openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

slap-hdb dirtyread
by CHIROSSEL, Olivier 03 Dec '10

03 Dec '10

Hi Someone kwon the status of this option ? "dirtyread Allow reads of modified but not yet committed data. Usually transactions are isolated to prevent other operations from accessing uncommitted data. This option may improve perforâ[m mance, but may also return inconsistent results if the data comes from a transaction that is later aborted. In this case, the modified data is discarded and a subsequent search will return a different result." For me this should be associate with the use of DB_READ_UNCOMMITTED flag .... Regards, Olivier

1 0

passwd fails
by Holger Schier 02 Dec '10

02 Dec '10

Hi guys, my ldapserver works fine now, but the first users are arriving. The normal user should change their own password. So, everyone thinks of passwd in the shell. But: LDAP password information update failed: Insufficient access Must supply old password to be changed as well as new one Here is my ACL: olcAccess: {0} to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdH istory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth olcAccess: {2}to attrs=shadowLastChange by self write by dn.base="cn=BINDUSER,dc=MY,dc=DC" read by users read by * auth olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by dn.base="cn=BINDUSER,dc=MY,dc=DC" read by * none I tried the same with olcAccess: {4}to * by * read and allowing anonymous binds, but same error. passwd seems to try to bind with the binduser and then to read and to write the userPassword, but only has auth access. Has anyone an idea how to enable this? Thanks a lot. Holger

3 2

memory leak when chasing referrals?
by Arthur de Jong 02 Dec '10

02 Dec '10

Hello list, I'm not 100% sure that this is a bug in OpenLDAP or in my code so I'll post here first. I run into a memory leak when running the code below on a server that contains referrals. The code itself is the minimal representation I could make that triggers the leak. The referral I used is something like: dn: ou=ref,ou=people,dc=test,dc=tld objectClass: referral objectClass: extensibleObject dc: subtree ref: ldap://otherserver/ou=morepeople,dc=test2,dc=tld ou: ref When I run the code through "valgrind --leak-check=full" I get: ==30395== 4,184 (80 direct, 4,104 indirect) bytes in 1 blocks are definitely lost in loss record 3 of 3 ==30395== at 0x402328F: calloc (vg_replace_malloc.c:467) ==30395== by 0x41D2CDF: ber_memcalloc_x (in /usr/lib/liblber-2.4.so.2.5.6) ==30395== by 0x40650A0: ldap_send_server_request (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x4065EB1: ldap_chase_v3referrals (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x40510A3: ldap_result (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x8048871: main (test.c:28) Is there something wrong with my code (except for the complete lack of error handling that I stripped out to improve readability)? Should I free something in the LDAP_RES_SEARCH_REFERENCE case? Thanks. -----8<-- test.c --8<----- #include <stdio.h> #include <errno.h> #define LDAP_DEPRECATED 1 #include <ldap.h> int main(int argc,char *argv[]) { char *base="dc=test,dc=tld"; char *filter="(objectClass=posixAccount)"; char *attrs[] = { "uid", NULL }; int i; LDAP *ld; LDAPMessage *msg=NULL; int msgid; char **values; /* set up connection */ ldap_initialize(&ld,"ldap://localhost"); i=3; ldap_set_option(ld,LDAP_OPT_PROTOCOL_VERSION,&i); ldap_simple_bind_s(ld,NULL,NULL); /* start search and handle results */ ldap_search_ext(ld,base,LDAP_SCOPE_SUB,filter,attrs, 0,NULL,NULL,NULL,LDAP_NO_LIMIT,&msgid); while (1) { switch (ldap_result(ld,msgid,LDAP_MSG_ONE,NULL,&msg)) { case LDAP_RES_SEARCH_ENTRY: /* we have a normal search entry, print some attribute values */ values=ldap_get_values(ld,msg,attrs[0]); for (i=0;values[i]!=NULL;i++) fprintf(stderr,"%s=%s\n",attrs[0],values[i]); ldap_value_free(values); break; case LDAP_RES_SEARCH_RESULT: /* end of results */ ldap_msgfree(msg); ldap_unbind(ld); return 0; case LDAP_RES_SEARCH_REFERENCE: break; /* just ignore search references */ default: /* we have some error condition, bail out */ return -1; } ldap_msgfree(msg); } } -----8<-- test.c --8<----- -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

1 0

Readonly user for translucent proxy
by Christoph Berkemeier 02 Dec '10

02 Dec '10

Greetings, i am using an translucent proxy over here on Debian Lenny 64-bit in version 2.4.11-1+lenny2. The proxy is working fine when i am using the rootdn configured in my translucent proxy conf. But when i configure a readonly dn like below, i get only parts of my upstream server. The readonly is configured like this: access to * by dn="cn=admin,dc=hq,dc=example,dc=com" write by dn="uid=tlc,ou=user,dc=example,dc=com" read by * read With this config it should not even be necessary to configure an additional user, should it? The overlay is configured like this: overlay translucent translucent_local memberUid lastmod off uri ldaps://ldap.example.com acl-bind binddn="uid=tlc,ou=user,dc=example,dc=com" credentials="verysecret" Every authenticated dn uses the same binddn and credentials for the upstream ldap server ldap.example.com, right? Best Regards, Christoph Berkemeier

1 0

OpenLDAP on T2000
by Nick Folino 02 Dec '10

02 Dec '10

I'm evaluating OpenLDAP on various platforms and am having trouble getting the tools (slapadd, slapindex, etc) to perform well on Sun's T2000 servers. For example slapadd is running at about 50k/s. On an x86 server importing the same ldif yields over 1M/s. Using Berkeley DB 4.8 backend. I'm assuming the problem is related to CPU speed and threads. Can anyone give me some tips to increase the performance on this platform? Nick

4 3

Programmatically creating users
by Juan Pablo Romero Méndez 02 Dec '10

02 Dec '10

Hello, I'm trying to programmatically call useradd to create an ldap user on opensuse 11.2. The problem is that calling useradd -m --service ldap -D "cn=Administrator,dc=tkm,dc=com,dc=mx" testuser requests the ldap admin password in a way which I find difficult to handle programmatically. I thought that setting rootbinddn in /etc/ldap.conf and the password in /etc/ldap.secret would prevent useradd to ask the password but this is not the case. Is it possible to accomplish this? (i.e. configure useradd/passswd to not to ask passwords in the command line?) Regards, Juan Pablo

2 1

synrepl sends wrong rid cookie?
by Marc Patermann 02 Dec '10

02 Dec '10

Hi, on the provider server there are 3 databases glued together with one sync provider in the top level database: ... overlay glue overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 one consumer replicates two of the three database, each to a database, each database has its own synrepl statement with an own searchbase to get only the entries of this tree/database from the provider. Each database has its own rid: 401 and 402. When something changes in database 1 ou=humans, rid=401, the change is replicated. When something changes in database 2 ou=linux, rid=402, it is not. Only after a restart of the consumer changes apply. Now I saw this in the log: 1. change in ou=humans (rid=401) 2. change in ou=linux (rid=402) 3. change in ou=linux (rid=402) Dec 1 17:53:15 tfas099 slapd[12318]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - NEW_COOKIE Dec 1 17:53:15 tfas099 slapd[12318]: do_syncrep2: rid=402 NEW_COOKIE: rid=402,csn=20101201165315.347441Z#000000#000#000000 Dec 1 17:53:15 tfas099 slapd[12318]: do_syncrep2: rid=401 cookie=rid=401,csn=20101201165315.347441Z#000000#000#000000 Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 be_search (0) Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 employeeNumber=0,ou=humans,ou=foo Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 be_modify employeeNumber=0,ou=humans,ou=foo (0) ... Dec 1 17:53:28 tfas099 slapd[12318]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - NEW_COOKIE Dec 1 17:53:28 tfas099 slapd[12318]: do_syncrep2: rid=401 NEW_COOKIE: rid=401,csn=20101201165328.955051Z#000000#000#000000 ... Dec 1 17:53:42 tfas099 slapd[12318]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - NEW_COOKIE Dec 1 17:53:42 tfas099 slapd[12318]: do_syncrep2: rid=401 NEW_COOKIE: rid=401,csn=20101201165342.175128Z#000000#000#000000 As you can see, on all three changes rid=401 is mentioned, never rid=402. When I restart, I can see this: Dec 1 18:06:35 tfas099 slapd[15676]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 inserted UUID 9cd2cfc4-9005-102f-9517-d54a6b53d2d0 Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 be_search (0) Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 ou=accounts,ou=linux,ou=steuer,o=landesverwaltung niedersachsen,c=de Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 be_modify ou=accounts,ou=linux,ou=steuer,o=landesverwaltung niedersachsen,c=de (0) Dec 1 18:06:35 tfas099 slapd[15676]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Dec 1 18:06:35 tfas099 slapd[15676]: do_syncrep2: rid=402 cookie=rid=402,csn=20101201165342.175128Z#000000#000#000000 I get the rid=402 changes! Is this a configuration error on my side? Provider is 2.4.23, consumer is 2.4.20. Marc

2 2

Rebuild openldap so all modules/overlays are separate
by Chris Jacobs 02 Dec '10

02 Dec '10

Main question: how to build openldap with all overlays as dynamically loaded modules (ie: optional). Why? These problems have been covered before, recently even. I'm trying to get Solaris 9/10 clients talking to openldap server. I can do getent passwd <user> but getent passwd or getent group or even ldaplist all fail. I haven't had any success with Benjamin's acl fix/work around, or configuring the overlay for sssvlv in slapd.conf. So, I thought I'd recompile openldap - without sssvlv support, but then I thought why have to do this again in the future if I find another incompatibility? I'd prefer to simply have all overlays/modules as separate loadable modules. When I compiled OpenLDAP, I configured it with: ./configure --with-tls=openssl \ --enable-crypt \ --enable-dynamic \ --enable-ldap \ --enable-lmpasswd \ --enable-modules \ --enable-overlays \ --enable-spasswd \ --sysconfdir=/etc The enable-overlays option builds in a number of overlays I use and am interested in using in the future - however, it also enables sss/vlv. I supposed I could try to build it again with that option followed by --disable-sssvlv but what I'd really prefer is a way to build openldap with the overlays as separate modules that I can load/unload when/as I need them. I've searched the documentation, but I can't figure out how. It's quite likely I haven't looked in the right spot. I'm currently trying to make my way through the configure script... Blech. Thanks for any pointers, - chris Chris Jacobs, Systems Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.839-8245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 4

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 01 Dec '10

01 Dec '10

2010/11/19 Phuong Marie VUONG <mangocphung(a)gmail.com>: > Hello, > > First, im sorry about my English. I share here my experience which worked > for limit acces host/group of host for user... > > In the configuration of ldap client /etc/ldap.conf , i have activate the > host attribute and a filter in nss_base_passwd > pam_check_host_attr yes > nss_base_passwd > ou=People,dc=xxxxx,dc=xxxx?one?|(host=hostname.domain)(host=PatternofHostGroup)(host=*) > > In the user entry, add the host attribute > And in the host set, you can put the pattern value correpond of the level > that you want to authorize to connect , for exe : > hostname.domain > or > PatternofHostGroup > or > * > > Hope that can help > > > 2010/11/19 c0re <nr1c0re(a)gmail.com> >> >> can you give an example of usage pam_check_host_attr? >> >> And how can I use group of hosts and assign user to this group to >> permit access user to this group avoiding enumerating hosts in users >> dn each time I add new user? >> >> What should I set in "host:"? Hostname of server? How host attr are >> sent to pam_ldap? >> >> 2010/11/18 Aaron Richton <richton(a)nbcs.rutgers.edu>: >> > On Thu, 18 Nov 2010, c0re wrote: >> > >> >> I mean user user1 can must login only on server1,server2 and server3. >> >> And user2 can login only on server5 and server2. >> > >> > You could probably overload almost anything (dyngroups, OpenLDAP ACLs, >> > search filters, who knows) to accomplish this, but the cleanest way to >> > do >> > this in pam_ldap would utilize pam_check_host_attr. I assume pam_ldap >> > because you mentioned "pam_groupdn" which is not an OpenLDAP >> > configuration >> > directive. >> > > > > > -- > Milan&Phuong > 06.17.34.09.77 > 09.53.57.04.94 > http://www.phuong.fr/photos/ > > > I moved a bit different way. I used pam_groupdn in ldap.conf and created a group for each server. Now if I add user to ldap, I need to add to groups "memberUid: `userdn`". And user will be able to login to those servers in which groups is user as a member. But if I got 100-200 servers and want to give access to new user to all this servers, I should add user to all groups. Of course it's a waste of time and it's possible to be done via some external shell/perl script, but may be there another way in openldap? pam_check_host_attr do almost same. If I add user - I need to add all hosts to user attr "host:". So it's same work I think.

2 2

ssf settings on server restart
by Christian Bösch 01 Dec '10

01 Dec '10

hi, i have an acl set to allow only some ips to connect unencrypted: {0}to dn.children="dc=abc,dc=net" by peername.ip=10.10.40.100 read break by peername.ip=10.10.8.49 read break by ssf=128 read break by * none olcSecurity: ssf=0 tls=0 simple_bind=0 update_ssf=0 this works in general, but if i restart slapd i get from the defined ips from above 'confidentially required'. then i have to set ssf=1 then back to ssf=0 to make it work again? anyone an idea why? /thx.chris

2 6

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical