openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Simple question about LDAP and web authentication.
by Bryan Boone 22 Jun '10

22 Jun '10

Hi everyone. I am a noob to LDAP and I have a question. I am on a team that is building a special server. This server will be running linux with an apache web server with PHP and apache is running a special website that we designed. I need to have the website be able to query LDAP servers for web authentication. So when a user connects to this special web server, they are prompted for a user name and password. Then I want to have the website check the LDAP server to make sure that the user is indeed a user of the website on our special server. So in a sense our special server will be an LDAP client. So my question is??? Is an LDAP client to be run as a Daemon or service? Is this what OpenLDAP provides? Or can I simply use function calls (from PHP or C) from the OpenLDAP library for the authentication? Basically all I need is... The user brings up the web page. The user enters in the user name and password. The server uses PHP or C to check to see if the entered information matches an LDAP server. The web grants or denies access. The LDAP server connection is closed. No other actions or information from the LDAP server is needed. Do I have the right idea? thanks

7 6

What DN (user name) I should use for connecting to ldap server?
by sam 22 Jun '10

22 Jun '10

Hi, I have ldap server started up in freebsd. I tried to test it with Apache Directory Studio. When I open a New Connection in the Studio, it asks for User name. I entered "root" as user name, then go for the connection... However I got following error message in ldap log file: Jun 21 23:14:51 hometest slapd[2417]: conn=1005 fd=11 ACCEPT from IP=192.168.1.100:57297 (IP=192.168.1.20:389) Jun 21 23:14:51 hometest slapd[2417]: conn=1005 op=0 do_bind: invalid dn (root) Jun 21 23:14:51 hometest slapd[2417]: conn=1005 op=0 RESULT tag=97 err=34 text=invalid DN Jun 21 23:14:51 hometest slapd[2417]: conn=1005 fd=11 closed (connection lost) What value of DN I should enter in the ldap browser (Apache Directory Studio) in order to connect to the ldap server? I have ldap listening to the following ports: hometest:openldap # netstat -an | egrep '389|636' tcp4 0 0 192.168.1.20.636 *.* LISTEN tcp4 0 0 192.168.1.20.389 *.* LISTEN Your help is much appreciated Thanks Sam

6 6

Syncrepl problems
by renski＠exemail.com.au 21 Jun '10

21 Jun '10

Hi, I'm trying to setup replication with syncrepl. I'm having problems with the slave config, I've thrown in the syncrepl config at the end of slapd.conf, but it keeps saying this: /etc/ldap/slapd.conf: line 103: unknown directive <syncrepl rid=100> inside backend database definition. thanks, Rick

4 4

Multi master replication
by Aravind Divakaran 21 Jun '10

21 Jun '10

Hi All, I have configured two servers with multi master replication. Below is my configuration for synrepl on both servers. Server One ------------ serverID 001 overlay syncprov syncprov-checkpoint 100 10 syncrepl rid=000 provider=ldap://192.168.10.100 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=syncuser,dc=example,dc=com" credentials=password mirrormode TRUE Server Two -------------- serverID 002 overlay syncprov syncprov-checkpoint 100 10 syncrepl rid=000 provider=ldap://192.168.10.25 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=syncuser,dc=example,dc=com" credentials=password mirrormode TRUE Today one of user said that he was not able to login. So i checked in the servers in one server i was able to login but on another server i was not able to login with the same password. I have checked the contextCSN on both server they are equal. In the log it is showing this syncrepl_entry: rid=000 entry unchanged, ignored (uid=user,ou=People,dc=example,dc=com) Apr 28 12:14:17 mails slapd[16595]: syncrepl_entry: rid=000 uid=user,ou=People,dc=example,dc=com Apr 28 12:14:17 mails slapd[16595]: syncrepl_entry: rid=000 be_add uid=user,ou=People,dc=example,dc=com (68) Apr 28 12:14:17 mails slapd[16595]: dn_callback : entries have identical CSN uid=user,ou=People,dc=example,dc=com 20100422132507.789242Z#000000#002#000000 Can anyone help me why above message is showing in the log files and why the user is not able to login. Rgds, Aravind M D

7 14

Distributed directories using meta backend
by Luiz Marcelo 21 Jun '10

21 Jun '10

Hello everyone. Well, I have a scenario with three LDAP servers. This scenario represents a practical structure of a multi-campus institution. For example: Each server of each campus has the following contexts instantiated name in a backend hdb: Campus 1: dc = a, dc = institution, dc = org Campus 2: dc = b, dc = institution, dc = org Campus 3: dc = c, dc = institution, dc = org Each campus only manages your server, but allows that queries to other remote servers. They must present themselves as a single directory, transparent to user queries. I tried using the backend target with the suffix dc=institution,dc=org to perform a masking of the name. In practice the target backend (server instantiated in the campus) is like this: database meta suffix "dc=institution,dc=org" uri "ldap: / / localhost /dc=a" idassert-bind bindmethod=simple binddn="cn=reader,dc=a" credentials="readera" rebind-as-user yes suffixmassage "dc=institution,dc=org" "dc=a" # Remote Server - b uri "ldap: / /10.0.0.2/dc=b" idassert-bind bindmethod=simple binddn="cn = reader,dc = b" credentials = "leitorb" rebind-as-user yes suffixmassage "dc=institution,dc=org" "dc=b" lastmod off # Remote server - c uri "ldap: / /10.0.0.3/dc=c" idassert-bind bindmethod=simple binddn="cn=reader,dc = c" credentials = "leitorc" rebind-as-user yes suffixmassage "dc=institution,dc = org" "dc=b" lastmod off When performing a general consultation to dc=institution,dc=org all data from the three campuses were merged and the query returned. example: ldapsearch -x -D cn=reader,dc=a -W -b dc=institution,dc=org "cn=reader " the result is: cn = reader, dc = institution, dc = org cn = reader, dc = institution, dc = org cn = reader, dc = institution, dc = org 3 results appear, each encontraddo in three different bases. The problem is that have the same DN. Assuming that this structure is used to authentication user and a user can log in at any institution, be it home or away, if any two users with uid=john (eg: uid=john,dc=a and uid=john,dc=b) when performing a search using the meta backend, duplicate the results appear. Someone with experience in using the meta backend, give me a hint how to implement this scenario without causing an Replication DNs? Suddenly a way to make the server does not store a new entry if it is equal to an existing (masquerading under the proxy target)? The main objective of this implementation is to implement a distributed model that guarantees 1 - administrative independence for each campus (just write in your base, but read all) 2 - Allow users to authenticate to the system, inside or outside their home institution. Finally, it would be possible to use the backend relay, after which the main role of the backend? Thanks in advance. Luizmarceloo!

2 1

failed to start slapd & can't create password - please help.
by sam 20 Jun '10

20 Jun '10

Hi, With the following setup: hometest:openldap # uname -a FreeBSD hometest.ip6.com.au <http://hometest.ip6.com.au> 8.1-RC1 FreeBSD 8.1-RC1 #0: Fri Jun 18 15:26:58 EST 2010 root@hometest.ip6.com.au:/usr/ obj/usr/src/sys/mail.db.java.portal i386 hometest:openldap # pkg_info | grep -i ldap openldap-sasl-client-2.4.22 Open source LDAP client implementation with SASL2 support openldap-sasl-server-2.4.22 Open source LDAP server implementation hometest:openldap # pkg_info | grep -i db db46-4.6.21.4 The Berkeley DB package, revision 4.6 hometest:openldap # pkg_info | grep -i sasl cyrus-sasl-2.1.23 RFC 2222 SASL (Simple Authentication and Security Layer) cyrus-sasl-saslauthd-2.1.23 SASL authentication server for cyrus-sasl2 openldap-sasl-client-2.4.22 Open source LDAP client implementation with SASL2 support openldap-sasl-server-2.4.22 Open source LDAP server implementation I can't create password for ldap: hometest:openldap # slappasswd -h {MD5} -s password Password generation failed for scheme MD5: scheme not recognized and: hometest:rc.d # ./slapd start Starting slapd. ./slapd: WARNING: failed to start slapd slapd.conf file is shown below: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema #X.500 RFC1274 COSINE Pilot Schema include /usr/local/etc/openldap/schema/cosine.schema #For Addressbooks include /usr/local/etc/openldap/schema/inetorgperson.schema #For Authentication include /usr/local/etc/openldap/schema/nis.schema TLSCACertificateFile /usr/local/etc/ssl/cacert.pem TLSCertificateFile /usr/local/etc/openldap/ssl/portal.ip6.com.au.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/private/cakey.pem TLSCipherSuite HIGH # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org <http://root.openldap.org> pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=ip6,dc=com,dc=au" rootdn "cn=Manager,dc=ip6,dc=com,dc=au" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data # Indices to maintain index objectClass eq Can anyone tell me how to start openldap and how to assign password to it? Your help is very much appreciated. Thanks Sam -

5 6

Solaris 10 openldap authentication with md5 passwords
by Giannis Fotopoulos 19 Jun '10

19 Jun '10

Hello to everyone, We are trying to enable ldap authentication with pam_ldap and md5 passwords on a Solaris 10 system to an openldap server. If passwords are stored using crypt, everything works correctly. But if the password in openldap is in md5, then authentication fails. We have installed openldap client along with pam_ldap and nss_ldap from padl (http://www.padl.com/pam_ldap.html) Our openldap version is openldap-2.3.39 And all passwords are encrypted with : Base 64 encoded md5 Below is a sample password: |{md5}2FeO34RYzgb7xbt2pYxcpA==| The error messages when trying to 'su -' to the ldap user are: |Jun 1 18:35:23 servername su: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:35:23 servername su: [ID 810491 auth.crit]'su ldapuser' failed*for* mike on /dev/pts/4 |and for ssh: |Jun 1 18:35:54 servername sshd[14197]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:35:54 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed*for* ldapuser from pc7395.sa.example.int Jun 1 18:36:00 servername sshd[14224]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:36:00 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed*for* ldapuser from pc7395.sa.example.int Jun 1 18:36:02 servername sshd[14278]: [ID 800047 auth.info] Accepted publickey*for* scponly from 10.24.4.52 port 35390 ssh2 Jun 1 18:36:04 servername sshd[14270]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:36:04 servername sshd[14191]: [ID 800047 auth.error] error: PAM: Authentication failed*for* ldapuser from pc7395.sa.example.int Jun 1 18:36:04 servername sshd[14191]: [ID 800047 auth.info] Failed keyboard-interactive/pam*for* ldapuser from 192.168.1.25 port 41075 ssh2 Jun 1 18:36:08 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:36:08 servername sshd[14191]: [ID 800047 auth.info] Failed password*for* ldapuser from 192.168.1.25 port 41075 ssh2 Jun 1 18:36:12 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:36:12 servername sshd[14191]: [ID 800047 auth.info] Failed password*for* ldapuser from 192.168.1.25 port 41075 ssh2 Jun 1 18:36:17 servername sshd[14191]: [ID 896952 auth.debug] pam_unix_auth: entering pam_sm_authenticate() Jun 1 18:36:17 servername sshd[14191]: [ID 800047 auth.info] Failed password*for* ldapuser from 192.168.1.25 port 41075 ssh2 | Below are the configuration files (pam.conf, nsswitch.conf, ldap.conf) and anything else that I imagine could help (comments of the files have been removed). Please feel free to ask for any other configuration file: */etc/pam.conf* |login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth sufficient pam_unix_auth.so.1 server_policy debug login auth required /usr/lib/security/pam_ldap.so.1 debug rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 use_first_pass rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 rsh auth required pam_unix_auth.so.1 ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_dial_auth.so.1 ppp auth sufficient pam_unix_auth.so.1 server_policy other auth sufficient /usr/lib/security/pam_ldap.so.1 debug other auth required pam_unix_auth.so.1 use_first_pass debug passwd auth sufficient pam_passwd_auth.so.1 server_policy passwd auth required /usr/lib/security/pam_ldap.so.1 debug cron account required pam_unix_account.so.1 other account requisite pam_roles.so.1 other account sufficient pam_unix_account.so.1 server_policy other account required /usr/lib/security/pam_ldap.so.1 debug other session required pam_unix_session.so.1 other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 server_policy |*/etc/ldap.conf *|base ou=users,ou=Example,dc=staff,dc=example ldap_version 3 scope sub pam_groupdn cn=sysadm(a)example.int,ou=groups,ou=Example,dc=staff,dc=example pam_member_attribute memberUid nss_map_attribute uid displayName nss_map_attribute cn sn pam_password_prohibit_message Please visit https://changepass.exapmle.int/ to change your password. uri ldap://ldapserver01/ ssl no bind_timelimit 1 bind_policy soft timelimit 10 nss_reconnect_tries 3 host klnsds01 nss_base_group ou=system_groups,ou=Example,dc=staff,dc=example?sub pam_password md5 |*/etc/nsswitch.conf *|passwd: files ldap group: files ldap hosts: files dns ipnodes: files dns networks: files protocols: files rpc: files ethers: files netmasks: files bootparams: files publickey: files netgroup: files automount: files aliases: files services: files printers: user files auth_attr: files prof_attr: files project: files tnrhtp: files tnrhdb: files |* /etc/security/policy.conf* |AUTHS_GRANTED=solaris.device.cdrw PROFS_GRANTED=Basic Solaris User CRYPT_ALGORITHMS_DEPRECATE=__unix__ LOCK_AFTER_RETRIES=YES CRYPT_ALGORITHMS_ALLOW=1,2a,md5 ||CRYPT_DEFAULT=1| Thanks in advance for any response...!! | |

1 0

ACLs using members and groups
by Indexer 18 Jun '10

18 Jun '10

Hi, I have a question regarding ACLs and their use in an interesting circumstance. I have a group, lets call it g, and it contains users a and b. I also have users a, b, c and d. Now, I want user d to be able to have access to write to the members of group g, and unable to access non members of group g. Now lets say i add user e, and e becomes a member of g, i want d to be able to write to these 3 members (a,b,e) without needing to rewrite or insert ACLs etc. I have been looking alot at the ACL page on the openldap site, and as much as i think the group and regex rules are fantastic, I cant think of how to implement them for this situation. Any help would be greatly appreciated Thanks for your time and help, yet again. William

2 1

smbk5pwd: ldappassword hangs
by Frank Van Damme 18 Jun '10

18 Jun '10

Hi list, I installed and configured the smbk5pwd overlay as described on http://student.physik.uni-mainz.de/~reiffert/smbk5pwd.html#smbk5pwd. This succeeded, the module is loaded etc. But an unwelcome side effect is that password changes don't function anymore. With the overlay/module disabled, there is no problem; if I enable it, the "ldappasswd" command hangs. I marked where I hit Ctrl-C on the hanging ldappasswd command. This is the slapd log... daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy >>> slap_listener(ldap://127.0.0.1/) daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero daemon: listen=7, new connection on 15 daemon: added 15r (active) listener=(nil) conn=1 fd=15 ACCEPT from IP=127.0.0.1:37250 (IP=127.0.0.1:389) daemon: activity on 2 descriptors daemon: activity on: 15r daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 ber_get_next ldap_read: want=8, got=8 0000: 30 43 02 01 01 60 3e 02 0C...`>. ldap_read: want=61, got=61 0000: 01 03 04 2f 75 69 64 3d 74 72 79 6f 75 74 2c 6f .../uid=tryout,o 0010: 75 3d 50 65 6f 70 6c 65 2c 64 63 3d 6f 74 65 63 u=People,dc=otec 0020: 2c 64 63 3d 76 75 62 2c 64 63 3d 61 63 2c 64 63 ,dc=vub,dc=ac,dc 0030: 3d 62 65 80 08 4d 68 43 30 47 6a 4d 4a =be..MhC0GjMJ ber_get_next: tag 0x30 len 67 contents: ber_dump: buf=0x824c518 ptr=0x824c518 end=0x824c55b len=67 0000: 02 01 01 60 3e 02 01 03 04 2f 75 69 64 3d 74 72 ...`>..../uid=tr 0010: 79 6f 75 74 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 yout,ou=People,d 0020: 63 3d 6f 74 65 63 2c 64 63 3d 76 75 62 2c 64 63 c=otec,dc=vub,dc 0030: 3d 61 63 2c 64 63 3d 62 65 80 08 4d 68 43 30 47 =ac,dc=be..MhC0G 0040: 6a 4d 4a jMJ ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=1 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x824c518 ptr=0x824c51b end=0x824c55b len=64 0000: 60 3e 02 01 03 04 2f 75 69 64 3d 74 72 79 6f 75 `>..../uid=tryou 0010: 74 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 3d 6f t,ou=People,dc=o 0020: 74 65 63 2c 64 63 3d 76 75 62 2c 64 63 3d 61 63 tec,dc=vub,dc=ac 0030: 2c 64 63 3d 62 65 80 08 4d 68 43 30 47 6a 4d 4a ,dc=be..MhC0GjMJ ber_scanf fmt (m}) ber: ber_dump: buf=0x824c518 ptr=0x824c551 end=0x824c55b len=10 0000: 00 08 4d 68 43 30 47 6a 4d 4a ..MhC0GjMJ >>> dnPrettyNormal: <uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be> => ldap_bv2dn(uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be,0) <= ldap_bv2dn(uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=tryout,ou=people,dc=otec,dc=vub,dc=ac,dc=be)=0 <<< dnPrettyNormal: <uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be>, <uid=tryout,ou=people,dc=otec,dc=vub,dc=ac,dc=be> daemon: activity on 1 descriptor conn=1 op=0 BIND dn="uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be" method=128 do_bind: version=3 dn="uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be" method=128 ==> hdb_bind: dn: uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be bdb_dn2entry("uid=tryout,ou=people,dc=otec,dc=vub,dc=ac,dc=be") => hdb_dn2id("ou=people,dc=otec,dc=vub,dc=ac,dc=be") <= hdb_dn2id: got id=0x4 => hdb_dn2id("uid=tryout,ou=people,dc=otec,dc=vub,dc=ac,dc=be") <= hdb_dn2id: got id=0x22 entry_decode: "" <= entry_decode() => access_allowed: auth access to "uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be" "userPassword" requested => acl_get: [1] attr userPassword => slap_access_allowed: result not in cache (userPassword) => acl_mask: access to entry "uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=admin,dc=otec,dc=vub,dc=ac,dc=be <= check a_dn_pat: anonymous <= acl_mask: [2] applying auth(=xd) (stop) <= acl_mask: [2] mask: auth(=xd) => slap_access_allowed: auth access granted by auth(=xd) => access_allowed: auth access granted by auth(=xd) conn=1 op=0 BIND dn="uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be" mech=SIMPLE ssf=0 do_bind: v3 bind: "uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be" to "uid=tryout,ou=People,dc=otec,dc=vub,dc=ac,dc=be" send_ldap_result: conn=1 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 15 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1 op=0 RESULT tag=97 err=0 text= daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 ber_get_next ldap_read: want=8, got=8 0000: 30 1e 02 01 02 77 19 80 0....w.. ldap_read: want=24, got=24 0000: 17 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 .1.3.6.1.4.1.420 0010: 33 2e 31 2e 31 31 2e 31 3.1.11.1 ber_get_next: tag 0x30 len 30 contents: ber_dump: buf=0x824d060 ptr=0x824d060 end=0x824d07e len=30 0000: 02 01 02 77 19 80 17 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 31 .1.4203.1.11.1 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=1 op=1 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0x824d060 ptr=0x824d063 end=0x824d07e len=27 0000: 77 19 80 17 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 31 31 2e 31 4203.1.11.1 conn=1 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero CTRL-C daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=1, closing. connection_closing: readying conn=1 sd=15 for close connection_close: conn=1 sd=15 daemon: activity on 1 descriptor daemon: removing 15 daemon: activity on: conn=1 fd=15 closed (connection lost) daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero -- Frank Van Damme A: Because it destroys the flow of the conversation. Q: Why is it bad? A: No, it's bad. Q: Should I top post in replies to mailing lists or on Usenet?

4 6

Re: Q: status of component matching?
by Lehnert, Hartmut 17 Jun '10

17 Jun '10

Hi all! I would like to post further information on this theme which is of essential interest to us. After preventing slapd to dump a core file (by preventing memory freeing) we could not perform a component match filter search, and in the meanwhile we debugged slapd to see why a component match filter search fails. The result is that the signature algorithm of our certificate (sha256WithRSA) cannot be parsed by the code contained in "contrib/slapd-modules/comp_match/certificate.c". The function BDecAlgorithmIdentifier fails in line 198 because the value of totalElmtsLen1 is 11 and the value of elmtLen0 is 13 while parsing the OID 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 and obviously not handling the trailing Null parameter of the AlgorithmIdentifier. Can anybody suggest a solution for this problem? Regards, Hartmut

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical