openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

Re: tag=97 error in openLDAP
by Tim Dunphy 02 Nov '10

02 Nov '10

Thank you very much for your clarifying message. I have found it very helpful, but the problem actually turned out not to be the password, but the problem actually turned out to be the loginShell. 44 uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. ThatGuy givenName: Timothy P. sn: ThatGuy mail: bluethundr(a)example.com mailRoutingAddress: bluethundr(a)mail.example.com mailHost: mail.summitnjhome.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword: {CRYPT}secret uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. ThatGuy loginShell: /usr/local/bin/bash The LDAP server is FreeBSD but the clients are CentOS. The problem turned out to be that the PADL migration script that had generated the user ldif from /etc/passwd and produced the loginShell attribute with a BSD path to bash (i.e. /usr/local/bin/bash), when the clients which are all CentOS needed the red hat path to bash (i.e. /bin/bash). I have also added an index for uid to by slap.conf as per your suggestion. Best regards and thank you again for your assistance! On Sun, Oct 31, 2010 at 8:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, October 30, 2010 8:51 AM -0400 Tim Dunphy > <bluethundr(a)gmail.com> wrote: > >> Oct 29 22:49:41 LBSD2 slapd[1085]: <= bdb_equality_candidates: (uid) not >> indexed Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1001 op=7 SEARCH RESULT >> tag=101 err=0 nentries=1 text= >> Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 BIND >> dn="uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" >> method=128 >> Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 RESULT tag=97 err=49 >> text= >> tag=97 > > Tag's are not error messages, they are information purpose. > > Error messages are prefixed with "err=", in this case, your log clearly > shows the wrong password was used, or the binddn is wrong, or both. > > Thus the LDAP server returns "ERROR 49" very clearly in your log for > connection 1002. > > You likely should also create an equality index on uid, since apparently > your dns are uid based. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

1 0

ACL filter not working
by Darren Hildebrand 01 Nov '10

01 Nov '10

I'm having a problem with access control lists in slapd.conf. The filter doesn't seem to be working in OpenLDPA 2.4.23 using syntax that worked in 2.3.43. I've simplified my tests down to a single ACL rule just to see if it's working, and this is what I'm finding: I'm trying this ACL: access to dn.subtree="ou=users,dc=companyname,dc=com" filter="(objectClass=person)" by * read I tried an anonymous search using this command: ldapsearch -h 1.2.3.4 -x -b ou=users,dc=companyname,dc=com And it returned the following: # search result search: 2 result: 32 No such object I tried the same with the same ACL as above with the filter set to "(uid=*)", and got the same problem (note that all users have a uid value set). However, I tried with the filter set to "(objectClass=*), and it returned all users as I would expect. Has anything changed with ACL syntax between OpenLDAP 2.3 and 2.4? Or do you see any problems with the syntax of my ACL line above? Thanks. Darren

2 2

memberOf Overlay
by Bram Cymet 01 Nov '10

01 Nov '10

Hi, I am using the memberOf overlay and it works perfectly on my main ldap server but when I search for memberOf on my slave ldap server I don't see everything I should, however the member attributes all got synchronized properly. Any idea what is going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

1 0

LDAP filter question
by Antonio Batovanja 01 Nov '10

01 Nov '10

Hi, I'm having problems finding documentation for range filters. Can someone explain to me how to use a range filter on shadowExpire? From nis.schema: attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) so it's an integer value. from my slapd.conf (openldap 2.3.38): index shadowExpire pres,eq I'd like to find entries where either shadowExpire is not present, or shadowExpire is present and greater than or equal to X. # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire=*))' dn returns 978 entries. # ldapsearch -x '(&(objectclass=shadowaccount)(!(shadowexpire=*)))' dn returns 311 entries. But: # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire>1000))' dn gives me ldap_search_ext: Bad search filter (-7) and # ldapsearch -x '(&(objectclass=shadowaccount)(shadowexpire>=1000))' dn returns no results. At least one entry has shadowExpire > 1000: # ldapsearch -x -LLL uid=toni objectclass shadowexpire dn: cn=Batovanja Antonio,ou=People,ou=EDV Zentrale,dc=humanomed,dc=at objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: hmUserExtention objectClass: organizationalPerson shadowExpire: 20000 My final filter should be (|(shadowExpire=0)(shadowExpire>=14910)(!(shadowExpire=*))) but that's not working What am I doing wrong? Cheers, Toni

3 3

Dynamically unloading a module
by Jaap Winius 01 Nov '10

01 Nov '10

Hi folks, With cn=config (OpenLDAP 2.4.23-6 on Debian squeeze), dynamically loading a module is straightforward. E.g., create an LDIF to add the the attribute "olcModuleLoad: {1}syncprov" to the cn=module{0} entry, apply it and as a result the configuration will be changed and the module loaded. However, when attempting to do the reverse -- applying an LDIF to delete that same attribute and unload the module -- this error appears: modifying entry "cn=module{0},cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: cannot delete olcModuleLoad Of course, it is still possible to stop slapd, remove the unwanted attribute directly from /etc/ldap/slapd.d/cn=config/cn=module{0}.ldif and start slapd again, but surely that is not the preferred method. Can anyone explain what the correct method is for dynamically removing a module, or does this not work due to a bug in the aforementioned version of OpenLDAP? Thanks, Jaap

2 1

Multimaster "cluster" + Regular Slaves (consumers?)
by Ciro Iriarte 01 Nov '10

01 Nov '10

Hi, I've done some Master/Slave replication in the 2.2 era. Right now I'm looking to setup a multimaster replication with 2.4 on a main office (2 node pacemaker cluster) and at least 6 slaves (only "consumers" this days) on different branches. This LDAP directories will be used as samba backends. A PDC/BDC pair on the main office and BDCs on the branches. Should this work with the "only slaves" pointing to a clustered IP that could move between the two clustered nodes?. This resource can be for "load balancing" or failover only. Should regular replication work?, what about delta replication? Anybody has done something like this?. Regards, -- Ciro Iriarte http://cyruspy.wordpress.com --

1 0

tag=97 error in openLDAP
by Tim Dunphy 01 Nov '10

01 Nov '10

Hello, I recently had a "knowledgeable" friend work on my openldap server. he made some changes to the cofigs without backing them up and now users are unable to authenticate against this openldap 2.4 server where previously they could. I am running on FreeBSD 8.1. I am a student trying to learn and be comfortable with openLDAP. when a user ssh's to any machine on the network that is configured to listen to this ldap server now gets an error in the LDAP logs: Oct 29 22:49:41 LBSD2 slapd[1085]: <= bdb_equality_candidates: (uid) not indexed Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1001 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 BIND dn="uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" method=128 Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=4 RESULT tag=97 err=49 text= Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=5 BIND dn="" method=128 Oct 29 22:49:41 LBSD2 slapd[1085]: conn=1002 op=5 RESULT tag=97 err=0 text= it looks like it's failing to bind: conn=1003 op=3 BIND dn="" method=128 and I think this error may be key but I am unsure of it's meaning: tag=97 my ldap.conf reads as so: host ldap.summitnjhome.com base dc=summitnjhome,dc=com scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com And why would the uid not be indexed? and this is the user id in LDAP: [root@LBSD2:/home/bluethundr/txt/ldif]#cat bluethundr.ldif dn: uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. givenName: Timothy P. sn: mail: bluethundr(a)blah.com mailRoutingAddress: bluethundr(a)mail.blah.com mailHost: mail.blah.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword: {CRYPT}secret loginShell: /usr/local/bin/bash uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. and these are my ACL's in slapd.conf: access to * by read access to attrs=userPassword by self write by anonymous auth access to * by self write by dn.children="ou=summitnjops,ou=staff,dc=summitnjhome,dc=com" write by users read by anonymous auth access to * by self write I would certainly appreciate any help to get this working again! thank you -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

2 1

Push-based syncrepl + slapo-rwm
by Raphael Ordinas 29 Oct '10

29 Oct '10

Hi, I'd like to replicate with syncrepl a master directory and change the naming context on the consumer. I try setup a syncrepl push-based synchronization, with a proxy and slapo-rwm overlay. Here's what my config looks like : MASTER LDAP (suffix : dc=suffix1,dc=com) | | | PROXY push-based syncrepl and slapo-rwm (rewrite "dc=suffix1,dc=com" to "dc=suffix2,dc=com") | | | SLAVE (suffix : dc=suffix2,dc=com) I can't get rewriting working on the proxy, data are pushed to my slave directory with the suffix "dc=suffix1,dc=com". So replication don't work because of different naming context. PROXY's slapd.conf looks like this : ############################## database ldap hidden on suffix "dc=suffix2,dc=com" rootdn "cn=admin,dc=suffix2,dc=com" uri ldap://slave/ lastmod on restrict all acl-bind bindmethod=simple binddn="cn=admin,dc=suffix2,dc=com" credentials=secret overlay rwm rwm-rewriteEngine on rwm-suffixmassage "dc=suffix2,dc=com" "dc=suffix1,dc=com" overlay syncprov syncrepl rid=001 provider=ldap://master/ binddn="cn=admin,dc=suffix2,dc=com" bindmethod=simple credentials=secret searchbase="dc=suffix2,dc=com" type=refreshAndPersist retry="5 5 300 5" ############################## What's wrong ? Thank you for your help. Regards Raphael

1 0

Regarding overlay acceslog and auditlog
by Sai Suman Mallela 28 Oct '10

28 Oct '10

Hi, I need to implement overlay accesslog / auditlog to gain the client information (host name, service etc) who access our ldap server. Following are the openldap details: version : openldap-2.2.29operating system : Windows server 2003 I would appreciate any help to configure the slapd.conf file and the necessary schemas. Thanks, Sai

1 0

Error 18: Solaris 10 Native LDAP-Client
by Benjamin Griese 28 Oct '10

28 Oct '10

Hello guys, I got a problem while pulling information with the native ldap client on my various solaris 10 machines from an openldap2-2.4.23-116.1 Maybe someone has any ideas, because I am on the end of mine. I don't know what to do in the further steps to solve the problem. the important information are below. thanks for your help. kind regards, benjamin. ============================================================= on the solaris box: solaris profile pulled from DIT, runs absolutly fine, but is maybe not perfect for openldap # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=proxyuser,ou=system,ou=people,dc=example,dc=de NS_LDAP_BINDPASSWD= secret NS_LDAP_SERVERS= ldap01 ldap02 NS_LDAP_SEARCH_BASEDN= dc=example,dc=de NS_LDAP_AUTH= simple NS_LDAP_SEARCH_REF= FALSE NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 60 NS_LDAP_PROFILE= solaris_profile NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=people,dc=example,dc=de?sub NS_LDAP_SERVICE_SEARCH_DESC= group: ou=groups,dc=example,dc=de?sub NS_LDAP_SERVICE_SEARCH_DESC= sudoers: ou=SUDOers,dc=example,dc=de?sub NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=people,dc=example,dc=de?sub NS_LDAP_BIND_TIME= 10 NS_LDAP_OBJECTCLASSMAP= group:posixGroup=posixGroup NS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=posixAccount NS_LDAP_OBJECTCLASSMAP= sudoers:sudoRole=sudoRole # ldaplist passwd ldaplist: Object not found (LDAP ERROR (18): Inappropriate matching.) getent passwd/group dont show anything, but strangely, single "id <username>" show the user information I was expecting. on sles11sp1/openldap2-2.4.23-116.1 (http://download.opensuse.org/repositories/network:/ldap:/OpenLDAP:/RE24/SLE…) thats what I see in the logs on the openldap-server, right after typing "ldaplist passwd" on the solaris box Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 fd=22 ACCEPT from IP=10.0.0.1:45604 (IP=0.0.0.0:389) Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=0 BIND dn="cn=proxyuser,ou=system,ou=people,dc=example,dc=de" method=128 Oct 15 14:37:33 examplehost slapd[8339]: => bdb_entry_get: found entry: "cn=proxyuser,ou=system,ou=people,dc=example,dc=de" Oct 15 14:37:33 examplehost slapd[8339]: => bdb_entry_get: found entry: "cn=default,ou=pwdpolicy,dc=example,dc=de" Oct 15 14:37:33 examplehost slapd[8339]: => access_allowed: result not in cache (userPassword) Oct 15 14:37:33 examplehost slapd[8339]: => access_allowed: auth access to "cn=proxyuser,ou=system,ou=people,dc=example,dc=de" "userPassword" requested Oct 15 14:37:33 examplehost slapd[8339]: => acl_get: [1] attr userPassword Oct 15 14:37:33 examplehost slapd[8339]: => acl_mask: access to entry "cn=proxyuser,ou=system,ou=people,dc=example,dc=de", attr "userPassword" requested Oct 15 14:37:33 examplehost slapd[8339]: => acl_mask: to value by "", (=0) Oct 15 14:37:33 examplehost slapd[8339]: <= check a_dn_pat: cn=ldapadm,dc=example,dc=de Oct 15 14:37:33 examplehost slapd[8339]: <= check a_dn_pat: cn=proxyuser,ou=system,ou=people,dc=example,dc=de ## just for testing purpose Oct 15 14:37:33 examplehost slapd[8339]: <= check a_dn_pat: anonymous Oct 15 14:37:33 examplehost slapd[8339]: <= acl_mask: [3] applying auth(=xd) (stop) Oct 15 14:37:33 examplehost slapd[8339]: <= acl_mask: [3] mask: auth(=xd) Oct 15 14:37:33 examplehost slapd[8339]: => slap_access_allowed: auth access granted by auth(=xd) Oct 15 14:37:33 examplehost slapd[8339]: => access_allowed: auth access granted by auth(=xd) Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=0 BIND dn="cn=proxyuser,ou=system,ou=people,dc=example,dc=de" mech=SIMPLE ssf=0 Oct 15 14:37:33 examplehost slapd[8339]: => bdb_entry_get: found entry: "cn=proxyuser,ou=system,ou=people,dc=example,dc=de" Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=0 RESULT tag=97 err=0 text= Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=1 SEARCH RESULT tag=101 err=18 nentries=0 text=serverSort control: No ordering rule Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=1 do_search: get_ctrls failed Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 op=2 UNBIND Oct 15 14:37:33 examplehost slapd[8339]: conn=1160 fd=22 closed that seems to be a problem with a supportedControl of the ldap-server which the solaris ldap client is unable to handle, because the local openldap-client in the sles-server has absolutly no problem binding and getting infos. is this kind of offtopic for this list? http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com… says 18 LDAP_INAPPROPRIATE_MATCHING Inappropriate matchingFilter type not supported for the specified attribute. but I don't know what to do this seems kind of related to this problem, maybe its the same: http://markmail.org/message/dgtk3rpihvkqndqx#query:serverSort%20control%3A%… -- To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To be is to do -- Sartre | Do be do be do -- Sinatra

3 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical