openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

slapindex Required or Not
by ldap＠mm.st 02 Feb '11

02 Feb '11

I am in the process of rebuilding our ldap servers that are many years old to run on RH5. I basically took the existing slapd.conf file from the old server and am using it on the new server (minor changes). I did a slapcat on the old server, modified the schema a little and did a slapadd on the new. Systems seem to be able to authenticate against the new test server and things seem to function corretly. For now, the db backend is ldbm. It has the following index statements: index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial I'm unclear of when and if it is required to run slapindex on the new server. Is this something that should be done after slapadd and should it be done on a regular basis? I assume you should stop slapd when this is run.

2 3

Running back-perl and hdb/bdb in the same suffix
by José Miguel Parrella Romero 02 Feb '11

02 Feb '11

Hi, I've written a Perl class to be used with back-perl. I'm able to load this class from slapd.conf using a different suffix than my traditional hdb database. Say, for example, my hdb database is serving the dc=my,dc=net suffix, and my Perl is serving dc=perl,dc=my,dc=net. This effectively prevents me from "catching" user password modifications in dc=my,dc=net. If I use the subordinate keyword on my Perl database I'm able to see searches spanning through my dc=perl,dc=my,dc=net, but then again, modifications on users in dc=my,dc=net aren't seen by the Perl backend. I've tried different approaches for this, but as of now I guess my only chance is to actually "proxy" the LDAP operations from Perl using the LDAP library to the dc=my,dc=net suffix in order to get a seamless experience and achieve my goal of user password manipulation. This is what I've seen in (really old) projects such as acctsync in Sourceforge. So, my question is: can I use both backends in the same suffix, so only some LDAP operations get overriden in Perl and others "pass through" the physical backend? And if not, what would be your strategy to achieve this goal? My last plan is to store passwords in plaintext, create an ACL to prevent everyone but a non-human role to read userPassword and move along, but I'd feel terrible about this. By the way, thanks for making such an awesome piece of software. Jose

1 0

slapadd: could not add entry dn="cn=plc1, ou=groups, dc=orleans-tours, dc=iufm, dc=fr" (line=53343): txn_aborted! Internal error (80)
by Olivier PAVILLA 02 Feb '11

02 Feb '11

Hi everyone I met some difficulties to import ldif to my ldap On the old LDAP I did [root@luz ~]# /etc/init.d/crond stop Ce qui donne Arrêt de crond : [ OK ] [root@luz ~]# /etc/init.d/ldap stop Ce qui donne Arrêt de slapd : [ OK ] After that I did #slapindex And after [root@luz ~]# slapcat > /root/sauvegarde_luz_new.ldif I uploaded on the new server And I did that luz:~/setup# slapadd -l sauvegarde_luz_new.ldif bdb(dc=orleans-tours,dc=iufm,dc=fr): Lock table is out of available locks => bdb_idl_insert_key: c_get failed: Cannot allocate memory (12) => bdb_tool_entry_put: index_entry_add failed: Internal error (80) => bdb_tool_entry_put: txn_aborted! Internal error (80) slapadd: could not add entry dn="cn=plc1,ou=groups,dc=orleans-tours,dc=iufm,dc=fr" (line=53343): txn_aborted! Internal error (80) Someone can tell me what does this message mean? I don't understand this message error then I don't know what should I do. -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-ørleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

2 1

Do I need using slapindex?
by Olivier PAVILLA 02 Feb '11

02 Feb '11

Hi. I need your advice. I have LDAP server on a fedora core 5 which is running for more than 3 years without any update nor upgrade neither. So now I've to migate this LDAP on a new server with new Linux distribution (Debian Lenny 5.0.7 64 bits). Should I or do I need to use slapindex before I use slapcat to export in ldif file? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-orleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

3 2

Re: Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by masarati＠aero.polimi.it 02 Feb '11

02 Feb '11

>> 2.3.43 included with CentOS. I'll try the latest package. Thanks! > > Ah. Actually, I only tried an undefined objectClass, which works. In > fact, in the case you're considering, (objectClass=user) contains an > invalid value of a valid attribute, while (sAMAccountName=user01) contains > an invalid attribute, so the two cases are different. Right now, with > HEAD's back-meta for "(&(objectClass=user)(sAMAccountName=user01))" I get > "(&(?objectClass=user)(!(objectClass=*)))". Let me check a bit more. I have provided another round of fixes. One of them affects back-meta (map.c, ITS#6818); another affects filter handling (ava.c); finally, another affects slapo-rwm when used in conjunction with back-ldap (rwmmap.c). Now the issue should be definitely fixed. Please test. p.

2 1

authz-regexp and uid's
by Derek Bodner 02 Feb '11

02 Feb '11

Hello, I'm running an ldap 2.3 server, with users setup under cn=<first name> <last name>,ou=People,dc=org,dc=com. I have an application that is trying to access the dn's directly, via uid=<username>,ou=People,dc=org,dc=com I've setup an authz-regexp rule to try to rewrite the request: authz-regexp uid=([^,]*),ou=People,dc=org,dc=com ldap:///ou=People,dc=org,dc=com??one?(uid=$1) But my query still seems to be failing [dbodner@nagios01 ~]$ ldapsearch -h <ldap server> -x -b "uid=dbodner,ou=People,dc=org,dc=com" # extended LDIF # # LDAPv3 # base <uid=dbodner,ou=People,dc=org,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 Any ideas on what I'm doing wrong ? -- Derek Bodner subscribedlists(a)derekbodner.com

2 2

using slapindex on a running instance of openldap
by François Périchon 02 Feb '11

02 Feb '11

Hi, I am using the gentoo build of openldap 2.4.23 with db-4.8 on a 64bit gentoo linux system. I am trying to reindex a database after switching this database on readonly mode (by editing the bdb backend entry in th cn=config). The slapindex manpage read: Your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. But I get this error: sudo -u ldap slapindex -q member bdb_db_open: database "dc=univ-lille2,dc=fr": database already in use. backend_startup_one (type=bdb, suffix="dc=univ-lille2,dc=fr"): bi_db_open failed! (-1) slap_startup failed Regards, -- François Périchon Gestion des identités numériques Université Lille 2 - Droit & Santé Centre de Ressources Informatiques http://cri.univ-lille2.fr tel: +33 3 20 96 52 28 - A: Yes. > Q: Are you sure ? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting annoying in email ?

1 0

same objects in multiple ou?
by Joe Comeaux 01 Feb '11

01 Feb '11

I'm trying to design an environment that does not allow anonymous binds, and the users that require authentication reside across multiple OU's. It seems common practice among authentication modules to take a cn, bind anonymously to scan for the full dn, and then check password with full dn to authenticate. What I'd like to avoid is the anonymous bind, or storing a name and password with read access to bind, to increase security. I think what would be ideal is to somehow map all objects across multiple ou's to a single ou. Something along the lines of : all objects in ou=Department1,dc=example,dc=com + ou=Department2,dc=example,dc=com + ou=Department3,dc=example,dc=com to be linked to ou=Everyone,dc=example,dc=com. If something like that were in place, new users created in Department3 could be authenticated with cn=username,ou=Everyone,dc=example,dc=com. All modules designed to check authentication would not need to bind first to search the directory for the full dn. I've seen references to aliasing, but that applies only to a single object, and also mentions of mapping, but I can't tell if that would do what I expect it to do. Has anyone else built something similar? Can what I explain even be done with OpenLDAP? What should I be looking in to for direction on setting this up? Thanks in advance -Joe Comeaux

3 7

autonumbering
by Molenda, Mark 01 Feb '11

01 Feb '11

I know you can create a sequence for auto numbering in records, I was wondering if this is still the preferred method? What is the best way?

1 0

User managed groups - ACLs
by Christian Manal 01 Feb '11

01 Feb '11

Hi list, I am currently trying to make it possible for ordinary users to manage their own groups in the following way: 1 Any user can create new groups ("groupOfNames"). 1.1 On creation, the creator is set to be the first member and manager of the group (the latter is defined as a single-value attribute (UDBgrpAdmin) for a self defined auxiliary objectClass "UDBgrp"). 1.2 Some names should be prohibited from being used for new groups. 2 Group managers can invite any user to the group by adding their DN to the invited list of the group (UDBgrpInvited) and revoke invitations by removing DNs from said list. 2.1 Group managers can kick members from the group. 2.2 Group managers can delete the group. 2.3 Group managers can assign a new manager who has to be a member of the group. 2.4 Group managers can (re)set a description for the group. 3 Invited users can accept or decline the invitation, i.e. remove themselves from the invite list and add themselves to the member list. 4 Group members can leave the group permanently or temporarily. The latter is achieved by moving themselves from the member list to a suspended list (UDBgrpSuspended) which allows them to rejoin the group later (i.e. move themselves back to the member list) without a new invitation. I have most of the above covered, but I'm struggling with the points 1.1, 2.3 and to some extend 1.2. 1.1 and 2.3: I have no idea if this is even possible, let alone how to achieve it. 1.2: By extending the 'filter' rule that limits the objectClasses for new entries in "ou=Group" I can make a blacklist for 'cn' values, but I'd rather have something in the DIT itself, so I can modify the list without meddling with the server config. This is optional, though, since I don't except the list to change very often. This is what I've got so far: <http://openldap.pastebin.com/n8P4eKvU> Any help would be appreciated. Regards, Christian Manal

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical