openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

meta directory backend and rewriting option '|'
by Lehnert, Hartmut 01 Feb '11

01 Feb '11

Hello! I have a question concerning the pipe option '|' when using the meta directory backend and rewriting. In the manual pages the '|' option is marked as "not implemented". Does this reflect the actual state of the software or has somebody just forgotten to update the man page? Regards, Hartmut

2 2

Access control
by Thomas Schweikle 31 Jan '11

31 Jan '11

Hi! I am trying to set up access control for an OpenLDAP server. I'd like to use a Group to set up users allowed to access and write to entries inside my tree: I've created the group: dn: cn=administrators,dc=example,dc=com cn: administrators objectclass: groupOfNames (important for the group acl feature) member: cn=user1,ou=Users,dc=example,dc=com member: cn=user2,ou=Users,dc=example,dc=com in dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcRootDN: cn=adm,dc=example,dc=com olcRootPW: ${admpw} olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by * read Now trying to access "userPassword" from any user inside the tree "ou=Users,dc=example,dc=com". 1. The password field is empty -- it should hold a value 2. Entering a value, then pressing apply: "Error modifying 'cn=user3,ou=Users,dc=xompu,dc=de': Insufficient access I'd expected to have access to "userPassword" and I am allowed to write this value. Why does it not work if I log in with user1? -- Thomas

3 5

cn=config how to grant read rights
by John Espiro 31 Jan '11

31 Jan '11

I am new to the whole cn=config thing... Having just started with it, I have a question. I have an existing user for which I need to give read rights to the tree: "This user must have the Read right to the LDAP service.". How do I go about modifying the ACL so that he has this? John

1 0

Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by Christopher Cprek 31 Jan '11

31 Jan '11

Hello, I'm attempting to configure a slapd server in a very simple transparent proxy configuration. I'm having a problem where clients for this proxy have a (objectClass=user) filter defined. This filter is being replaced with (!(objectClass=*)) when the searchRequest is relayed to the backend LDAP server. I believe this is something missing in the schema, though I'm very new to LDAP. I've already included an AD schema in my slapd.conf to resolve some AD specific filters I had trouble with. I've attempted to uncomment and modify the core.schema's definition of attributetype NAME objectClass, and commented out what I suspected was the conflicting duplicate attributeType NAME supportedApplicationContext. But I can't get slapd to start. I keep getting a duplicate attribute type error in the config. hdb_back_initialize: Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) /etc/openldap/schema/core.schema: line 66: Duplicate attributeType: "2.5.4.0" slapd-ldap destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. I would appreciate any guidance to help resolve my problem. All I want is the filter (objectClass=user) to be relayed correctly from the slapd service to the LDAP proxy backend. Thanks in advance! /Chris

3 6

Authentication for on the fly configuration updates in OpenLDAP 2.4
by Razvan Deaconescu 30 Jan '11

30 Jan '11

Hi! I've browsed the configuration page for slapd[1] and it mentions that, for starting from version 2.3, "The LDAP configuration engine allows all of slapd's configuration options to be changed on the fly, generally without requiring a server restart for the changes to take effect." What is the user and password required to update the LDAP configuration database? I'm using slapd 2.4.23-7 on a Debian Squeeze (testing). I've tried using the admin user (cn=admin,dc=...,dc=...) and it fails. This link[2] mentions using the cn=admin,dc=config account and a password found in ldap.secret. I've not found that file and don't know what is the password for the cn=admin,dc=config account. Thanks, Razvan

6 11

syncrepl don't preserve the order of the value on multivalued attribute
by Ricardo Machini 30 Jan '11

30 Jan '11

Hi, I changed recently from sluprd to syncrepl. And I saw that the syncrepl do not preserve the order of the value on multivalued attribute (I dont know if it is a bug) . Example: Entry on LDAP master/slave: dn: cn=ricardo deliveryProgramPath: odeiavir deliveryProgramPath: maildrop When I do this modify on master: dn: cn=ricardo changetype:modify replace: deliveryProgramPath deliveryProgramPath: maildrop deliveryProgramPath: odeiavir The result is: LDAP Master: dn: cn=ricardo deliveryProgramPath: maildrop deliveryProgramPath: odeiavir LDAP Slave: dn: cn=ricardo deliveryProgramPath: odeiavir deliveryProgramPath: maildrop The slave server keep the old order. Someone knows if this is a replication bug ? Thanks, Ricardo Machini

2 1

How to get the socket to listen for replies from referral connections?
by Ian Puleston 28 Jan '11

28 Jan '11

Hi, Some time back I implemented an OpenLDAP-based LDAP client in a network appliance that uses code based on the tools for LDAP searches etc. I used the tool code because it gave me a nice easy LDIF-based API, but the downside was that each search operation was totally synchronous, so I'm now working on updating it to support asynchronous searches. I have a daemon task that listens for replies from the server after a request is set, and that then calls ldap_result, ldap_parse_result, etc. - basically all the things that ldap_do_search does synchronously. The daemon task, being ouside of OpenLDAP, gets the socket to listen on for each request via ldap_get_option with LDAP_OPT_SOCKBUF. This is working well. The problem is when new connections are opened when a referral/reference is followed. In this case the daemon needs to listen for replies on these too, but there is no way that I can see to get at its socket from outside the OpenLDAP core. LDAP_OPT_SOCKBUF gets the socket for the primary connection and there is no equivalent mechanism to get the sockets for the referral connections. What I've had to do is to add a new LDAP_OPT_REF_SOCKBUFS in my local OpenLDAP code to return a list of the socket buffers for additional connections opened for referrals. I am using an oldish version - 2.3.32 so: - am I missing any alternate way to get these sockets to listen on? - has anything been added in more recent versions that will help with this? - if not would this new option LDAP_OPT_REF_SOCKBUFS be a useful addition? If so I could submit it via the bug reporting. Ian

2 3

Search Filter for Second Value
by Tim Gustafson 28 Jan '11

28 Jan '11

Is there any way to craft a search filter that checks for an attribute with two or more values? For example, how could I construct a query to search for users with two passwords? Something like: userPassword[1]=* (where userPassword[0] would be the user's first password attribute) Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 4

Is the fix for ITS#6540 included in a minor release?
by Khosrow Ebrahimpour 28 Jan '11

28 Jan '11

Hello list, Recently I ran into the olcDbURI bug that was mentioned earlier on this mailing list (http://www.openldap.org/lists/openldap-technical/201011/msg00124.html). It turned out to be part of ITS #6540 and I've found that the issue was resolved and patch was submitted sometime in Nov, 2010. I am currently running ubuntu 10.04 with the following openldap packages : libldap-2.4-2 2.4.21-0ubuntu5.3 slapd 2.4.21-0ubuntu5.3 What I'm wondering is, if there's a minor release that I can install on my servers. I've searched the official Ubuntu repositories and they don't seem to offer an updated package, so I realize that building the package is my only option. Your input is highly appreciated. -- Khosrow

2 1

auto incrementing digit pool
by mike＠grounded.net 28 Jan '11

28 Jan '11

Is there a way of creating an attribute which can be assigned a value which auto increments using an external file. In other words, say I use the employeeNumber attribute but I want the value to be entered by picking the next value from a file. In my file, I might have 000123 000124 000125 000126 000127 Then when I run an ldap connection from my remote application, it would pick the next number if it doesn't exist on any account. The next problem is I don't know how ldap works in terms of keeping track of things. When I sync my application database with ldap, does it, or can it, check all of the users to see if a value is assigned or is that beyond it's functions? Or, would keeping track of the values be something which needs to be done on the application side? The programmers tell me that there is no means of going back to ldap to identify if a user has been assigned a value, therefore, assign the next.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical