openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

back_shell anomaly with distribution example deploy
by Marco Pizzoli 07 Mar '11

07 Mar '11

Hi list, I'm having a problem in using the example back_shell example of OL distribution. I'm using OL 2.4.21 as released in Ubuntu10.04 distribution. This is my database definition: database shell suffix "dc=pippo,dc=it" search /tmp/slapd_search.sh This is the example script found in the OL distribution. Im my test this is /tmp/slapd_search.sh #!/bin/bash # $OpenLDAP: /servers/slapd/back-shell/searchexample.sh,v 1.9.2.6 2011/01/04 23:50:44 kurt Exp $ ## This work is part of OpenLDAP Software <http://www.openldap.org/>. ## ## Copyright 1998-2011 The OpenLDAP Foundation. ## All rights reserved. ## ## Redistribution and use in source and binary forms, with or without ## modification, are permitted only as authorized by the OpenLDAP ## Public License. ## ## A copy of this license is available in the file LICENSE in the ## top-level directory of the distribution or, alternatively, at ## <http://www.OpenLDAP.org/license.html>. # ## Portions Copyright (c) 1995 Regents of the University of Michigan. ## All rights reserved. ## ## Redistribution and use in source and binary forms are permitted ## provided that this notice is preserved and that due credit is given ## to the University of Michigan at Ann Arbor. The name of the University ## may not be used to endorse or promote products derived from this ## software without specific prior written permission. This software ## is provided ``as is'' without express or implied warranty. while [ 1 ]; do read TAG VALUE #echo "TAG: $TAG" >>/tmp/temp1.txt #echo "VALUE: $VALUE" >>/tmp/temp1.txt if [ $? -ne 0 ]; then break fi case "$TAG" in base:) BASE=$VALUE ;; filter:) FILTER=$VALUE ;; # include other parameters here esac done LOGIN=`echo $FILTER | sed -e 's/.*=$.*$)/\1/'` PWLINE=`grep -i "^$LOGIN" /etc/passwd` #sleep 60 # if we found an entry that matches if [ $? = 0 ]; then echo $PWLINE | awk -F: '{ printf("dn: cn=%s,%s\n", $1, base); printf("objectclass: top\n"); printf("objectclass: person\n"); printf("cn: %s\n", $1); printf("cn: %s\n", $5); printf("sn: %s\n", $1); printf("uid: %s\n", $1); }' base="$BASE" echo "" fi # result echo "RESULT" echo "code: 0" exit 0 This is the result. I cannot see my user listed root@LTSP-vanilla:/etc/ldap/slapd.conf.d# ldapsearch -v -x -s sub -b "dc=pippo,dc=it" "(cn=marco)" ldap_initialize( <DEFAULT> ) filter: (cn=marco) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=pippo,dc=it> with scope subtree # filter: (cn=marco) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 By using strace I can see full execution appering. This is the final excerpt of my output: Process 3914 detached [pid 3915] <... read resumed> "", 4096) = 0 [pid 3915] write(1, "dn: cn=marco,dc=pippo,dc=it\nobjectclass: top\nobjectclass: person\ncn: marco\ncn: marco,,,\nsn: marco\nuid: marco\n", 109) = 109 [pid 3915] exit_group(0) = ? Process 3915 detached [pid 3909] <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 3914 [pid 3909] waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 3915 [pid 3909] rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0 [pid 3909] rt_sigaction(SIGINT, {SIG_DFL, [], 0}, {0x8086b90, [], 0}, 8) = 0 [pid 3909] close(4) = -1 EBADF (Bad file descriptor) [pid 3909] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 3909] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 3909] waitpid(-1, 0xbfda677c, WNOHANG) = -1 ECHILD (No child processes) [pid 3909] sigreturn() = ? (mask now []) [pid 3909] write(1, "\n", 1) = 1 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] read(255, "\n# result\necho \"RESULT\"\necho \"code: 0\"\n\nexit 0\n\n", 1835) = 48 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] write(1, "RESULT\n", 7) = 7 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] write(1, "code: 0\n", 8) = 8 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 3909] exit_group(0) = ? Process 3909 detached [pid 3767] <... read resumed> "dn: cn=marco,dc=pippo,dc=it\nobjectclass: top\nobjectclass: person\ncn: marco\ncn: marco,,,\nsn: marco\nuid: marco\n", 4096) = 109 [pid 3767] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 3767] waitpid(-1, NULL, WNOHANG) = 3909 [pid 3767] waitpid(-1, NULL, WNOHANG) = -1 ECHILD (No child processes) [pid 3767] sigreturn() = ? (mask now []) [pid 3767] read(19, "\nRESULT\ncode: 0\n", 4096) = 16 [pid 3767] read(19, "", 4096) = 0 [pid 3767] time(NULL) = 1299531296 [pid 3767] send(4, "<167>*Mar 7 21:54:56 slapd[3765]: shell: fgets failed: Success (0)\n*", 67, MSG_NOSIGNAL) = 67 [pid 3767] write(16, "0\f\2\1\2e\7\n\1\0\4\0\4\0", 14) = 14 [pid 3767] time(NULL) = 1299531296 [pid 3767] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=\n", 94, MSG_NOSIGNAL) = 94 [pid 3767] close(19) = 0 [pid 3767] munmap(0xb777f000, 4096) = 0 [pid 3767] futex(0x212fc060, FUTEX_WAIT_PRIVATE, 32, NULL <unfinished ...> [pid 3766] <... epoll_wait resumed> {{EPOLLIN, {u32=556622232, u64=556622232}}}, 1024, 450000) = 1 [pid 3766] epoll_ctl(7, EPOLL_CTL_MOD, 16, {0, {u32=556622232, u64=556622232}}) = 0 [pid 3766] futex(0x212fc060, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x212fc05c, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1} <unfinished ...> [pid 3789] <... futex resumed> ) = 0 [pid 3789] futex(0x212fc044, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> [pid 3766] <... futex resumed> ) = 1 [pid 3766] futex(0x212fc044, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> [pid 3789] <... futex resumed> ) = 0 [pid 3789] futex(0x212fc044, FUTEX_WAKE_PRIVATE, 1) = 0 [pid 3789] time(NULL) = 1299531296 [pid 3789] read(16, "0\5\2\1\3B\0", 8) = 7 [pid 3789] time(NULL) = 1299531296 [pid 3789] read(16, "", 8) = 0 [pid 3789] write(6, "0", 1) = 1 [pid 3789] time(NULL) = 1299531296 [pid 3789] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 op=2 UNBIND\n", 56, MSG_NOSIGNAL) = 56 [pid 3789] epoll_ctl(7, EPOLL_CTL_DEL, 16, {0, {u32=556622232, u64=556622232}}) = 0 [pid 3789] shutdown(16, 2 /* send and receive */) = 0 [pid 3789] close(16) = 0 [pid 3789] time(NULL) = 1299531296 [pid 3789] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 fd=16 closed\n", 57, MSG_NOSIGNAL) = 57 [pid 3789] futex(0x212fc060, FUTEX_WAIT_PRIVATE, 34, NULL <unfinished ...> [pid 3766] <... futex resumed> ) = 1 [pid 3766] time(NULL) = 1299531296 [pid 3766] epoll_wait(7, {{EPOLLIN, {u32=556622188, u64=556622188}}}, 1024, 1283000) = 1 [pid 3766] read(5, "0", 8192) = 1 [pid 3766] time(NULL) = 1299531296 [pid 3766] epoll_wait(7, <unfinished ...> [pid 3765] <... futex resumed> ) = ? ERESTARTSYS (To be restarted) [pid 3765] futex(0xb7609bd8, FUTEX_WAIT, 3766, NULL^C <unfinished ...> Process 3765 detached Process 3766 detached Process 3767 detached Process 3789 detached As you can see with bold font, I obtain a strange behaviour "fgets failed". But user "marco" exists in /etc/passwd. Someone could tell me what is wrong? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

LDAP browsers and cn=config
by Gervase Markham 07 Mar '11

07 Mar '11

How does one use an LDAP browser to view and change the cn=config config? I am using the OpenLDAP 2.4.23 package from Ubuntu 10.10, and have been using both "luma" and more recently ApacheDS. I have tried an enormous number of ways all afternoon, but feel I'm stumbling in the dark. Do I have to use a special bind DN and password, or should the RootDN and password for my normal data do? If it's special, what is it? Where is it configured? I can view the data using ldapsearch, as root: ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config I've tried adding an olcRootPW and olcRootDN manually to the cn=config LDIF file (/etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif) but when I start slapd up again and do the command-line search it seems to have noticed the password but not the RootDN :-( The magic way of getting at it (-Y EXTERNAL) given above, which works only for root, doesn't translate well into filling in boxes in an LDAP browser config. (I tried running the LDAP browser as root and binding anonymously - I could see all my data, but still not cn=config.) The slapd-config man page has lots of info about what to change, but nothing about how to change it. I've searched the web for hours, and tried to find it in the Admin Guide, but no luck. Any help would be very much appreciated! :-) Gerv

2 1

Re: When login from one application, "error=49" error show up, but other application's login are all right.
by Andrew Findlay 07 Mar '11

07 Mar '11

On Fri, Mar 04, 2011 at 11:01:28AM +0000, mahaoboy(a)gmail.com wrote: > To: openldap-its(a)openldap.org This is not a bug-report at this stage so I am directing replies to openldap-technical(a)openldap.org. > This user can logged in confluence successfully, but when could not log in > fisheye. > Log of confluence logging: > conn=5 op=8052 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8052 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8052 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=8 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=8 op=0 BIND dn="cn=jirasupport,ou=People,ou=eejira,o=nsn" mech=SIMPLE ssf=0 > conn=8 op=0 RESULT tag=97 err=0 text= All OK so far. > Log of fisheye logging: > conn=5 op=8051 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8051 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8051 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=7 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=7 op=0 RESULT tag=97 err=49 text= Error 49 (decimal) is 0x31 (hex) which is LDAP_INVALID_CREDENTIALS so the password does not match. > And other users are all right for logging in all applications. My guess would be that there is something odd about this user's password. Be aware that most existing LDAP client software treats passwords as strings of binary without consideration of character set encoding. This can lead to problems where an account has a password that cannot be represented in 7-bit ASCII. There is nothing that the LDAP server can do about this, as it does not know what character set the application is using. I would suggest changing this account's password to a new one using only printable 7-bit characters. You can maintain good security by making the password longer (but beware that the old Unix-crypt hash scheme only uses the first 8 characters so avoid that if you can: SSHA1 is far better). Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

syncrepl missing entries in openldap 2.4.23
by James_Whiteacre＠McAfee.com 04 Mar '11

04 Mar '11

I am trying to set up syncrepl to have multiple providers to a single consumer. Basically allowing me to combine two ldap's into a single ldap. I know this is probably not a standard configuration but seems like it should work. This seems to work for a while but then all of the records from one of the providers is deleted. And even though the consumer still is polling both providers the records will will not get added back. Here is my consumer syncrepl configuration. The providers are a standard provider configuration. Any help would be appreciated. Jim serverID 064 database bdb suffix "o=dogcatfish" rootdn "cn=admin,o=dogcatfish" limits dn.exact="cn=admin,o=dogcatfish" size=unlimited time=unlimited # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw admin # syncrepl configuration syncrepl rid=64 provider=ldap://provider1 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # syncrepl configuration syncrepl rid=68 provider=ldap://provider2 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # Indices to maintain index contextCSN,entryCSN,entryUUID,objectClass,cn,dc,mail eq checkpoint 1024 5 mirrormode TRUE

2 3

Replication monitoring
by Andreas Andersson 04 Mar '11

04 Mar '11

Hi! I posted an announcement here about a year ago about my little LDAP monitoring project CN=Monitor. Asked for feedback and received a lot. Thank you! Some feedback was related to adding replication verification for OpenLDAP so of course I gave it a try. Unfortunately I don’t have a large scale OpenLDAP environment to verify this functionality on so I need your help :) Is it working and can it be improved? This is how it works: The contextCSN is verified on all servers within the same environment. See attached image. As always… I appreciate all feedback I can get and let me know if you have any suggestions on new features or something else that can approve this monitoring application. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor Best Regards - Andreas

4 11

Combining multiple objectClasses
by Johannes Michael Jordan 04 Mar '11

04 Mar '11

Hello, I am setting up LDAP and I wonder if my sense of laying out my directory is possible to realize. For each of our users, we need (_objectClass_): - _inetOrgPerson_ (obv.) - PAM login, _posixAccount_ - automounter information for her home: _automount_ - samba account for Windows: _sambaSamAccount_ My rationale was that I put all these objectClasses into a single object. This is not possible, as several of them are structural. Next thing I tried is to create a new objectClass that has these as superiors. Also not possible: slapd silently refuses to start, when this is included in my schema file: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP (inetOrgPerson $ sambaSamAccount) STRUCTURAL ) Whereas it starts up fine with: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP inetOrgPerson STRUCTURAL ) What is holding slapd from accepting my schema? Johannes

2 1

Allowing users to add, but not delete, entries?
by Gervase Markham 04 Mar '11

04 Mar '11

Hi, Summary: is it possible to configure access control such that users to can add, but not delete, entries? Details: My planned schema has a branch: ou=tags,dc=example,dc=com The entries below this are like this: objectClass=groupOfNames cn=sometagname member=<user dn 1> member=<user dn 2> member=<user dn 3> ... I have worked out how to make it so users can only add and remove themselves from a tag: access to dn.children="ou=tags,dc=example,dc=com" attrs=member,entry # Allow people to add and remove themselves from any other tag by dnattr=member selfwrite # Allow anyone to read by anonymous read So far so good, but I would like authenticated users to be able to add new entries (tags), and add themselves as members to them, but _not_ to be able to delete tags. Even better, the tag would be deletable, or even automatically removed, but only if the user removed their own name and there were no more members - i.e. it was empty. (I believe the member attribute is mandatory in groupOfNames, and I don't want it to be impossible for someone to remove their name because they are the only member!) This is difficult, because as far as I can see the "write" permission does not distinguish between adding and deleting. Can someone tell me if this is possible? Thanks, Gerv

4 10

openLDAP C++ API
by sim123 04 Mar '11

04 Mar '11

Hi, I am evaluating openLDAP and need to perform ldapsearch from C++ program. I looked at openLDAP C++ API, however README says its an unstable release. So just wanted to understand, is it ok to use that API in production environment? Is anyone using it? If there is any other library for C++ and openLDAP, please point me to that. Would really appreciate any suggestions! Thanks.

2 1

objectclasses as part of schema file
by Aleksandar Stoisavljevic 03 Mar '11

03 Mar '11

Hi all, as a almost newby with openLDAP, I encounter following problem and would like if there is someone to help me to clarify few things. So the state of a problem follows. I have request from a client (e.g. client name as foo) to establish LDAP provider at my office while we are in process of development and once we are ready for acceptance then we will move our software to client machines. Therefore I have a requirement to support user management using IBM Tivoly DS. Since I am not willing to pay for such solution and having in mind that LDAP providers should support common LDAP protocol and last I have a little knowledge how to set-up openLDAP I've decided to go with openLDAP while we are at development. Now since they have some legacy directory structure, I've asked them to export existing data and to give me that file so I can import in LDAP. But as may guessed that would be the easy and often in practice this is not the case. I've noticed that exported LDIF file contain some "custom" objectClasses and was under impression that this was something related to Tivoly DS. But after further investigation I was wondering if it is the case why I can have those objectClasses as well ??? Reading more on this theme, and in a communication with a client (legacy code was done by some external 3rd party company) I've came to conclusion that client has custom schema files. Let's call them foo.schema and foo_v3.schema So two of them and now I thought that all of my problems are gone. My intention was to change slapd.conf file so that these two are now included (include directive in the the top of the slapd.conf file). So I have places these two files in /etc/openldap/schema directory and added these two lines in slapd.conf include /etc/openldap/schema/foo.schema include /etc/openldap/schema/foo_v3.schema As I've learned on my previous project that I have worked with openLDAP, now I have started slaptest command: slaptest -d 4095 -f /etc/openldap/slapd.conf And I've got following error (this is just a example, please be aware that names are different due to NDA): eading config file /etc/openldap/schema/foo_v3.schema line 1 (objectClasses {) /etc/openldap/schema/foo_v3.schema: line 1: unknown directive <objectClasses> inside backend database definition (ignored). And if I post here you the start of this foo_v3.schema the first line really starts with: objectClasses { ( 1.3.18.0.2.6.398 NAME 'os400-root' DESC 'Root node for OS/400 system projection suffix.' SUP top STRUCTURAL MAY os400-sys ) ( 1.3.18.0.2.6.399 NAME 'os400-usrprf' DESC 'Projected OS/400 user profile.' SUP top STRUCTURAL MUST os400-profile MAY userPassword ) ... To be honest, all examples that I have encounter (openLDAP and Apache DS) that was addressing customizing schema NEVER HAD objectClasses, but rather objectClass. And finally my question is, Is this what I am trying to do really feasable, and if it is what is wrong with this foo_v3.schema file and why this is not working ? Thank you for help -- Aleksandar dipl. ing. Stoisavljevic Software Developer mobile: +381 (0) 64 211 50 40 Web: http://www.staleksit.in.rs E-mail:staleks@gmail.com SkypeId: staleks_ns Mail: Branislava Nusica 10, 21000 Novi Sad, Serbia

3 2

Problem unexpected failing slapd
by Ruud Baart 03 Mar '11

03 Mar '11

Problem: For a customer we use LDAP for many years. Last year suddenly the slapd service just stopped without any traces in the logfiles. After a restart of slapd everything works fine again. But the problem was there: it was not an incident, now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server. Environment: - Several (debian squeeze) servers , several windows servers. We use bdb database backend. - There is one master LDAP server which provides syncprov and two replica's LDAP servers (syncrepl). The master server is most intens used (mainly samba as primary domain controller: a few hundred useraccounts, lot of groupaccounts, workstations, acl's, etc.), one of the replica's is not very busy but handles the mail for all users (lookup: amavis, postfix, courier-imap, mailaccount settings etc). The third replica is not busy at all, it is a remote location. - Total LDAP is 3700 dn's, slapcat produces a file of 7,3 Mb. - It is only the master LDAP with stops suddenly. I have never seen a failure of a replica LDAP. Because I have no clear idea about the problem I have no idea which technical details are relevant: DB_CONFIG =========== set_cachesize 0 10485760 1 set_lk_max_objects 10000 set_lk_max_locks 10000 set_lk_max_lockers 10000 set_lg_dir /home/ldap-dbd The database is stored on a ext3 filesystem, kernel 2.6.32. The server has no problems, plenty of memory and a fast diskarray (SAS->SATA). Never technical problems with this server. And it worked without problems for a long period. Nothing has changed to the environment or the LDAP setup (except of course with the upgrade to debian squeeze but the problem was already there). What we have tried: - upgrade from openldap 2..4.17 (debian lenny+backports) to openldap 2.4.23 (debian squeeze). I saw in the release notes that problems related to syncrepl were solved. Therefor we waited for version 2.4.23 te become available in debian. This upgrade made no difference. - reindex, rebuilt the directory. When I rebuilt the LDAP with a clean LDIF file on the master LDAP or an other machine with ldapadd there is not one error or warning. The workaround for the moment: I have written a process monitor (perl daemon) which monitors the slapd daemon and if it suddenly stops, slapd is restarted. It is of course not a solution but the 300 user can work. If slapd stops without a restart within 1 minute a few hundred people can't work because samba stops working. I would like to receive suggestions what we can do to find the problem. Because there is no pattern, nothing in the logfiles I don't know where to start. -- Regards, Ruud Baart

5 12

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical