openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

tag=97 error in openLDAP
by Tim Dunphy 31 Oct '10

31 Oct '10

Hello, I recently had a "knowledgeable" friend work on my openldap server. he made some changes to the cofigs without backing them up and now users are unable to authenticate against this openldap 2.4 server where previously they could. I am running on FreeBSD 8.1. I am a student trying to learn and be comfortable with openLDAP. when a user ssh's to any machine on the network that is configured to listen to this ldap server now gets an error in the LDAP logs: Oct 29 22:49:41 LBSD2 slapd[1085]: <= bdb_equality_candidates: (uid) not indexed Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1001 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 BIND dn="uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" method=128 Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 RESULT tag=97 err=49 text= Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=5 BIND dn="" method=128 Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=5 RESULT tag=97 err=0 text= it looks like it's failing to bind: conn=1003 op=3 BIND dn="" method=128 and I think this error may be key but I am unsure of it's meaning: tag=97 my ldap.conf reads as so: host ldap.summitnjhome.com base dc=summitnjhome,dc=com scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com And why would the uid not be indexed? and this is the user id in LDAP: [root@LBSD2:/home/bluethundr/txt/ldif]#cat bluethundr.ldif dn: uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. givenName: Timothy P. sn: mail: bluethundr(a)blah.com mailRoutingAddress: bluethundr(a)mail.blah.com mailHost: mail.blah.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword: {CRYPT}secret loginShell: /usr/local/bin/bash uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. and these are my ACL's in slapd.conf: access to * by read access to attrs=userPassword by self write by anonymous auth access to * by self write by dn.children="ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" write by users read by anonymous auth access to * by self write I would certainly appreciate any help to get this working again! thank you -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

2 1

Push-based syncrepl + slapo-rwm
by Raphael Ordinas 29 Oct '10

29 Oct '10

Hi, I'd like to replicate with syncrepl a master directory and change the naming context on the consumer. I try setup a syncrepl push-based synchronization, with a proxy and slapo-rwm overlay. Here's what my config looks like : MASTER LDAP (suffix : dc=suffix1,dc=com) | | | PROXY push-based syncrepl and slapo-rwm (rewrite "dc=suffix1,dc=com" to "dc=suffix2,dc=com") | | | SLAVE (suffix : dc=suffix2,dc=com) I can't get rewriting working on the proxy, data are pushed to my slave directory with the suffix "dc=suffix1,dc=com". So replication don't work because of different naming context. PROXY's slapd.conf looks like this : ############################## database ldap hidden on suffix "dc=suffix2,dc=com" rootdn "cn=admin,dc=suffix2,dc=com" uri ldap://slave/ lastmod on restrict all acl-bind bindmethod=simple binddn="cn=admin,dc=suffix2,dc=com" credentials=secret overlay rwm rwm-rewriteEngine on rwm-suffixmassage "dc=suffix2,dc=com" "dc=suffix1,dc=com" overlay syncprov syncrepl rid=001 provider=ldap://master/ binddn="cn=admin,dc=suffix2,dc=com" bindmethod=simple credentials=secret searchbase="dc=suffix2,dc=com" type=refreshAndPersist retry="5 5 300 5" ############################## What's wrong ? Thank you for your help. Regards Raphael

1 0

Regarding overlay acceslog and auditlog
by Sai Suman Mallela 28 Oct '10

28 Oct '10

Hi, I need to implement overlay accesslog / auditlog to gain the client information (host name, service etc) who access our ldap server. Following are the openldap details: version : openldap-2.2.29operating system : Windows server 2003 I would appreciate any help to configure the slapd.conf file and the necessary schemas. Thanks, Sai

1 0

Error 18: Solaris 10 Native LDAP-Client
by Benjamin Griese 28 Oct '10

28 Oct '10

Hello guys, I got a problem while pulling information with the native ldap client on my various solaris 10 machines from an openldap2-2.4.23-116.1 Maybe someone has any ideas, because I am on the end of mine. I don't know what to do in the further steps to solve the problem. the important information are below. thanks for your help. kind regards, benjamin. ============================================================= on the solaris box: solaris profile pulled from DIT, runs absolutly fine, but is maybe not perfect for openldap # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=proxyuser,ou=system,ou=people,dc=example,dc=de NS_LDAP_BINDPASSWD= secret NS_LDAP_SERVERS= ldap01 ldap02 NS_LDAP_SEARCH_BASEDN= dc=example,dc=de NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= FALSE NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 60 NS_LDAP_PROFILE= solaris_profile NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=people,dc=example,dc=de?sub NS_LDAP_SERVICE_SEARCH_DESC= group: ou=groups,dc=example,dc=de?sub NS_LDAP_SERVICE_SEARCH_DESC= sudoers: ou=SUDOers,dc=example,dc=de?sub NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=people,dc=example,dc=de?sub NS_LDAP_BIND_TIME= 10 NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixGroup NS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=posixAccount NS_LDAP_OBJECTCLASSMAP= sudoers:sudoRole=sudoRole # ldaplist passwd ldaplist: Object not found (LDAP ERROR (18): Inappropriate matching.) getent passwd/group dont show anything, but strangely, single "id <username>" show the user information I was expecting. on sles11sp1/openldap2-2.4.23-116.1 (http://download.opensuse.org/repositories/network:/ldap:/OpenLDAP:/RE24/SLE…) thats what I see in the logs on the openldap-server, right after typing "ldaplist passwd" on the solaris box Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 fd=22 ACCEPT from IP=10.0.0.1:45604 (IP=0.0.0.0:389) Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=0 BIND dn="cn=proxyuser,ou=system,ou=people,dc=example,dc=de" method=128 Oct 15 14:37:33 examplehost slapd[8339]: => bdb_entry_get: found entry: "cn=proxyuser,ou=system,ou=people,dc=example,dc=de" Oct 15 14:37:33 examplehost slapd[8339]: => bdb_entry_get: found entry: "cn=default,ou=pwdpolicy,dc=example,dc=de" Oct 15 14:37:33 examplehost slapd[8339]: => access_allowed: result not in cache (userPassword) Oct 15 14:37:33 examplehost slapd[8339]: => access_allowed: auth access to "cn=proxyuser,ou=system,ou=people,dc=example,dc=de" "userPassword" requested Oct 15 14:37:33 examplehost slapd[8339]: => acl_get: [1] attr userPassword Oct 15 14:37:33 examplehost slapd[8339]: => acl_mask: access to entry "cn=proxyuser,ou=system,ou=people,dc=example,dc=de", attr "userPassword" requested Oct 15 14:37:33 examplehost slapd[8339]: => acl_mask: to value by "", (=0) Oct 15 14:37:33 examplehost slapd[8339]: <= check a_dn_pat: cn=ldapadm,dc=example,dc=de Oct 15 14:37:33 examplehost slapd[8339]: <= check a_dn_pat: cn=proxyuser,ou=system,ou=people,dc=example,dc=de ## just for testing purpose Oct 15 14:37:33 examplehost slapd[8339]: <= check a_dn_pat: anonymous Oct 15 14:37:33 examplehost slapd[8339]: <= acl_mask: [3] applying auth(=xd) (stop) Oct 15 14:37:33 examplehost slapd[8339]: <= acl_mask: [3] mask: auth(=xd) Oct 15 14:37:33 examplehost slapd[8339]: => slap_access_allowed: auth access granted by auth(=xd) Oct 15 14:37:33 examplehost slapd[8339]: => access_allowed: auth access granted by auth(=xd) Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=0 BIND dn="cn=proxyuser,ou=system,ou=people,dc=example,dc=de" mech=SIMPLE ssf=0 Oct 15 14:37:33 examplehost slapd[8339]: => bdb_entry_get: found entry: "cn=proxyuser,ou=system,ou=people,dc=example,dc=de" Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=0 RESULT tag=97 err=0 text= Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=1 SEARCH RESULT tag=101 err=18 nentries=0 text=serverSort control: No ordering rule Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=1 do_search: get_ctrls failed Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=2 UNBIND Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 fd=22 closed that seems to be a problem with a supportedControl of the ldap-server which the solaris ldap client is unable to handle, because the local openldap-client in the sles-server has absolutly no problem binding and getting infos. is this kind of offtopic for this list? http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com… says 18 LDAP_INAPPROPRIATE_MATCHING Inappropriate matchingFilter type not supported for the specified attribute. but I don't know what to do this seems kind of related to this problem, maybe its the same: http://markmail.org/message/dgtk3rpihvkqndqx#query:serverSort%20control%3A%… -- To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To be is to do -- Sartre | Do be do be do -- Sinatra

3 8

Problem updating cn=config directory
by Bram Cymet 28 Oct '10

28 Oct '10

Hi, I am having problems updating the cn=config datebase as shown in the following output: ldapmodify -Y external -H ldapi:/// <<EOF > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 > EOF SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Referral (10) referrals: ldap://ottauth1.test.cbn/cn=config Does anyone know what this referral (10) error means. The URI listed there is the local box. For some reason I am only getting these errors on Master servers not on slaves. This really confused me because I am not replicating the cn=config directory. Any help you be great. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

2 2

ldapsearch performance degradation
by Tim Dyce 27 Oct '10

27 Oct '10

Hi all, I am trying to track down what causes ldap searches to slow down over time, especially if content is added and removed. We are having issues with this as a grid site in the EGEE/EGI computing grid. Attached is a graph of search performance over time, and a basic test I did to get it (runs from /opt/bdii_test_core). This test only uses the core schema and operates on organizationalUnit. Can anyone tell me what's causing this? It's causing us some serious grief, as the searches slow down, some sites start to disappear off the grid and jobs start to fail. I've tried restarts and slap_index, but no love. Any help/advice would be much appreciated. Thanks, Tim -- ---------- Tim Dyce Research Computing EPP Group The School of Physics The University of Melbourne +61 3 8344 5462 +61 431 485 166

2 3

LDAP Schema Changes During Replication
by Anton Chu 27 Oct '10

27 Oct '10

Hi Everyone, I've setup a basic consumer,provider model replication. I've added a new schema eduPerson to my provider server and now the consumer server cannot replicate. Here's the error I'm getting on my consumer server: Oct 21 22:32:08 webtest110 slapd[31984]: slapd starting Oct 21 22:32:08 webtest110 slapd[31984]: syncrepl_message_to_op: rid=000 mods check (objectClass: value #3 invalid per syntax) Oct 21 22:32:08 webtest110 slapd[31984]: do_syncrepl: rid=000 rc 21 retrying I have delete the eduPerson schema on my provider server, deleted the person (uid=jim) using those attributes in my DIT , and restarted the slapd process on both server but error still persists. Any insights appreciated.

2 3

Structure LDAP
by Alejandro Rodriguez Luna 27 Oct '10

27 Oct '10

Hi all, how can I find the complete structure of my LDAP server, I mean dc=example,dc=com Users Groups Application uid=1 gid=group1 app=app1 uid=2 gid=group2 app=app2

1 0

Re: Authenticating OpenLDAP client with AD
by Benjamin Griese 27 Oct '10

27 Oct '10

oops, forgot the ML On Wed, Oct 27, 2010 at 17:06, Benjamin Griese <der.darude(a)gmail.com> wrote: > @Vinay > > I've found another solution that maybe fits your needs: > > http://lsc-project.org/wiki/ > > On Sat, Oct 23, 2010 at 15:26, Quan Nguyen <qnguyen(a)ayr1.com> wrote: >> >> >> Send from IPhone >> >> >> On Oct 23, 2010, at 5:55 AM, Benjamin Griese <der.darude(a)gmail.com> wrote: >> >>> Hi, >>> >>> yes that is another possibility I wanted to show you. >>> By searching I found another, but probably not open, method to do it. >>> http://www.likewise.com/ >>> >>> Good luck. >>> >>> On Sat, Oct 23, 2010 at 14:52, Vinay Kalkoti <kalkoti.vinay(a)gmail.com> >>> wrote: >>>> >>>> Hi Benjamin, >>>> >>>> Are you hinting at running the openldap server instead of openldap >>>> client and sync the required accounts using replication and >>>> authenticate againt the openldap server locally ? >>>> >>>> Thanks, >>>> Vinay >>>> >>>> On 10/23/10, Benjamin Griese <der.darude(a)gmail.com> wrote: >>>>> >>>>> Hi vinay, >>>>> >>>>> you may take a look at this: >>>>> http://sourceforge.net/projects/acctsync/ >>>>> >>>>> It's not exactly what you want, but can help you reaching the goal. :) >>>>> >>>>> Bye, Benjamin. >>>>> >>>>> On Sat, Oct 23, 2010 at 12:22, Vinay Kalkoti <kalkoti.vinay(a)gmail.com> >>>>> wrote: >>>>>> >>>>>> Hi, >>>>>> >>>>>> I am working on authenticating OpenLDAP client with AD server. I saw >>>>>> lots of examples which map the rfc2307bis schema using nss_schema >>>>>> attribute in ldap.conf file >>>>>> >>>>>> # Enable support for RFC2307bis (distinguished names in group >>>>>> # members) >>>>>> nss_schema rfc2307bis >>>>>> >>>>>> and also, map the attributes of the rfc2307bis to the AD server schema >>>>>> attributes. >>>>>> >>>>>> nss_map_attribute uid msSFU30Name >>>>>> nss_map_attribute uidNumber msSFU30UidNumber >>>>>> nss_map_attribute gidNumber msSFU30GidNumber >>>>>> nss_map_attribute loginShell msSFU30LoginShell >>>>>> nss_map_attribute gecos name >>>>>> nss_map_attribute userPassword msSFU30Password >>>>>> nss_map_attribute homeDirectory msSFU30HomeDirectory >>>>>> >>>>>> >>>>>> Isn't there a way I can fetch the schema from the AD server and set it >>>>>> using nss_schema ?. >>>>>> >>>>>> Basically, I am looking at fetching the schema/objectClass/Attributes >>>>>> from the LDAP/AD server and make them as a client schema's so that I >>>>>> don't have to keep doing the mapping using nss_map_attribute and >>>>>> nss_schema. >>>>>> >>>>>> I am new to LDAP world, and I am sorry if I my question doesn't make >>>>>> any >>>>>> sense. >>>>>> >>>>>> I have seen lots of enterprise products which integrate with LDAP/AD. >>>>>> They provide a user interface to map the server side schema >>>>>> objectClass and attributes. I am trying to see if I can get rid of >>>>>> this and do it internally. >>>>>> >>>>>> Thanks, >>>>>> Vinay >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To >>>>> be is to do -- Sartre | Do be do be do -- Sinatra >>>>> >>>> >>> >>> >>> >>> -- >>> To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To >>> be is to do -- Sartre | Do be do be do -- Sinatra >>> >> >> > > > > -- > To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To > be is to do -- Sartre | Do be do be do -- Sinatra > -- To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To be is to do -- Sartre | Do be do be do -- Sinatra

1 0

Attribute Aliasing
by Russell Harmon 27 Oct '10

27 Oct '10

I'm trying to reconfigure my existing OpenLDAP server to expose personal information under multiple attributes. I'm doing this so that both Apple's contact application and my custom software will work. I've read about rwm-map in slapo-rwm, but although it makes the new attribute accessible, it hides the old one. I need both the new and old to be accessible. For example: I have an existing attribute for a cellular phone number "cellPhone". I want to make this accessible under both the attributes "cellPhone" and "mobile" Is this possible with OpenLDAP? Thanks Russell Harmon

3 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical