openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

Ordering index and integerOrderingMatch rule
by thierryblaise＠hotmail.com 05 Aug '24

05 Aug '24

Hi everyone, I posting again about my issue on my v2.5.18 OpenLDAP installation on RHEL8. I'm required by an editor to add a custom structural class to the LDAP schema, and especially afterwards to add an index on one interger attribute part of the new class. To that end, in openLdap, I think it means : 1) to my knowledge and following documentation (https://www.openldap.org/doc/admin25/schema.html#Attribute%20Type%20Specifi…), I need to declare an ordering matching rule in attribute definition of the schema. However, when I do that with the following olcAttributeTypes definition : olcAttributeTypes: ( 1.3.6.1.4.1.xxx.x.x.xxx NAME 'last-modified' DESC 'Object Last Modified Time' ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) and try to import the ldif containing this definition, the following error appears: modifying entry "cn={5}clients,cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: olcAttributeTypes: AttributeType inappropriate matching rule: "integerOrderingMatch" I tried with all documented OrderingMatch rules in case, but same error modulo name of OrderingMatch rule appears each time, as if syntax and rule of the attribute don't match. Note that I tested the attribute definition without the ORDERING rule, the attribute is correctly added, but search with operators "<=" and ">=" are not working. 2) add an index to y MDB database through, for example, the following ldif: dn: olcDatabase={1}mdb,cn=config add: olcDbIndex olcDbIndex: last-modified <indexKeyword> However, here, I can't find the index keyword needed for ordering in the documentation... don't know if this is even supported. Can somebody please help me on those two topics ? Regards,

3 5

ldap_simple_bind_s is failing after setting LDAP_OPT_NETWORK_TIMEOUT value
by venugopal chinnakotla 05 Aug '24

05 Aug '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. We are using OpenLDAP 2.6.7. As part of this migration activity, we are replacing one of the timeout values. Without setting LDAP_OPT_NETWORK_TIMEOUT value, ldap bind is working fine and application functionality also working well with bind, search and other operations. After setting LDAP_OPT_NETWORK_TIMEOUT value, ldap_simple_bind_s is failing with return code -1 (LDAP error -1-Unknown Error). Here is the snippet. struct timeval tv = { 20, 0 }; ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *) &tv); lderr = ldap_simple_bind_s( ld, (char *)AdminDN, (char *)AdminPW); Here we are getting bind failure with return code as -1. But without setting LDAP_OPT_NETWORK_TIMEOUT, the bind function is working well. Could you help us to fix this issue? or let me know if I am missing anything here? -- Thanks, *c.venugopal*

1 0

ACL by anonyous auth
by pficheux＠integra.fr 05 Aug '24

05 Aug '24

Hello, I'm trying to put ACL for a group, to allow write actions. I followed this and it's workin : https://www.openldap.org/faq/data/cache/52.html Here is what I put in my ldif file: dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to dn.subtree="dc=test,dc=example,dc=com" by group.exact="cn=writer,dc=test,dc=example,dc=com" write by anonymous auth But I have two questions: Why do I have to put "by anonymous auth"? Without that I have an error 49, invalid credentials. I have not put "by self write", and it's working like that. Is it important? Regards, Gab

3 9

No permissions on files created by LMDB
by Ian Emmons 31 Jul '24

31 Jul '24

I am attempting to use LMDB for the first time, on Mac OS 14.6 on an Apple Silicon (M3) Mac, using Apple’s clang compiler. The issue I am having is that when LMDB creates new data and lock files, they are created with no permissions at all, and then LMDB fails to open the file with error #13: Unable to open LMDB environment: Permission denied. After this happens, a directory listing (ls -l) shows this: ---------- 1 iemmons staff 8.0K Jul 31 14:45 tempFile.db-lock Where a typical directory entry on my system looks like this: -rw-r--r-- 1 iemmons staff 6.7K Apr 16 10:33 SomeFile.txt Is this issue something that you all might recognize and perhaps even know the fix for? If not, I will work up a minimal test case that exhibits the problem and post it. Thanks, Ian

2 1

multi-master OpenLDAP with SASL/GSSAPI
by Travis Bean 30 Jul '24

30 Jul '24

I developed a Bash script (https://launchpad.net/linuxha) to automate the installation and configuration of complex Linux software that is out of reach for most people. I want the syntax of this script to be perfect so I can use it as a teaching tool to educate people about Linux. If anyone on this mailing list is knowledgeable about multi-master OpenLDAP with SASL/GSSAPI authentication, please review the OpenLDAP/SASL/GSSAPI code that is part of my LinuxHA script and provide feedback. Thank you. Kind regards, Travis Bean

2 1

Re: Facing issues with Symas LDAP upgrade from 2.4 to 2.5
by anil kumar pathuri 24 Jul '24

24 Jul '24

hi Quanah, Hope you are doing well. Thank you for your email. PFA This is what I did: Installed openldap 2.4.44 --> Upgraded to Symas OpenLDAP 2.4.57 --> Upgrading from Symas OpenLDAP 2.4.57 to Symas OpenLDAP 2.6.7 ***PS: I am not using slapd.conf, what should I do in this case. Regards, Anil P On Fri, 17 May 2024 at 01:57, Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, May 16, 2024 7:55 PM +0000 anilkumar.pathuri7(a)gmail.com > wrote: > > > Hi Team, GM > > Successful while trying to upgrade from openLDAP 2.4.44 to > SymasLDAP2.4.57 > > > > Facing issues while trying to upgrade to 2.5.x and 2.6.x from > > SymasLDAP2.4.57 https://repo.symas.com/soldap2.5/upgrading/ > > > > Issues while trying to upgrade from SymasLDAP2.4.57 to SymasLDAP 2.5.17. > > 1. config error processing olcDatabase={2}mdb,cn=config > > UNKNOWN attributeDescription "OLCDBINDEX" inserted > > Providing a config snippet is not particularly useful. > > You also say issue going from 2.5.x to 2.6.x but then you say the error is > in going from 2.4.57 to 2.5.17. > > Your error generally indicates that you're missing a module load on the > MDB > backend module. > > --Quanah > >

7 13

How to synchronize between different DC domains
by 2458943823＠qq.com 24 Jul '24

24 Jul '24

OpenLDAP version: 2.4.44 Requirement: How to configure the slapd.conf file to successfully synchronize user information between master and slave servers from different DCs, to keep the user DC consistent with the slave server DC. Current issue: 1. When filling in the syncrepl synchronization rule with suffixmassage "dc=ws,dc=sip,dc=com" "dc=ws,dc=slave2,dc=sip,dc=com", it shows Error: parse_syncrepl_line: unable to parse "suffixmassage".

3 6

question about partial replication
by Frédéric Goudal 24 Jul '24

24 Jul '24

Hello, I’m trying to build a partial replication, but due to the structure of our ldap directory I’m wondering how to do : I have an ou branch for people that I want to replicate (ou=people,<prefix>) I have an ou branch for groups that I want to replicate (ou=groups,<prefix>) I have an ou branche for sudo that I want to replicate (ou=sudo,<prefix>) I guess that the setup for that is to replicate on <prefix> base and just filter on the objectClass BUT… my problem is that I have another ou branch for some people (ou=otherPeople,<prefix>) that I don’t want to replicate, but that contains exactly the same objects than then ou=people,<prefix> branch, so I can not use a filter on objectClass, there is no specific attribut that allow to say if an object belongs to ou=otherPoeple ou to ou=People I wonder what is the correct solution to achieve my goal. I was wondering if I could put several olcSyncrepl on the database with the same provider but one for every ou that I want to replicate ? Or is there a better way to do ? Thanks in advance — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 4

Openldap 2.6.8 installation some minor questions
by Frédéric Goudal 23 Jul '24

23 Jul '24

Hello, I have just ran into un install from source of 2.6.8 on an ubuntu24.04 server. I have had some minor problems with systemd, but maybe it’s my fault. I have compiled openldap with —with-tls and —with-systemd But on the service file there was no ldaps:// in url list, maybe it’s normal ? On the service file there is a reference of a /etc/sysconfig/slapd Environment file but this file is not installed with the make install, maybe I did miss a point ? And I wonder for the location of the slapd.service file, it is put in the main /usr/lib/systemd/system . As I have not put openldap in the main /usr/ hierarchy directory but /usr/local (that is the default), I was expecting to find slapd.service in /etc/systemd/system directory. I have not found a place in the configure tool to tell where to put the service file. Any thoughts on these points ? — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

1 0

LDAP search API failing if search filter contains escape character before equals to sign
by c.venugopal521＠gmail.com 19 Jul '24

19 Jul '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. As part of this activity, from our application, we are sending one search query using search API (Ex: ldap_search_ext_s) to one of LDAP servers with a filter: smVariableName=dzORGS\=\= In this search filter, escape character (\) is added for equals to (=) symbols. We expected a successful result for this query as we have a valid entry. But the LDAP search call failed. By high level investigation, it was identified that the search call did not reach the LDAP server and OpenLDAP API internally returned failure status by saying BAD filter. Note: With the same client application code (where search filter and search API is same), using nsldap C SDK, we are able to execute the query successfully and able to see results. Could you please let me know if I missed any specific configuration/setting in OpenLDAP APIs before making a search? OR Do we need to change the search filter value (remove escape character) for OpenLDAP APIs?

2 1

← Newer
1
...
4
5
6
7
8
9
10
...
979
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical