openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

push replication with proxy and rwm overlay
by Gwenn Gueguen 13 Dec '10

13 Dec '10

Hi all, I'm trying to set up push replication from master to slave through a proxy with rwm overlay. Master, proxy and slave are OpenLDAP 2.4.11 from debian lenny. On the slave, I don't want samba related attributes so I used the attrs param on syncrepl to only get attributes I want but entries still have sambaSamAccount or sambaGroupMapping as objectClass. I tried using the rwm overlay to remove these references to samba in objectclass but it did not work and I still get the following error when proxy tries to add the entries on the slave: error code 0x15: objectClass: value #3 invalid per syntax Here is the proxy configuration: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/authldap.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 modulepath /usr/lib/ldap moduleload back_ldap moduleload syncprov moduleload rwm database ldap suffix "..." rootdn "cn=admin,..." uri ldap://ldap-dmz # Save the time that the entry gets modified, for database #1 lastmod on #We don't need any access to this DSA restrict all overlay rwm rwm-map objectclass inetOrgPerson * rwm-map objectclass posixAccount * rwm-map objectclass shadowAccount * rwm-map objectclass organizationalPerson * rwm-map objectclass person * rwm-map objectclass posixGroup * # rwm-map objectclass sambaSamAccount # rwm-map objectclass sambaGroupMapping rwm-map objectclass * acl-bind bindmethod=simple idassert-bind bindmethod=simple binddn="cn=admin,..." credentials="secret" syncrepl rid=001 provider=ldap://ldap attrs="@inetOrgPerson,@posixAccount,@shadowAccount,@organizationalPerson,@person" bindmethod=simple searchbase="ou=people,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off syncrepl rid=002 provider=ldap://ldap attrs="@posixGroup" bindmethod=simple searchbase="ou=groups,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off overlay syncprov I tried upgrading OpenLdap on the proxy to 2.4.17 from backports and also upgraded to squeeze with OpenLdap 2.4.23 but I still get the error. Am I doing something wrong or is rwm buggy ? Thanks, -- Gwenn

1 1

Ordering of shadowExpire values
by Antonio Batovanja 13 Dec '10

13 Dec '10

From nis.schema: attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) If I add ORDERING integerOrderingMatch to shadowExpire, I can use a range filter like (&(objectclass=shadowaccount)(shadowexpire>=1000)) What else can I do to be able to use a range filter? I don't like changing standard schemas... Cheers, Toni

1 0

debugging memberOf overlay
by c0re 13 Dec '10

13 Dec '10

Hello all! Trying to get memberOf overlay working. Added to slapd.conf "overlay memberof" Restarted slapd. Checked that overlay loaded # slaptest -d 1 ............. config_build_entry: "olcOverlay={1}memberof" ............. Then added 1 user and 2 groups via ldif: dn: cn=test,ou=users,dc=domain,dc=local sn: test cn: test uid: test objectClass: inetOrgPerson objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile uidNumber: 5555 gidNumber: 5555 homeDirectory: /home/test givenName: test loginShell: /bin/sh shadowMin: 0 shadowMax: 999 shadowWarning: 7 shadowInactive: -1 shadowExpire: 0 shadowFlag: 0 dialupAccess: yes dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local And made # ldapsearch -x -D "cn=admin,dc=domain,dc=local" -b "dc=domain,dc=local" -W "(cn=test)" memberOf # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (cn=test) # requesting: memberOf # # test, users, domain.local dn: cn=test,ou=users,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 As you see - no memberOf in users attrs. I got no ideas why... By that I wanted to test output of ldapsearch to check will there be two or one memberOf attrs. Thanks!

1 2

Oddities with searching for a specific value of an attribute
by Sebastian Urbanneck 12 Dec '10

12 Dec '10

Sorry for this weird topic, but I didn't know how to name this one. These are the facts: we're using the phamm.schema from the PHAMM Project for saving virtual domain entries in our Ldap database. Searching for them is mostly no pronblem, but one specific circumstance is bothering me to death: when I try to search for a specific value of the attribute "vd", the corresponding entry is not always found. Any other attribute does the trick, but vd does'nt. For example: the search for (using the root_dn) ldapsearch -x -W -D "cn=admin,dc=uebergebuehr,dc=de" -b "ou=domains,dc=uebergebuehr,dc=de" "(vd=*) -s"one" produces following output: ---------output------------- # extended LDIF # # LDAPv3 # base <vd=lak-hessen.de,ou=domains,dc=uebergebuehr,dc=de> with scope baseObject # filter: (vd=*) # requesting: ALL # # lak-hessen.de, domains, uebergebuehr.de dn: vd=lak-hessen.de,ou=domains,dc=uebergebuehr,dc=de vd: lak-hessen.de lastChange: 1291723263 maxMail: 100 maxAlias: 100 maxQuota: 100 accountActive: TRUE editAV: TRUE delete: FALSE postfixTransport: dovecot objectClass: top objectClass: VirtualDomain description: lak-hessen.de # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------- This is true for everytime I put a Wildcard (*) into the search pattern, and with scope "sub" there's also no matter in which part of the tree above this entry I am. But when I'm searching specificly for the value (lak-hessen.de) nothin is found, no matter in which entry I am and which scope use. Strangely this pattern _is_ found when you go into the entry of the domain itself (vd=lak-hessen.de,ou=domains,...) and search with scobe 'base'. Any idea what I'm doing wrong? Or is this a bug? I think ACLs are ruled out because of using the root_dn. I didn't want to file a Bug before being reallly sure that this is one regards Sebastian

2 2

slapcat, PROXIED attributeDescription inserted, and cron jobs
by btb＠bitrate.net 09 Dec '10

09 Dec '10

hi- i'm running slapcat from a daily cron job to back up cn=config and other databases. i've recently updated from 2.4.21 to 2.4.23, and notice now in the output of slapcat, messages such as >slapcat -b 'cn=config' -l 'config.ldif' > /dev/null PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. a bit of searching seems to indicate that these shouldn't be cause for concern, and are just informative messages. since these messages are written to stderr, cron sends email every time it runs slapcat. if they're not errors, do they maybe belong in stdout rather than stderr? alternatively, can these messages be suppressed? according to the man page, there doesn't appear a way to do so. thanks -ben

4 4

x500UniqueIdentifier
by Juan Gonzalez 09 Dec '10

09 Dec '10

Hi, I'm trying to insert userCertificate values containing x500UniqueIdentifiers. When the value appears at the SubjectNames, it inserts correctly. By this I assume there is a validation for the field formatting. When I have a x500UniqueIdentifier at the IssuerNames it fails to insert. Is there a specific place where valid attributes and syntaxes for IssuerNames should be declared? Thanks Jgcardoso.

3 3

slapd 2.4.23 SASL/GSSAPI problem
by Matej Zagiba 09 Dec '10

09 Dec '10

Hello everybody, I'm running debian squeeze (testing) with openldap 2.4.23 and MIT kerberos 1.8.3 KDC. I had functinal SASL/GSSAPI authentication configured, but recently it stopped working. I cannot be realy sure, but I suspect upgrade from openldap 2.4.22 is the cause. In logs I see lots of this: SASL [conn=1003] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Configuration file does not specify default realm) I added sasl-realm option but it did not helped. All other kerberos applications works without problem. Is there any (new) SASL option I missed? Or it's a bug in 2.4.23? Thanks for any help. Matej Zagiba

2 5

Re: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 09 Dec '10

09 Dec '10

Hey Victor, thanks four your long helpful answer. Yes, it is the Redhat provided openldap-servers-2.4.22-7.el6.i386, because compiling from source (on RH 5!) did not work for me :-( (s. other discussion) For me I'd like to stay with the RH Packages, as compiling is not yet part of my daily business ;-) But things may change.... Before I started to try your suggestions, I restarted my testsystem and 'just' launched slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d and adjusted the file permissions. And voila, my slapd config is build and the server starts without errors. All I did was restarting the system, no change to the config. So something had a hick-up. Regards . Götz Am 08.12.10 18:30, schrieb Gattegno, Victor (GCC - Software): > Hello Götz, > > Which OpenLDAP 2.4 version do you use? > The one of RHEL 6? > > Or the one (OpenLDAP 2.4.23) from http://www.openldap.org? > Then slapd.conf is : /usr/local/etc/openldap/slapd.conf > > I would recommend you OpenLDAP 2.4.23 from http://www.openldap.org > associated with BDB recommended-version: > http://www.openldap.org/doc/admin24/appendix-recommended-versions.html > > Check with: > locate slapd > slapd -V > >> db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > It seems that slaptest saw that your configuration expects a LDAP database in /var/lib/ldap, which doesn't exist... I guess that you have "directory /var/lib/ldap" in your slapd.conf, then you should have a database associated... > > So, first, check your slapd.conf content. > > After that, test it through: > slaptest -f /etc/openldap/slapd.conf > > Once your slapd.conf is ok, you can convert it through: > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > Or (if OpenLDAP 2.4.23) through: > slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > > Rgds, > Victor > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Götz Reinicke - IT-Koordinator > Sent: mercredi 8 décembre 2010 16:53 > To: openldap-technical(a)openldap.org > Subject: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3 > > Hey, > > I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 > and the main migration point is the 'new' config style. > > I removed my test-database (I have a ldif-backup) files and the default > config from my testsystem. > > I followed the RH guide [1], but now get an error with my testsystem > while lauching this command: > > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > > bdb_db_open: database "dc=filmakademie,dc=de": > db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > > backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): > bi_db_open failed! (2) > > > > What may I have missed? Any suggestions? Thanks a lot for pointing me > into the right direction! > > /Götz > > > [1] > http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 1

Host Best Authentication
by Anton Chu 08 Dec '10

08 Dec '10

Anyone have a great solution on setting up host base filtering? I've tried the ldapns.schema and then setup pam using this site: https://help.ubuntu.com/community/LDAPClientAuthentication Ddin't work. Regards

1 0

Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 08 Dec '10

08 Dec '10

Hey, I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 and the main migration point is the 'new' config style. I removed my test-database (I have a ldif-backup) files and the default config from my testsystem. I followed the RH guide [1], but now get an error with my testsystem while lauching this command: slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d bdb_db_open: database "dc=filmakademie,dc=de": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): bi_db_open failed! (2) What may I have missed? Any suggestions? Thanks a lot for pointing me into the right direction! /Götz [1] http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical