openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

ldap_result returns LDAP_TIMEOUT even after getting search response
by Shankar Anand R 06 Dec '10

06 Dec '10

Hi, I am seeing very slow responses while using ldap_search_ext() and ldap_result(). I have explained my application below. Kindly let me know if you see any problems/clues. I have written a simple application which reads a file and does LDAP search for all entities in the file. I am doing a simple bind with the LDAP server. I have 2 threads and 2 queues namely, LDAP Search queue and LDAP result queue. - Thread 1 reads all the entities from LDAP Search queue, sends out LDAP search requests for those entities and puts them into LDAP result queue. - Thread 2 reads all the entities from LDAP Result queue and checks for search results for those entities. These 2 threads do these tasks every 1 second. Since I don't want to overload the LDAP server I have programmed a constraint of a maximum of 20 outstanding LDAP searches that haven't got a result yet. Successful ldap_result() seems to be taking a long time. I keep getting LDAP_TIMEOUT errors. But i do get the result eventually without any retransmissions. But after a long time. When I capture the LDAP packets, the results seems to coming in pretty quick. But still ldap_result returns a LDAP_TIMEOUT error. Why should ldap_result() return a timeout in this case? Note that I am using LDAP_MSG_ONE in ldap_result. And I am using a timeout of 0 - I want to poll for the result and not actually block. I have turned OFF LDAP_OPT_REFERRALS on client side. (But still not able to figure out how to prevent Active Directory 2008 from sending out referrals). My test file contains 25 entities and I want to query the LDAP server for these 25 entities. This is a simplified form of my log: At 0 seconds: LDAP Search thread: 25 more LDAP searches pending. 0 LDAP Search waiting for results Sent out 20 LDAP Search Requests. Trigger to start LDAP Result thread after 1 second. 5 more LDAP searches pending. Wait for 1 second before sending these out. At 1 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 1 LDAP results. 19 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 5 more LDAP Searches pending. 19 LDAP Search waiting for results. Sent out 1 LDAP Search Requests. 4 more LDAP searches pending. Wait for 1 second before sending these out. At 2 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 5 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 4 more LDAP Searches pending. 15 LDAP Search waiting for results. Sent out 4 LDAP Search Requests. 0 LDAP Search pending. Stopping LDAP Search thread. At 3 seconds: LDAP Result thread: 19 LDAP Search results pending. Got 4 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. At 4 seconds: LDAP Result thread: 15 LDAP Search results pending. Got 4 LDAP results. 11 LDAP Search results still pending. Try again after 1 second. At 5 seconds: LDAP Result thread: 11 LDAP Search results pending. Got 3 LDAP results. 8 LDAP Search results still pending. Try again after 1 second. At 6 seconds: LDAP Result thread: 8 LDAP Search results pending. Got 2 LDAP results. 6 LDAP Search results still pending. Try again after 1 second. At 7 seconds: LDAP Result thread: 6 LDAP Search results pending. Got 1 LDAP results. 5 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 5 LDAP Search results pending. Got 2 LDAP results. 3 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 3 LDAP Search results pending. Got 1 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 9 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 0 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 10 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 1 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 11 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 0 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 12 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 1 LDAP results. 0 LDAP Search Results pending. Stopping LDAP Result thread. Any help/clues is much appreciated. Regards, Shankar

1 0

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/1 Dan White <dwhite(a)olp.net>: > On 01/12/10 18:27 +0300, c0re wrote: >> >> Can't understand about how to use nssov overlay in my case, but >> understood about dynamic groups overlay and it should fit to my needs. >> >> Also I've got freeradius that authenticate users by looking in ldap. >> Works good. But can't understand about how to restrict users to login >> to some devices. At that moment all users has access to all devices >> via radius. Same requests - this must be controlled via openldap. >> >> May be someone uses freeradius and has already made such restritions >> and can give me some tips. > > Here's one approach: > > Given a huntgroups file of: > > device1 NAS-IP-Address == 192.168.1.1 > cisco1 NAS-IP-Address == 192.168.1.2 > > and corresponding entries in your clients.conf, you can add something like > this in your users file: > > DEFAULT Huntgroup-Name == "device1", ldap-customattr-Ldap-Group == "device1" > Fall-Through = no > > DEFAULT Huntgroup-Name == "device1", Auth-Type := Reject > > DEFAULT Huntgroup-Name == "cisco1", ldap-customattr-Ldap-Group == > "cisco1/admin", User-Profile := "cn=ciscoadmin,ou=radius,dc=example,dc=net" > Fall-Through = no > > DEFAULT Huntgroup-Name == "cisco1", Auth-Type := Reject > > then create /etc/freeradius/modules/ldap-customattr with: > > ldap ldap-customattr { > > server = "ldap://ldap.example.net" > ldap_debug = 0x0028 > identity = "$dn" > password = $pass > ldap_connections_number = 5 > basedn = "dc=example,dc=net" > filter = "(uid=%u)" > start_tls = no > tls_mode = no > password_attribute = "userPassword" > groupname_attribute = "customattr" > groupmembership_filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > groupmembership_attribute = "customattr" > > } > > Add 'ldap-customattr' inside the 'instantiate' section within > /etc/freeradius/radiusd.conf. > > Add this to your tree: > > dn: cn=ciscoadmin,ou=radius,dc=example,dc=net > objectClass: radiusObjectProfile > objectClass: radiusprofile > cn: ciscoadmin > radiusReplyItem: cisco-avpair = "shell:priv-lvl=15" > > > Then within your user entries, any user with: > > customattr: device1 > > will be authorized to authenticate to device1, and > > customattr: cisco1/admin > > will authenticate to cisco1, and will also drop directly into enable mode, > assuming the cisco device is configured to do so. > > -- > Dan White > Thanks for example! But it still requires to edit clients.conf when adding device. And not restricts by groups. As per http://wiki.freeradius.org/Rlm_ldap I can use groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" If there any other variables that can be used? I mean not only Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname or anything else to unique identify remote device. So I can use dynamic groups in OpenLdap and restrict access to device by group membership.

1 0

Multiple LDAP server IPs to ldap_init, server is busy and failover question.
by Jorgen Lundman 06 Dec '10

06 Dec '10

Solaris 10 x86 u8 openldap-2.4.23 db-4.8.30.NC dovecot-1.2.7 Can I have some clarification on how failover works when using OpenLDAP library as a client. If a piece of software is passing multiple space-separated hosts to ldap_init() (or initialize) calls, but receives "Server is busy" error during a search request, should the LDAP library not handle that for the caller automatically/transparently? Ie, switch to next working LDAP server, and perform the ldap_search. Or is it closer to that ldap_init will find the first working IP (the failover is early in the flow), but if an already started search later fails, it is up to the software to retry/reconnect? It only guarantees that the initial connection is valid. What is the general practise here? Thanks, Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

OpenLDAP 2.4 authentication methods
by Josh Spranger 04 Dec '10

04 Dec '10

I have OpenLDAP version 2.4 installed on an OpenSUSE box. I am using it as an LDAP Proxy to Windows AD domain. It works perfectly using standard LDAP logon credentials (cn=user,DC=domain,DC=com). But I have some applications that use user(a)domain.com<mailto:user@domain.com> logon credentials. Is there a way to configure OpenLDAP to authenticate in this way? Slapd config file available on request. Thanks! Josh Spranger Sr. Network Engineer

2 3

Cannot ID LDAP User On LDAP Client
by Anton Chu 03 Dec '10

03 Dec '10

I've setup an Ubuntu 10.10 LDAP Client to authenticate off my LDAP server. I've install the following: sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils pam_ccreds Here's my /etc/nsswitch.conf: passwd: files ldap [NOTFOUND=return] db > > group: files ldap [NOTFOUND=return] db > > shadow: files ldap > > hosts: files dns > networks: files > > protocols: db files > services: db files > ethers: db files > rpc: db files > I can nss_updatedb ldap succssfully: # nss_updatedb ldap passwd... done. group... done. I can getent passwd, getent passwd shadow, getent group just fine and they all show all my ldap users. However, I cannot do an id ldapuser ex: $ id tony id: tony: No such user Here's my auth.log: Dec 1 21:08:17 webdev120 sshd[14765]: pam_unix(sshd:auth): check pass; user > unknown > Here's my syslog: sshd[14648]: Libgcrypt warning: missing initialization - please fix the > application > Here's my /etc/pam.d/commoun-auth: auth [success=4 default=ignore] pam_unix.so nullok_secure > auth [success=3 default=ignore] pam_ldap.so use_first_pass > auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 > action=validate use_first_pass > auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update > # here's the fallback if no module succeeds > #auth requisite pam_deny.so > # prime the stack with a positive return value if there isn't one already; > # this avoids us returning an error just because nothing sets a success > code > # since the modules above will each just jump around > #auth required pam_permit.so > # and here are more per-package modules (the "Additional" block) > auth optional pam_ccreds.so minimum_uid=1000 action=store > # end of pam-auth-update config > Here's my /etc/pam.d/common-account: # here are the per-package modules (the "Primary" block) > account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so > account [success=1 default=ignore] pam_ldap.so > # here's the fallback if no module succeeds > account requisite pam_deny.so > # prime the stack with a positive return value if there isn't one already; > # this avoids us returning an error just because nothing sets a success > code > # since the modules above will each just jump around > account required pam_permit.so > # and here are more per-package modules (the "Additional" block) > # end of pam-auth-update config > ID works just fine with my local users on my local machine so somehow it's not able to read the ldap users. Any insights appreciated.

3 7

last login time
by Nick Folino 03 Dec '10

03 Dec '10

I saw some old list traffic from 2005 about implementing last login time into the password policy. Was this idea scrapped? Nick

1 0

MemberOf out of sync on consumer[s]
by Yuri Bank 03 Dec '10

03 Dec '10

Hello, I've been putting this off for a while, but this is happening frequently enough that I think its time to ask for opinions on the bug I'm running into with OpenLDAP and the MemberOf overlay. Version: 2.4.23 Configuration: Single Provider, with 4 Consumers. It seems that when I add a new users on my provider, the MemberOf attribute disappears randomly for some users, on some ( not all ) consumer nodes. Everything in the DIT is in tact, and the changes made on my provider are replicated to the consumers correctly. The only issue here is with the memberof attribute. The only way for me to remedy this problem is to shutdown slapd on the affected consumer node, delete everything in /var/sun/slapd, and then start slapd again which then fully syncs with my provider with all memberof attributes in tact. My testing shows that this is triggered by making changes to to my LDAP groups/users on the provider node, but that is all I can find. Nothing in the logs gives me any clues as to what is happening. Has anyone experienced similar problems? Thanks, -Yuri

1 0

slap-hdb dirtyread
by CHIROSSEL, Olivier 03 Dec '10

03 Dec '10

Hi Someone kwon the status of this option ? "dirtyread Allow reads of modified but not yet committed data. Usually transactions are isolated to prevent other operations from accessing uncommitted data. This option may improve perforâ[m mance, but may also return inconsistent results if the data comes from a transaction that is later aborted. In this case, the modified data is discarded and a subsequent search will return a different result." For me this should be associate with the use of DB_READ_UNCOMMITTED flag .... Regards, Olivier

1 0

passwd fails
by Holger Schier 02 Dec '10

02 Dec '10

Hi guys, my ldapserver works fine now, but the first users are arriving. The normal user should change their own password. So, everyone thinks of passwd in the shell. But: LDAP password information update failed: Insufficient access Must supply old password to be changed as well as new one Here is my ACL: olcAccess: {0} to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdH istory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth olcAccess: {2}to attrs=shadowLastChange by self write by dn.base="cn=BINDUSER,dc=MY,dc=DC" read by users read by * auth olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by dn.base="cn=BINDUSER,dc=MY,dc=DC" read by * none I tried the same with olcAccess: {4}to * by * read and allowing anonymous binds, but same error. passwd seems to try to bind with the binduser and then to read and to write the userPassword, but only has auth access. Has anyone an idea how to enable this? Thanks a lot. Holger

3 2

memory leak when chasing referrals?
by Arthur de Jong 02 Dec '10

02 Dec '10

Hello list, I'm not 100% sure that this is a bug in OpenLDAP or in my code so I'll post here first. I run into a memory leak when running the code below on a server that contains referrals. The code itself is the minimal representation I could make that triggers the leak. The referral I used is something like: dn: ou=ref,ou=people,dc=test,dc=tld objectClass: referral objectClass: extensibleObject dc: subtree ref: ldap://otherserver/ou=morepeople,dc=test2,dc=tld ou: ref When I run the code through "valgrind --leak-check=full" I get: ==30395== 4,184 (80 direct, 4,104 indirect) bytes in 1 blocks are definitely lost in loss record 3 of 3 ==30395== at 0x402328F: calloc (vg_replace_malloc.c:467) ==30395== by 0x41D2CDF: ber_memcalloc_x (in /usr/lib/liblber-2.4.so.2.5.6) ==30395== by 0x40650A0: ldap_send_server_request (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x4065EB1: ldap_chase_v3referrals (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x40510A3: ldap_result (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x8048871: main (test.c:28) Is there something wrong with my code (except for the complete lack of error handling that I stripped out to improve readability)? Should I free something in the LDAP_RES_SEARCH_REFERENCE case? Thanks. -----8<-- test.c --8<----- #include <stdio.h> #include <errno.h> #define LDAP_DEPRECATED 1 #include <ldap.h> int main(int argc,char *argv[]) { char *base="dc=test,dc=tld"; char *filter="(objectClass=posixAccount)"; char *attrs[] = { "uid", NULL }; int i; LDAP *ld; LDAPMessage *msg=NULL; int msgid; char **values; /* set up connection */ ldap_initialize(&ld,"ldap://localhost"); i=3; ldap_set_option(ld,LDAP_OPT_PROTOCOL_VERSION,&i); ldap_simple_bind_s(ld,NULL,NULL); /* start search and handle results */ ldap_search_ext(ld,base,LDAP_SCOPE_SUB,filter,attrs, 0,NULL,NULL,NULL,LDAP_NO_LIMIT,&msgid); while (1) { switch (ldap_result(ld,msgid,LDAP_MSG_ONE,NULL,&msg)) { case LDAP_RES_SEARCH_ENTRY: /* we have a normal search entry, print some attribute values */ values=ldap_get_values(ld,msg,attrs[0]); for (i=0;values[i]!=NULL;i++) fprintf(stderr,"%s=%s\n",attrs[0],values[i]); ldap_value_free(values); break; case LDAP_RES_SEARCH_RESULT: /* end of results */ ldap_msgfree(msg); ldap_unbind(ld); return 0; case LDAP_RES_SEARCH_REFERENCE: break; /* just ignore search references */ default: /* we have some error condition, bail out */ return -1; } ldap_msgfree(msg); } } -----8<-- test.c --8<----- -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical