openldap-technical

openldap-technical@openldap.org

9897 discussions

distribution list in openldap
by Ben Kim 13 Jan '11

13 Jan '11

Hi, I'm trying to create a distribution list for outlook 2007, using openldap. Outlook reads ldap contacts quite OK, but I can't make a mailing group. Does anyone know of a good tutorial? I did some googling, but most of the related questions seem unanswered. I looked at http://www.openldap.org/faq/data/cache/1317.html MS Outlook: How To Make Distribution Lists. If you have followed the tutorial already, I would need some detailed steps, since I'm not an ldap expert. Thanks. -- Ben Kim Lead Database Administrator College of Education Texas A&M University http://benix.tamu.edu

2 2

Help reading db_printlog
by Peter Palmreuther 13 Jan '11

13 Jan '11

Hello, I had soem problems with a MirrorMode set up OpenLDAP cluster (version 2.4.20) and after some replication trouble I lost some data. I could restore it by using "db_restore" on the data directory (it's a 'hdb' backend). Now I'm trying to get as much information as possible about when exactly, and as far as possible why, the data got lost / was deleted. Unluckily I don't get far with reading the output of "db_printlog". I found " http://download.oracle.com/docs/cd/E17076_02/html/installation/debug_printl…" but this does not really help in getting the meaning of all the output. Is there any more help / documentation / whatever available to "dissect" the output and get an idea about what happend (and when, if possible)? Thanks in advance, -- Peter

1 0

Hello, how
by Alexey Shalin 13 Jan '11

13 Jan '11

Good afternoon, Tell me how to exclude the user's "search" from thesecurity policies The user is located in the ou =users Ou=policy also located in ou=users The reason that I need to exclude the user, is that when I set the pwdMaxAge and pwdGraceAuthNLimit. I can not log into the application at any login. In the openldap logs have a message bdb_dn2entry("uid=search,ou=users,ou=db") bdb_entry_get: rc=0 ppolicy_bind: Entry uid=search,ou=users,ou=db has an expired password: -39 grace logins send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 52 bytes to sd 13 tls_write: want=73, written=73 0000: 17 03 01 00 44 c3 ec 7b f6 fb 12 85 2d 87 57 6c ....D..{....-.Wl 0010: 6c 8c 36 ec 6f d3 39 1d 91 4b 1a db 53 d6 99 0e l.6.o.9..K..S... 0020: e8 94 85 93 b0 9a 3e 38 18 ab 00 fc 0f 3f d6 b4 ......>8.....?.. 0030: 39 a8 2d 8f 84 7f 46 09 90 cf 1d d2 28 a3 6e eb 9.-...F.....(.n. 0040: e8 ac f0 ad 66 44 7b 4f 47 ....fD{OG ldap_write: want=52, written=52 0000: 30 32 02 01 01 61 07 0a 01 31 04 00 04 00 a0 24 02...a...1.....$ 0010: 30 22 04 19 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0"..1.3.6.1.4.1. 0020: 34 32 2e 32 2e 32 37 2e 38 2e 35 2e 31 04 05 30 42.2.27.8.5.1..0 0030: 03 81 01 00 .... conn=1 op=0 RESULT tag=97 err=49 text= If I set pwdGraceAuthNLimit to 100. I'm able to login into the application. I can not change password for user "search" :-( Thank you ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: a.shalin(a)ipc.kg

1 0

Evolution Contacts Schema
by Peter L. Berghold 13 Jan '11

13 Jan '11

Hi folks, I've been running in circles trying to locate something and I've had Epic Fail. Quick background: I've been setting up a new email/calendering system for my family. My wife and I both run our own small businesses and just keeping our schedules in sync is nuts. The "nice to have" my wife asked for was being able to have one central email contacts place to work with. This is where Evolution comes in. Unfortunately Evolution seems to do contacts differently than say Thunderbird and I need a "special schema" to get it to work. I've done a Google looking for the schema files and found lots of dead links and schema files that don't seem to play well. Anyone know of a more reliable source? Thanks in advance... -- Peter L. Berghold <peter(a)berghold.net>

3 4

Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, OpenLDAP version: 2.3.43-12 (CentOS 5.5), 64-bit. In order to enable ppolicy overlay, I am trying to create the relevant entries, as specified in http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies I import two LDIFs, first: dn: ou=Policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Policies and second dn: cn=default,ou=Policies,dc=example,dc=com cn: default objectClass: top objectClass: pwdPolicy objectClass: person pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 2 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value The first loads OK. When I try to import the second, I receive this diagnostics: Could not add object cn=default,ou=Policies,dc=itelsib,dc=com Message: Invalid syntax Error code: 0x15 (LDAP_INVALID_SYNTAX) Error description: An invalid attribute value was specified. Could someone suggest what's wrong with the attribute name? the ppolicy.schema is specified in /etc/slapd.conf. Thanks. Sincerely, Konstantin

6 15

LDAP and PAM: account is expired, but pam_ldap allows authentification
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is still allowed to login. How pam_ldap should be instructed to take the expiration attributes ito account? Thanks. Sincerely, Konstantin

4 7

unique overlay
by Christian Bösch 12 Jan '11

12 Jan '11

hi, i want to use unique overlay with the following config: objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {6}unique olcUniqueURI: ldap:///ou=People,dc=abc,dc=net?mailLocalAddress,mail,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=abc,dc=net?gid?one the attribute uniqueness for the people tree's uri works, but not the one for the group tree. i found out the when i do an ldapsearch for a group and filter for gid=xy i get an empty result ldapsearch -Y EXTERNAL -b 'ou=Groups,dc=abc,dc=net' 'gid=32011' the log file says: conn=18817 op=1 SRCH base="ou=Groups,dc=abc,dc=net" scope=2 deref=0 filter="(?gid=32011)" why is the filter ?gid=32011 could this be the problem? thanks for any hint. /chris

2 2

Re: using of shared memory with slapadd
by tim stone 11 Jan '11

11 Jan '11

> Run slapadd as the same user that slapd runs as. This is no different than > running slapadd without shared memory segments, where you will have the same > issue with the created BDB caching files (i.e., same results whether it is > in memory or on disk). > Thanks, yes you are right. This issue I've never seen on my server, because SuSE automatically makes automaticly (via start script) a chown in the different backend database directorys ... Thanks Steeg

1 0

using of shared memory with slapadd
by Steeg Carson 11 Jan '11

11 Jan '11

Hello, I use shm_key in my database definition and its working fine. But after using slappadd (stopped slapd), the process use the same shm_key like the slapd (read from slapd.conf) After the slapadd is finished, the shared memory remains reserved in RAM with owner root. (ipcs -m) So after slapadd, I cant start slapd, I have to delete these shared memory with ipcrm. Is there a possibility, that the slapadd deletes the shared memory before ending or is there a reason that it remain? Thanks Steeg

2 1

dynlist overlay searching in a different server
by Angel L. Mateo 11 Jan '11

11 Jan '11

Hello, I have two different LDAP servers containing different information about my users. In one of them, I'm trying to configure dynlist overlay to dinamically add attributes for users, so I have configured dynlist. I'm using the labeledURI attribute with a value like this: labeledURI: ldap://<the_other_server>:389/dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>) Whenever I look for a user I get the error: Jan 10 13:07:07 canis12 slapd[12689]: dynlist_prepare_entry("<userDN>"): illegal URI "ldap://<the_other_server>:389/dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>)" If I remove the server part of the URI, like: labeledURI: ldap:///dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>) but, obviously, I'm not getting the additional attributes (because this LDAP directory doesn't have them). What am I doing wrong? Could I use a LDAP URI directed to another LDAP server? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical