openldap-technical

openldap-technical@openldap.org

18 participants
9897 discussions

New Attributes, ACL, and Indices
by Andy Carlson 15 Dec '10

15 Dec '10

I have recently added a few new attributes to an existing object class (this was a custom object class, not an out-of-the-box one). I also created a few olcAccess (ACL) entries to enable access to these new attributes and olcDbIndex entries to index the values of the attributes. I added all of these using the cn=config directory structure containers. It is my understanding that unless I modify schema/ldif files on the server that these changes will be lost upon server/service restart. I have the idea that these are the correct folder, but since I've never done this before I'm seeking confirmation/direction. The ACLs and Indices appear to be located in the /opt/<Server-Instance>/common/setup folder. In this folder there is an olcAccess.bdb.ldif file (which appears to hold the ACLs). There's also an LDIF file for the frontend and monitor container located within cn=config. The attributes appear to be located in the /opt/<Server-Instance>1/etc/openldap/schema.mbi folder (mbi is an identifier for our organization). In this folder there is a file named mbiUser.schema (mbiUser is the custom object class). I suspect that this is where the attributes would be stored. Again, this is a non-exhaustive listing of a few things that caught my eye. Let me know if you have any thoughts or suggestions. Thanks much, Andy Carlson Identity Administrator | Information Systems Moody Bible Institute 820 N. LaSalle Blvd., Chicago, IL 60610 312-329-4385 www.moodyministries.net<http://www.moodyministries.net> >From the Word. To Life.

1 0

PAM Filtering Not working with CRYPT Passwds
by Anton Chu 15 Dec '10

15 Dec '10

I have installed the ldapns.schema in my ubuntu 10.04 ldap server to enable host based authentication/filtering. I have some ubuntu 10.10 ldap clients that requires filtering. All my ldap users have passwords in crypt format that I have converted to an ldif file using the PADL migration.pl scripts. After importing them into my ldap server, the pam filtering wasn't working; however, when I changed the passwords from crypt to clear or md5 or sha1, filtering worked fine. The question is how can I get filtering to work with {CRYPT} password hashing? cat /etc/ldap.conf | grep -v ^# | grep -v ^$ > base dc=web,dc=net > uri ldap://10.112.18.2 > ldap_version 3 > rootbinddn cn=admin,dc=web,dc=net > bind_policy soft > pam_filter |(host=webdev120)(host=\*) > nss_initgroups_ignoreusers > backup,bin,daemon,games,gnats,irc,libuuid,list,lp,mail,man,news,proxy,root,sshd,sync,sys,syslog,uucp,www-data > > cat common-auth | grep -v ^# | grep -v ^$ > auth [success=2 default=ignore] pam_unix.so nullok_secure > auth [success=1 default=ignore] pam_ldap.so use_first_pass > auth requisite pam_deny.so > auth required pam_permit.so > cat common-account | grep -v ^# | grep -v ^$ > account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so > account [success=1 default=ignore] pam_ldap.so > account requisite pam_deny.so > account required pam_permit.so > cat common-password | grep -v ^# | grep -v ^$ > password [success=2 default=ignore] pam_unix.so obscure sha512 > password [success=1 user_unknown=ignore default=die] pam_ldap.so > use_authtok try_first_pass > password requisite pam_deny.so > password required pam_permit.so >

1 0

How Indexes work?
by Steeg Carson 15 Dec '10

15 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entires form id2enty.bdb If I use Indexes, are all other entires are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

1 0

Debugging syncrepl
by Angel L. Mateo 15 Dec '10

15 Dec '10

Hello, I've configured 2 ldap servers (2.4.21, from ubuntu 10.04 package) in a master-master configuration. The configuration I have is: {0}rid=004 provider=ldap://ldap1.mydomain.com binddn="<replicauser>" bindmethod=simple credentials=<replicapass> searchbase="<dc=mydomain>" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout=1 {1}rid=005 provider=ldap://ldap2.mydomain.com binddn="<relicauser>" bindmethod=simple credentials=<replicapass> searchbase="<dc=mydomain>" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout=1 I have an oclAccess like: {3}to dn.subtree=<dc=mydomain> by group.exact=<admingroup> manage ... by * none break Replica user belongs to group <admingroup>, so it has complete access to the directory. I have also a limit like: {1}group=<admingroup> time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited so it has no limits. The problem is that I'm loading the directory with a lot of entries (about 109000). After all the load process (I've done it in ldap2, with ldapadd commands) I have all the entries in ldap2, but I have a few less in ldap1 (about 107000). How could I debug the problem? I have tried later to remove from ldap2 an entry that it isn't at ldap1, and then add it again and the replication is done, so I don't know why it hasn't been replicated the first time. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

Syncrepl attrs selection
by Raphael Ordinas 15 Dec '10

15 Dec '10

Hi everyone, I'm facing a minor problem with syncrepl. I'd like to tell syncrepl to sync all attributs but the one specified. Is this possible ? Thanks Raphael

2 2

Using dynlist overlay like dynlist and dyngroup (extend dyngroup schema?)
by c0re 15 Dec '10

15 Dec '10

Hello openldap users! slapd.conf: overlay dynlist dynlist-attrset groupOfUrls labeledURI member ldif: dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local dn: cn=testgroup,ou=servers,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: testgroup labeledURI: ldap:///ou=users,dc=domain,dc=local??one?(objectClass=inetOrgPerson) dn: cn=maingroup,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) With this configuration when ldapsearching for contents of "cn=testgroup,ou=servers,dc=domain,dc=local" I got "member: cn=testgroup,ou=servers,dc=domain,dc=local". Cool! It's working. Then I want to have dynlist that contains members of group of dyngroups. And here I stuck. In slapd.conf I can say that some objectClass can be dyngroup or dynlist, but not together. That's right. Then I though that I can extend dyngroup.schema and add groupOfUrls2, then add "dynlist-attrset groupOfUrls2 labeledURI" to slapd.conf and groupOfUrls2 will behave like dynlist, and groupOfUrls will still be dyngroup. That's would be very good for me! I looked in dyngroup.schema and copy groupOfUrls definition to groupOfUrls2. objectClass ( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs2' SUP top STRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $ owner $ seeAlso ) ) But there was error: /usr/local/etc/openldap/schema/dyngroup.schema: line 89 objectClass: Inconsistent duplicate objectClass: "2.16.840.1.113730.3.2.33" /usr/local/etc/openldap/slapd.conf: line 11: <include> handler exited with 1! slapd destroy: freeing system resources. slapd stopped. So... I changed 33 to 34 in chema. Error gone, slapd started. I added to ldap: dn: cn=maingroup2,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs2 cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) and my slapd.conf not looking like this: overlay dynlist dynlist-attrset groupOfUrls labeledURI member dynlist-attrset groupOfUrls2 labeledURI So groupOfUrls must be dyngroup, and groupOfUrls2 must be dynlist. And now when I ldapsearch for member attr in maingroup2 I wanted to get all members of groups that are under ou=servers,dc=domain,dc=local, but I got no members... Logic was - testgroup (and others groupOfURLs) work as dyngroup and generate member attr in it depending on specified labeledURI. Then maingroup2 (and others) will ldapsearch in ou=servers and make member: attr depending on member attr of groups in ou=servers (and some filters, that I will use later). But maingroup2 not working... It not generate member: attr in it. I think I was wrong changing 33 to 34, because I need some more thing to do, but I do not know what I should do. Can anoyone suggest what to do?

1 0

ldap personal addressbook
by Umarzuki Mochlis 14 Dec '10

14 Dec '10

i already setup squirrelmail and roundcubemail to read ldap global addressbook on RHEL 5 but how can i make both be able to: 1. store personal addressbook in openldap 2. import addressbooks from squirrelmail database into openldap so both webmail can view the same addressbook any hints and links are welcomed. -- Regards, Umarzuki Mochlis http://debmal.my

1 0

Re: backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi, Here are the location of some files related to db-4.6.21 installed in my box. sioux@lion$ pkg_info -L db-4.6.21 | grep include /usr/local/include/db4/db.h /usr/local/include/db4/db_185.h /usr/local/include/db4/db_cxx.h sioux@lion$ pkg_info -L db-4.6.21 | grep lib /usr/local/lib/db4/libdb.a /usr/local/lib/db4/libdb.la /usr/local/lib/db4/libdb_cxx.a /usr/local/lib/db4/libdb_cxx.la /usr/local/share/doc/db4/ref/build_unix/shlib.html /usr/local/share/doc/db4/ref/refs/libtp_usenix.ps /usr/local/lib/db4/libdb.so.5.0 /usr/local/lib/db4/libdb_cxx.so.6.0 /usr/local/lib/libdb.so.5.0 /usr/local/lib/libdb_cxx.so.6.0 sioux@lion$ I setted CPPFLAGS as the following (and it worked when i ran ./configure): sioux@lion$ export CPPFLAGS="-I/usr/local/include/db4" But for LDFLAGS, how should i set it? On Tue, Dec 14, 2010 at 4:25 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 14, 2010 5:51 AM -0200 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Ok! >> >> I looked at /usr/include/db.h. How could i solve this problem ? > > Set the appropriate variables, specifically: > CPPFLAGS > and > LDFLAGS > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi folks, i run openbsd as my OS of choice and would like to install openldap and BDB. i am forced to use openldap 2.3.43 with Berkeley DB v3. Is there anything i should be aware about this combination? Has anyone in this list faced the same scenario ? What is your experience? best regards, Fried.

3 6

rwm overlay missing
by Josh Spranger 14 Dec '10

14 Dec '10

I have OpenLDAP 2.4.23 on OpenSUSE 11. When I compiled the binaries I used the flags -enable-ldap and -enable-rewrite so I could use it as a Proxy to AD. I also want to use the rwm overlay to remap the AD attributes. My problem is when I configure 'overlay rwm' and use slaptest it returns with "overlay 'rwm' not found" and I do not have any rwm.la files anywhere to load in the 'moduleload' section. I presume I am missing a configure flag, but for this version which one? Thanks!

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical