slapd.conf: include /tmp/openldap/multi-master/etc/schema/core.schema include /tmp/openldap/multi-master/etc/schema/cosine.schema include /tmp/openldap/multi-master/etc/schema/nis.schema argsfile /tmp/openldap/multi-master/var/run/slapd.args pidfile /tmp/openldap/multi-master/var/run/slapd.pid threads 16 idletimeout 0 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 003 modulepath /tmp/openldap/multi-master/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,cn=config rootpw {SSHA}yMFj3Y7KPh223NkkKLQsFeLUVm08Ckpm database monitor rootdn cn=manager,cn=monitor rootpw {SSHA}vPVSN8o8eRnLdC/bGS7yDwQGeH4BHc0R database hdb suffix dc=example,dc=com rootdn cn=manager,dc=example,dc=com rootpw {SSHA}0obbsJw5Yq2XAkdd/kS7vokaB9rrSOtI directory /tmp/openldap/multi-master/var/data/dc=example,dc=com cachesize 30000 cachefree 5 checkpoint 128 15 dncachesize 25000 idlcachesize 100000 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://host1:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://host2:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=003 provider=ldap://host4:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off HOST4 slapd.conf: include /tmp/openldap/multi-master/etc/schema/core.schema include /tmp/openldap/multi-master/etc/schema/cosine.schema include /tmp/openldap/multi-master/etc/schema/nis.schema argsfile /tmp/openldap/multi-master/var/run/slapd.args pidfile /tmp/openldap/multi-master/var/run/slapd.pid threads 16 idletimeout 0 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 004 modulepath /tmp/openldap/multi-master/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,cn=config rootpw {SSHA}yMFj3Y7KPh223NkkKLQsFeLUVm08Ckpm database monitor rootdn cn=manager,cn=monitor rootpw {SSHA}vPVSN8o8eRnLdC/bGS7yDwQGeH4BHc0R database hdb suffix dc=example,dc=com rootdn cn=manager,dc=example,dc=com rootpw {SSHA}0obbsJw5Yq2XAkdd/kS7vokaB9rrSOtI directory /tmp/openldap/multi-master/var/data/dc=example,dc=com cachesize 30000 cachefree 5 checkpoint 128 15 dncachesize 25000 idlcachesize 100000 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://host1:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://host2:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off syncrepl rid=003 provider=ldap://host3:1389 type=refreshAndPersist interval=00:00:05:00 retry="15 +" searchbase="dc=example,dc=com" binddn="cn=manager,dc=example,dc=com" credentials="example_pass" starttls=no schemachecking=off Thank you.

3 5

[GnuTLS][TLS init def ctx failed: -1]
by Warren Howard 02 Apr '11

02 Apr '11

Hi there, I'm using: slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Mar 30 2011 18:32:32) $ buildd@rothera:/build/buildd/openldap-2.4.21/debian/build/servers/slapd cat /etc/issue Ubuntu 10.04.2 LTS \n \l This is Ubuntu so openldap has been compiled with GnuTLS ldd /usr/sbin/slapd . . . libgnutls.so.26 => /usr/lib/libgnutls.so.26 (0xb73a9000) . . . I've been following this guide https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html and the section on TLS works perfectly if I follow the instructions to the letter. That is, so long as the locations of olcTLSCACertificateFile, olcTLSCertificate and olcTLSCertificateKeyFile are /etc/ssl/certs, /etc/ssl/certs and /etc/ssl/private respectively, then slapd will start. For example: olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem However, if I change the location of any of these files slapd will fail to start with the error "TLS init def ctx failed: -1". Should anyone ask, yes I've doubled checked for correct file permissions and searched for typos. The names of the files does not matter, just their location. These appears to be bug to me. Regards, Warren.

2 2

Using memberOf overlay with groups that contain uids, not DNs
by Oliver Beattie 02 Apr '11

02 Apr '11

Hi, I realise the documentation for slapo-memberof indicate that this isn't possible, but I thought it worthwhile asking here anyway — is it possible to use the memberOf overlay with groups that use memberUid as their membership attributes, rather than user DNs? We have a large existing LDAP database that has thousands of groups like this, and would very much like to use slapo-memberof. Any pointers (positive or negative) much appreciated — just so I know for definite. —Oliver

2 1

adding a second node
by Friedrich Locke 01 Apr '11

01 Apr '11

Hi folks, i am begining to study ldap and have a doubt. In my tree i have a node a=b inserted below c=d,e=f, i.e., a=b,c=d,e=f exists. What happens if i try to insert a "new" a=b below c=d,e=f ? Thanks in advance. Gustavo.

2 1

Re: Antwort: Re: RHEL 6 OpenLDAP 2.4.19-15.el6 init problem
by Quanah Gibson-Mount 01 Apr '11

01 Apr '11

--On Friday, April 01, 2011 6:05 AM +0100 Markus Moj <MMoj(a)timocom.com> wrote: > > Hi, > > due to update and security policies in my company we are using the stable > version of the delivered build in openLDAP from Red Hat. Hi Markus, While I understand this is often the case with companies, this policy is short sighted. If you want to have a stable, secure, and functional LDAP server, then you need to be able to build OpenLDAP from source. If you insist on using RedHat's outdated and flawed packages, then you need to contact RedHat support to fix any bugs you find with it, as the advice from upstream will always be for you to build and install the current OpenLDAP version to verify whether or not any bugs you find actually exist in a current release. I would suggest you read over the change logs since OpenLDAP 2.4.19 was released to get an idea of the numerous issues that have been fixed since that release went out. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Dealing with BDB Crash
by ldap＠mm.st 01 Apr '11

01 Apr '11

A while ago I posted that we were having what we thought were random bdb backend crashes with the following in our log: bdb(o=example.com): PANIC: fatal region error detected; run recovery. This was on a on our RH5 openldap servers (2.3.43) that we were rebuilding: It appears that the crashes were caused by a vulnerability scanner that was hitting the server (still testing), even though it was suppose to be safe. We'll have to investigate what is causing it, maybe we will need an acl to stop whatever the scanner is doing. Once we stopped the automated scan, the servers seem to be running as expected. But, this brought up another issue. When the bdb backend failed, the slapd process continued run and listen on the ldap ports and clients still tried to connect to the failed server for authentication. The server accepted and established the connection with the client. Of course the client could not authenticate since the backend db was down. The client will not fail over to the other server that is listed in it's ldap.conf file since it thinks it has a valid connection. If the slap process is not running then the fail over works fine since no ports are there for the client to connect to. I'm thinking that bdb failures will be rare once we solve the scanner issue, but on a network that relies heavily on ldap, a failed bdb backend with a running slapd would cause significant issues. Just trying to restart the slapd service doesn't fix the issue, a manual recovery is required (slapd_db_recover). I was curious if anyone has put something in place to deal with this potential issue? Maybe run slapd_db_status via cron and if it errors due a bdb corruption, just stop slapd and let the admin know. At least the clients would be able to failover to the other ldap servers. I guess an automated recovery is possible via a script, but I'm not sure if that's a good idea. Maybe dealing with this type of failure is not really required, I was hoping that some of you that have been do this for a while would have some insight.

8 9

issue with slapadd
by Judith Flo Gaya 01 Apr '11

01 Apr '11

Hello, I'm using openldap-server 2.4.19-15 in a Red Hat 6 box (x86_64), rpm installation. This is the very first time I use ldap and I'm having some issues with the configuration. I read that the slapd.conf file should not be use, instead the slapd.d directory is the new system that is meant to be. As I don't know how this exactly works, I've been reading and folowing the tutorial in the openldap page. Specifically I read the Administration guide and I copy and adapt the config.ldif file to suit my needs. After a while I manage to run the command: slapadd -F /etc/openldap/slapd.d -n 0 -l config.ldif with no problems. I thought that once this was done the slapd should start smoothly, but instead I'm having an slaptest error saying that my configuration FILE is wrong. As the slapd.conf doesn't exists, I don't know where this error comes from. I tried #slaptest -v -d1 -F ../slapd.d/ [......] ldif_back_add: "olcDatabase={-1}frontend,cn=config" oc_check_required entry (olcDatabase={-1}frontend,cn=config), objectClass "olcDatabaseConfig" oc_check_required entry (olcDatabase={-1}frontend,cn=config), objectClass "olcFrontendConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcDatabase" oc_check_allowed type "olcAddContentAcl" oc_check_allowed type "olcLastMod" oc_check_allowed type "olcMaxDerefDepth" oc_check_allowed type "olcReadOnly" oc_check_allowed type "olcMonitoring" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" ldif_back_add: err: 68 text: send_ldap_result: conn=-1 op=0 p=0 slaptest: bad configuration directory! Since the directory structure was built by the slapadd command, where is the problem? I'm sure I'm doing something wrong but I can't find it ;( Permissions are ok (at the beginning I had issues with the include core.ldif part of my config.ldif, I ended pasting the contents in the config.ldif) Thanks in advance for your help, hope you can shed some light on this. j -- Judith Flo Gaya Systems Administrator IMPPC e-mail: jflo(a)imppc.org Tel (+34) 93 554-3079 Fax (+34) 93 465-1472 Institut de Medicina Predictiva i Personalitzada del Càncer Crta Can Ruti, Camí de les Escoles s/n 08916 Badalona, Barcelona, Spain http://www.imppc.org

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical