openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

joomla ldap; joomla users not created
by mike＠grounded.net 14 Jan '11

14 Jan '11

Joomla 1.5, fully updated. php does have ldap installed and working Openldap 2.3.43-12.el5_5.3 running on fully updated centos server dedicated to this. On the openldap server, I have; Server Local LDAP Server timeout (Schema | search | refresh | info | import | export | logout ) Logged in as: cn=admin,dc=mydomain,dc=com - img dc=mydomain,dc=com (2) - img cn=admin new Create new entry here - img ou=users (2) + img uid=bob + img uid=bobby new Create new entry here new Create new entry here I have Distinguished Name: ou=users,dc=mydomain,dc=com I followed docs which showed me how to create add and use a joomla.schema. The above is where joomla users are supposed to be being created. What I suspect is that joomla isn't talking to the proper joomla.schema on the ldap server which is preventing the user from being created. But since I'm new to ldap, I've not been able to figure out how to diagnose this and fix the problem. I've been struggling with this for weeks and would very much welcome some help. Thanks.

1 0

Substrings in attributes - changing schemas
by Nick Milas 14 Jan '11

14 Jan '11

Hi, I store my DNS records in openldap (I use powerdns with ldap backend) and I am trying to use a search filter like: (aRecord=10.11.12.*) but it never produces results. I noticed that aRecord is defined in dnsDomain schema (available in cosine.schema) and inherited in dnsDomain2 schema (which is used by powerdns, available here: http://www.linuxnetworks.de/pdnsldap/dnsdomain2.schema). I came to the conclusion that the problem may be caused by the fact that aRecord (oid: 0.9.2342.19200300.100.1.26) in cosine.schema has no substring matching rule defined in schema: attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) I thought of modifying it in order to allow substring matching, like: attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) Questions: 1. Is the above logic correct, i.e. has the cause of the problem been identified correctly? 2. Is there any other way we can search substrings of values in this (or other similar) attribute(s) without modifying the schema(s)? 3. Can an LDAP administrator freely modify an organisation's schema(s) whenever it is deemed appropriate? Are there any risks by doing it? (I understand one should be cautious when upgrading openldap, and take care to "cascade" modifications to the upgraded version.) - AND/OR - Is there any process of "schema evolution" where LDAP server users provide feedback so that standard schema(s) are globally adapted to user request(s)? In the end: What is the easiest recommended way of using customized schema(s) in an organization? Please advise. Thanks in advance, Nick

3 7

distribution list in openldap
by Ben Kim 13 Jan '11

13 Jan '11

Hi, I'm trying to create a distribution list for outlook 2007, using openldap. Outlook reads ldap contacts quite OK, but I can't make a mailing group. Does anyone know of a good tutorial? I did some googling, but most of the related questions seem unanswered. I looked at http://www.openldap.org/faq/data/cache/1317.html MS Outlook: How To Make Distribution Lists. If you have followed the tutorial already, I would need some detailed steps, since I'm not an ldap expert. Thanks. -- Ben Kim Lead Database Administrator College of Education Texas A&M University http://benix.tamu.edu

2 2

Help reading db_printlog
by Peter Palmreuther 13 Jan '11

13 Jan '11

Hello, I had soem problems with a MirrorMode set up OpenLDAP cluster (version 2.4.20) and after some replication trouble I lost some data. I could restore it by using "db_restore" on the data directory (it's a 'hdb' backend). Now I'm trying to get as much information as possible about when exactly, and as far as possible why, the data got lost / was deleted. Unluckily I don't get far with reading the output of "db_printlog". I found " http://download.oracle.com/docs/cd/E17076_02/html/installation/debug_printl…" but this does not really help in getting the meaning of all the output. Is there any more help / documentation / whatever available to "dissect" the output and get an idea about what happend (and when, if possible)? Thanks in advance, -- Peter

1 0

Hello, how
by Alexey Shalin 13 Jan '11

13 Jan '11

Good afternoon, Tell me how to exclude the user's "search" from thesecurity policies The user is located in the ou =users Ou=policy also located in ou=users The reason that I need to exclude the user, is that when I set the pwdMaxAge and pwdGraceAuthNLimit. I can not log into the application at any login. In the openldap logs have a message bdb_dn2entry("uid=search,ou=users,ou=db") bdb_entry_get: rc=0 ppolicy_bind: Entry uid=search,ou=users,ou=db has an expired password: -39 grace logins send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 52 bytes to sd 13 tls_write: want=73, written=73 0000: 17 03 01 00 44 c3 ec 7b f6 fb 12 85 2d 87 57 6c ....D..{....-.Wl 0010: 6c 8c 36 ec 6f d3 39 1d 91 4b 1a db 53 d6 99 0e l.6.o.9..K..S... 0020: e8 94 85 93 b0 9a 3e 38 18 ab 00 fc 0f 3f d6 b4 ......>8.....?.. 0030: 39 a8 2d 8f 84 7f 46 09 90 cf 1d d2 28 a3 6e eb 9.-...F.....(.n. 0040: e8 ac f0 ad 66 44 7b 4f 47 ....fD{OG ldap_write: want=52, written=52 0000: 30 32 02 01 01 61 07 0a 01 31 04 00 04 00 a0 24 02...a...1.....$ 0010: 30 22 04 19 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0"..1.3.6.1.4.1. 0020: 34 32 2e 32 2e 32 37 2e 38 2e 35 2e 31 04 05 30 42.2.27.8.5.1..0 0030: 03 81 01 00 .... conn=1 op=0 RESULT tag=97 err=49 text= If I set pwdGraceAuthNLimit to 100. I'm able to login into the application. I can not change password for user "search" :-( Thank you ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: a.shalin(a)ipc.kg

1 0

Evolution Contacts Schema
by Peter L. Berghold 13 Jan '11

13 Jan '11

Hi folks, I've been running in circles trying to locate something and I've had Epic Fail. Quick background: I've been setting up a new email/calendering system for my family. My wife and I both run our own small businesses and just keeping our schedules in sync is nuts. The "nice to have" my wife asked for was being able to have one central email contacts place to work with. This is where Evolution comes in. Unfortunately Evolution seems to do contacts differently than say Thunderbird and I need a "special schema" to get it to work. I've done a Google looking for the schema files and found lots of dead links and schema files that don't seem to play well. Anyone know of a more reliable source? Thanks in advance... -- Peter L. Berghold <peter(a)berghold.net>

3 4

Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, OpenLDAP version: 2.3.43-12 (CentOS 5.5), 64-bit. In order to enable ppolicy overlay, I am trying to create the relevant entries, as specified in http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies I import two LDIFs, first: dn: ou=Policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Policies and second dn: cn=default,ou=Policies,dc=example,dc=com cn: default objectClass: top objectClass: pwdPolicy objectClass: person pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 2 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value The first loads OK. When I try to import the second, I receive this diagnostics: Could not add object cn=default,ou=Policies,dc=itelsib,dc=com Message: Invalid syntax Error code: 0x15 (LDAP_INVALID_SYNTAX) Error description: An invalid attribute value was specified. Could someone suggest what's wrong with the attribute name? the ppolicy.schema is specified in /etc/slapd.conf. Thanks. Sincerely, Konstantin

6 15

LDAP and PAM: account is expired, but pam_ldap allows authentification
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is still allowed to login. How pam_ldap should be instructed to take the expiration attributes ito account? Thanks. Sincerely, Konstantin

4 7

unique overlay
by Christian Bösch 12 Jan '11

12 Jan '11

hi, i want to use unique overlay with the following config: objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {6}unique olcUniqueURI: ldap:///ou=People,dc=abc,dc=net?mailLocalAddress,mail,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=abc,dc=net?gid?one the attribute uniqueness for the people tree's uri works, but not the one for the group tree. i found out the when i do an ldapsearch for a group and filter for gid=xy i get an empty result ldapsearch -Y EXTERNAL -b 'ou=Groups,dc=abc,dc=net' 'gid=32011' the log file says: conn=18817 op=1 SRCH base="ou=Groups,dc=abc,dc=net" scope=2 deref=0 filter="(?gid=32011)" why is the filter ?gid=32011 could this be the problem? thanks for any hint. /chris

2 2

Re: using of shared memory with slapadd
by tim stone 11 Jan '11

11 Jan '11

> Run slapadd as the same user that slapd runs as. This is no different than > running slapadd without shared memory segments, where you will have the same > issue with the created BDB caching files (i.e., same results whether it is > in memory or on disk). > Thanks, yes you are right. This issue I've never seen on my server, because SuSE automatically makes automaticly (via start script) a chown in the different backend database directorys ... Thanks Steeg

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical