openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

slapcat on bdb
by ldap＠mm.st 08 Mar '11

08 Mar '11

Running RH5 openldap 2.3 with "database bdb" in slapd.conf. This has most likely been covered, but I am seeing many conflicting recommendations on running slapcat while slapd is running. The man page states "It is always safe to run slapcat with the slapd-bdb" Which seems very definitive, but I came across another well know guide that states that even though the man page states its ok, slapd should be stopped first before running slapcat. I'm writing a short backup script to generate nightly ldif output using slapcat and would rather not shut down slapd in the script. Since I have not been running openlap for very long, I was curious if anyone has had any problems running slapcat while slapd was running.

2 1

Re: LDAP browsers and cn=config
by harry.jede＠arcor.de 08 Mar '11

08 Mar '11

Gervase Markham wrote: > Can you tell me which LDAP browsers do support this scheme? After > all, the other part of my message was asking for advice on which was > best. GQ I am using gq for years. It's an GTK based graphical LDAP Editor. And yes, you may edit cn=config. Snippet of my ~/.gq <ldapserver> <name>debby-3</name> <ldaphost>debby-3</ldaphost> <ldapport>389</ldapport> <basedn>cn=config</basedn> <binddn>cn=admin,dc=kronprinz,dc=xx</binddn> <pw-encoding>Base64</pw-encoding> <search-attribute>cn</search-attribute> </ldapserver> I am NOT using ldapi and NOT the directory cn=config, but the file slapd.conf with a config-DB definition: database config rootdn "cn=admin,dc=kronprinz,dc=xx" This rootdn is the same rootdn as I use in database hdb. So there is no need to specify a password here. -- Harry Jede

1 0

LDAP single sign on with samba
by Lumeng Lim 08 Mar '11

08 Mar '11

not sure if this is the right place. would like to implement samba with ldap as well as authentication using sonicwall basically, I just want to be able to manage groups, users and computers. would like your help on where I can start so I can implement this properly.

5 4

back_shell anomaly with distribution example deploy
by Marco Pizzoli 07 Mar '11

07 Mar '11

Hi list, I'm having a problem in using the example back_shell example of OL distribution. I'm using OL 2.4.21 as released in Ubuntu10.04 distribution. This is my database definition: database shell suffix "dc=pippo,dc=it" search /tmp/slapd_search.sh This is the example script found in the OL distribution. Im my test this is /tmp/slapd_search.sh #!/bin/bash # $OpenLDAP: /servers/slapd/back-shell/searchexample.sh,v 1.9.2.6 2011/01/04 23:50:44 kurt Exp $ ## This work is part of OpenLDAP Software <http://www.openldap.org/>. ## ## Copyright 1998-2011 The OpenLDAP Foundation. ## All rights reserved. ## ## Redistribution and use in source and binary forms, with or without ## modification, are permitted only as authorized by the OpenLDAP ## Public License. ## ## A copy of this license is available in the file LICENSE in the ## top-level directory of the distribution or, alternatively, at ## <http://www.OpenLDAP.org/license.html>. # ## Portions Copyright (c) 1995 Regents of the University of Michigan. ## All rights reserved. ## ## Redistribution and use in source and binary forms are permitted ## provided that this notice is preserved and that due credit is given ## to the University of Michigan at Ann Arbor. The name of the University ## may not be used to endorse or promote products derived from this ## software without specific prior written permission. This software ## is provided ``as is'' without express or implied warranty. while [ 1 ]; do read TAG VALUE #echo "TAG: $TAG" >>/tmp/temp1.txt #echo "VALUE: $VALUE" >>/tmp/temp1.txt if [ $? -ne 0 ]; then break fi case "$TAG" in base:) BASE=$VALUE ;; filter:) FILTER=$VALUE ;; # include other parameters here esac done LOGIN=`echo $FILTER | sed -e 's/.*=$.*$)/\1/'` PWLINE=`grep -i "^$LOGIN" /etc/passwd` #sleep 60 # if we found an entry that matches if [ $? = 0 ]; then echo $PWLINE | awk -F: '{ printf("dn: cn=%s,%s\n", $1, base); printf("objectclass: top\n"); printf("objectclass: person\n"); printf("cn: %s\n", $1); printf("cn: %s\n", $5); printf("sn: %s\n", $1); printf("uid: %s\n", $1); }' base="$BASE" echo "" fi # result echo "RESULT" echo "code: 0" exit 0 This is the result. I cannot see my user listed root@LTSP-vanilla:/etc/ldap/slapd.conf.d# ldapsearch -v -x -s sub -b "dc=pippo,dc=it" "(cn=marco)" ldap_initialize( <DEFAULT> ) filter: (cn=marco) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=pippo,dc=it> with scope subtree # filter: (cn=marco) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 By using strace I can see full execution appering. This is the final excerpt of my output: Process 3914 detached [pid 3915] <... read resumed> "", 4096) = 0 [pid 3915] write(1, "dn: cn=marco,dc=pippo,dc=it\nobjectclass: top\nobjectclass: person\ncn: marco\ncn: marco,,,\nsn: marco\nuid: marco\n", 109) = 109 [pid 3915] exit_group(0) = ? Process 3915 detached [pid 3909] <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 3914 [pid 3909] waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 3915 [pid 3909] rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0 [pid 3909] rt_sigaction(SIGINT, {SIG_DFL, [], 0}, {0x8086b90, [], 0}, 8) = 0 [pid 3909] close(4) = -1 EBADF (Bad file descriptor) [pid 3909] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 3909] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 3909] waitpid(-1, 0xbfda677c, WNOHANG) = -1 ECHILD (No child processes) [pid 3909] sigreturn() = ? (mask now []) [pid 3909] write(1, "\n", 1) = 1 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] read(255, "\n# result\necho \"RESULT\"\necho \"code: 0\"\n\nexit 0\n\n", 1835) = 48 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] write(1, "RESULT\n", 7) = 7 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] write(1, "code: 0\n", 8) = 8 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 3909] exit_group(0) = ? Process 3909 detached [pid 3767] <... read resumed> "dn: cn=marco,dc=pippo,dc=it\nobjectclass: top\nobjectclass: person\ncn: marco\ncn: marco,,,\nsn: marco\nuid: marco\n", 4096) = 109 [pid 3767] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 3767] waitpid(-1, NULL, WNOHANG) = 3909 [pid 3767] waitpid(-1, NULL, WNOHANG) = -1 ECHILD (No child processes) [pid 3767] sigreturn() = ? (mask now []) [pid 3767] read(19, "\nRESULT\ncode: 0\n", 4096) = 16 [pid 3767] read(19, "", 4096) = 0 [pid 3767] time(NULL) = 1299531296 [pid 3767] send(4, "<167>*Mar 7 21:54:56 slapd[3765]: shell: fgets failed: Success (0)\n*", 67, MSG_NOSIGNAL) = 67 [pid 3767] write(16, "0\f\2\1\2e\7\n\1\0\4\0\4\0", 14) = 14 [pid 3767] time(NULL) = 1299531296 [pid 3767] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=\n", 94, MSG_NOSIGNAL) = 94 [pid 3767] close(19) = 0 [pid 3767] munmap(0xb777f000, 4096) = 0 [pid 3767] futex(0x212fc060, FUTEX_WAIT_PRIVATE, 32, NULL <unfinished ...> [pid 3766] <... epoll_wait resumed> {{EPOLLIN, {u32=556622232, u64=556622232}}}, 1024, 450000) = 1 [pid 3766] epoll_ctl(7, EPOLL_CTL_MOD, 16, {0, {u32=556622232, u64=556622232}}) = 0 [pid 3766] futex(0x212fc060, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x212fc05c, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1} <unfinished ...> [pid 3789] <... futex resumed> ) = 0 [pid 3789] futex(0x212fc044, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> [pid 3766] <... futex resumed> ) = 1 [pid 3766] futex(0x212fc044, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> [pid 3789] <... futex resumed> ) = 0 [pid 3789] futex(0x212fc044, FUTEX_WAKE_PRIVATE, 1) = 0 [pid 3789] time(NULL) = 1299531296 [pid 3789] read(16, "0\5\2\1\3B\0", 8) = 7 [pid 3789] time(NULL) = 1299531296 [pid 3789] read(16, "", 8) = 0 [pid 3789] write(6, "0", 1) = 1 [pid 3789] time(NULL) = 1299531296 [pid 3789] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 op=2 UNBIND\n", 56, MSG_NOSIGNAL) = 56 [pid 3789] epoll_ctl(7, EPOLL_CTL_DEL, 16, {0, {u32=556622232, u64=556622232}}) = 0 [pid 3789] shutdown(16, 2 /* send and receive */) = 0 [pid 3789] close(16) = 0 [pid 3789] time(NULL) = 1299531296 [pid 3789] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 fd=16 closed\n", 57, MSG_NOSIGNAL) = 57 [pid 3789] futex(0x212fc060, FUTEX_WAIT_PRIVATE, 34, NULL <unfinished ...> [pid 3766] <... futex resumed> ) = 1 [pid 3766] time(NULL) = 1299531296 [pid 3766] epoll_wait(7, {{EPOLLIN, {u32=556622188, u64=556622188}}}, 1024, 1283000) = 1 [pid 3766] read(5, "0", 8192) = 1 [pid 3766] time(NULL) = 1299531296 [pid 3766] epoll_wait(7, <unfinished ...> [pid 3765] <... futex resumed> ) = ? ERESTARTSYS (To be restarted) [pid 3765] futex(0xb7609bd8, FUTEX_WAIT, 3766, NULL^C <unfinished ...> Process 3765 detached Process 3766 detached Process 3767 detached Process 3789 detached As you can see with bold font, I obtain a strange behaviour "fgets failed". But user "marco" exists in /etc/passwd. Someone could tell me what is wrong? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

LDAP browsers and cn=config
by Gervase Markham 07 Mar '11

07 Mar '11

How does one use an LDAP browser to view and change the cn=config config? I am using the OpenLDAP 2.4.23 package from Ubuntu 10.10, and have been using both "luma" and more recently ApacheDS. I have tried an enormous number of ways all afternoon, but feel I'm stumbling in the dark. Do I have to use a special bind DN and password, or should the RootDN and password for my normal data do? If it's special, what is it? Where is it configured? I can view the data using ldapsearch, as root: ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config I've tried adding an olcRootPW and olcRootDN manually to the cn=config LDIF file (/etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif) but when I start slapd up again and do the command-line search it seems to have noticed the password but not the RootDN :-( The magic way of getting at it (-Y EXTERNAL) given above, which works only for root, doesn't translate well into filling in boxes in an LDAP browser config. (I tried running the LDAP browser as root and binding anonymously - I could see all my data, but still not cn=config.) The slapd-config man page has lots of info about what to change, but nothing about how to change it. I've searched the web for hours, and tried to find it in the Admin Guide, but no luck. Any help would be very much appreciated! :-) Gerv

2 1

Re: When login from one application, "error=49" error show up, but other application's login are all right.
by Andrew Findlay 07 Mar '11

07 Mar '11

On Fri, Mar 04, 2011 at 11:01:28AM +0000, mahaoboy(a)gmail.com wrote: > To: openldap-its(a)openldap.org This is not a bug-report at this stage so I am directing replies to openldap-technical(a)openldap.org. > This user can logged in confluence successfully, but when could not log in > fisheye. > Log of confluence logging: > conn=5 op=8052 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8052 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8052 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=8 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=8 op=0 BIND dn="cn=jirasupport,ou=People,ou=eejira,o=nsn" mech=SIMPLE ssf=0 > conn=8 op=0 RESULT tag=97 err=0 text= All OK so far. > Log of fisheye logging: > conn=5 op=8051 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8051 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8051 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=7 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=7 op=0 RESULT tag=97 err=49 text= Error 49 (decimal) is 0x31 (hex) which is LDAP_INVALID_CREDENTIALS so the password does not match. > And other users are all right for logging in all applications. My guess would be that there is something odd about this user's password. Be aware that most existing LDAP client software treats passwords as strings of binary without consideration of character set encoding. This can lead to problems where an account has a password that cannot be represented in 7-bit ASCII. There is nothing that the LDAP server can do about this, as it does not know what character set the application is using. I would suggest changing this account's password to a new one using only printable 7-bit characters. You can maintain good security by making the password longer (but beware that the old Unix-crypt hash scheme only uses the first 8 characters so avoid that if you can: SSHA1 is far better). Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

syncrepl missing entries in openldap 2.4.23
by James_Whiteacre＠McAfee.com 04 Mar '11

04 Mar '11

I am trying to set up syncrepl to have multiple providers to a single consumer. Basically allowing me to combine two ldap's into a single ldap. I know this is probably not a standard configuration but seems like it should work. This seems to work for a while but then all of the records from one of the providers is deleted. And even though the consumer still is polling both providers the records will will not get added back. Here is my consumer syncrepl configuration. The providers are a standard provider configuration. Any help would be appreciated. Jim serverID 064 database bdb suffix "o=dogcatfish" rootdn "cn=admin,o=dogcatfish" limits dn.exact="cn=admin,o=dogcatfish" size=unlimited time=unlimited # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw admin # syncrepl configuration syncrepl rid=64 provider=ldap://provider1 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # syncrepl configuration syncrepl rid=68 provider=ldap://provider2 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # Indices to maintain index contextCSN,entryCSN,entryUUID,objectClass,cn,dc,mail eq checkpoint 1024 5 mirrormode TRUE

2 3

Replication monitoring
by Andreas Andersson 04 Mar '11

04 Mar '11

Hi! I posted an announcement here about a year ago about my little LDAP monitoring project CN=Monitor. Asked for feedback and received a lot. Thank you! Some feedback was related to adding replication verification for OpenLDAP so of course I gave it a try. Unfortunately I don’t have a large scale OpenLDAP environment to verify this functionality on so I need your help :) Is it working and can it be improved? This is how it works: The contextCSN is verified on all servers within the same environment. See attached image. As always… I appreciate all feedback I can get and let me know if you have any suggestions on new features or something else that can approve this monitoring application. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor Best Regards - Andreas

4 11

Combining multiple objectClasses
by Johannes Michael Jordan 04 Mar '11

04 Mar '11

Hello, I am setting up LDAP and I wonder if my sense of laying out my directory is possible to realize. For each of our users, we need (_objectClass_): - _inetOrgPerson_ (obv.) - PAM login, _posixAccount_ - automounter information for her home: _automount_ - samba account for Windows: _sambaSamAccount_ My rationale was that I put all these objectClasses into a single object. This is not possible, as several of them are structural. Next thing I tried is to create a new objectClass that has these as superiors. Also not possible: slapd silently refuses to start, when this is included in my schema file: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP (inetOrgPerson $ sambaSamAccount) STRUCTURAL ) Whereas it starts up fine with: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP inetOrgPerson STRUCTURAL ) What is holding slapd from accepting my schema? Johannes

2 1

Allowing users to add, but not delete, entries?
by Gervase Markham 04 Mar '11

04 Mar '11

Hi, Summary: is it possible to configure access control such that users to can add, but not delete, entries? Details: My planned schema has a branch: ou=tags,dc=example,dc=com The entries below this are like this: objectClass=groupOfNames cn=sometagname member=<user dn 1> member=<user dn 2> member=<user dn 3> ... I have worked out how to make it so users can only add and remove themselves from a tag: access to dn.children="ou=tags,dc=example,dc=com" attrs=member,entry # Allow people to add and remove themselves from any other tag by dnattr=member selfwrite # Allow anyone to read by anonymous read So far so good, but I would like authenticated users to be able to add new entries (tags), and add themselves as members to them, but _not_ to be able to delete tags. Even better, the tag would be deletable, or even automatically removed, but only if the user removed their own name and there were no more members - i.e. it was empty. (I believe the member attribute is mandatory in groupOfNames, and I don't want it to be impossible for someone to remove their name because they are the only member!) This is difficult, because as far as I can see the "write" permission does not distinguish between adding and deleting. Can someone tell me if this is possible? Thanks, Gerv

4 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical