openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

OpenLDAP with MySQL Cluster - No free node Error
by Priyesh Potdar 03 Jun '10

03 Jun '10

Hi All, I am new to use of ndb with openLDAP. I have established a MySQL Cluster in my network and also compiled the openLDAP with --enable-ndb option. Now when I start the openLDAP with command "slapd -d 5" (To see the debug output), I get the following error: Configuration error: Error : Could not alloc node id at 192.168.7.40 port 1186: No free node id found for mysqld(API). My slapd.conf contains : ####################################################################### database ndb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret dbconnect 192.168.7.40 ## dbhost - mysql host, where you mysql server resides, used to create schemas dbhost 192.168.7.40 ## dbname - mysql database dbname testing ## dbuser - mysql user name dbuser root ## dbpass - mysql user password (empty in this case) dbpass "" ## dbconnections - how many connections slapd should make to Cluster ## (like ndb-cluster-connection-pool) dbconnections 1 # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain #index objectClass eq Output from the ndbd_mgm show command is as follows: -- NDB Cluster -- Management Client -- ndb_mgm> show Connected to Management Server at: 192.168.7.40:1186 Cluster Configuration --------------------- [ndbd(NDB)] 3 node(s) id=2 @192.168.7.30 (mysql-5.1.44 ndb-7.1.3, Nodegroup: 0, Master) id=3 @192.168.7.56 (mysql-5.1.44 ndb-7.1.3, Nodegroup: 1) id=4 (not connected, accepting connect from 192.168.7.40) [ndb_mgmd(MGM)] 1 node(s) id=1 @192.168.7.40 (mysql-5.1.44 ndb-7.1.3) [mysqld(API)] 8 node(s) id=5 @192.168.7.30 (mysql-5.1.44 ndb-7.1.3) id=6 (not connected, accepting connect from any host) id=7 (not connected, accepting connect from any host) id=8 (not connected, accepting connect from any host) id=9 (not connected, accepting connect from any host) id=10 (not connected, accepting connect from any host) id=11 (not connected, accepting connect from any host) id=12 (not connected, accepting connect from any host) and Config.ini file contains the following data: [NDBD DEFAULT] NoOfReplicas=1 [MYSQLD DEFAULT] [NDB_MGMD DEFAULT] [TCP DEFAULT] # Managment Server [NDB_MGMD] HostName=192.168.7.40 # Storage Engines [NDBD] HostName=192.168.7.30 [NDBD] HostName=192.168.7.56 [NDBD] HostName=192.168.7.40 [MYSQLD] [MYSQLD] [MYSQLD] [MYSQLD] [API] [API] [API] [API] Any help on the same is appreciated. Thanks, Priyesh Potdar

1 0

Syncrepl - ldap_bind: Invalid credentials error
by Gocher, Mark 03 Jun '10

03 Jun '10

I'm receiving the following error on my consumer, using logging -d stats + args + trace + sync 2> /var/log/ldap @(#) $OpenLDAP: slapd 2.4.22 (May 21 2010 12:10:42) $ @cambridge:/usr/local/openldap-2.4.22/servers/slapd slapd starting slap_client_connect: URI=ldap://oxford.unix1.city.ac.uk:389 DN="cn=replicator,dc=city,dc=ac,dc=uk" ldap_sasl_bind_s failed (49) I can see from the documentation that my consumer is not authenticating to my provider, but I can't see what the error is. If any other info would help please let me know. I have created the uid for replicator and repeated this search with the 'access to attrs=userPassword' line commented out on the provider to ensure that the userPassword for replicator is clear text 'secret'. I can also perform this search from the consumer successfully. ldapsearch -x -b dc=city,dc=ac,dc=uk uid=replicator version: 1 dn: uid=replicator,ou=users,dc=city,dc=ac,dc=uk objectClass: person objectClass: posixAccount objectClass: inetOrgPerson sn: replicator cn: replicator uid: replicator uidNumber: 22258 gidNumber: 22258 homeDirectory: /export/home/replicator userPassword: secret displayName: replicator mail: None labeledURI: None description: openLDAP replication id Consumer ldap.conf: database bdb suffix "dc=city,dc=ac,dc=uk" rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk" rootpw {CRYPT}******* directory /var/opt/csw/openldap-data index default pres,eq,sub index objectClass eq index cn index sn index uid access to attrs=userPassword by anonymous auth by * none access to * by * read index entryUUID eq syncrepl rid=0 provider=ldap://oxford.unix1.city.ac.uk:389 bindmethod=simple binddn="cn=replicator,dc=city,dc=ac,dc=uk" credentials=secret searchbase="dc=city,dc=ac,dc=uk" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog updateref ldap://oxford.unix1.city.ac.uk database monitor Provider ldap.conf: database bdb suffix "dc=city,dc=ac,dc=uk" rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk" rootpw {CRYPT}aZmvWMwFgg.vk directory /var/opt/csw/openldap-data index default pres,eq,sub index objectClass eq index cn index sn index uid access to * by dn.base="cn=replicator,dc=city,dc=ac,dc=uk" read by * break access to attrs=userPassword by anonymous auth by * none access to * by * read modulepath /usr/local/openldap-2.4.22 moduleload back_bdb.la moduleload accesslog.la moduleload syncprov.la database bdb suffix cn=accesslog directory /var/opt/csw/accesslog rootdn cn=accesslog index default eq index objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # database bdb # suffix "dc=dc=city,dc=ac,dc=uk" # rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk" index entryCSN eq index entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 99+00:00 00+00:01 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database monitor

2 9

syncrepl & history store
by Oliver Henriot 02 Jun '10

02 Jun '10

Dear OpenLDAP list users, I'm having syncrepl oddities. One of my consumer servers has an entry which is absent on the provider. I thought syncrepl would delete it during "present phase" mentioned in the admin guide but it's been sitting there for days and hasn't been removed. There is only one consumer on which this superfluous entry is present. I'm logging sync level on provider and consumers since I identified the problem and nothing odd appears. I unfortunately did not log sync level at the time the problem appeared so maybe I missed any useful info. The only thing I got in the logs when the problem occured was "deferring operation: too many executing" but I also sometimes get the same error in the logs and nothing bad happens to the data. I'm reading through the guide trying to understand what's going on and in the syncrepl section (http://www.openldap.org/doc/admin23/syncrepl.html ; yes I'm reading the version 2.3 documentation because I'm using the CentOS 5.5 packaged version : 2.3.43-12.el5) I've come across references to a history store maintained on the provider which is useful for the delete phase used in refreshAndPersist, which is what I am using. I thought this might be a plausible clue for my problem. However, nowhere else do I find any reference to this history store, how it's configured or how it works. Could the use of RefreshAndPersist explain the superflous entry present on one consumer and should(could) I configure a history store to solve this issue? Or should I switch to RefreshOnly to prevent this kind of problem from occuring again in the future? It's the first time I've come across it but when my directories will really be used they will be absolutely critical and I'd rather not have this kind of problem again if possible. Thanks for your help. Best regards, Oliver

2 1

multiple instances
by mj romero 02 Jun '10

02 Jun '10

Hello, I installed a server (RHEL5 x86_64) with three instances of OpenLDAP 2.3.43. ldap 6572 1 0 May24 ? 00:49:12 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.104:389 -f /etc/openldap/slapd.conf -l LOCAL4ldap 6612 1 0 May24 ? 00:49:09 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.106:389 -f /etc/openldap/slapd_i3.conf -l LOCAL6ldap 8031 1 0 01:01 ? 00:01:26 /usr/sbin/slapd -u ldap -g ldap -h ldap://X.Y.Z.105:389 -f /etc/openldap/slapd_i2.conf -l LOCAL5 At first everything worked perfect but after several days working properly one instance stopped.I started the instance again but after several days one instance stopped (not the same).I don't understand what happens. Any help is very useful to me. Thank you very much. _________________________________________________________________ Consejos para seducir ¿Puedes conocer gente nueva a través de Internet? ¡Regístrate ya! http://contactos.es.msn.com/?mtcmk=015352

2 2

TLS certs needed for Provider and consumer
by Sotomayor, Vicente (ITD) 02 Jun '10

02 Jun '10

Hello Everyone: Does anyone a have a link the shows what steps are needed to for creating certs for a Provider and Consumer? I've been able to do it for Provider, but I'm stuck on what to do for the consumer. Thanks

2 1

replication issue
by Lennart Job 01 Jun '10

01 Jun '10

Hi there, I've got some problems with ldap replication. Ever since I've updated the master from Debian Etch to Lenny changes are no longer synced. I've got v2.4.11 running on both servers. The slave is still running Etch. SSL is active, so maybe there's a problem with the certificates... However, if I restart the slave slapd he does replicate properly. Do you know any reasons for this behavior? In addition, synchronization with samba on the master doesn't work properly anymore. I can create accounts but password changes don't take effect. So everybody has to use his first ever password to connect to samba... Thanks for your help! Kind regards, Lennart -- Lennart Job Ressort IT / Wissensmanagement fuks e.V. Waldhornstraße 27 76131 Karlsruhe Büro +49 721 38 42 313 Fax +49 721 37 98 24 Privat +49 721 20 46 845 Mobil +49 173 78 87 643 E-Mail lennart.job(a)fuks.org Web www.fuks.org fuks e.V. - Vorsitz: André Fuchs - VR: 791 (Amtsgericht Karlsruhe)

2 1

LDAP C API
by Покотиленко Костик 01 Jun '10

01 Jun '10

Hi there, I'm writing GTK application for managing LDAP directory, a kind of GTK variant of phpldapadmin. As for now I'm able to browse directory, objects' probepries and their values. What is not clear is how to figure out the RDN and Required property, and Structural value. How it is done? -- Покотиленко Костик <casper(a)meteor.dp.ua>

1 0

Server certificate
by Daniel Gomes 01 Jun '10

01 Jun '10

Hey there, I've got a simple enough question: is it possible to use a certificate for TLS (through the TLSCertificateFile directive) on which the FQDN of the LDAP server is not on the CN but instead on the alternative name? I tried this, but I'm getting a "TLS init def ctx failed: -64" and I thought it might be because of this issue. I also couldn't find a list of the error numbers and their descriptions, making it harder for me to understand what's wrong... Cheers, -- Daniel Gomes (SysAdmin) dgomes(a)ipfn.ist.utl.pt Ext. 3487 - 218419487 Instituto de Plasmas e Fusão Nuclear Instituto Superior Técnico - UTL Av. Rovisco Pais - 1049-001 Lisboa - Portugal

3 3

Notes on virtual views
by Vladislav Nespor 01 Jun '10

01 Jun '10

I have tried to create virtual views of existing local data and I have realized that the rewrite/remap overlay (slapo-rwm) in conjunction with the relay backend (slapd-relay) (both are experimental) does not exactly do what I would like to have. To explain the problem, let me consider the following hypothetical situation. We have two groups of UNIX clients. All clients should be accessed by the same set of users having different user ID on each client group. In addition, it would be nice to have different user passwords for each client group. In the local schema, we define two new attributes xxxUidNumber and xxxUserPassword, and a new object class xxxPosixAccount holding them. The local.schema file, the initial slapd.conf file (OpenLDAP 2.4.22), and the real data ldif file are at the end of this email. The real data are in 'ou=users,ou=auth,o=example', and the virtual view is in 'ou=xxxUsers,ou=auth,o=example'. 1 The search problem ==================== Here are some queries and results to demonstrate it: Real data: ---------- Search request A ~~~~~~~~~~~~~~~~ /usr/local/bin/ldapsearch -LLL -H ldaps://censor.ethz.ch -x \ -D "cn=ldap_manager,ou=auth,o=example" \ -w qwerty \ -b 'cn=user10,ou=users,ou=auth,o=example' dn: cn=user10,ou=users,ou=auth,o=example objectClass: top objectClass: person objectClass: posixAccount objectClass: xxxPosixAccount cn: user10 sn: user10 uid: user10 uidNumber: 1111 xxxUidNumber: 2222 gidNumber: 3333 homeDirectory: /tmp loginShell: /bin/tcsh gecos: User 10 userPassword:: e1NTSEF9QWlmMWtyQXhkRGQ3bHJ5amp6VzFoTUgxOFdVU01BPT0= xxxUserPassword: {SSHA}BaPK4xvEKVpYwj3qK0zbOWpVOAwSMA== Virtual view: ------------- Search request B ~~~~~~~~~~~~~~~~ /usr/local/bin/ldapsearch -LLL -H ldaps://censor.ethz.ch -x \ -D "cn=ldap_manager,ou=auth,o=example" \ -w qwerty \ -b 'cn=user10,ou=xxxUsers,ou=auth,o=example' dn: cn=user10,ou=xxxUsers,ou=auth,o=example objectClass: top objectClass: person objectClass: posixAccount objectClass: xxxPosixAccount cn: user10 sn: user10 uid: user10 uidNumber: 1111 uidNumber: 2222 gidNumber: 3333 homeDirectory: /tmp loginShell: /bin/tcsh gecos: User 10 userPassword:: e1NTSEF9QWlmMWtyQXhkRGQ3bHJ5amp6VzFoTUgxOFdVU01BPT0= userPassword:: e1NTSEF9QmFQSzR4dkVLVnBZd2ozcUswemJPV3BWT0F3U01BPT0= The rewrite/remap part in slapd.conf was as follows: overlay rwm rwm-suffixmassage "ou=users,ou=auth,o=example" rwm-map attribute userPassword xxxUserPassword rwm-map attribute uidNumber xxxUidNumber Because of the simple mapping, the reply contains uidNumber and userPassword attributes two times. To eliminate this, we modify the rewrite/remap part in slapd.conf: overlay rwm rwm-suffixmassage "ou=users,ou=auth,o=example" rwm-map attribute userPassword xxxUserPassword rwm-map attribute userPassword rwm-map attribute uidNumber xxxUidNumber rwm-map attribute uidNumber Now the answer from the previous search request (B) seems to be as desired: dn: cn=user10,ou=xxxUsers,ou=auth,o=example objectClass: top objectClass: person objectClass: posixAccount objectClass: xxxPosixAccount cn: user10 sn: user10 uid: user10 uidNumber: 2222 gidNumber: 3333 homeDirectory: /tmp loginShell: /bin/tcsh gecos: User 10 userPassword:: e1NTSEF9QmFQSzR4dkVLVnBZd2ozcUswemJPV3BWT0F3U01BPT0= But the next search request returns values, although one would expect an empty result set, as the attribute xxxUidNumber (used in the filter) is not explicitly present in the virtual view (it is mapped): Search request C ~~~~~~~~~~~~~~~~ /usr/local/bin/ldapsearch -LLL -H ldaps://censor.ethz.ch -x \ -D "cn=ldap_manager,ou=auth,o=example" \ -w qwerty \ -b 'ou=xxxUsers,ou=auth,o=example' \ '(xxxUidNumber=*)' dn: cn=user10,ou=xxxUsers,ou=auth,o=example objectClass: top objectClass: person objectClass: posixAccount objectClass: xxxPosixAccount cn: user10 sn: user10 uid: user10 uidNumber: 2222 gidNumber: 3333 homeDirectory: /tmp loginShell: /bin/tcsh gecos: User 10 userPassword:: e1NTSEF9QmFQSzR4dkVLVnBZd2ozcUswemJPV3BWT0F3U01BPT0= I think the attribute xxxUidNumber should be removed from the internal query to the foreign data set, because it is used as a foreign name (and in the same time not as a local name) in the mapping, and the query (C) above should return an empty result set. One can improve this by modifying the rewrite/remap part in slapd.conf as follows: overlay rwm rwm-suffixmassage "ou=users,ou=auth,o=example" rwm-map attribute cn * rwm-map attribute sn * rwm-map attribute uid * rwm-map attribute gidNumber * rwm-map attribute homeDirectory * rwm-map attribute loginShell * rwm-map attribute gecos * rwm-map attribute userPassword xxxUserPassword rwm-map attribute uidNumber xxxUidNumber rwm-map attribute * Now both search requests (B and C) work as expected. The last remap line correctly removes everything what is not mapped. The problem here is that one has to explicitly list all desired attributes in the remap configuration. If a new attribute is added to the real data, it would not show in the result set without a change in the remap configuration. 2 The authentication problem ============================ The following two bind request use the same password for authentication, regardless of the mapping and the value of the attribute xxxUserPassword. /usr/local/bin/ldapsearch -LLL -H ldaps://censor.ethz.ch -x \ -D "cn=user10,ou=users,ou=auth,o=example" \ -w abc123 \ -b 'cn=user10,ou=users,ou=auth,o=example' dn dn: cn=user10,ou=users,ou=auth,o=example /usr/local/bin/ldapsearch -LLL -H ldaps://censor.ethz.ch -x \ -D "cn=user10,ou=xxxUsers,ou=auth,o=example" \ -w abc123 \ -b 'cn=user10,ou=xxxUsers,ou=auth,o=example' dn dn: cn=user10,ou=xxxUsers,ou=auth,o=example If we use the userPassword (xyz789), reported by the view (e.g. query B), the bind request returns 'Invalid credentials'. If I understand it correctly, this is not a bug. The LDAP bind request does not contain the name of the attribute holding the user password at the server site, so there is (unfortunately) nothing to map. There are many real life situations where, for security reasons, it would be desirable to have different passwords for different applications, or groups of applications/clients (e.g. web access, UNIX login, etc.). Unfortunately, it seems the present virtual views (slapo-rwm + slapd-relay) cannot solve it. For the moment, I see only one possibility -- to create a copy of the user entries and to modify the userPassword attribute. (Please let me know, if you know a better solution.) But there are disadvantages connected with this approach, for example the maintenance of the data consistency, large indices, etc. My question is -- would it be possible to solve the password mapping in the OpenLDAP software? For example, (i) to extend the structure holding the bind request data to include an attribute name, (ii) to initialise its value to 'userPassword', (iii) to allow slapo-rwm to rewrite/remap it, and then (iv) to use the new value of the attribute name for the internal user password verification. With best regards, Vlado ------------------------------------------------------------------------- local.schema: ============= attributetype ( 1.3.6.1.4.1.9999.2.1.102 NAME 'xxxUidNumber' DESC 'An integer uniquely identifying a user in an administrative domain (XXX private)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.9999.2.1.105 NAME 'xxxUserPassword' DESC 'RFC2256/2307: password of user (XXX private)' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) objectclass ( 1.3.6.1.4.1.9999.2.2.10 NAME 'xxxPosixAccount' DESC 'Abstraction of an account with POSIX attributes (XXX private)' SUP top AUXILIARY MAY ( xxxUidNumber $ xxxUserPassword ) ) slapd.conf: =========== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /etc/openldap/local.schema pidfile /var/openldap/slapd.pid argsfile /var/openldap/slapd.args loglevel 256 TLSCertificateFile /etc/openldap/xxx_cert.pem TLSCertificateKeyFile /etc/openldap/xxx_key.pem TLSRandFile /var/run/prngd-socket TLSCACertificateFile /etc/openldap/yyy_cacert.pem database relay suffix "ou=xxxUsers,ou=auth,o=example" subordinate overlay rwm rwm-suffixmassage "ou=users,ou=auth,o=example" rwm-map attribute userPassword xxxUserPassword rwm-map attribute uidNumber xxxUidNumber database hdb suffix "ou=auth,o=example" directory /var/openldap/hdb rootdn "cn=ldap_manager,ou=auth,o=example" rootpw {SSHA}jN4XaG5UmYFwpY/47aW0nLralRwSMA== dbconfig set_cachesize 0 268435456 0 dbconfig set_flags DB_TXN_NOSYNC dbconfig set_flags DB_LOG_AUTOREMOVE dbconfig set_lk_max_locks 3000 dbconfig set_lk_max_lockers 3000 dbconfig set_lk_max_objects 3000 dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 10485760 dbconfig set_lg_bsize 2097152 dbconfig set_lg_dir /var/log/hdb dbconfig set_tmp_dir /tmp Real data: ========== dn: ou=auth,o=example objectClass: top objectClass: organizationalUnit ou: auth dn: ou=users,ou=auth,o=example objectClass: top objectClass: organizationalUnit ou: users dn: cn=user10,ou=users,ou=auth,o=example objectClass: top objectClass: person objectClass: posixAccount objectClass: xxxPosixAccount cn: user10 sn: user10 uid: user10 uidNumber: 1111 xxxUidNumber: 2222 gidNumber: 3333 homeDirectory: /tmp loginShell: /bin/tcsh gecos: User 10 # abc123 userPassword: {SSHA}Aif1krAxdDd7lryjjzW1hMH18WUSMA== # xyz789 xxxUserPassword: {SSHA}BaPK4xvEKVpYwj3qK0zbOWpVOAwSMA==

1 0

Re: Q: status of component matching?
by Lehnert, Hartmut 31 May '10

31 May '10

Hi all! To avoid the slapd's core dump when using component match filters (see ITS # 6556) I removed line 556 of file "servers/slapd/filter.c": case LDAP_FILTER_EXT: //mra_free( op, f->f_mra, 1 ); break; Now component match filter search requests are answered by slapd but don't work correctly. In fact nothing is found! For example the request /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s sub "(userCertificate:componentFilterMatch:=item:{ component \"toBeSigned.serialNumber\", rule allComponentsMatch, value 449 })" sncertnr Is answered with # extended LDIF # # LDAPv3 # base <o=CustomerCA,c=de> with scope subtree # filter: (userCertificate:componentFilterMatch:=item:{ component "toBeSigned.serialNumber", rule allComponentsMatch, value 449 }) # requesting: sncertnr # # search result search: 2 result: 0 Success # numResponses: 1 But in the database of slapd there are several certificates with serialNumber 449: lehnert.hartmut@sn-ocspr4:/opt/lehnert/Openldap-Support$ ./dumpasn1 449.cer 0 30 702: SEQUENCE { 4 30 551: SEQUENCE { 8 A0 3: [0] { 10 02 1: INTEGER 2 : } 13 02 2: INTEGER 449 17 30 13: SEQUENCE { 19 06 9: OBJECT IDENTIFIER : sha256WithRSAEncryption (1 2 840 113549 1 1 11) 30 05 0: NULL : } 32 30 111: SEQUENCE { 34 31 11: SET { 36 30 9: SEQUENCE { 38 06 3: OBJECT IDENTIFIER countryName (2 5 4 6) 43 13 2: PrintableString 'DE' : } : } 47 31 12: SET { On slapd's side the debug message bdb_search: <integer> does not match filter is written out for every record. What's going wrong here? Regards, Hartmut

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical