openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

Can't read attribute except as root
by Richard Connon 20 Dec '10

20 Dec '10

Hi. I'm having some trouble reading certain attributes using non-root DNs on my directory. My olcAccess attributes on the relevant database are these: olcAccess: {0}to attrs=userPassword,shadowLastChange,loginShell,gecos by self write by anonymous auth by * none olcAccess: {1}to * by * read My understanding suggests that the second line should allow any user and even anonymous to read all attributes but I can't read the loginShell attribute as anonymous

2 1

Re: Filesystem & backend options for embedded openldap
by Bruce Edge 20 Dec '10

20 Dec '10

On Sat, Dec 18, 2010 at 12:26 PM, Peter Lambrechtsen <plambrechtsen(a)gmail.com> wrote: > Or perhaps TinyLdap? http://www.fefe.de/tinyldap/ > > Also FreeRadius (if your app's support Radius and LDAP) supports a myriad of > backend databases. > Hmm, very interesting. I was not aware of this project. My concern is that there's been very little activity on the project in recent years. Is there no simple, reliable, backend config for openldap? I'm not concerned with speed, just reliability and data integrity. I'd settle for a 10x performance penalty for data integrity. -Bruce > On Sun, Dec 19, 2010 at 5:59 AM, Bruce Edge <bruce.edge(a)gmail.com> wrote: >> >> On Sat, Dec 18, 2010 at 12:19 AM, Peter Lambrechtsen >> <plambrechtsen(a)gmail.com> wrote: >> > Why don't you use SQLite instead??? It's pretty rock solid backend >> > database. >> > >> > Unless your client side only wants to talk LDAP. >> >> Hi, >> Thanks the the response. One of the reasons for ldap is that it >> handles all the authentication for a lot of the packages we're using >> out of the box so it was a natural progression to extend it to handle >> the other data we need as well. >> The only probems, it appears, is how to make it more failsafe on the back >> end. >> >> -Bruce >> >> > >> > On Sat, Dec 18, 2010 at 6:48 AM, Bruce Edge <bruce.edge(a)gmail.com> >> > wrote: >> >> >> >> Perhaps a bit more detail... >> >> During testing our developers frequently hang the target machines. >> >> This usually results in a corrupted ldap database even though no write >> >> activity was present on the box since long before the crash. >> >> >> >> What ldap config tuning options are required to get slapd to sync the >> >> backend to a state where power loss / kernel crashes do not corrupt >> >> the data? >> >> >> >> Thanks >> >> >> >> -Bruce >> >> >> >> On Wed, Dec 15, 2010 at 10:25 AM, Bruce Edge <bruce.edge(a)gmail.com> >> >> wrote: >> >> > I'm working on an embedded system for which I would like to use >> >> > openldap as the means of config storage. >> >> > I've spent a lot of time RTFM'ing and still feel that there is a lot >> >> > that is escaping me as far as the optimal configuration. >> >> > >> >> > If the primary goal is data safety and zero human intervention, what >> >> > would be the optimal combination of file system / backend storage / >> >> > and config options? >> >> > >> >> > I would like to never have to manually recover a database and have it >> >> > gracefully recover from power failures. Speed is not an issue as it's >> >> > very low traffic. Integritiy is everything. >> >> > It's target storage is a USB flash device. Are there any special >> >> > considerations WRT flash storage and ldap? >> >> > >> >> > Thanks in advance. >> >> > >> >> > -Bruce >> >> > >> > >> > > >

4 7

Constant invalid credentials error (49)
by gael therond 19 Dec '10

19 Dec '10

Dear members, I installing/configuring a new OpenLDAP server with compiled sources today. But unfortunatly I got a serious issue with this server. Here are the specs: OpenLDAP Slapd 2.4.23. Configure Commands: ./configure --prefix=/usr/local/ldap/ --sysconfdir=/etc/ldap/ --enable-ipv6=no --enable-dynacl --enable-cleartext=no --enable-crypt --enable-lmpasswd --enable-rlookups --enable-backends=no --enable-bdb --enable-dnssrv --enable-ldap --with-tls --enable-kerberos "Make" commands have been correctly and without errors tested. But now, if I launch my slapd, and if I want to access it throught a LDAP Browser, for exemple JXplorer, I can't. I've got an Invalid Credentials error = 49 message. Here is link my slapd.conf and ACL file.(Pastebin): slapd.conf: http://pastebin.com/3bfu5exy acl file: http://pastebin.com/wJUjJAT0 If I try to pass the following command to change the password and connect me with the new one but it failed: ldappasswd -x -v -D "cn=manager,dc=lab,dc=geka" -A -S -W Then when it ask me the old password I type "test" without the ", then I confirm it. The following message ask me to a new password, that I type (123123 for informations) and confirm again. Then it ask me for the LDAP Password, and so I test with 123123 without success. Same way if I test with the following command and test as password: ldappasswd -v -D "cn=manager,dc=lab,dc=geka" -W Here is the error message: ldap_bind: Invalid credentials (49) I now my password, 'cause it's simply write on the slapd.conf file, but it seems that the LDAP server refuse any connections.

2 1

LDAP installation
by Stefano Malini 18 Dec '10

18 Dec '10

Dear all, i'm installing OpenLdap 2.4.23 on a virtual box with linux ubuntu 2.4.31-14 in /usr/local/. I first succesfully installed Berkeley DB 4.8.26 always in /usr/local/ My problem is launching ./configure command from OpenLDAP directory. The last lines are: checking db.h usability... no checking db.h presence... no checking for db.h... no configure: error: BDB/HDB: BerkeleyDB not available Could you help me, please? Thank you very much, Stefano

3 5

Re: Filesystem & backend options for embedded openldap
by Bruce Edge 18 Dec '10

18 Dec '10

On Sat, Dec 18, 2010 at 12:19 AM, Peter Lambrechtsen <plambrechtsen(a)gmail.com> wrote: > Why don't you use SQLite instead??? It's pretty rock solid backend database. > > Unless your client side only wants to talk LDAP. Hi, Thanks the the response. One of the reasons for ldap is that it handles all the authentication for a lot of the packages we're using out of the box so it was a natural progression to extend it to handle the other data we need as well. The only probems, it appears, is how to make it more failsafe on the back end. -Bruce > > On Sat, Dec 18, 2010 at 6:48 AM, Bruce Edge <bruce.edge(a)gmail.com> wrote: >> >> Perhaps a bit more detail... >> During testing our developers frequently hang the target machines. >> This usually results in a corrupted ldap database even though no write >> activity was present on the box since long before the crash. >> >> What ldap config tuning options are required to get slapd to sync the >> backend to a state where power loss / kernel crashes do not corrupt >> the data? >> >> Thanks >> >> -Bruce >> >> On Wed, Dec 15, 2010 at 10:25 AM, Bruce Edge <bruce.edge(a)gmail.com> wrote: >> > I'm working on an embedded system for which I would like to use >> > openldap as the means of config storage. >> > I've spent a lot of time RTFM'ing and still feel that there is a lot >> > that is escaping me as far as the optimal configuration. >> > >> > If the primary goal is data safety and zero human intervention, what >> > would be the optimal combination of file system / backend storage / >> > and config options? >> > >> > I would like to never have to manually recover a database and have it >> > gracefully recover from power failures. Speed is not an issue as it's >> > very low traffic. Integritiy is everything. >> > It's target storage is a USB flash device. Are there any special >> > considerations WRT flash storage and ldap? >> > >> > Thanks in advance. >> > >> > -Bruce >> > > >

1 0

Filesystem & backend options for embedded openldap
by Bruce Edge 17 Dec '10

17 Dec '10

I'm working on an embedded system for which I would like to use openldap as the means of config storage. I've spent a lot of time RTFM'ing and still feel that there is a lot that is escaping me as far as the optimal configuration. If the primary goal is data safety and zero human intervention, what would be the optimal combination of file system / backend storage / and config options? I would like to never have to manually recover a database and have it gracefully recover from power failures. Speed is not an issue as it's very low traffic. Integritiy is everything. It's target storage is a USB flash device. Are there any special considerations WRT flash storage and ldap? Thanks in advance. -Bruce

1 1

syncrep and memberof
by Yuri Bank 17 Dec '10

17 Dec '10

Are there any known issues with these two overlays when used together? I'm curious what the suggested configuration would be in a single Provider + many Consumer setup. Should the memberof overlay be enabled on the consumer nodes or just the provider? I've noticed that when I add new users to the database, all users under that OU will be refreshed and at which time I lose the memberof attribute for SOME of the users, on only 1 or 2 of the consumer nodes. It seems like a bug, but I wonder if there is any way to get around this. I was thinking of trying delta-sync replication.

1 0

can't contact the LDAP server
by kibirango moses 17 Dec '10

17 Dec '10

hullo everybody I have tested the SLAPD server and it is giving me the output below root@mailbackup:/etc/openldap# ldapsearch -x -W -D 'cn=Manager,dc=mak,dc=ac,dc=ug' -b "" -s base Enter LDAP Password: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) How can i contact the LDAP server? Thanx

2 1

TLS trace: SSL_accept:error in SSLv2/v3 read client hello A
by Martin Jungowski 17 Dec '10

17 Dec '10

Hi everybody, I'm trying to run OpenLDAP 2.2.13 on a CentOS 4.8 box with TLS/SSL enabled. Certificate should be ok (fqdn set as common name!), self-signed since I can't copy a cacert file to all clients that will one day have to connect to the server (among others a few iPhones). "openssl x509 -in slapd.pem -noout -text" returns the correct contents of the certificate, "openssl s_client -connect localhost:636 -showcerts" works too (although it does hang at the end right after "---" which I guess is normal.. haven't left it running for 300 seconds yet). However, whenever trying to connect to my LDAP server through port 636 I get the above error message. The full message when performing "ldapsearch -x -h localhost:636 -b dc=home" (no difference if I replace localhost with the fqdn): > daemon: activity on 1 descriptors > daemon: new connection on 10 > daemon: added 10r > daemon: activity on: > daemon: select: listen=6 active_threads=0 tvp=NULL > daemon: select: listen=7 active_threads=0 tvp=NULL > daemon: activity on 1 descriptors > daemon: activity on: 10r > daemon: read activity on 10 > connection_get(10): got connid=7 > connection_read(10): checking for input on id=7 > TLS trace: SSL_accept:before/accept initialization > TLS trace: SSL_accept:error in SSLv2/v3 read client hello A > TLS: can't accept. > TLS: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol s23_srvr.c:580 > connection_read(10): TLS accept error error=-1 id=7, closing > connection_closing: readying conn=7 sd=10 for close > connection_close: conn=7 sd=10 > daemon: removing 10 > daemon: select: listen=6 active_threads=0 tvp=NULL > daemon: select: listen=7 active_threads=0 tvp=NULL > daemon: activity on 1 descriptors > daemon: select: listen=6 active_threads=0 tvp=NULL > daemon: select: listen=7 active_threads=0 tvp=NULL Same error message when trying to connect with jxplorer or Thunderbird. Any ideas what else I could try? I've tried various ways of creating a certificate, including both the CentOS recommended "make slapd.pem" in / usr/share/ssl/certs and the "openssl" way but neither made any difference. They all resulted in the exact same error pattern. Frankly, I'm out of ideas. Thanks in advance, Martin -- Rieke Computersysteme GmbH Hellerholz 5 D-82061 Neuried Email: martin[at]rhm[dot]de

2 1

using of db_stat
by Steeg Carson 16 Dec '10

16 Dec '10

Hello, can I really use db_stat with id2entry.bdb and dn2id.bdb without concern and impact of production (speed of ldap) to investigate the database statistic? - Is db_stat usable on a online database without any danger - If I use db_stat online, which impact I have to expect? Thanks for help!

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical