openldap-technical

openldap-technical@openldap.org

9 participants
9873 discussions

Re: OpenLDAP to replace Oracle Internet Directory
by Matheus Morais 30 Aug '10

30 Aug '10

Hi Gavin, Sorry for the late reply, I need to organize my mail box, I just not seen this email! On Mon, Jul 26, 2010 at 2:24 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > > I want thank every one responsible to keep OpenLDAP project with that > high > > level of quality and I am really proud about that kind of quality has > been > > produced by a free software project (free as in freedom). > > Excellent news! How is it going now? Did you use our docs to help you? > We're doing really well at this time. Right now we're waiting for the dev team to correct one of our LDAP API which was using substring search for distinguishedName attributes and that works on Oracle Internet Directory but as RFC 2256 say, section 5.50 more precisely, the 'client must not assume that LDAP servers are capable of performing attribute subtyping'. They are testing and after put on production we will be ready to change the last systems which still using Oralce Internet Directory. I most used the Administrator's Guide for version 2.4 and all the manuals available. I think the documentation is very complete in general but could be improved in some points, like the session of Monitor backend for example. I also would be happy if we had a portuguese version of Admin's Guide. Since I'm not a developer I could help on the documention at my spare time. I would be glad if I could help in some aspect. > Do you have any suggestions for improvements to the docs? > > Thanks. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > Thanks, Matheus Morais!

2 1

I can't see my /etc/ldap/slapd.conf file after reinstall
by Eric KOM 28 Aug '10

28 Aug '10

Hi Dear Team! Please, I got problem with my OpenLDAP server on Debian Testing. I try to purge slapd package with aptitude purge slapd and remove all files and directories with rm on /etc/ldap/. after reinstall slapd, I can't see the main configuration file /etc/ldap/slapd.conf? but the server is running. Thank you in advance. -- Yours truly, Eric KOM 110 LAWN STREET ROSETTENVILLE 2190 JOHANNESBURG SOUTH AFRICA Phone: +27 (0) 788 791 334 Fax: +27 (0) 865 563 009 E-mail: erickom(a)namekom.co.za Websites: www.erickom.co.za | www.namekom.co.za/erickom | www.namekom.co.za

5 11

to much archive logs
by isso2＠gmx.de 27 Aug '10

27 Aug '10

Hello team, our openldap-server (OS: Redhat 5) was succesfully installed and it works. But sometimes it gets out of control, that means: every 3 minutes it generates an archive-log. Shutdown and start is not successfully. We have do to a db_recover. Any idea ? Thanks a lot. -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 3

syncrepl help
by Adam Cassar 27 Aug '10

27 Aug '10

Hi All, I would appreciate some insight with a syncrepl issue that I have. The scenario is as follows: (1) LDAP master running debian slapd v2.3.30 replicating using syncrepl to (2) LDAP master running debian slapd v2.4.11 The initial data for this node was seeded using slapcat/slapadd due to the db size. This is replicating via syncrepl to (3) LDAP slave running debian slapd v2.4.11 On (3) the slave I am receiving the error: do_syncrep2: cookie=rid=001,csn=20100825064231Z#000000#00#000000 do_syncrep2: rid=001 CSN too old, ignoring 20100825064231Z#000000#00#000000 for all replication events that are being received. What I am trying to achieve is to deprecate server (1) with as little downtime as possible, server (2) becomes the new master and (3) the new slave Replication between 1 & 2 works correctly but not between 2 & 3. The time is correct on the servers. Server (3) database is seeded using syncrepl. Configurations for 1, 2 & 3 are attached.

2 2

Supported formats of server/client certificate
by Ondrej Moriš 27 Aug '10

27 Aug '10

Hi, I am wondering what formats of server/client x.509 certificates are supported by OpenLDAP? I see that PEM is supported, but what about other formats like binary DER, PKCS#7, PKCS#12? I've tried to find answer in documentation, but it said that CA cert should be given in PEM and nothing about server/client certs. Any help greatly appreciated! -- Ondrej Moriš

2 1

Re: replicate two branches?
by Marc Patermann 27 Aug '10

27 Aug '10

Isaac, Isaac Hailperin schrieb am 27.08.2010 12:49 Uhr: > On 08/27/2010 11:12 AM, Marc Patermann wrote: >> Isaac Hailperin schrieb am 25.08.2010 17:44 Uhr: >> >>> I was wondering whether there is a way to replicate more then one >>> branch. I tried to replicate two branches using two syncrepl sections in >>> slapd.conf with different rid, but that got me an error >>> "syncrepl: database already shadowed" >>> So I suppose its at least not that easy. >> You are speaking about the provider, right? > No, the error occured on the slave side, after I put two syncrepl > directives in slapd.conf. > >> If you have o=foo with branch a ou=a,o=foo and branch b in ou=b,o=foo, >> what do you want to achieve then? Replicate branch a to server a and >> branch b to server b, or what? > I have dc=foo with ou=bar,dc=foo ou=rab,dc=foo and ou=oof,dc=foo. > I want to replicate ou=bar and ou=rab to another server, but not ou=oof. Where syncrpl is a database option, you could define a database for each branch in the consumer and define the searchbase corresponding to each branch (if you cannot reduce the replication data to a branch by setting a filter, where "dn= ..." is not a valid filter). database bdb suffix "ou=bar,dc=foo" syncrepl rid=1 searchbase=ou=bar,dc=foo ... directory ... database bdb suffix "ou=rab,dc=foo" syncrepl rid=1 searchbase=ou=rab,dc=foo ... directory ... Marc

1 0

Re: replicate two branches?
by Marc Patermann 27 Aug '10

27 Aug '10

Isaac, Isaac Hailperin schrieb am 25.08.2010 17:44 Uhr: > I was wondering whether there is a way to replicate more then one > branch. I tried to replicate two branches using two syncrepl sections in > slapd.conf with different rid, but that got me an error > "syncrepl: database already shadowed" > So I suppose its at least not that easy. You are speaking about the provider, right? If you have o=foo with branch a ou=a,o=foo and branch b in ou=b,o=foo, what do you want to achieve then? Replicate branch a to server a and branch b to server b, or what? You may have to describe your problem a bit more in detail. Marc

2 1

Getting Solaris to use Openldap
by Stuart Cherrington 27 Aug '10

27 Aug '10

Hi, I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients to use the master by use of the /etc/ldap.conf file. I'm now trying to get a SOlaris 10 client to use the master by initialising with the default profileName. If I run: ldapclient -v init -a proxypassword=xxxxx -a proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a domainname=ldn.sw.com 10.2.250.15 This errors with Parsing proxypassword=5wap5proxy Parsing proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Parsing domainname=ldn.sw.com Arguments parsed: domainName: ldn.sw.com proxyDN: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com proxyPassword: xxxxx defaultServerList: 10.2.250.15 Handling init option About to configure machine by downloading a profile No profile specified. Using "default" findBaseDN: begins findBaseDN: ldap not running findBaseDN: calling __ns_ldap_default_config() found 1 namingcontexts findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=ldn.sw.com))" rootDN[0] dc=ldn,dc=sw,dc=com NOTFOUND:Could not find the nisDomainObject for DN dc=ldn,dc=sw,dc=com found_cxt = -1 findBaseDN: Err exit Failed to find defaultSearchBase for domain ldn.sw.com So the 2 errors are the NOTFOUND nisDomainObject which is there when I check on the master: [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # ldn.sw.com dn: dc=ldn,dc=sw,dc=com dc: ldn o: ldn associatedDomain: ldn.sw.com nisDomain: ldn.sw.com objectClass: dcObject objectClass: organization objectClass: domainRelatedObject objectClass: nisDomainObject objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The other error is 'Failed to find defaultSearchBase for domain ldn.sw.com' [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # default, profile, ldn.sw.com dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com defaultSearchBase: dc=ldn,dc=sw,dc=com authenticationMethod: simple followReferrals: TRUE profileTTL: 43200 searchTimeLimit: 30 objectClass: DUAConfigProfile defaultServerList: 10.2.250.15 credentialLevel: proxy cn: default defaultSearchScope: one # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Obviously I've missed something, anyhelp would be appreciated. Thanks, Stuart.

1 0

tnsnames in openldap
by Stuart Cherrington 26 Aug '10

26 Aug '10

Hi, I was wondering if anyone here has had a good/bad experience of getting Openldap to provision tnsnames lookup for Oracle Databases? We're thinking of removing our current OID implementation which is very old and as I'm already running OpenLDAP 2.4 is makes sense to just roll it from there. I found a VERY useful article at http://oracle-cookies.blogspot.com/2007/01/get-tnsnamesora-from-openldap.ht… which I think will help enormously. Thanks, STuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/195013117/direct/01/

3 2

Re: OpenLDAP as a proxy for Active Directory (missing attributes)
by Marius Flage 26 Aug '10

26 Aug '10

On 08/26/2010 11:10 PM, Mike Olivieri wrote: > However, when I try to search for that same user using ldapsearch, I get > no results. > ldapsearch -x \ > -a always \ > -h fqa-ldap \ > -p 9389 \ > -D "CN=mike0,OU=Service Accounts,dc=myco_ad,dc=mycompany,dc=com" \ > -w "password" \ > -b "DC=MYCO_AD,dc=mycompany,dc=com" \ > "(sAMAccountName=mikeo)" Try omitting the search filter '(sAMAccountName)', do you get any results then? If so, then you need to add the attribute declaration for sAMAccountName to your schema: attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) That's my only guess to this and I'll leave it to the experts if that's not the solution :) - Marius

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical