openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Invalid credentials (49)
by Claudio Martella 23 Sep '10

23 Sep '10

Hello, I have a windows 2008 server, serving users auth with AD. I have another windows 2003 server, serving other users. I'm trying to access them through openldap and an PHP application. I can easly access my 2003 server with this command: ldapsearch -x -D "cn=cm,cn=TIS,dc=TIS,dc=local" -W -H ldap://192.168.10.206 but when i try to access the 2008 server with the same command i get: ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 525, v1772 in this case my user is "cm" and he is in the "TIS" folder and i can login from a windows client with user TIS\cm successfully. I've tried also with -Z and -ZZ, in that case i get a service unavailable error. Do you have any idea why this would happen? Claudio -- Claudio Martella Digital Technologies Unit Research & Development - Analyst TIS innovation park Via Siemens 19 | Siemensstr. 19 39100 Bolzano | 39100 Bozen Tel. +39 0471 068 123 Fax +39 0471 068 129 claudio.martella(a)tis.bz.it http://www.tis.bz.it

2 1

openldap back-sock
by stefano vital 23 Sep '10

23 Sep '10

Hi, I have a question about a special LDAP setup , I try to use sock backend for bind user that after succesfull bind have to search on another backend, Here my slapd.conf on openldap 2.4.11 access to * by users read ##################BACKEND SOCK################################################# database sock suffix "dc=reg-bus-users-local,dc=it" #catturo le richieste riscritte da rwm bloccando richieste di lettura e scrittura dirette socketpath /tmp/ldapauthorization.sock ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=tfk,dc=tfkdatastore" rootdn "cn=Root,dc=tfk,dc=tfkdatastore" rootpw xxxxx I also made a fake bind in server listening on socket ldapauthorization.sock if ($request eq "BIND\n") { my %req = (); print "RESULT\n"; print "code: 0\n"; print "matched: cn=fratbrother,dc=reg-bus-users-local,dc=it\n"; } my ldapsearch is : ldapsearch -H ldap://localhost:389/ -D "cn=fratbrother,dc=reg-bus-users-local,dc=it" -w xxxx -x -b "dc=tfk,dc=tfkdatastore" "(objectClass=*)" "*" result : ldap_bind: Insufficient access (50) my goal if work , is to make bind = (bind + search attribute) in other ldap server check the validity of attribute and then response bind succesfull, so redirected bind with check on remote attribute , is possible to do that ? is the right usage of backend sock ? Ps : also noted that ldap does not connect to socket but make response directly "insufficient access". Ps : sorry for the bad english Thanks in Advance Stefano Vitali

1 0

problem with replication
by Craig White 23 Sep '10

23 Sep '10

never did replication and certain to be something that I did but this is the type of error I am getting... Sep 15 10:58:44 srv1 slapd[2766]: slap_client_connect: URI=ldap://srv2.ayr1.local DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) Sep 15 10:58:44 srv1 slapd[2766]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) Obviously because I didn't tell it NOT to use SASL bind for replication. Is there some simple adjustment to use something other than SASL for credentials when replicating? Craig

2 8

Setting up a chain overlay
by Bram Cymet 23 Sep '10

23 Sep '10

Hi, I am trying to setup a chain overlay to allow writes to a read-only slave to be chained up to the master. The closest ldif file I could figure out to update the cn=config directory was: dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDBURI:ldap://10.1.0.3/ olcDbIDAssertBind: bindmethod=simple binddn="cn=admin,dc=roessner-net,dc=de" credentials=********** mode=self This works until I have to restart the slave ldap server because this is an invalid config. Can anyone let me know an ldif file to set up the chain to the master? Or at least point me to the right direction. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

4 7

Re: Problem of getpeereid.c:38: error: storage size of ‘peercred’ isn’t known
by Gavin Henry 22 Sep '10

22 Sep '10

Simply add CPPFLAGS=-D_GNU_SOURCE Don't email people directly :-) ----- Original Message ----- Hey , when i configure LDAP i got this error "getpeereid.c:38: error: storage size of ‘peercred’ isn’t known " also i saw your answer Presumably a dup of ITS#5464. > Workaround: Compile with CPPFLAGS=-D_GNU_SOURCE. what is the Presumably ? can you pls give me the full command that should i follow ??? Thx !! -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Replicating from a mirrormode pair to a read-only server
by Andrew Findlay 22 Sep '10

22 Sep '10

I am updating an OpenLDAP installation at present, and one of the improvements is to introduce a pair of master servers running in mirror mode. There will be several read-only servers as well, and I would like those to replicate from whichever master is currently available. I did the obvious thing, and put two syncrepl clauses in the read-only server's config - one for each master server. Starting with an empty database, the read-only server chews CPU badly and generates thousands of log messages like this: Sep 2 14:57:34 nis0 slapd[9257]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: conn=-1 op=0: attribute "entryCSN" index delete failure Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: conn=-1 op=0: attribute "entryCSN" index delete failure .... Sep 2 14:56:10 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:10 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: conn=-1 op=0: attribute "localAttribute" index add failure Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) It is very likely that each syncrepl connection will be retrieving the same entries at about the same time, so there is clearly potential for collisions. Question: is this topology sensible? If it is expected to work I will gather some debug data for an ITS. If not, I will have to drop back to plan B... OpenLDAP 2.4.22 with BerkeleyDB.4.8 running on SLES 10.3 i586 Thanks Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

3 8

slapo-rwm : concatenate rule
by Anthony Milan 22 Sep '10

22 Sep '10

Hi, I would like to create a rewrite rule with slapo-rwm using back-relay to concatenate two different attributes in an other one? Something like this with an approximate syntax: map attribute cn concat(givenName sn) or with Perl syntax: map attribute cn "$givenName $sn" Is it possible to do this with rewriteRules directives? Thanks for help, -- Anthony Milan

2 1

Recommended BerkeleyDB version?
by Marco Pizzoli 21 Sep '10

21 Sep '10

Hi all, I would like to know if is there a "recommended" version of BerkeleyDB to be used with OpenLDAP. Days ago, on this mailing list, I read comments about 4.8.30. On the Oracle site I see there are also: - 5.0.21 - 5.0.26 - 5.1.19 Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

3 3

Filter on higher rdn and read lower rdn attributes
by S.A. 21 Sep '10

21 Sep '10

Hello, I have a question regarding the construction of search filter (assuming that what I think is possible in LDAP). For a tree shown like below: o dc=com | o dc=xyz / | | \ ou=machines o . . . . . o ou=people / | \ uid=abby o . . o ou=xie <- OC1 / ou=options o <- OC2 / ou=theme1 o <- OC3 OC1 != OC2 != OC3 (objectclasses with different set of attributes) Assume that at uid=<name> rdn, the objectclass (OC1) has an attribute called accessFlag. Based on this accessFlag attribute value, is it possible to construct a search filter that will give us the attributes of the objectclass (OC3) with rdn ou=<theme name>? That is, I want to get the theme values of all users whose accessFlag is set to some value. Thank you!

2 3

Undefined attribute type (17)
by Michael Ostrowski 21 Sep '10

21 Sep '10

Hi, I am getting the following error when trying to modify an entry via the ldapmodify command Any help would be appreciated, Thanks, Mike c:\open-ldap\OpenLDAP>ldapmodify -f useradd1.ldif -v -D "cn=Manager,dc=loda,dc=l ocal" -w secret ldap_initialize( <DEFAULT> ) replace change-type: modify replace add: uid replace uid: larry modifying entry "cn=Larry Anderson, dc=loda, dc=local" modify complete ldap_modify: Undefined attribute type (17) additional info: change-type: attribute type undefined The LDIF file looks like dn: cn=Larry Anderson, dc=loda, dc=local change-type:modify add:uid uid:larry The current entry in the database dn: cn=Larry Anderson,dc=loda,dc=local cn: Larry Anderson objectClass: person sn:: QW5kZXJzb24gICAgICAgICAg structuralObjectClass: person entryUUID: 91801ba1-103b-4277-85fc-56dfa2ae0bd7 creatorsName: cn=Manager,dc=loda,dc=local modifiersName: cn=Manager,dc=loda,dc=local createTimestamp: 20100915201014Z modifyTimestamp: 20100915201014Z entryCSN: 20100915201014Z#000001#00#000000 <http://www.arraynetworks.net/entry.asp?PageID=395>

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical