openldap-technical

openldap-technical@openldap.org

11 participants
9877 discussions

Global configuration directive 'logfile'
by Mark 31 Mar '11

31 Mar '11

I've been trying to get the 'logfile' configuration attribute (man5/slapd.conf.5) working but can't seem to. The relevant slapd.conf entries before I define my backend look like: loglevel stats sync logfile /tmp/openldap/var/log/slapd.log and the file exists before I start slapd: $ ls -l /tmp/openldap/var/log/slapd.log -rw-r--r-- 1 me mygrp 0 Mar 30 15:58 /tmp/openldap/var/log/slapd.log SLAPD runs fine dumping information into syslog but my logfile stays zero length. How can I get my logfile to get written to also? Thank you, My setup: RedHat Enerprise Linux 4.7 (Linux host 2.6.9-78.ELsmp #1 SMP Wed Jul 9 15:46:26 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux) OpenLDAP 2.4.25 BerkeleyDB 4.8.30 OpenSSL 1.0.0d *Cyrus SASL *2.1.23 configured thusly: ( PATH="/tmp/openldap/bin:${PATH}"; export PATH echo "##BEG `date '+%Y/%m/%d %H:%M:%S'` - configure" CPPFLAGS="-I/tmp/openldap/include" \ CFLAGS="-g" \ LDFLAGS="-L/tmp/openldap/lib -R/tmp/openldap/lib" \ ./configure \ --without-subdir \ --enable-slapd \ --enable-modules \ --enable-wrappers \ --enable-backends=mod \ --disable-sql \ --disable-ndb \ --enable-overlays=mod \ --enable-debug \ --prefix=/tmp/openldap echo "##END `date '+%Y/%m/%d %H:%M:%S'` - configure" ) compiled and installed in /tmp/openldap $ file /tmp/openldap/libexec/slapd /tmp/openldap/libexec/slapd: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), stripped

1 1

Re: Antwort: Re: RHEL 6 OpenLDAP 2.4.19-15.el6 init problem
by Dan White 31 Mar '11

31 Mar '11

On 31/03/11 14:29 +0100, Markus Moj wrote: >So what do you mean by specify a gid? This is not a self scripted init >script this one is 100% Red Hat we have changed nothing within the start >script. Redhat may not, but it's not uncommon for other OSs to do so. I'm assuming that the error message you are seeing is permissions related, possibly due to the fact that slapd is running under a different effective gid when you start it from the command line versus when you start it from an init script. One way to trouble shoot that is to explicitly specify a gid (-g) from your init script and your command line. -- Dan White

2 1

Infos needed to setup a ldap proxy
by Frank Bonnet 31 Mar '11

31 Mar '11

Hello Anyone could send me some pointers on documentation howto setup a proxy OpenLDAP server ? Basically I need it to have a unique LDAP server to configure all our LAN clients and have the possibility to modify the proxy server on demand to access several directory servers ( locals and distants ) Thanks

3 2

ldapsearch - CA cert without using ldap.conf
by Liam Gretton 31 Mar '11

31 Mar '11

Hi, With ldapsearch I'd like to specify on the command line the CA certificate file without having to use TLS_CACERT in ldap.conf or any other configuration file. I suspect the solution lies in either the -O or -e option to ldapsearch, but I can't find any documentation about them. I'd be very grateful to any pointers to a solution. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

5 5

Authentication issue with syncrepl consumer
by Daniel Finn 30 Mar '11

30 Mar '11

I’ve got a strange issue going on which I believe just started happening but it’s hard to say for sure. I’ve got a small environment with a syncrepl provider and a syncrepl consumer which is placed in our DMZ. The provider is used for authentication for all of our internal linux servers and the consumer is used for authentication for all of our DMZ servers. The environment is less than 50 servers and maybe about 25 users. Both of these ldap servers are running OpenLDAP 2.3.43-12 provided by CentOS. I put this all into place about 2 months ago and everything has been working fine up until now. I’m seeing authentication failures for servers using the consumer but it’s not for all users, for example my personal user is able to authenticate fine which is what makes it hard to say when this started happening. For the most part I’m the only one logging into these servers on a regular basis. One of our web developers today let me know that he was unable to log into any servers that authenticate against the consumer but that he could log into all of the rest of our servers. I changed his password, noticed that syncrepl saw the change on the consumer and I still wasn’t able to log in as that user. I then created a new user, saw that syncrepl saw that on the consumer, and also was not able to log in as that user. Both of these users can still log into any server authenticating against the provider. On the consumer, I shut down ldap, deleted everything from under /var/lib/ldap and started from scratch using slapadd to import an ldiff that was dumped from the provider. This still didn’t fix the authentication issues. I’m not exactly sure what the relevant info is from the log so I captured a complete log that includes a failed authentication attempt with the loglevel set at 1. It can be seen here: http://pastebin.com/KY9m0CN4 The only thing I see in there that jumps out at me is: “<= bdb_index_read: failed (-30989)” It looks like I’m seeing that for every authentication failure. I found a couple old mailing posts regarding that error saything that it could either be BDB corruption or that it could just mean it’s searching for something that doesn’t exist. I was assuming that if it was BDB, that starting from scratch with the slapadd would fix it but it did not. I also did a diff against the dumps from both the provider and the consumer and when comparing the entries for a user who is failing authentication on the consumer, the only difference was the entryCSN and the modifyTimestamp. Any help would be really appreciated. Thanks, Dan Daniel Finn Linux/Storage Administrator P: 801.553.4587 M: 801.683.9147 [cid:3384344954_110196386] “Improving Oral Health Globally” Email Policy - Unauthorized review, use, disclosure, or distribution of this e-mail is strictly prohibited. This e-mail transmission, and any documents, files or previous e-mail messages attached to it, is intended solely for the individual or individuals to whom it is specifically addressed. If the recipient of this email is not the intended recipient, do not read, copy or distribute it or any of the information it contains. Please delete it immediately and notify us by return email or by telephone 801.572.4200.

1 1

user authentication on attributes
by sim123 30 Mar '11

30 Mar '11

I have openLDAP server up and running and trying to integrate it with Confluence. My LDAP structure looks like DN :: uid=123, ou=users, dc=example, dc=com uid :: 123 mail :: bjason(a)example.com cn :: barbara sn :: jason userPassword :: test (plain test for now) I have another similar entry in another branch (su) for "confluence admin", I did LDAP configuration in confluence and tested the bind with confluence user. Now for every user authentication I am assuming LDAP should be able to bind on any attribute other than DN. however I can not do that. when I try to login from confluence using mail & password, this is what I see in my slapd.d logs : connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 48 contents: op tag 0x60, time 1301434489 ber_get_next conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <uid=234,ou=su,dc=example,dc=com> <<< dnPrettyNormal: <uid=234,ou=su,dc=example,dc=com>, <uid=234,ou=su,dc=example,dc=com> do_bind: version=3 dn="uid=234,ou=su,dc=example,dc=com" method=128 bdb_dn2entry("uid=234,ou=su,dc=example,dc=com") => bdb_dn2id("dc=example,dc=com") <= bdb_dn2id: got id=0x1 => bdb_dn2id("ou=su,dc=example,dc=com") <= bdb_dn2id: got id=0x4 => bdb_dn2id("uid=234,ou=su,dc=example,dc=com") <= bdb_dn2id: got id=0x7 entry_decode: "uid=234,ou=su,dc=example,dc=com" <= entry_decode(uid=234,ou=su,dc=example,dc=com) do_bind: v3 bind: "uid=234,ou=su,dc=example,dc=com" to "uid=234,ou=su,dc=example,dc=com" send_ldap_result: conn=1000 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 144 contents: op tag 0x63, time 1301434489 ber_get_next conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <ou=user,dc=example,dc=com> <<< dnPrettyNormal: <ou=user,dc=example,dc=com>, <ou=user,dc=example,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" ==> limits_get: conn=1000 op=1 self="uid=234,ou=su,dc=example,dc=com" this="ou=user,dc=example,dc=com" => bdb_search bdb_dn2entry("ou=user,dc=example,dc=com") => bdb_dn2id("ou=user,dc=example,dc=com") <= bdb_dn2id: got id=0x3 entry_decode: "ou=user,dc=example,dc=com" <= entry_decode(ou=user,dc=example,dc=com) search_candidates: base="ou=user,dc=example,dc=com" (0x00000003) scope=2 => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 => bdb_dn2idl("ou=user,dc=example,dc=com") <= bdb_dn2idl: id=2 first=3 last=6 => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=6, last=7 => bdb_equality_candidates (cn) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 bdb_search_candidates: id=0 first=3 last=0 bdb_search: no candidates send_ldap_result: conn=1000 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 12 I guess I should be able to do LDAP_BIND with any attribute and LDAP should be able to search user's DN based on the attribute and authenticate him as I have laready provided valid DN and password (for confluence user), am I right here? Please let me know if its doable (should be) and what am I missing here ? I tried searching for this but couldn't find it on the web. Thanks for the help and support. -simon

3 6

syncrepl binds always fail the first time
by Tyler Gates 30 Mar '11

30 Mar '11

Hello, Using version 2.4.24 I have a replication server that periodically queries the provider for updates via refreshOnly. I've noticed that once slapd is started, the bind to the replicator DN on the provider always failed but subsequent do_syncrepl retries succeed. Ideally I'd like the first bind to succeed so it pulls in all the data instead of having to wait <retry> seconds. Is this normal behavior or do I have something mis-configured? slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/qmail.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_hdb loglevel config allow bind_anon_dn database hdb directory /var/lib/ldap suffix "dc=domain,dc=com" rootdn "cn=Manager,dc=domain,dc=com" index objectclass,entryCSN,entryUUID eq index uid,memberUid,uidNumber,gidNumber eq cachesize 200 idlcachesize 600 checkpoint 50 5 syncrepl rid=001 provider=ldaps://directory-master.domain.com type=refreshOnly interval=00:00:10:00 retry="60 5 600 +" searchbase="dc=domain,dc=com" filter="(|(&(objectClass=posixAccount)(uid=username))(&(objectClass=posixGroup)(memberUid=username)))" scope=sub attrs="cn,sn,givenName,homeDirectory,loginShell,ou,uid,uidNumber,userPassword,memberUid,gidNumber" schemachecking=off bindmethod=simple binddn="cn=replicator,dc=domain,dc=com" credentials=secret

2 1

meta and AD disabled accounts
by Fred 30 Mar '11

30 Mar '11

Okay, new to OpenLDAP, have managed to setup a meta backend/proxy to multiple Active Directory systems that is doing everything I need with one exception. I can't figure out a reliable way to filter out disabled accounts on the AD side. I know how to query this directly against AD of course (NOT UserAccountControl:1.2.840.113556.1.4.803:=2), but after a lot of searching and head scratching I'm not sure how to implement this in my slapd.conf - or even just allow the filter (if specified by a client) to pass through: My original filter: "(&(objectclass=inetOrgPerson)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))" >From slapd debug output, after passing through the parser: "(objectClass=user)(!(!(objectClass=*)))(?=error)" As you can see, objectClass inetOrgPerson is mapped to User (and I've got some work to do on the Computer objectClass too) but the UserAccountControl bitwise flag is the part I'm hung up on right now.

2 2

entry format
by Omer Faruk SEN 30 Mar '11

30 Mar '11

Hi, I have a dump of Sun LDAP Directory server (6.3.1) I see dn: cn=me,ou=groups,dc=me,dc=com nsUniqueId: 1255060a-46e511dd-803ce5f5-385faa0b objectClass;vucsn-4869456e0009002d0000: top objectClass;vucsn-4869456e0009002d0000: groupOfUniqueNames cn;vucsn-4869456e0009002d0000;mdcsn-4869456e0009002d0000: everyone description;vucsn-4869456e0009002d0000: everyone lines what is the meaning of vucsn,mdcsn and adcsn? Regards.

2 2

slapd segfaults in one node of master-master
by Dave Smith 29 Mar '11

29 Mar '11

We run version 2.4.16 on two RHEL4 platforms in master-master configuration. One of our nodes regularly reports a segfault and exits. The log is shown below. This is a production platform so we run minimal logging for performance reasons. We have been running openldap in this configuration for 2 years without a problem. The issues started after we applied as schema change and added more users accounts to the system. The schema changes we straight-forward. We added a few optional attributes to existing objects and added one new object to our schema. Nothing that required data fixes. Our schema provides an auxiliary user account object that we use with the standard "account" object. We have a number of additional objects that are related user authentication and authorization. We applied these same changes in various development and testing environments without problem. The other thing we did was add a lot of users accounts. Prior to this release we had some 6000 users accounts. Now we have over 15000 user accounts. We are concerned that our problem may be related to the additional load from these users. We are planning further grow in the user-base. One thing I should mention is that our system is more write-heavy that the NIS replacement system. We change attributes on the account record on every authentication request. We suspect this might be replication related because when we dump (using slapcat) and compare the two nodes, one user account record is missing from the node with the segfaults. This weekend we plan to rebuild this node from the slapcat output of the other. We hope this will resolve our problem. Mar 21 00:59:02 msgeuroha slapd: slapd startup succeeded Mar 21 01:47:29 msgeuroha kernel: slapd[19367]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 01:53:58 msgeuroha slapd: slapd startup succeeded Mar 21 03:46:54 msgeuroha kernel: slapd[14167]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 03:51:34 msgeuroha slapd: slapd startup succeeded Mar 21 09:10:34 msgeuroha kernel: slapd[6834]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 --DS

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical