openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

slapo-lastbind
by Marco Pizzoli 07 Feb '11

07 Feb '11

Hi all, I used effectively the new slapo-lastbind overlay. I noticed that my authTimestamp attribute become populated for each user who successfully does a bind, but on my multi-master deploy I cannot have that attribute shared/replicated on all servers Any suggestions? Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

Compile contrib modules?
by Marco Pizzoli 07 Feb '11

07 Feb '11

Hi list, Today I downloaded the HEAD repository and tried to compile also the contrib module "lastbind". With the configure script I'm not able to have that module built in. I have to do something particular? Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

3 3

Search with filter doesn't return any results?
by Markku Tavasti 06 Feb '11

06 Feb '11

Hi! I have strange problem: I have newly built ldap database. System is running on Centos 5.5 (same as RHEL 5) # slapd -V @(#) $OpenLDAP: slapd 2.3.43 (Nov 29 2010 03:44:41) $ mockbuild@builder10.centos.org:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd I have configured syncrepl from ldap1 to ldap2. Both systems have same slapd.conf execpt on ldap1 syncprov overlay, ldap2 syncrepl consumer. To both servers ldapsearch without additional filters works fine, and returns content of database. However, to ldap1 (synrepl master) applying any search filter gives no results. Only filters I have noticed working are objectClass-filters. For example like this: --------- shell commands & output start --------- [root@srv]# ldapsearch -x -h ldap1 -b "dc=hq,dc=mydomain,dc=com" ... actual search results removed ..... # search result search: 2 result: 0 Success # numResponses: 33 # numEntries: 32 [root@srv]# ldapsearch -x -h ldap1 -b "dc=hq,dc=mydomain,dc=com" | grep tavasti memberUid: tavasti memberUid: tavasti memberUid: tavasti # tavasti, Users, hq.mydomain.com dn: uid=tavasti,ou=Users,dc=hq,dc=mydomain,dc=com uid: tavasti homeDirectory: /home/ldap/tavasti [root@srv]# ldapsearch -x -h ldap1 -b "dc=hq,dc=mydomain,dc=com" uid=tavasti # extended LDIF # # LDAPv3 # base <dc=hq,dc=mydomain,dc=com> with scope subtree # filter: uid=tavasti # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 --------- shell commands & output end --------- On log I get with the last one: Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 fd=15 ACCEPT from IP=10.x.x.x:347 25 (IP=0.0.0.0:389) Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=0 BIND dn="" method=128 Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=0 RESULT tag=97 err=0 text= Feb 4 18:29:54 ldap1 slapd[8611]: begin get_filter Feb 4 18:29:54 ldap1 slapd[8611]: EQUALITY Feb 4 18:29:54 ldap1 slapd[8611]: end get_filter 0 Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=1 SRCH base="dc=hq,dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=tavasti)" Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: AND Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_list_candidates 0xa0 Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: OR Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_list_candidates 0xa1 Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: EQUALITY Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: EQUALITY Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_list_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_list_candidates: id=0 first=1 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=1 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=2 UNBIND Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 fd=15 closed ---------------------------------------------------------------------- On config I have 'loglevel filter config stats' Any ideas what on earth is going on? -- M. Tavasti / tavasti(a)tavasti.fi / +358-40-5078254

2 2

Ghost/invisible subtree
by David Mohr 06 Feb '11

06 Feb '11

Hi, I'm having a strange issue. I'm running openldap 2.4.23 (on debian), and after playing around with some software using my ldap server I now have a ghost subtree. 'Ghost' meaning that I cannot see this subtree, but if I try to add an entry that used to exist, I get an 'Already exists (68)' error. With slapcat I can see all the invisible entries. I tried to run slapindex, but that did not help. Then I created a dump using slapcat, deleted the database, and used slapadd to fill it with data again. Yet my subtree is still invisible. Does anyone have suggestions on how to solve this issue? I can't seem to find any information beyond slapcat & slapadd. I don't see any obvious issues in the ldif dump either. Any help? Thanks, ~David

1 1

AccessLog behaviour
by Marco Pizzoli 05 Feb '11

05 Feb '11

Hi all, I would like to know the internal behaviour of slapo-accesslog. I would like to have accesslog with a data retention of 10 days. In my ldap usage scenario this retention produce an accesslog db of quite 10GB of data. Things are working quite fine, but when the log db contains data older than the retention I defined after restart slapd has a thread allocated at 100% of cpu of one processor. I logged at loglevel 992 = 512 + 256 + 128 + 64 + 32, blocked with iptables every external ldap access and saw these lines in the log: [cut] Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000008Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000010Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000012Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000014Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042855.000000Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:09 ldap03 slapd[16289]: => test_filter Feb 3 09:37:09 ldap03 slapd[16289]: LE Feb 3 09:37:09 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042855.000002Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:09 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:09 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:09 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:09 ldap03 slapd[16289]: => test_filter Feb 3 09:37:09 ldap03 slapd[16289]: LE Feb 3 09:37:09 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042855.000004Z,cn=log03,dc=mycorp.it" "reqStart" requested [cut] I could assume that slapo-accesslog is querying all entries older than the retention and passes to delete them. What if this step to end the job will take more time than the interval time of re-starting? Augmenting the frequency of this job could help in this meaning? Every best practice to follow to use accesllog effectively will be very appreciated! :-) Thanks Marco Pizzoli -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 3

How to I verify SSL is working correctly
by Rob Tanner 04 Feb '11

04 Feb '11

Hi, I’m adding SSL to an existing openLDAP server. My certificate is a 2048 bit from Comodo and I need to install both the certificate and and the intermediate chain, 5 certificates altogether. I bundled the chain into a single file in the order Comodo lists and in slapd.conf I added: TLSCACertificateFile /path/to/providerBundle.crt TLSCertificateFile /path/to/mycert.pem TLSCertificateKeyFile /path/to/mykey.pem Then I restarted openLDAP. I have several different browsers to test the SSL connection, and mostly they all worked just fine. However, lbe, a java based browser that I think was originally from Novel, asks me if I want to trust the CA root certificate, which is the first cert in the CA bundle. So, needless to say, I’m confused. Can anyone help unconfuse me? Thanks. Rob Tanner UNIX Services Manager Linfield College, McMinnville Oregon

2 1

TLS Directives in slapd.conf
by ldap＠mm.st 04 Feb '11

04 Feb '11

I have authentication working using TLS on my RH5 servers with openldap 2.3, but was looking for some clarification on the TLS directives in slapd.conf. Most of what I have seen and read states to generate the key and cert (can be done a number of ways) and update the following directives: # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem Which I have done using the "make ldap.pem" in the pki directory on the Redhat server. Both the key and the cert are in a singe file. The directives now read: TLSCACertificateFile /etc/pki/tls/certs/ldap.pem TLSCertificateFile /etc/pki/tls/certs/ldap.pem TLSCertificateKeyFile /etc/pki/tls/certs/ldap.pem I place the cert section in the client ldap.conf and all seems to work fine. My question is, what is the function of TLSCACertificateFile directive. I can comment out the directive and authentication still works fine and appears to not have a effect on operation. Both TLSCertificateFile and TLSCertificateKeyFile seem to be required if any one of the directives are used. The man page explanation says it "contains certificates for all of the Certificate Authorities that slapd will recognize." I'm not sure how TLSCACertificateFile should be used, if at all. Just trying to understand how the directive should be implemented.

1 0

LDAP writes/second limit?
by Diego Lima 04 Feb '11

04 Feb '11

Hello all, I'm running some load tests on an LDAP server using JMeter and as part of the tests I'm running a continuous loop of users trying to change their passwords. The problem is, there is a point where OpenLDAP stops responding requests and is unable to complete its current operations. This is what each "user" do: Bind -> Modify userPassword -> Unbind When I spawn a few users on a short time and try to do the modify operation the server stops responding. I was able to do that by spawning 5 threads simultaneously and trying to have them change the user password at once. It seems that something is not handling the write operations well and is hanging. Slapd doesnt stop responding completely, as I'm able to send a kill signal to it and it'll tell that it is waiting for some tasks to end. The complete log follows: Feb 4 13:47:44 Server01 slapd[8772]: @(#) $OpenLDAP: slapd 2.4.23 (Jan 28 2011 17:07:07) $#012#011root@Server01:/home/suporte/openldap-2.4.23/servers/slapd Feb 4 13:47:44 Server01 slapd[8772]: /ldap/etc/slapd.conf: line 108: rootdn is always granted unlimited privileges. Feb 4 13:47:44 Server01 slapd[8773]: bdb_db_open: database "dc=diretorio,dc=mycompany": unclean shutdown detected; attempting recovery. Feb 4 13:47:45 Server01 slapd[8773]: slapd starting Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 fd=12 ACCEPT from IP=192.168.1.2:6098 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 fd=15 ACCEPT from IP=192.168.1.2:6101 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 fd=13 ACCEPT from IP=192.168.1.2:6102 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 fd=14 ACCEPT from IP=192.168.1.2:6099 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 fd=16 ACCEPT from IP=192.168.1.2:6103 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=0 BIND dn="cn=tcarga_usuario4,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=0 BIND dn="cn=tcarga_usuario1,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=0 BIND dn="cn=tcarga_usuario3,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=0 BIND dn="cn=tcarga_usuario5,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=0 BIND dn="cn=tcarga_usuario1,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=0 BIND dn="cn=tcarga_usuario2,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=0 BIND dn="cn=tcarga_usuario2,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=0 BIND dn="cn=tcarga_usuario3,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=0 BIND dn="cn=tcarga_usuario4,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=0 BIND dn="cn=tcarga_usuario5,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=1 MOD dn="cn=tcarga_usuario5,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=1 MOD dn="cn=tcarga_usuario2,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=1 MOD dn="cn=tcarga_usuario4,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=1 MOD dn="cn=tcarga_usuario3,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x40d36450 20110204154751.766634Z#000001#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x426a5450 20110204154751.766634Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x436a7450 20110204154751.766652Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=1 MOD dn="cn=tcarga_usuario1,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x42ea6450 20110204154751.766981Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x41ea4450 20110204154751.767126Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=1 RESULT tag=103 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: slap_graduate_commit_csn: removing 0x7f9bc4203f10 20110204154751.766634Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=2 UNBIND Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 fd=16 closed [ Here I sent sigterm to slapd ] Feb 4 13:52:14 Server01 slapd[8773]: daemon: shutdown requested and initiated. Feb 4 13:52:14 Server01 slapd[8773]: slapd shutdown: waiting for 4 operations/tasks to finish The server does not respond anymore and I have to kill the process by using kill -9. Anyone ever experienced the same or can provide hints as to what is happening? I'm using slapd 2.4.23 and berkeley db 4.6 on a Debian Lenny system. -- Diego Lima http://www.diegolima.org

2 2

'Inheriting' an attribute from a group.
by ian+openldap＠comtek.co.uk 04 Feb '11

04 Feb '11

Is there a recommended, 'production' way to inherit certain attributes from a group? Perhaps some kind of overlay? For example, if a user is in the 'users' group and the users group has the attribute userQuota=100 then the user will appear to have userQuota=100. If, on the other hand, userQuota=200 is set on the user then that would override the current value. Thanks for any suggestions. Ian

3 2

System user login fails if ldap goes down.
by Meghanand Acharekar 04 Feb '11

04 Feb '11

Hi, I have configured a mixed authentication systems (LDAP + System Users). On this system some users are configure to login via ldap rest as system users. I observed that if the ldap server goes down, system users also not able to login. Is there any way to prevent this, following my pam configuration. system-auth : auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 debug minclass=4 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so nsswitch.conf --------------------- passwd: files ldap shadow: files ldap group: files ldap I get following errors in syslog, even after proving correct password. sshd[23564]: nss_ldap: failed to bind to LDAP server ldap://10.0.119.36/: Can't contact LDAP server sshd[23564]: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)... sshd[23568]: pam_ldap: ldap_simple_bind Can't contact LDAP server sshd[23568]: Failed password for testuser from 1.2.3.4 port 33324 ssh2 sshd[23571]: fatal: Access denied for user testuser by PAM account configuration Regards, Meghanand N. Acharekar

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical