openldap-technical

openldap-technical@openldap.org

9 participants
9873 discussions

OpenLDAP + Samba , very poor performance
by Becskei Robert 13 Oct '10

13 Oct '10

Dear List, I have CentOS 5.5 64bit (fully updated) , Samba3 3.5.5-43.el5 (SerNETSamba) , openldap-2.3.43-12.el5_5.2 , nss_ldap-253-25.el5 .My Problem is , If I login to the domain and run a program from the Samba3 Server it's slow , if I login from this same machine but this time to the local account, and then I go to the Samba3 server specify domain admin password when asked for it(only once,when accessing the desired share) and run the same program I'm 2-3x times faster. I've googled a bit, and found another guy was having speed problems when runing programs on a Samba3 server with ldap backend. But I must admit I'm no Openldap expert, if you can please take a look at my config and tell me what is wrong with it, it's probably the ldap part... what I did try sofar stoped openldap , and did a slapindex, and started it again but no help. Bellow are my config files : /etc/samba/smb.conf [global] use sendfile = yes read raw = yes write raw = yes #max xmit = 65535 dead time = 30 getwd cache = yes lock spin time = 200 workgroup = CAPRIOLOBIKE netbios name = PDC-SERVER server string = cfile-server log file = /var/log/samba/log.%m max log size = 50 security = user encrypt passwords = yes # Added by moquist obey pam restrictions = No ldap passwd sync = Yes time server = Yes unix password sync = no # Added by moquist log level = 1 syslog = 0 mangling method = hash2 dos charset = 850 unix charset = ISO8859-1 passwd program = /usr/sbin/smbldap-passwd -u %u username map = /etc/samba/smbusers interfaces = bond0 local master = yes os level = 200 domain master = yes preferred master = yes domain logons = yes logon script = scripts\%m.bat # Added by moquist logon drive = X: logon home = \\%L\home\%U passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=capriolobike,dc=com ldap suffix = dc=capriolobike,dc=com ldap group suffix = ou=Groups ldap user suffix = ou=Users ldap machine suffix = ou=Computers ldap idmap suffix = ou=Users ldap ssl = off ldap delete dn = Yes # use the smbldap-tools scripts add user script = /usr/sbin/smbldap-useradd -m "%u" delete user script = /usr/sbin/smbldap-userdel "%u" add machine script = /usr/sbin/smbldap-useradd -w "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" delete group script = /usr/sbin/smbldap-groupdel "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u" logon path = wins support = yes #dns proxy = yes name resolve order = wins bcast hosts #veto oplock files = /*.doc/*.xls/*.mdb/ #============================ Share Definitions ============================== idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/false winbind use default domain = no [IPC$] path = /tmp browsable = No [homes] comment = Home Directories valid users = %S browseable = No writable = yes create mask = 0600 directory mask = 0700 [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon guest ok = Yes [profiles] comment = Profile Share path = /var/lib/samba/profiles writeable = yes browseable = No create mode = 0600 directory mode = 0700 [backup1] comment = Private Backup 1 path = /share read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 valid users = denes invalid users = bikeclub oplocks = false level2 oplocks = false [storage3] comment = Public Storage 3 path = /share5 read only = No create mask = 0777 directory mode = 0777 force create mode = 077 invalid users = bikeclub oplocks = false level2 oplocks = false [storage2] comment = Public Storage 2 path = /share2 read only = No create mask = 0777 directory mask = 0777 force create mode = 0777 invalid users = bikeclub oplocks = false level2 oplocks = false [storage] comment = Public Storage path = /share3 read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 invalid users = bikeclub oplocks = false level2 oplocks = false [novosti] comment = Novosti path = /share4 read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 invalid users = bikeclub oplocks = false level2 oplocks = false [drivers1] comment = Drivers 1 path = /drivers1 read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 invalid users = bikeclub oplocks = false level2 oplocks = false [drivers2] comment = Drivers 2 path = /drivers2 read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 invalid users = bikeclub oplocks = false level2 oplocks = false [drivers3] comment = Drivers 3 path = /drivers3 read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 invalid users = bikeclub oplocks = false level2 oplocks = false [K] path = /app_capri read only = No create mask = 0777 directory mode = 0777 force create mode = 0777 invalid users = bikeclub oplocks = true level2 oplocks = true [T] path = /app_kripton read only = No create mask = 0777 directory mask = 0777 force create mode = 0777 invalid users = bikeclub oplocks = true level2 oplocks = true [Q] path = /backuppc/WINGS read only = No create mask = 0777 directory mask = 0777 force create mode = 0777 invalid users = bikeclub oplocks = true level2 oplocks = true /etc/openldap/ldap.conf # $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $ # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. HOST 127.0.0.1 BASE dc=capriolobike,dc=com TLS_CACERTDIR /etc/openldap/cacerts /etc/openldap/slapd.conf # $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $ # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. HOST 127.0.0.1 BASE dc=capriolobike,dc=com TLS_CACERTDIR /etc/openldap/cacerts [root@pdc-server openldap]# cat slapd.conf # $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.8 2003/05/24 23:19:14 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/slapd.pid ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=capriolobike,dc=com" rootdn "cn=Manager,dc=capriolobike,dc=com" rootpw my_secret_code # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub /etc/ldap.conf host 127.0.0.1 base dc=capriolobike,dc=com rootbinddn cn=nssldap,ou=DSA,dc=capriolobike,dc=com timelimit 30 bind_timelimit 30 ssl no pam_password md5 tls_cacertdir /etc/openldap/cacerts bind_policy soft nss_initgroups_ignoreusers ldap /var/lib/ldap/DB_CONFIG # $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.1.2.4 2007/12/18 11:51:46 ghenry Exp $ # Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. # # See the Oracle Berkeley DB documentation # <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co nfig.html> # for detail description of DB_CONFIG syntax and semantics. # # Hints can also be found in the OpenLDAP Software FAQ # <http://www.openldap.org/faq/index.cgi?file=2> # in particular: # <http://www.openldap.org/faq/index.cgi?file=1075> # Note: most DB_CONFIG settings will take effect only upon rebuilding # the DB environment. # one 0.25 GB cache set_cachesize 0 268435456 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs # Note: special DB_CONFIG flags are no longer needed for "quick" # slapadd(8) or slapindex(8) access (see their -q option). Sincerely Robert Becskei

1 0

multi-master consumer refresh present problems
by Barry Colston 13 Oct '10

13 Oct '10

I am trying to configure a 2 LDAP directory server system that allows updates to occur (from a user) on server 1 and server 2 with server 1 replicating changes to server 2 via the refresh and persist method of syncrepl. Only a small number of records will be updated by users on server 2 (5,000 records) and the changes will be made only within 2 unique branches of the tree (ounit=system,dc=authentx and permissions=dxy,ounit=permissions,dc=authentx); any records that are updated/added/deleted by users on server 2 must not be replicated to server 1. Replication is one-way from server 1 from server 2. Replication works fine if both the provider and consumer servers are up. The problem I am having occurs when server 2's consumer slapd starts and a refresh present phase occurs (a refresh present phase occurs if changes are made to the provider while the consumer is down and then the provider slapd is bounced (stopped/restarted). In scenario 1, I defined the consumer to replicate everything from the provider. When the refresh present occurs on the consumer, the consumer slapd deletes any records that were previously added by a user at server 2. My understanding is that this is the normal behavior. In scenario 2, I defined the consumer to replicate only certain branches from the provider by specifying a "filter" statement in the "syncrepl" section of the slapd.conf file. When the refresh present occurs on the consumer, the consumer slapd deletes numerous records within some of the branches that were specified in the filter statement. For example, my syncrepl statement is: syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="30 60 60 +" searchbase="dc=authentx" filter="(|(entrydn:dnSubtreeMatch:=ounit=credentials,dc=authentx) (entrydn:dnSubtreeMatch:=ounit=entities,dc=authentx) (entrydn:dnSubtreeMatch:=permissions=authentx,ounit=permissions,dc=authentx) (entrydn:dnSubtreeMatch:=permissions=hspd12,ounit=permissions,dc=authentx))" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="SECRET" mirrormode on The consumer slapd did not delete records incorrectly when I tested with a 3,000 record database, but when I tested with a 750,000 record database, when the refresh present occurs on the consumer, the consumer slapd deletes numerous records within some of the branches that were specified in the filter statement (these are deleted by the syncrepl_del_nonpresent() function, based on messages in the slapd log file with sync debug turned on). The 750,000 record database provider has records in the following branches: ounit=credentials,dc=authentx (300,000+ records) ounit=entities,dc=authentx (20,000+ records) permissions=authentx,ounit=permissions,dc=authentx (6 records) permissions=dxy,ounit=permissions,dc=authentx (4,000+ records) permissions=hspd12,ounit=permissions,dc=authentx (50,000+ records) ounit=system,dc=authentx (13 records) After the sync refresh phase occurred on the consumer, the consumer database has records in the following branches: ounit=credentials,dc=authentx (300,000+ records) ounit=entities,dc=authentx (20,000+ records) permissions=authentx,ounit=permissions,dc=authentx (0 records) permissions=dxy,ounit=permissions,dc=authentx (0 records) permissions=hspd12,ounit=permissions,dc=authentx (0 records) ounit=system,dc=authentx (0 records) In scenario 3, I defined the consumer as a multi-master consumer by specifying the "overlay syncprov" section in the slapd.conf file. When a "Refresh Present" phase is performed at a multi-master consumer, objects that were deleted at the provider while the consumer was down are not deleted from the multi-master consumer (if the provider is brought down and back up after the consumer is down). I wrote ITS#6671 for this problem. Does anyone have any suggestions on how I can accomplish my requirements for the 2 servers? Barry Colston

1 0

support for arbitrary PKCS11 pin input method
by Silvan Marco Fin 13 Oct '10

13 Oct '10

Hi! I searched through tls_m.c for means to enter the token PIN for a PKCS11 token. I found a call to PK11_SetPasswordFunc(). The callback is set to tlsm_pin_prompt(), which by itself uses tlsm_get_pin(). tlsm_get_pin() only supports reading the PIN from file or via STDIN. To be usable within any form of gui, there would have to be some method to pass a GUI callback to ask for the PIN. Do you plan on implementing such a feature in the near future or is there a proposed way of setting such a callback method? Kind regards, Silvan

3 4

Tree, ACL and auth...
by Jarek 11 Oct '10

11 Oct '10

Hello! I'd like to create administrator groups under each OU, so this administrator will be allowed to manage everything in this OU. by default, I'm creating simpleSecurityObject with cn=admin in each administrators group, so OU administrator can login as OU, or if there are more administrators, they can use admin_name@OU as username. This works nice if I have OU on one level. I have no idea, how to do it, if I will have more complicated structure, i.e.: root +-ou=department1 | +-ou=administrators | +-cn=admin | +-cn=admin2 | +-ou=department2 +-ou=administrators | +-admin | +-ou=subdepartment1 | +-ou=administrators | +-admin +-ou=subdepartment2 | +-ou=administrators | +-admin ... I can assume that all departments will have unique names. I'd like that each admin will be able login as department (=>admin@department) or as user@department. Is there any way, to ensure that each ou (with specific objectClass=departement) will have unique name ? Is it possible to construct bind dn, with only department (ou) name ? I'd like to avoid using loginname as: admin2(a)subdepartment2.departmnt2 if I'm sure that supdepartment2 name is unique. I've tried to do it in two steps: search DN of subdepartment-N as anonymous, than add "cn=admin,ou=administrators" as prefix and then login as right user with password. It works, but it requires read access to all tree for anonymous which may not be acceptable. I've tried to limit annonymous access to only dc and ou attributes, but with such ACL I see only first level of ou. Thanks in advance! -- Jarek <jarek(a)poczta.srv.pl>

1 0

problems updating from provider?
by Tim Tyler 11 Oct '10

11 Oct '10

Openldap experts, I am currently running openldap 2.3.43 on a RedHat 5.5 system. I recently had to move one of my replication ldap servers to another box. After doing so, it won’t update from the provider any more. I had simply done a slapcat of the provider’s db into a ldif file and then slapadd it into the replication server. It runs fine and looks up data, but it won’t update any changes from the provider. I have a second replication server which works just fine with updates from the provider. So I am pretty sure the problem is with this replication server. I restored the configurations exactly as I had it previously when it was working. What might I be doing wrong? Does this suggest that I might have a permissions problem or perhaps a corrupt database? I can’t seem to find a permission difference between my two replications servers. Is it acceptable to simply do a slapadd –l filename.ldif or should I include other parameters when adding in the files from scratch? Note: the only file that exists in the ldap database directory is the DBCONFIG file when restoring the ldif. Below is a part of my syncrepl config in slapd.conf in case that helps. syncrepl rid=102 provider=ldaps://xxx.beloit.edu:636 type=refreshAndPersist interval=00:01:00:00 searchbase="dc=beloit,dc=edu" filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Admin,dc=beloit,dc=edu" I must be missing something. Any advice? Tim Tyler Network Engineer Beloit College

2 1

Recommended approach for LDAP as backend for virtual domain mail hosting?
by Andreas Ntaflos 11 Oct '10

11 Oct '10

Hi, I will probably also post this to the Postfix mailing list but it is fundamentally an (Open)LDAP question so here goes: Short version: What is a recommended way to set up virtual mail hosting based on OpenLDAP? I.e. providing mail and authentication services, like SMTP and IMAP, using Postfix and Dovecot, for multiple *independent domains* such as example.net, example.org, example.com? I am looking for RTFMs, HOWTOs, blogs, or any experience and anecdotes users on this list can provide. I myself no experience designing a DIT in LDAP (I am more at home in Postgres) and have much learning to do. Long version: I know such setups exist and I have found many references in the archives of this list but there was never a completely straigt- forward answer that didn't say "it depends on your requirements" or involve frontends/add-ons like Jamm or Phamm, which I have no interest in. So the requirements are basically: * Independent domains and users, i.e. john.doe(a)example.org is completely different/distinct from john.doe(a)example.net, even though both may be the same physical human being. * Thus accounts in different domains must have separate passwords fields * Groups and aliases must be possible * Performance should not be terrible, obviously * Applications such as Apache, Ejabberd, Wikis and Webmail clients (to name a few) which support LDAP authentication should be able to query the DIT or DITs without needing any hacks or ugly constructs (this is a vague requirement, I know). Now I believe the question basically boils down to this: Should we use multiple independent backend databases (DITs) or one large "hosting" database as described in [1,2]? Which of the two is the better approach? Which is more flexible, which has less administrative or functional overhead? If we use multiple DITs we probably will have to glue them together somehow, won't we? How would queries against multiple independent DITs look? Our current setup is more like [1,2], one big hosting database. It is a PostgreSQL database with a few tables for virtual domains (virtual_mailbox_domains in Postfix), virtual users (virtual_mailbox_maps), virtual aliases (virtual_alias_maps) and a few others. It is based loosely on [3]. This works fine but now the need has arisen to see if we can migrate that setup to an LDAP-based one, mainly for flexibility and compatibility with various authentication needs: many applications and services provide some kind of LDAP-based authentication but are hopelessly overwhelmed with SQL backends, especially when the queries are a bit complex. Thanks in advance! Andreas PS: I gathered much from the article in [1] but by now it is over 7 years old and many things have changed so I can't follow it to the letter. [1] http://www.linuxjournal.com/article/5917 [2] http://www.linuxjournal.com/files/linuxjournal.com/linuxjournal/articles/05… [3] http://workaround.org/ispmail/lenny

4 13

Question about openldap and Outlook
by David Díaz Díaz 08 Oct '10

08 Oct '10

Hello All, I'm not sure if this list is the appropiate place to make a question about ldap & outlook, in case not, please let me know. I'm newbie with Open Ldap, I'm using it with qmail and vpopmail (my mailserver) and I can access to my LDAP book address using outlook, I can search users and everithing works fine, but the only issue that I had is when I tried to display info for any group; let me explain, I can see the group, outlook identify it, but when I tried to see the members of that group, the outlook doesn't display any info, instead of members, the outlook display the records as another member... I was looking on a lot websites info about my issue, but I couldn't find anything... any idea? Saludos! davidiaz

2 1

OpenLDAP configured as Proxy
by Marco Pizzoli 08 Oct '10

08 Oct '10

Hi all, is there a way to obtain a OL configuration to permit proxying an ldap connection without knowledge in advance about the target ldap server? Simple scenario, I would like to put a proxy system in front of a client which is trying to check a Certificate Revocation List (CRL), which is published via internet. I cannot "register" in advance all possibile public CAs in my slapd configuration. I'm searching a way similar to a SOCKS server but specialized for the LDAP protocol. Any hint eventually involving other LDAP tools are obviously appreciated. Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

Replication server won't update from provider after moving it?
by Tim Tyler 08 Oct '10

08 Oct '10

1 0

How can I make the unique overlay play nicely with my ACL?
by Owen Jacobson 08 Oct '10

08 Oct '10

Hi there, I'm trying to enforce that the 'uid' attribute is globally unique in my tree using the unique overlay. For a collection of mostly-uninteresting reasons, the LDAP server is publicly connectable but not publicly searchable (details below). It appears that the unique overlay uses the *worst possible* combination of credentials to perform the searches it uses to guarantee uniqueness. All of the following information was obtained from ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config -- it's really what slapd thinks it's seeing. My unique configuration: dn: olcOverlay={0}unique,olcDatabase={1}hdb,cn=config objectClass: olcUniqueConfig olcOverlay: {0}unique olcUniqueURI: ldap:///dc=unreasonent,dc=com?uid?sub? My database configuration (indexes and hdb configuration elided): dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap/unreasonent.com olcSuffix: dc=unreasonent,dc=com olcAccess: {0}to attrs=userPassword by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by group="cn=Directory Administrator,ou=Roles,dc=internal,dc=unreasonent,dc=com" manage by anonymous auth by self write by * none olcAccess: {1}to attrs=shadowLastChange by self write by * break olcAccess: {2}to dn.base="" by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by group="cn=Directory Administrator,ou=Roles,dc=internal,dc=unreasonent,dc=com" manage by * break olcAccess: {3}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by group="cn=Directory Administrator,ou=Roles,dc=internal,dc=unreasonent,dc=com" manage by users read by peername.regex="IP=10.27.70.6\:\d+" read by * none (The peername.regex ACL entry is shrapnel from my attempts to make this work on my own, but it came in handy. The IP address there is the IP address of my LDAP server.) As you can see anonymous users are allowed to do one thing: authenticate. My tree contains the following user already: dn: uid=owen,ou=People,dc=internal,dc=unreasonent,dc=com When I log in with the user above (who is in the group cn=Directory Administrator,ou=Roles,dc=internal,dc=unreasonent,dc=com) and add the following test user dn: uid=owen,ou=test,ou=People,dc=unreasonent,dc=com changetype: add objectClass: inetOrgPerson uid: owen sn: Test cn: Test the add succeeds (which should not happen, as the UID is already in use). A little digging with slapd -d -1 reveals that the unique overlay is doing a search of its own: ==> unique_add <uid=owen,ou=test,ou=People,dc=unreasonent,dc=com> ==> unique_search (|(uid=owen)) str2filter "(|(uid=owen))" put_filter: "(|(uid=owen))" put_filter: OR put_filter_list "(uid=owen)" put_filter: "(uid=owen)" put_filter: simple put_simple_filter: "uid=owen" begin get_filter OR begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0xb5dd5438 ptr=0xb5dd543a end=0xb5dd5447 len=13 0000: a3 0b 04 03 75 69 64 04 04 6f 77 65 6e ....uid..owen end get_filter 0 end get_filter_list end get_filter 0 => hdb_search bdb_dn2entry("dc=unreasonent,dc=com") => access_allowed: search access to "dc=unreasonent,dc=com" "entry" requested => dn: [3] => acl_get: [4] attr entry => acl_mask: access to entry "dc=unreasonent,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth <= check a_dn_pat: users <= check a_peername_path: IP=10.27.70.6\:\d+ => acl_string_expand: pattern: IP=10.27.70.6\:\d+ => acl_string_expand: expanded: IP=10.27.70.6\:\d+ => regex_matches: string: IP=10.27.70.210:46908 => regex_matches: rc: 1 no matches <= check a_dn_pat: * <= acl_mask: [5] applying none(=0) (stop) <= acl_mask: [5] mask: none(=0) => slap_access_allowed: search access denied by none(=0) => access_allowed: no more rules send_ldap_result: conn=1029 op=33 p=3 send_ldap_result: err=32 matched="" text="" => unique_search found 0 records As you can see, (a) the IP address the search "comes from" is not the IP address of the LDAP server nor is it the LDAP server's ldapi:// socket (it's actually my client machine's IP address) and (b) the authenticated DN used in the search is empty. Combined, these two facts lead to slapd deciding the search is not permitted by the ACL, which in turn causes the unique overlay to decide no other entries with the same uid exist. This seems wrong: the connection from that IP and port has already authenticated as a user (which would've permitted the search). Assuming for the moment that allowing the world at large to search my LDAP server is not an option, how can I allow the unique overlay to enforce my constraint? -o

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical