openldap-technical

openldap-technical@openldap.org

9 participants
9875 discussions

slapd mysteriously quit/crash/die without last words
by Zhang Weiwu 25 Oct '10

25 Oct '10

Hello. slapd keep dying more and more frequently recently, from dying once a week in last month to current dying 3 to 5 times a day. "/etc/init.d/slapd start" instantly recover it, for next a few hours. Exactly the same web application that uses the ldap database had been running as-is for about one year without this problem. Server machine never changed/replaced/touched. What we tried are (in that order): 1. Run a server monitor to make sure the server load is not high (below 0.5) when slapd dies. 2. Upgrade to 2.4.11-1+lenny2 (on Debian) 3. slapcat the mostly used database (hdb) and slapadd them back in. 4. do the same for the other database (bdb); 5. track the log message at log level 256 (connection) and finding no clue. For example, one time, the last word is: Oct 25 16:06:59 www slapd[11969]: conn=26289 fd=29 ACCEPT from IP=**.**.**.**:56539 (IP=0.0.0.0:389) Oct 25 16:06:59 www slapd[11969]: conn=26289 op=0 BIND dn="cn=admin,dc=*******" method=128 Oct 25 16:06:59 www slapd[11969]: conn=26289 op=0 BIND dn="cn=admin,dc=*******" mech=SIMPLE ssf=0 Oct 25 16:06:59 www slapd[11969]: conn=26289 op=0 RESULT tag=97 err=0 text= Oct 25 16:06:59 www slapd[11969]: conn=26288 op=8 UNBIND Oct 25 16:06:59 www slapd[11969]: conn=26288 fd=41 closed Oct 25 16:06:59 www slapd[11969]: conn=26289 op=1 UNBIND Oct 25 16:06:59 www slapd[11969]: conn=26289 fd=29 closed Another time it is: Oct 25 16:27:09 www slapd[25691]: conn=2750 fd=51 ACCEPT from IP=**.**.**.**:54846 (IP=0.0.0.0:389) Oct 25 16:27:09 www slapd[25691]: conn=2750 op=1 SRCH base="ou=contacts,ou=china,dc=*******" scope=2 deref=0 filter="(uidNumber=7762)" Oct 25 16:27:10 www slapd[25691]: conn=2750 op=1 SRCH attr=o mail telephonenumber contactperson c st l street postalcode postofficebox facsimiletelephonenumber labeleduri businesscategory description pnglogo changetime lastrecapdate objectclass category 6. Track the log message at log level 4 (heavy trace debugging) and finding no clue. For example, one time, the last word is: Oct 25 22:23:48 www slapd[723]: connection_get(50) Oct 25 22:23:48 www slapd[723]: SRCH "ou=contacts,ou=china,dc=*******" 2 0 Oct 25 22:23:48 www slapd[723]: 0 0 0 Oct 25 22:23:48 www slapd[723]: filter: (uidNumber=2) Oct 25 22:23:48 www slapd[723]: attrs: Oct 25 22:23:49 www slapd[723]: Oct 25 22:23:49 www slapd[723]: connection_get(56) Oct 25 22:23:49 www slapd[723]: SRCH "ou=contacts,ou=china,dc=*******" 2 0 Oct 25 22:23:49 www slapd[723]: 0 0 0 Oct 25 22:23:49 www slapd[723]: filter: (uidNumber=2) Help, hints and suggestion of specific RTFM highly appreciated. Offering *paid* help to remote login to solve this problem is highly appreciated as well (please send me and my colleague on the 'cc' an email about the quotes). The problem exhausted us all. Thanks in advance! Zhang Weiwu

2 1

LDAP and Automount
by Holger Schier 25 Oct '10

25 Oct '10

Hey guys, I have a problem to get automount working correctly with my LDAP. I am using a Suse Linux Enterprise Edition 11. LDAP works fine, NFS too. The Client Desktops have an OpenSUSE 11.2 or 11.3. In the YaST LDAP Client I have activated the "Start Automounter" Option. On the Server I am working with the rfc2307bis.schema: ----- attributetype ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) objectclass ( 1.3.6.1.1.1.2.16 NAME 'automountMap' SUP top STRUCTURAL MUST ( automountMapName ) MAY description ) objectclass ( 1.3.6.1.1.1.2.17 NAME 'automount' SUP top STRUCTURAL DESC 'Automount information' MUST ( automountKey $ automountInformation ) MAY description ) ----- I added these next lines to my LDAP tree: ----- dn: ou=autofs,dc=MY,dc=DC objectclass: top objectclass: organizationalUnit ou: autofs dn: ou=home,ou=autofs,dc=MY,dc=DC objectclass: top objectclass: organizationalUnit ou: home dn: automountKey=/,ou=home,ou=autofs,dc=MY,dc=DC objectclass: top objectclass: automount automountInformation: SERVER:/home/& automountKey: / ------ and on the client maschine auto.master file: ----- /home ldap SERVER:ou=home,ou=autofs,dc=MY,dc=DC ----- and I added these lines in the /etc/sysconfig/autofs file (the old one are comments now) ----- DEFAULT_MAP_OBJECT_CLASS="automountMap" DEFAULT_ENTRY_OBJECT_CLASS="automount" DEFAULT_MAP_ATTRIBUTE="automountMapName" DEFAULT_ENTRY_ATTRIBUTE="automountKey" DEFAULT_VALUE_ATTRIBUTE="automountInformation" ----- But anyway, it doesn't want to work. What is missing? I tried to work with some guides in the net, but every guide isn't exact my case, so i tried it on my own. I am happy for every hint. Thanks. Holger

2 1

ldapsearch does not work properly
by Martin Jungowski 25 Oct '10

25 Oct '10

I'm facing a weird problem with ldapsearch on our companies CentOS OpenLDAP Server (CentOS 5.5, OpenLDAP 2.3.43-12.el5). Our DIT is as follows: o=company_name,c=country,ou=branch,ou=pool Within that pool are all users of that particular branch office. With some of those ldapsearch does not return a result when the search base is o=company_name but does return one starting with c=country,o=company_name: martin/linux2$ ldapsearch -x -h icld -b c=de,o=company_name uid | grep dn | grep s_sarwar dn: uid=s_sarwar,ou=pool,ou=branch,c=de,o=company_name martin/linux2$ ldapsearch -x -h icld -b o=company_name uid | grep dn | grep s_sarwar martin/linux2$ With other users within that same branch it works as expected: martin/linux2$ ldapsearch -x -h icld -b c=de,o=company_name uid | grep dn | grep t_ceylan dn: uid=t_ceylan,ou=pool,ou=branch,c=de,o=company_name martin/linux2$ ldapsearch -x -h icld -b o=company_name uid | grep dn | grep t_ceylan dn: uid=t_ceylan,ou=pool,ou=branch,c=de,o=company_name martin/linux2$ It does work for s_sarwar when I use the admin account to bind to in ldapsearch but my understanding is that it should work without it as well. We have no roles, no ACLs, no encryption, no nothing in that server. Simple authentication, nothing complicated. Any ideas? Martin -- Rieke Computersysteme GmbH Hellerholz 5 D-82061 Neuried Email: martin[at]rhm[dot]de

3 3

nss_ldap: could not determine LDAP server from ldap.conf or DNS
by Claudio Guzman 24 Oct '10

24 Oct '10

I get this error in the log files, Any idea what can cause this best regards

1 0

Authenticating OpenLDAP client with AD
by Vinay Kalkoti 23 Oct '10

23 Oct '10

Hi, I am working on authenticating OpenLDAP client with AD server. I saw lots of examples which map the rfc2307bis schema using nss_schema attribute in ldap.conf file # Enable support for RFC2307bis (distinguished names in group # members) nss_schema rfc2307bis and also, map the attributes of the rfc2307bis to the AD server schema attributes. nss_map_attribute uid msSFU30Name nss_map_attribute uidNumber msSFU30UidNumber nss_map_attribute gidNumber msSFU30GidNumber nss_map_attribute loginShell msSFU30LoginShell nss_map_attribute gecos name nss_map_attribute userPassword msSFU30Password nss_map_attribute homeDirectory msSFU30HomeDirectory Isn't there a way I can fetch the schema from the AD server and set it using nss_schema ?. Basically, I am looking at fetching the schema/objectClass/Attributes from the LDAP/AD server and make them as a client schema's so that I don't have to keep doing the mapping using nss_map_attribute and nss_schema. I am new to LDAP world, and I am sorry if I my question doesn't make any sense. I have seen lots of enterprise products which integrate with LDAP/AD. They provide a user interface to map the server side schema objectClass and attributes. I am trying to see if I can get rid of this and do it internally. Thanks, Vinay

2 3

ldap_unbind_s crashes, iphone
by Anil 22 Oct '10

22 Oct '10

Hi, I am using the OpenLDAP SDK for an iPhone project. On the iPhone 4, applications can go into the background (in a frozen state) and then come back to the foreground. When the app comes to the foreground, I do a unbind and then reconnect, to ensure I have a good connection (the LDAP server could do idle time out...). Sometimes, this ldap_unbind_s crashes the app, as noted below in the code and logs: if (LDAPServer) { NSLog(@"ldap_unbind_s req: %@", description); ldap_unbind_s(LDAPServer); NSLog(@"ldap_unbind_s completed: %@", description); } LDAPServer = NULL; Fri Oct 22 21:35:01 unknown CloudFace[780] <Warning>: ldap_unbind_s req: Entic.net Fri Oct 22 21:35:01 unknown com.apple.launchd[1] <Warning>: (UIKitApplication:net.entic.cf[0xb4bf]) Exited abnormally: Broken pipe Fri Oct 22 21:35:01 unknown SpringBoard[26] <Warning>: Application 'CloudFace' exited abnormally with signal 13: Broken pipe How should I handle proper unbind operation for this? I could just skip the whole unbind operation, and then make a *new* connection when the app is brought to the foreground and skip the whole ldap_unbind_s call. Is that the recommended action? Remember, the app can be in the background for just a few seconds or could be hours (when the connection would be dropped). I am trying to avoid having to make new connections repeatedly. I also have a method, setupServer() that is something like this: + (void) setupServer:(Server *)server { NSLog(@"+setupServer"); if ([server LDAPServer]) { NSLog(@"setupServer skipped... connection exists"); return; } ... } I have idle timeout set to 5 minutes on the LDAP server. Sometimes, even after 5-10 minutes, it doesn't crash, but sometimes it does... and it always seems to be in the ldap_unbind_s, I think. Thanks! Anil

1 0

Applying individual password policies
by Michael Starling 22 Oct '10

22 Oct '10

OPENLDAP 2.43 I have a default password policy working OK but I'd like to override the default policy for one individual. I create the policy and add this LDIF without any problems. dn: cn=user,ou=Policies,dc=mdvcat,dc=lott cn: user objectClass: pwdPolicy objectClass: person objectClass: top sn: Password Policy pwdAttribute: UserPassword pwdMaxAge: 0 pwdLockout: FALSE pwdMinLength: 10 I then try to apply the policy to a user with the following LDIF dn: uid=ldapmgr,ou=people,dc=mdvcat,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicy: cn=user,ou=Policies,dc=mdvcat,dc=lott I receive the following error. ldapadd -f ldapmgr.ldif -x -D cn=root,dc=mdvcat,dc=lott -W Enter LDAP Password: modifying entry "uid=ldapmgr,ou=people,dc=mdvcat,dc=lott" ldapadd: Undefined attribute type (17) additional info: pwdPolicy: attribute type undefined Any help would be appreciated Thanks, -Mike

2 2

Every user queried when one user logs in
by Gerrard Geldenhuis 22 Oct '10

22 Oct '10

Hi My question probably straddles both PAM and LDAP so please scan it to the bottom before outrightly dismissing it as being mis-posted. I am not sure if this is by design but when I login as a user to a box with LDAP enabled I see a search request for every possible user in my dirctory. This breaks my test system if I have more than 10 000 users, while is unlikely that I would have so many users I would still like to optimize the LDAP query to be slightly less verbose. I have added nss_base directive which I did not have to optimize the search but it has not had the desired effect I had hoped for, it has in fact added an additional 70 odd packets to the average network capture when a user authenticates. my /etc/ldap.conf: binddn uid=SysAuth,ou=Service Accounts,dc=mycompany bindpw secret pam_password clear base dc=betfair nss_base_passwd ou=people,dc=mycompany?sub nss_base_group ou=Groups,dc=mycompany?sub nss_base_group ou=PrivateGroups,dc=mycompany?sub nss_base_group ou=SystemGroups,dc=mycompany?sub sizelimit 1000 idle_timelimit 5 timelimit 10 bind_timelimit 5 nss_reconnect_tries 1 nss_reconnect_maxconntries 1 nss_reconnect_sleeptime 1 nss_reconnect_maxsleeptime 1 nss_reconnect_maxconntries 1 I have also played around with various debug levels in /etc/ldap.conf but I have not really been succesfull in matching requests I see there to requests I see in wireshark. The man page in centos (man pam_ldap and nss_ldap ) also does not make any mention of available log levels or what they do. I have also scanned the source code for some more info on log levels but did not find anything usefull. If it is in the source code then please point me to it. I have gone through the pam list logs and the closest I could find was a the following thread: https://www.redhat.com/archives/pam-list/2009-September/thread.html and a similar thread in December 2010. This threads although similar is related to groups and my problem is with every user being queried. I am also I am 90% certain that is a config error on my part but I have not been able to find that error yet and would welcome any assistance in finding the problem. My system-auth in /etc/pam.d/ looks as follows: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_access.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so debug account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so Using CentOS release 5.4 Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

1 1

LDAP backend TODO: Determine the real behaviour of DN+String and DN+Binary
by Andrew Bartlett 21 Oct '10

21 Oct '10

Anatoliy, The next big task, as I mentioned on mumble yesterday, for us to do on the OpenLDAP backend is to correctly test and implement the DN+String and DN+Binary matching rules. Once we have positive tests for these rules, then we can ask the OpenLDAP team to implement them, but we want to make sure we ask once, for the right thing (I may have already muddied the waters here, so I want to try again once, with the right info). The things we need to find out are: If I search on a DN+String attribute, does it match against the DN, or the DN+String. Likewise for the DN+Binary. If I attempt to add a duplicate DN+String value to an attribute, does it conflict (only unique values allowed in LDAP) based on the DN, or the DN +String. Likewise for DN+Binary. Once we understand this (and have tests to prove it), we need to implement proper matching rules based on these, upgrading our comparison functions to proper comparisons (not just canonicalise and memcmp()). Finally, we need to write the results of that research into a mail to Howard Chu and OpenLDAP tecnical, and see if they can help us by implementing this in their server, or if we should somehow deal with this client side. A particular difficulty is that we must have these values implement DN rules, such backlinks, changing on target rename and deleting when the target deletes etc, and a functional dereference control (or a replacement with extended DNs). There may be additional funny rules like the fact that you will see duplicates in backlinks that have different source String parts of the DN+String values, but for the same DN. I've CC'ed Howard, Pierangelo and openldap-technical to give them a heads-up about the fact that we are hoping to pick the ball up on this again, now some other matters have settled down. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc.

1 0

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by Helge Tore Høyland 21 Oct '10

21 Oct '10

Hi. I'm trying to get openldap up and running. I am following this howot: http://techpubs.spinlocksolutions.com/dklar/ldap.html I did a previous atempt yesterday, where i tried to do a tls setup. Today i have done a dpkg-reconfigure slapd so, everything should be back to start. /etc/hosts 127.0.0.1 localhost localhost.localdomain 192.168.1.5 server.htnett server krb1.htnett krb1 ldap1.htnett ldap1 # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts /etc/ldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=htnett URI ldap://192.168.1.5/ #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never /etc/ldap/slapd.conf er vedlagt. This is installed on a fully updated Debian 5.0.6 distro. slapcat gives a nice readout but: ldapsearch -x stats this: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) This means no other computer will be able to connect through net. Portmap is running, but hosts.allow and hosts.deny is emty. hostname is server. Anyone got a clue to whats wrong?

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical