openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

autonumbering
by Molenda, Mark 01 Feb '11

01 Feb '11

I know you can create a sequence for auto numbering in records, I was wondering if this is still the preferred method? What is the best way?

1 0

User managed groups - ACLs
by Christian Manal 01 Feb '11

01 Feb '11

Hi list, I am currently trying to make it possible for ordinary users to manage their own groups in the following way: 1 Any user can create new groups ("groupOfNames"). 1.1 On creation, the creator is set to be the first member and manager of the group (the latter is defined as a single-value attribute (UDBgrpAdmin) for a self defined auxiliary objectClass "UDBgrp"). 1.2 Some names should be prohibited from being used for new groups. 2 Group managers can invite any user to the group by adding their DN to the invited list of the group (UDBgrpInvited) and revoke invitations by removing DNs from said list. 2.1 Group managers can kick members from the group. 2.2 Group managers can delete the group. 2.3 Group managers can assign a new manager who has to be a member of the group. 2.4 Group managers can (re)set a description for the group. 3 Invited users can accept or decline the invitation, i.e. remove themselves from the invite list and add themselves to the member list. 4 Group members can leave the group permanently or temporarily. The latter is achieved by moving themselves from the member list to a suspended list (UDBgrpSuspended) which allows them to rejoin the group later (i.e. move themselves back to the member list) without a new invitation. I have most of the above covered, but I'm struggling with the points 1.1, 2.3 and to some extend 1.2. 1.1 and 2.3: I have no idea if this is even possible, let alone how to achieve it. 1.2: By extending the 'filter' rule that limits the objectClasses for new entries in "ou=Group" I can make a blacklist for 'cn' values, but I'd rather have something in the DIT itself, so I can modify the list without meddling with the server config. This is optional, though, since I don't except the list to change very often. This is what I've got so far: <http://openldap.pastebin.com/n8P4eKvU> Any help would be appreciated. Regards, Christian Manal

1 1

meta directory backend and rewriting option '|'
by Lehnert, Hartmut 01 Feb '11

01 Feb '11

Hello! I have a question concerning the pipe option '|' when using the meta directory backend and rewriting. In the manual pages the '|' option is marked as "not implemented". Does this reflect the actual state of the software or has somebody just forgotten to update the man page? Regards, Hartmut

2 2

Access control
by Thomas Schweikle 31 Jan '11

31 Jan '11

Hi! I am trying to set up access control for an OpenLDAP server. I'd like to use a Group to set up users allowed to access and write to entries inside my tree: I've created the group: dn: cn=administrators,dc=example,dc=com cn: administrators objectclass: groupOfNames (important for the group acl feature) member: cn=user1,ou=Users,dc=example,dc=com member: cn=user2,ou=Users,dc=example,dc=com in dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcRootDN: cn=adm,dc=example,dc=com olcRootPW: ${admpw} olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by * read Now trying to access "userPassword" from any user inside the tree "ou=Users,dc=example,dc=com". 1. The password field is empty -- it should hold a value 2. Entering a value, then pressing apply: "Error modifying 'cn=user3,ou=Users,dc=xompu,dc=de': Insufficient access I'd expected to have access to "userPassword" and I am allowed to write this value. Why does it not work if I log in with user1? -- Thomas

3 5

cn=config how to grant read rights
by John Espiro 31 Jan '11

31 Jan '11

I am new to the whole cn=config thing... Having just started with it, I have a question. I have an existing user for which I need to give read rights to the tree: "This user must have the Read right to the LDAP service.". How do I go about modifying the ACL so that he has this? John

1 0

Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by Christopher Cprek 31 Jan '11

31 Jan '11

Hello, I'm attempting to configure a slapd server in a very simple transparent proxy configuration. I'm having a problem where clients for this proxy have a (objectClass=user) filter defined. This filter is being replaced with (!(objectClass=*)) when the searchRequest is relayed to the backend LDAP server. I believe this is something missing in the schema, though I'm very new to LDAP. I've already included an AD schema in my slapd.conf to resolve some AD specific filters I had trouble with. I've attempted to uncomment and modify the core.schema's definition of attributetype NAME objectClass, and commented out what I suspected was the conflicting duplicate attributeType NAME supportedApplicationContext. But I can't get slapd to start. I keep getting a duplicate attribute type error in the config. hdb_back_initialize: Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) /etc/openldap/schema/core.schema: line 66: Duplicate attributeType: "2.5.4.0" slapd-ldap destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. I would appreciate any guidance to help resolve my problem. All I want is the filter (objectClass=user) to be relayed correctly from the slapd service to the LDAP proxy backend. Thanks in advance! /Chris

3 6

Authentication for on the fly configuration updates in OpenLDAP 2.4
by Razvan Deaconescu 30 Jan '11

30 Jan '11

Hi! I've browsed the configuration page for slapd[1] and it mentions that, for starting from version 2.3, "The LDAP configuration engine allows all of slapd's configuration options to be changed on the fly, generally without requiring a server restart for the changes to take effect." What is the user and password required to update the LDAP configuration database? I'm using slapd 2.4.23-7 on a Debian Squeeze (testing). I've tried using the admin user (cn=admin,dc=...,dc=...) and it fails. This link[2] mentions using the cn=admin,dc=config account and a password found in ldap.secret. I've not found that file and don't know what is the password for the cn=admin,dc=config account. Thanks, Razvan

6 11

syncrepl don't preserve the order of the value on multivalued attribute
by Ricardo Machini 30 Jan '11

30 Jan '11

Hi, I changed recently from sluprd to syncrepl. And I saw that the syncrepl do not preserve the order of the value on multivalued attribute (I dont know if it is a bug) . Example: Entry on LDAP master/slave: dn: cn=ricardo deliveryProgramPath: odeiavir deliveryProgramPath: maildrop When I do this modify on master: dn: cn=ricardo changetype:modify replace: deliveryProgramPath deliveryProgramPath: maildrop deliveryProgramPath: odeiavir The result is: LDAP Master: dn: cn=ricardo deliveryProgramPath: maildrop deliveryProgramPath: odeiavir LDAP Slave: dn: cn=ricardo deliveryProgramPath: odeiavir deliveryProgramPath: maildrop The slave server keep the old order. Someone knows if this is a replication bug ? Thanks, Ricardo Machini

2 1

How to get the socket to listen for replies from referral connections?
by Ian Puleston 28 Jan '11

28 Jan '11

Hi, Some time back I implemented an OpenLDAP-based LDAP client in a network appliance that uses code based on the tools for LDAP searches etc. I used the tool code because it gave me a nice easy LDIF-based API, but the downside was that each search operation was totally synchronous, so I'm now working on updating it to support asynchronous searches. I have a daemon task that listens for replies from the server after a request is set, and that then calls ldap_result, ldap_parse_result, etc. - basically all the things that ldap_do_search does synchronously. The daemon task, being ouside of OpenLDAP, gets the socket to listen on for each request via ldap_get_option with LDAP_OPT_SOCKBUF. This is working well. The problem is when new connections are opened when a referral/reference is followed. In this case the daemon needs to listen for replies on these too, but there is no way that I can see to get at its socket from outside the OpenLDAP core. LDAP_OPT_SOCKBUF gets the socket for the primary connection and there is no equivalent mechanism to get the sockets for the referral connections. What I've had to do is to add a new LDAP_OPT_REF_SOCKBUFS in my local OpenLDAP code to return a list of the socket buffers for additional connections opened for referrals. I am using an oldish version - 2.3.32 so: - am I missing any alternate way to get these sockets to listen on? - has anything been added in more recent versions that will help with this? - if not would this new option LDAP_OPT_REF_SOCKBUFS be a useful addition? If so I could submit it via the bug reporting. Ian

2 3

Search Filter for Second Value
by Tim Gustafson 28 Jan '11

28 Jan '11

Is there any way to craft a search filter that checks for an attribute with two or more values? For example, how could I construct a query to search for users with two passwords? Something like: userPassword[1]=* (where userPassword[0] would be the user's first password attribute) Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical