openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

ldap_add: Invalid syntax (21)
by Cole 18 Aug '10

18 Aug '10

Hello. I'm trying to set up a computer cluster for a school project, and I am following a guide at debianclusters.org <http://www.debianclusters.org>. I'm trying to set up LDAP and I've followed the tutorial, but I keep getting this error. I saw this error in the FAQ, but I'm not sure how to fix it. Any ideas on what I am doing wrong? Here is a link to the tutorial: http://debianclusters.org/index.php/LDAP_Server ------------------------------------------------ root@durnik:/usr/share/migrationtools# ./migrate_all_online.sh Enter the X.500 naming context you wish to import into: [dc=muncc,dc=loc] Enter the hostname of your LDAP server [ldap]: durnik Enter the manager DN: [cn=admin,dc=muncc,dc=loc]: Enter the credentials to bind with: Do you wish to generate a DUAConfigProfile [yes|no]? no Importing into dc=muncc,dc=loc... Creating naming context entries... Migrating aliases... Migrating groups... Migrating hosts... Migrating networks... Migrating users... Migrating protocols... Migrating rpcs... Migrating services... Migrating netgroups... Migrating netgroups (by user)... Migrating netgroups (by host)... Importing into LDAP... adding new entry "ou=Hosts,dc=muncc,dc=loc" adding new entry "ou=Rpc,dc=muncc,dc=loc" adding new entry "ou=Services,dc=muncc,dc=loc" adding new entry "nisMapName=netgroup.byuser,dc=muncc,dc=loc" adding new entry "ou=Mounts,dc=muncc,dc=loc" adding new entry "ou=Networks,dc=muncc,dc=loc" adding new entry "ou=People,dc=muncc,dc=loc" adding new entry "ou=Group,dc=muncc,dc=loc" adding new entry "ou=Netgroup,dc=muncc,dc=loc" adding new entry "ou=Protocols,dc=muncc,dc=loc" adding new entry "ou=Aliases,dc=muncc,dc=loc" adding new entry "nisMapName=netgroup.byhost,dc=muncc,dc=loc" adding new entry "cn=mailer-daemon,ou=Aliases,dc=muncc,dc=loc" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax /usr/bin/ldapadd: returned non-zero exit status: saving failed LDIF to /tmp/nis.ldif.ImwnfdMVQr ----------------------------------------

2 1

Infrastructure for authentication using referrals
by Luiz M Oliveira 17 Aug '10

17 Aug '10

Hello everyone I'm having trouble configuring a distributed environment directories. I have the following scenario: A company with three departments (departments A, B and C) separated geographically. In each department a server is configured to store user input for authentication. The suffix of the directory of the three departments are configured as dc = company, dc = com Below the root directory of the three branches are configured. Using the example of the department A: Department_A dc =, dc = company, dc = com: has the user input in that department. departamento_B dc =, dc = company, dc = com: stores a referral to server B department departamento_C dc =, dc = company, dc = com: stores a referral to server B from the Department All departments follow this structure, but each department is set up a referral for other outlying departments. If a user of the department is located on the department network and B want to authenticate to that site, to query the server B, you receive a referral for their department of origin. Can I implement this authentication scenario, with all servers using the same suffix and below referrasl implemented for the branches of foreign departments? Thanks to all

2 1

Maximum ldap search filter string length ?
by Arjan Filius 17 Aug '10

17 Aug '10

Hello openldap-technical ML. Is there a clear answer to the question about the maximum ldap search filter length ? Dit hava a look at the ldapsearch code (2.4.19) and all seems dynamicaly allocated, and therefore no hard/fixed limit. ldap_search_ext/ldap_search (manpage) doesn't talk about limits too. filter is about: RFC 4515 as extended by RFC 4526, but doesn't mention maximum size as far i read. That leaves me to the conclusion that the filter size is dependent on archite4cture (32/64 bits), available memory systemwide, and available memory within a proces. Can someone confirm or deny this is correct, and perhaps is there a (rough) guide/best practice about max filter string length's ? Thanks in Advance, -- Arjan Filius mailto:iafilius@xs4all.nl

1 0

Re: replication from child to Parent domain
by Marc Patermann 16 Aug '10

16 Aug '10

Owen, owen nirvana schrieb am 13.08.2010 20:02 Uhr: > I means how to config replication in a multi-level LDAP nodes. like the > following > > the parent node is has a domain "dc=parentCA, dc=rootCA", and under this > domain, many users were saved with dn like "cn=john, > ou=sales,dc=parentCA, dc=rootCA" > it has some sons nodes,like "dc=son1CA,dc=parentCA, dc=rootCA" and like > its parent,users were saved with dn like "cn=john, > ou=sales,dc=son1CA,dc=parentCA, dc=rootCA" > > Now, I hope parent node could saved data from sons node, so I try to > config replication between the two nodes to make parent node could pull > data from son node. However, it seems like the current replication > solution was designed between the same nodes with the same domain, I > don't know how to implement replcation between the different level nodes So your consumer has a superset of data from (various) providers!? I think, it should be fine to define a database for each provider/subset of data on the consumer and define different syncrepl statements for each database (it may work in one database with different "searchbase"s und "rid"s). Marc

2 1

Re: replication from child to Parent domain
by owen nirvana 13 Aug '10

13 Aug '10

I means how to config replication in a multi-level LDAP nodes. like the following the parent node is has a domain "dc=parentCA, dc=rootCA", and under this domain, many users were saved with dn like "cn=john, ou=sales,dc=parentCA, dc=rootCA" it has some sons nodes,like "dc=son1CA,dc=parentCA, dc=rootCA" and like its parent,users were saved with dn like "cn=john, ou=sales,dc=son1CA,dc=parentCA, dc=rootCA" Now, I hope parent node could saved data from sons node, so I try to config replication between the two nodes to make parent node could pull data from son node. However, it seems like the current replication solution was designed between the same nodes with the same domain, I don't know how to implement replcation between the different level nodes thanks for help gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com> On Fri, Aug 13, 2010 at 8:18 PM, Torsten Schlabach (Tascel eG) < tschlabach(a)tascel.net> wrote: > Hi Owen! > > I am not sure I understand properly what you are trying to do. > > Do you want to replicate different parts within the same tree? This > wouldn't make too much sense to me. > > Or do you mean you want to replicate the content of what you call the > parent domain(dc=parentCA) on one server to the child domain on a different > server? > > Regards, > Torsten > > On Fri, 13 Aug 2010 17:11:10 +0800, owen nirvana <freeespeech(a)gmail.com> > wrote: > > How to config slapd.conf to replicate between the parent > > domain(dc=parentCA) > > and the child(dc=sonCA,dc=parentCA) domain. > > > > > > gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com> < > gtalk%3Afreeespeech(a)gmail.com <gtalk%253Afreeespeech(a)gmail.com>> >

1 0

Authentication information cannot be recovered
by Matt Burkhardt 13 Aug '10

13 Aug '10

I have a headless server running Ubuntu 10.04 with LDAP set to expire every 30 days. This is the first time that my password expired after the upgrade from 8.10 LTS, and now it won't let me get to the command prompt. I login, then I get the following messages: WARNING: Your password has expired. You must change your password now and login again! Enter login(LDAP) password: LDAP Password incorrect: try again Enter login(LDAP) password: passwd: Authentication information cannot be recovered passwd: password unchanged and it logs me off. What should I be looking for? Thanks, Matt Burkhardt Impari Systems, Inc. mlb(a)imparisystems.com http://www.imparisystems.com http://www.linkedin.com/in/mlburkhardt http://www.twitter.com/matthewboh 502 Fairview Avenue Frederick, MD 21701 work (301) 682-7901 cell (301) 802-3235

1 0

replication from child to Parent domain
by owen nirvana 13 Aug '10

13 Aug '10

How to config slapd.conf to replicate between the parent domain(dc=parentCA) and the child(dc=sonCA,dc=parentCA) domain. gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

delta-sync replication slave quitting problem - not a single retry
by Alexander Ivanov 12 Aug '10

12 Aug '10

Hello guys, I have a problem with delta-syn replication (all set up according to 'official' guide - http://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl I have master instance with logs 'shipped' to a client - it all works fine as long as connection is good. Getting ready to move into production I'm trying to emulate connectivity problems and here where I got problems. Specifically - even though I have mirror instance set up as: syncrepl rid=101 provider=ldap://192.168.22.62:389 type=refreshAndPersist bindmethod=simple binddn="cn=replicator,xxxxx" credentials="xxxxxx" searchbase="xxxxxxx" filter="(objectClass=*)" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" scope=sub attrs="*,+" schemachecking=off * retry="1 +"* syncdata=accesslog once I have server disconnected (I sumply restart slapd on master), the client not even tries to re-connect, the log below shows modificatin operation at 18:34:18 that went fine and 11 seconds later I restart master's ldap service (which became immediately available again): Jul 28 18:34:18 newton slapd[20353]: => entry_encode(0x00000032): mail=xxxxxxxxxxxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: bdb_modify: updated id=00000032 dn="yyyyyyyyyyyyyyyyyyyyyyyy" Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: conn=-1 op=0 p=0 Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: err=0 matched="" text="" Jul 28 18:34:18 newton slapd[20353]: syncrepl_entry: rid 101 be_modify (0) Jul 28 18:34:18 newton slapd[20353]: bdb_modify: xxxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: bdb_dn2entry("oxxxxxxxxxxxxxxx") Jul 28 18:34:18 newton slapd[20353]: bdb_modify_internal: 0x00000001: o=xxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: <= acl_access_allowed: granted to database root Jul 28 18:34:18 newton slapd[20353]: bdb_modify_internal: replace contextCSN Jul 28 18:34:18 newton slapd[20353]: => entry_encode(0x00000001): o=xxxxxxxxxxxxxxxxxxxxx. Jul 28 18:34:18 newton slapd[20353]: bdb_modify: updated id=00000001 dn="xxxxxxxxxxxxxxxx" Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: conn=-1 op=0 p=0 Jul 28 18:34:18 newton slapd[20353]: send_ldap_result: err=0 matched="" text="" Jul 28 18:34:18 newton slapd[20353]: daemon: activity on 1 descriptor Jul 28 18:34:18 newton slapd[20353]: daemon: activity on: Jul 28 18:34:18 newton slapd[20353]: Jul 28 18:34:18 newton slapd[20353]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 28 18:34:29 newton slapd[20353]: daemon: activity on 1 descriptor Jul 28 18:34:29 newton slapd[20353]: daemon: activity on: Jul 28 18:34:29 newton slapd[20353]: 14r Jul 28 18:34:29 newton slapd[20353]: Jul 28 18:34:29 newton slapd[20353]: daemon: read active on 14 Jul 28 18:34:29 newton slapd[20353]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 28 18:34:29 newton slapd[20353]: connection_get(14) Jul 28 18:34:29 newton slapd[20353]: connection_get(14): got connid=0 Jul 28 18:34:29 newton slapd[20353]: =>do_syncrepl rid 101 Jul 28 18:34:29 newton slapd[20353]: =>do_syncrep2 rid 101 Jul 28 18:34:29 newton slapd[20353]: do_syncrep2: rid 101 Can't contact LDAP server Jul 28 18:34:29 newton slapd[20353]: connection_get(14) Jul 28 18:34:29 newton slapd[20353]: connection_get(14): got connid=0 Jul 28 18:34:29 newton slapd[20353]: daemon: removing 14 Jul 28 18:34:29 newton slapd[20353]: daemon: activity on 1 descriptor Jul 28 18:34:29 newton slapd[20353]: daemon: activity on: Jul 28 18:34:29 newton slapd[20353]: Jul 28 18:34:29 newton slapd[20353]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 28 18:34:29 newton slapd[20353]: do_syncrepl: rid 101 quitting I'm running openldap 2.3.43-12.el5_5.1 from standard CentOS 5.4 installation. Do I get something wrong and slave not supposed to re-connect after master service restart or is this some kind of a problem that was fixed in later versions? Thank you, Alex

4 7

Evidence of client information in openldap accesslog
by Marco Pizzoli 12 Aug '10

12 Aug '10

Hi list, I'm implementing slapo-accesslog in my openldap deployment. I have about 100 unix/linux systems that use a central openldap deployment to make authentication and grant access to users. With accesslog I'm able to see when a particular user has logged in, but is there a way to obtain, on the LDAP server side, information about which system has been accessed? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

4 5

monitorCounter meaning
by Matheus Morais 11 Aug '10

11 Aug '10

Hi there, I was playing around with cn=Monitor and I became curious with the following search: ldapsearch -x -LLL -h host.example.com -s base -b cn=entries,cn=statistics,cn=monitor '(objectclass=*)' '*' '+' dn: cn=Entries,cn=Statistics,cn=Monitor objectClass: monitorCounterObject structuralObjectClass: monitorCounterObject cn: Entries creatorsName: modifiersName: createTimestamp: 20100804183416Z modifyTimestamp: 20100804183416Z monitorCounter: 45607686 entryDN: cn=Entries,cn=Statistics,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE What precisely meaning the attribute monitorCounter? Is it represent the number of entries which has been used as search base or something like that? Thanks! Matheus Morais

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical