openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

Help with developing LDAP client
by Bryan Boone 14 Jul '10

14 Jul '10

Hi everyone. I am writting an LDAP client. I am able to simple bind, and simble bind over SSL. I am having trouble with getting options. I am kinda a noob to C programming. What am I doing wrong? Here is what I have. if ((ld = ldap_init(HOSTNAME, PORTNUMBER)) == NULL) { perror("ldap_init"); return (1); } version = LDAP_VERSION3; if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_SUCCESS) { //rc = ldap_get_lderrno(ld, NULL, NULL); fprintf(stderr, "ldap_set_option: %s\n", ldap_err2string(rc)); ldap_unbind(ld); return (1); } ldap_start_tls_s(ld, NULL, NULL); char **temp; if (ldap_get_option(ld, LDAP_OPT_X_TLS_CACERTDIR, temp) != LDAP_SUCCESS) { ldap_perror(ld, "ldap_get_option"); return (1); } Everything works except I am having problems with the ldap_get_option. thanks

1 0

openldap 2.4.22 crash
by Marco Pizzoli 14 Jul '10

14 Jul '10

Hi all, I'm using Buchan's package of openldap2.4.22 x86_64 on RHEL5.3. I'm able to reproduce a crash renaming an entry in my tree. I'm doing this by using phpldapadmin. When I restart the engine I can see the entry with the name changed. I'm trying to produce a core dump and subsequently file an ITS, but I''m not able to have the core generated. I changed /etc/security/limits for the ldap user and some other RHEL specifics to not limit the size of the core. If I look to /proc/<slapd_pid>/limits I can see the following: [root@ldap04 14527]# cat limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 10485760 unlimited bytes *Max core file size unlimited unlimited bytes * Max resident set unlimited unlimited bytes Max processes 65536 65536 processes Max open files 1024 1024 files Max locked memory 32768 32768 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 65536 65536 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 After that I do the rename, the slapd crashes and the core dump isn't there... Any idea? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 2

Adding rfc schema clashes
by Stuart Cherrington 14 Jul '10

14 Jul '10

Hi, Running OpenLDAP 2.4 on RHEL 5. In order for my SOlaris 10 clients to start using the OpenLDAP service I need the objectclass 'nisDomainObject' to be declared. I found this objecttype in the 'rfc2307bis.schema' file so I've added it into the slapd.conf and now LDAP fails to restart with /usr/share/openldap2.4/schema/nis.schema: line 53 attributetype: Duplicate attributeType: "1.3.6.1.1.1.1.2" slaptest2.4: bad configuration file! I did a quick check the and "1.3.6.1.1.1.1.2" is declared in the nis.schema for the gecos attributetype. Can I alter the number within the rfc schema? Thanks, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

3 4

Max length of the attribute in UID attribute
by Bryan Boone 14 Jul '10

14 Jul '10

Hi everyone. How or where do I find out the max string length that I can have in the UID attribute in the inetorgperson objectclass. I assume that the length is set by the limitations of the DB, but I cannot seem to find that information anywhere. Or is the length defined in RFC 2798 somewhere? thanks

2 1

SHA2 in openldap 2.4.22
by Vernon Reilly 13 Jul '10

13 Jul '10

Have anyone managed to compile SHA2 slapd-module in openldap version 2.4.22 I am getting all sorts of errors trying to compile it after modifying the Makefile as per the README file inside: contrib/slapd-modules/passwd/sha2/ I think this code was for version 2.3 and should not be packaged with version 2.4. Anyways, any help would be appreciated. Thanks _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

2 1

bdb/hdb cachesize calculation
by openldap-ml＠stresst.net 13 Jul '10

13 Jul '10

Attached to this message you'll find a quick and dirty bash script that should determine the cachesize for an in-production bdb/hdb backend by taking dn2id and id2entry as well as all existing indexes into account. Internally the script calls the db_stat tool in combination with the formulas found in the 2.4 admin guide under: http://www.openldap.org/doc/admin24/tuning.html#Caching Based on our local production database files (run by slapd 2.4.21, bdb 4.5) which contain round about 460.000 (small) entries... # du -h dn2id.bdb id2entry.bdb 48M dn2id.bdb 755M id2entry.bdb # du -h *.bdb | grep -v dn2id | grep -v id2entry 12M cn.bdb 20M entryCSN.bdb 14M entryUUID.bdb 1.1M loginDisabled.bdb 8.6M mail.bdb 5.4M objectClass.bdb ...the attached script produces the following results: DB Cachesize Results (dn2id.bdb and id2entry.bdb): Overall DB Cachesize: 1871872 bytes Index Cachesize Results: Overall Index Cachesize: 245760 bytes (50% Index HitRatio) Overall Index Cachesize: 491520 bytes Resulting Overall Cachesize (DB and Indexes): Overall Cache Size: 2117632 bytes (50% Index HitRatio) Overall Cache Size: 2363392 bytes Including +15% bytes for growth: Overall Cache Size: 2435276.80 bytes (50% Index HitRatio) Overall Cache Size: 2717900.80 bytes Do the above results (2.4 - 2.7 MBytes?!) sound reasonable in comparison to the above bdb file sizes? As I'm currently unsure whether the result is correct or not I would appreciate your feedback for example whether the script's result makes sense within your environment or not. Thanks a lot!

3 4

2.4.22 mirrormode syncrepl credential password encryption
by Vernon Reilly 13 Jul '10

13 Jul '10

Hi, I have version 2.4.22 running with mirrormode enabled and it is working well. I have a question regarding the credentials field in the syncrepl part in slapd.conf. Must this be cleartext or can it be encrypted and what is considered good practise regarding which binddn to use. (e.g. should I create a user with cleartext password specifically for replication?) Up to now I have used the same binddn as my rootdn but I can only get this to work with a cleartext password and I don't want to have my rootpw as cleartext in slapd.conf. Here is my current slapd.conf snippet database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" moduleload syncprov overlay syncprov syncprov-checkpoint 1 1 syncprov-sessionlog 100 # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass eq syncrepl rid=123 provider=ldap://server:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=Manager,dc=uniscope,dc=jp" credentials=secret mirrormode on Any help would be appreciated. Thanks. _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

3 2

Recommended way to modify cn=schema entries?
by Ian Collins 13 Jul '10

13 Jul '10

I would like to re-order two schema entries to resolve a dependency issue (our local schema, included before dyngroup.schema, now references memberURL). However deleting a schema entry with ldapmodify does not appear to be supported: dn: cn={8}dyngroup,cn=schema,cn=config changetype: delete deleting entry "cn={8}dyngroup,cn=schema,cn=config" ldap_delete: Server is unwilling to perform (53) Any suggestions? -- Ian.

3 3

ldap falls without logs
by Márcio Luciano Donada 13 Jul '10

13 Jul '10

Hi list, I'm using debian lenny,[1], with openldap 2.4.11 and in many cases simply to LDAP, while not log information. My slapd.conf is: # Global Directives: # Features to permit allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/authldap.schema include /etc/ldap/schema/RADIUS-LDAPv3.schema include /etc/ldap/schema/ppolicy.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 256 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload syncprov moduleload back_monitor moduleload back_bdb moduleload ppolicy moduleload unique moduleload back_ldap # TLS TLSVerifyClient demand TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 16 threads 32 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database monitor database bdb # The base of your directory in database #1 suffix "dc=xxx,dc=com,dc=br" rootdn "cn=suporte,dc=xxx,dc=com,dc=br" rootpw blablabla overlay unique unique_uri ldap:///?mail?sub? overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Where the database file are physically stored for database #1 directory "/var/lib/ldap" idletimeout 30 checkpoint 128 15 cachesize 100000 lastmod on sizelimit unlimited index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uniqueMember eq index uidNumber eq index gidNumber eq index memberUID eq index mailAlternateAddress eq index MailForwardingAddress eq index mail pres,sub,eq index default sub index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index sambaSIDList,sambaGroupType eq index givenName pres,sub,eq index homePhone eq index shadowExpire,shadowLastChange,shadowMax,shadowWarning eq index entryCSN,entryUUID eq # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. # ACLs access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * none access to * by * read P.S. note that the loglevel is 256 and I have no record of trouble. [1]. Linux ldap 2.6.26-2-686 #1 SMP Wed Aug 19 06:06:52 UTC 2009 i686 GNU/Linux -- Márcio Luciano Donada <mdonada -at- auroraalimentos -dot- com -dot- br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 1

DN failed to copy
by Stuart Cherrington 13 Jul '10

13 Jul '10

Hi, Not sure if this is an issue with phpLDAPadmin 1.0.1 or Openldap2.4 (on rhel 5.3). I've created posixGroup's within my openLDAP and can see these within phpLDAPadmin, I was trying to copy the objects within my 'dc' prior to some invasive work, but I cannot copy the posixGroups. I have done copies of all other objects but posixGroup copy errors with: 'Failed to copy DN: cn=copydba,ou=group,dc=ldn,dc=sw,dc=com LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass.' Having looked through countless web pages it suggests that the posixGroup definition in the rfc2037bis.schema should have a MUST clause but it already has this: objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' SUP top AUXILIARY DESC 'Abstraction of a group of accounts' MUST gidNumber MAY ( userPassword $ memberUid $ description ) ) Any advice would be great. Thanks, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical