openldap-technical

openldap-technical@openldap.org

9897 discussions

for help about extend schema with java
by tong cui 07 Jun '10

07 Jun '10

Hi, I'm testing API "JLDAP - LDAP Class Libraries will be Java" with the versionof the openldap 2.4.12. I configured openldap and executed theExtendSchema.java example then I got the following error: Error: LDAPException: Invalid Attribute Syntax (21) Invalid Attribute SyntaxLDAPException: Server Message: attributeTypes: value #0 invalid per syntaxLDAPException: Matched DN:at (Unknown Source)at (Unknown Source) The syntax generated for the API LDAPAttributeSchema is the following one:( 2.5.4.130 NAME 'cesmic' DESC 'testing' SYNTAX1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) Any idea on what's going on? Thank you very much~ I am looking for your reply~ Yours Tom The ExtendSchema.java example is as follows ========================================================//Sample code file: var/ndk/webBuildengine/tmp/viewable_samples/f91a68eb-ad37-4526-92b1-b1938f37b871/ExtendSchema.java//Warning: This code has been marked up for HTML/******************************************************************************* * $Novell: ExtendSchema.java,v 1.12 2002/07/29 21:28:12 $ * Copyright (c) 2000, 2001 Novell, Inc. All Rights Reserved. * * THIS WORK IS SUBJECT TO U.S. AND INTERNATIONAL COPYRIGHT LAWS AND * TREATIES. USE AND REDISTRIBUTION OF THIS WORK IS SUBJECT TO THE LICENSE * AGREEMENT ACCOMPANYING THE SOFTWARE DEVELOPMENT KIT (SDK) THAT CONTAINS * THIS WORK. PURSUANT TO THE SDK LICENSE AGREEMENT, NOVELL HEREBY GRANTS TO * DEVELOPER A ROYALTY-FREE, NON-EXCLUSIVE LICENSE TO INCLUDE NOVELL'S SAMPLE * CODE IN ITS PRODUCT. NOVELL GRANTS DEVELOPER WORLDWIDE DISTRIBUTION RIGHTS * TO MARKET, DISTRIBUTE, OR SELL NOVELL'S SAMPLE CODE AS A COMPONENT OF * DEVELOPER'S PRODUCTS. NOVELL SHALL HAVE NO OBLIGATIONS TO DEVELOPER OR * DEVELOPER'S CUSTOMERS WITH RESPECT TO THIS CODE. * * $name: ExtendSchema.java * $description: ExtendSchema.java demonstrates how to extend directory schema. * It is used to add a new attribute definition, a * new effective object class definition, and a new auxiliary * class definition to the directory schema . Then it adds a * test objec to the directory and add the new auxiliary class * to the test object to show how to apply an auxiliary class to * the test object. * To extend directory schema, the user must have Admin * equivalent rights. Novell recommend that users use ICE and * ldif file ( Import, Conversion, and Export ) to modify schema * instead of embedding schema extension commands within program * files. ******************************************************************************/ import com.novell.ldap.*; import java.io.UnsupportedEncodingException; public class ExtendSchema { // Create a new LDAPAttributeSchema object static LDAPAttributeSchema newAttrType = new LDAPAttributeSchema( new String[] {"testAttribute"}, // name of the new attr "2.16.840.1.113719.1.186.4.1", // OID of the new attr "Test attr definition", // desc of the new attr "1.3.6.1.4.1.1466.115.121.1.15" , // case-ignore string false, // not single-valued null, // no super attr type false, // not obsolete null, // no equality matching null, // no ordering matching null, // no substring matching false, // not a collective attr true, // user modifiable attr LDAPAttributeSchema.USER_APPLICATIONS)// user applications // Create a new effective class object static LDAPObjectClassSchema newObjClass = new LDAPObjectClassSchema( new String[] {"testClass"}, // name of the new obj class "2.16.840.1.113719.1.186.6.1", // OID of effective class new String [] {"top"}, // 'top' is super class "Test class definition", // optional description new String [] {"cn", "title"}, // required attribute(s) null, // optional attribute(s) LDAPObjectClassSchema.STRUCTURAL, // effective class false); // not obsolete // Create a new auxiliary class object static LDAPObjectClassSchema newAuxClass = new LDAPObjectClassSchema( new String[] {"testAuxClass"}, // name of the new obj class "2.16.840.1.113719.1.186.6.2", // OID of this auxiliary class new String [] {"top"}, // 'top' is super class "Test auxilliary class definition", // optional description null, // required attribute(s) new String [] {"testAttribute"}, // optional attribute LDAPObjectClassSchema.AUXILIARY, // auxiliary class false); // not obsolete public static void main( String[] args ) { if (args.length != 4) { usage(); System.exit(1); } int ldapPort = LDAPConnection.DEFAULT_PORT; int ldapVersion = LDAPConnection.LDAP_V3; String ldapHost = args[0]; String loginDN = args[1]; String password = args[2]; String testObjDN = "cn=testObject," + args[3]; LDAPConnection conn = new LDAPConnection(); // Add Novell eDirectory specific flags for attribute definition newAttrType.setQualifier( "X-NDS_PUBLIC_READ", new String [] {"1"}); newAttrType.setQualifier( "X-NDS_NOT_SCHED_SYNC_IMMEDIATE", new String [] {"1"}); // Add Novell eDirectory specific flags for object class definition newObjClass.setQualifier( "X-NDS_NAMING", new String [] {"cn"}); newObjClass.setQualifier( "X-NDS_CONTAINMENT", new String [] {"organization", "organizationalUnit", "domain", "locality", "treeRoot"}); try { // connect to the server conn.connect( ldapHost, ldapPort ); // bind to the server conn.bind( ldapVersion, loginDN, password.getBytes("UTF8") ); /* * Adding schema extensions includes: * 1. add a new attribute definition to directory schema * 2. add a new object class definition to directory schema * 3. add a new auxiliary class definition to directory schema */ System.out.println( "\tAdding test schema extensions..."); // add schema extensions if ( extendSchema( conn ) ) { // add a test object to the directory tree if ( addTestObject( conn, testObjDN ) ) { // add the auxiliary class to the test object addAuxClassToTestObj( conn, testObjDN ); } } /* * Removing schema extensions consists of: * 1. remove auxiliary class definition from schema * 2. remove object class definition from schema * 3. remove attribute definition from schema */ // remove auxiliary class from test object if ( removeAuxClassFromTestObj( conn, testObjDN ) ) { // remove test object if ( removeTestObj( conn, testObjDN ) ) { System.out.println( "\tRemoving test schema extensions..."); unExtendSchema( conn ); } } // disconnect with the server conn.disconnect(); } catch( LDAPException e ) { System.out.println( "Error: " + e.toString() ); } catch( UnsupportedEncodingException e) { System.out.println( "Error: " + e.toString() ); } System.exit(0); } public static void usage() { System.err.println("Usage: java ExtendSchema <host name>" + " <login dn> <password> <test container DN>"); System.err.println("Example: java ExtendSchema Acme.com" + " \"cn=admin,o=Acme\" secret \"o=Acme\""); } // add schema extensions public static boolean extendSchema( LDAPConnection conn ) { boolean status = true; try { // Add attribute definition conn.modify( conn.getSchemaDN(), new LDAPModification(LDAPModification.ADD, newAttrType)); System.out.println("\tAdded attribute schema extensions successfully"); // Add object definitions LDAPModification[] modifications = new LDAPModification[2]; modifications[0] = new LDAPModification(LDAPModification.ADD, newObjClass); modifications[1] = new LDAPModification(LDAPModification.ADD, newAuxClass); conn.modify( conn.getSchemaDN(), modifications ); System.out.println( "\tAdded object schema extensions successfully."); } catch( LDAPException e ) { System.out.println( "\tFailed to add schema extensions."); System.out.println( "Error: " + e.toString() ); status = false; } return status; } // remove schema extensions public static boolean unExtendSchema( LDAPConnection conn ) { boolean status = true; try { // Remove auxiliary class definition // Add attribute definition LDAPModification[] modifications = new LDAPModification[2]; modifications[1] = new LDAPModification(LDAPModification.DELETE, newAuxClass); modifications[0] = new LDAPModification(LDAPModification.DELETE, newObjClass); conn.modify( conn.getSchemaDN(), modifications); System.out.println( "\tSuccessfully removed the object schema extensions"); conn.modify( conn.getSchemaDN(), new LDAPModification(LDAPModification.DELETE, newAttrType)); System.out.println( "\tSuccessfully removed the attribute schema extensions"); } catch( LDAPException e ) { System.out.println( "\tFailed to remove the schema extensions." ); System.out.println( "Error: " + e.toString() ); status = false; } return status; } // add test object public static boolean addTestObject( LDAPConnection conn, String dn ) { boolean status = true; LDAPAttribute attribute = null; LDAPAttributeSet attributeSet = new LDAPAttributeSet(); attribute = new LDAPAttribute("objectclass",new String []{"testClass"}); attributeSet.add( attribute ); attribute = new LDAPAttribute( "cn", new String []{ "testObject", "Test Object" }); attributeSet.add( attribute ); attribute = new LDAPAttribute( "title", new String []{ "testManager", "Test Manager" }); attributeSet.add( attribute ); LDAPEntry newEntry = new LDAPEntry( dn, attributeSet ); try { conn.add( newEntry ); System.out.println( "\t\tAdded test object successfully."); } catch( LDAPException e ) { System.out.println( "\t\tFailed to add test object." ); System.out.println( "Error: " + e.toString() ); status = false; } return status; } // remove test object public static boolean removeTestObj( LDAPConnection conn, String dn ) { boolean status = true; try { conn.delete( dn ); System.out.println("\t\tRemoved test object successfully."); } catch( LDAPException e ) { System.out.println("Failed to remove test object." ); System.out.println( "Error: " + e.toString() ); status = false; } return status; } // add auxiliary class to test object public static boolean addAuxClassToTestObj( LDAPConnection conn, String dn ) { boolean status = true; LDAPModification[] mods = new LDAPModification[2]; LDAPAttribute testAuxClass = new LDAPAttribute( "objectclass", "testAuxClass" ); mods[0] = new LDAPModification( LDAPModification.ADD, testAuxClass); LDAPAttribute testAttr = new LDAPAttribute("testAttribute", "pagerUser"); mods[1] = new LDAPModification( LDAPModification.ADD, testAttr) ; try { conn.modify( dn, mods); System.out.println( "\t\tAdded auxiliary class to" + " test object successfully."); } catch( LDAPException e ) { System.out.println( "\t\tFailed to add auxiliary" + " class to test object."); System.out.println( "Error: " + e.toString() ); status = false; } return status; } // remove auxiliary class from test object public static boolean removeAuxClassFromTestObj( LDAPConnection conn, String dn ) { boolean status = true; LDAPModification[] mods = new LDAPModification[2]; LDAPAttribute testAuxClass = new LDAPAttribute( "objectclass", "testAuxClass" ); mods[0] = new LDAPModification( LDAPModification.DELETE, testAuxClass); LDAPAttribute testAttr = new LDAPAttribute("testAttribute", "pagerUser"); mods[1] = new LDAPModification( LDAPModification.DELETE, testAttr); try { conn.modify( dn, mods ); System.out.println( "\t\tRemoved auxiliary class from test" + " object successfully."); } catch( LDAPException e ) { System.out.println( "\t\tFailed to remove auxiliary class from" + " test object." ); System.out.println( "Error: " + e.toString() ); status = false; } return status; } } _________________________________________________________________ Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:…

1 0

LDAP C API
by Покотиленко Костик 07 Jun '10

07 Jun '10

Did this message hit the list? Hi there, I'm writing GTK application for managing LDAP directory, a kind of GTK variant of phpldapadmin. As for now I'm able to browse directory, objects' probepries and their values. What is not clear is how to figure out the RDN and Required property, and Structural value. How it is done? -- Покотиленко Костик <casper(a)meteor.dp.ua>

2 4

Pam password authentication
by Indexer 07 Jun '10

07 Jun '10

Recently, i have hit a rather unique, and annoying, error with ldap. it seems that using pam with ldap, allows *any* password as valid. Im not really sure what i have done here, and any help would be apprecitaed. find my /etc/ldap.conf attached, as well as pam.d/ssh etc/ldap.conf base dc=chocolate,dc=lan suffix dc=chocolate,dc=lan uri ldap://ldap.chocolate.lan ldap_version 3 scope sub timelimit 3 bind_timelimit 3 bind_policy soft pam_filter objectclass=posixAccount pam_login_attribute uid pam_groupdn cn=login,ou=Nemo,ou=Group,dc=chocolate,dc=lan pam_member_attribute memberUid pam_password clear pam_password exop nss_base_passwd ou=Users,dc=chocolate,dc=lan?sub nss_base_shadow ou=Users,dc=chocolate,dc=lan?sub nss_base_group ou=Nemo,ou=Group,dc=chocolate,dc=lan?sub ssl on ssl start_tls tls_cacert /usr/local/etc/openldap/keys/cacert.crt tls_checkpeer no pam.d/sshd auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth sufficient /usr/local/lib/pam_ldap.so no_warn use_first_pass auth sufficient pam_unix.so no_warn try_first_pass account required pam_nologin.so account required pam_login_access.so account optional pam_unix.so account optional /usr/local/lib/pam_ldap.so session required pam_permit.so session optional /usr/local/lib/pam_ldap.so password sufficient /usr/local/lib/pam_ldap.so no_warn use_athtok use_first_pass password sufficient pam_unix.so no_warn try_first_pass

5 6

ldap with squid auth helper
by Gerardo Herzig 07 Jun '10

07 Jun '10

Hi all. Im triyng to use squid with the squid_ldap_group auth helper. The schema looks like o=Company | -Groups |-ProxyUsers |-Managers |-Sales Managers and Sales are OrganizationalUnit, ProxyUsers is GroupofUniqueNames Each entry of Managers and Sales inherits from PosixAccount and InetOrgPerson ProxyUsers entry for the user foo is: UniqueMember: uid=foo,ou=Managers,o=Company UniqueMember: uid=anotherfoo,ou=Sales,o=Company Inside the ProxyUsers can be people from Managers, Sales, and so. Im faliling to test squid_ldap_group from command line (i think the filters part) 1) Is there a way to test if the user foo is part of the ProxyUsers group? 2) It is possible to tell squid_ldap_group to look for uid=foo in Manager AND Sales, and if there is one try to use it? Like if the filter could be "(uid=foo) _AND_ (ou=Managers _OR_ ou=Sales)"? I hope to be clear with the question. Thanks! Gerardo

2 1

Scaling bottom-up - best practices?
by Jan Lühr 07 Jun '10

07 Jun '10

Hello, for some time now, we're using openldap 2.4.11 on debian lenny and everything is fine - but: We've to scale. Up to now our root-dn is dc=abc - our new root-dn ought to be: dc=xyz, having a subtree dc=abc,dc=xyz The root-dn is set in some application's configs as base dn, furthermore, it's referenced in ldap-entries (dynamic overlay-groups). Basically I can think of two strategies. a) Change the root-dn within the directory and in all applications depending on it (con: error prone - pro: clean result) b) Install a new server, proxy all requests to the old instance, removing dc=xyz on queries, add dc=xyz on responses. (con: complexity, pro: no changes in apps / Information depending on dc=abc) Have you had similar problems? What did you do to solve 'em? What strategy do you recommend? Thanks, Keep smiling yanosz

3 2

how to get DIT structure info
by owen nirvana 07 Jun '10

07 Jun '10

hi, I have a question. I want to manage some data by OpenLDAP, and I hope show them by tree structure when I list. So I want to get the DIT structure info and create the corresponding nodes in my treeview. so , how to do? gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

3 2

Bidirectional sync using openldap and active directory
by Benjamin MONTHOUEL 07 Jun '10

07 Jun '10

Hi, I'd like to know which method is recommended by openldap.org to perform a bidirectional sync with Microsoft Active Directory. This method has to notice that users changed their password by themselves. Kerberos token ??? Thanks for any information. -- Benjamin MONTHOUËL Systems Administrator Assistant NETASQ France - We Secure IT Villeneuve d'Ascq

2 2

Help with a referral
by Jason Voorhees 06 Jun '10

06 Jun '10

Hi: I'm trying to migrate an old LDAP server (that holds an ldap tree for Open-Xchange) to a new installation of OpenLDAP 2.3.43. A lot of users had configured their Outlook in a way that they make a base search for ou=Users,ou=OxObjects,dc=domain,dc=com in their LDAP address book. But my new LDAP tree won't have ou=OxObjects,dc=domain,dc=com entry, i'm creating a new ldap structure to be used with GOSA. So I decide to create a referral like this: dn: ou=Users,ou=OxObjects,dc=domain,dc=com ou: Users objectclass: referral objectclass: extensibleObject ref: ldap://HOSTNAME/ou=people,dc=domain,dc=com This works fine, now Outlook users can find their contacts using the same base search (ou=Users,ou=OxObjects,dc=domain,dc=com) but now GOSA got in problems because it finds two administrator users (cn=System administrator,ou=people,dc=domain,dc=com) because of the referral. I just would like to GOSA doesn't follow referrals or just searches for users under ou=people,dc=domain,dc=com instead of the root dc=domain,dc=com, but it seem that GOSA isn't good enough to customize this yet. So I think I could modify my referral to return not all attributes, just some of them (the attributes commonly used by an address book search) like this: dn: ou=Users,ou=OxObjects,dc=domain,dc=com ou: Users objectclass: referral objectclass: extensibleObject ref: ldap://HOSTNAME/ou=people,dc=domain,dc=com?cn,sn,givenName,telephoneNumber,mail After updating my referral and I make an ldapsearch: # ldapsearch -xLLL "(uid=admin)" I still get two entries (two administrators) and both of them returns all its attributes. Then I tried to modify my referral like this: dn: ou=Users,ou=OxObjects,dc=domain,dc=com ou: Users objectclass: referral objectclass: extensibleObject ref: ldap://HOSTNAME/ou=people,dc=domain,dc=com??sub?(!(uid=admin)) And still get two entries (two administrators). So I suspect that my referral URI isn't working. Am using a wrong referral? Or maybe OpenLDAP always returns all entries ignoring attributes and filters in a URI referral (ldap://HOSTNAME/ou=people,dc=domain,dc=com?cn,sn,givenName,telephoneNumber,mail)? I hope some one can help me because i'm stuck with this since two days ago. I just want to limit the entries returned by my referral. Thanks

4 8

ldap_sync* how to
by egemenozden＠gmail.com 06 Jun '10

06 Jun '10

hi, I needed to write a daemon which can react to changes on openldap server. It has to be an event driven application hence polling is ruled out. After some research, the most proper way seems to be through ldap sync however I could not find any documentation other than the man page of ldap_sync* which does not provide any example. Does any body know of an introductory document or another way to achieve my purpose? In the worst case I will dive into slapd's implementation to have a feeling or simply use the logs as an event channel. Thanks

3 2

input error=-2
by Joe Friedeggs 04 Jun '10

04 Jun '10

I just recently noticed 'input error=-2' when running in debug mode, and in my logs (loglevel sync shell stats ber conns). It seems to occur (always) when the connection it closed. Anyone know what might cause this? Is it anything I should be concerned with? I am not sure when this started. I have made numerous changes over the past few weeks; too many to back out. Thanks, Joe >From DEBUG:: ber_get_next on fd 25 failed errno=0 (Success) connection_read(25): input error=-2 id=20, closing. connection_closing: readying conn=20 sd=25 for close connection_close: conn=20 sd=25 =>ldap_back_conn_destroy: fetching conn 20 daemon: removing 25 Similarly in log: Jun 4 15:39:31 ldapserver slapd[7683]: daemon: read active on 16 Jun 4 15:39:31 ldapserver slapd[7683]: conn=150 op=2 UNBIND Jun 4 15:39:31 ldapserver slapd[7683]: connection_read(16): input error=-2 id=150, closing. Jun 4 15:39:31 ldapserver slapd[7683]: daemon: removing 16 Jun 4 15:39:31 ldapserver slapd[7683]: conn=150 fd=16 closed Jun 4 15:39:31 ldapserver slapd[7683]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jun 4 15:39:31 ldapserver slapd[7683]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 4 15:39:31 ldapserver slapd[7683]: daemon: activity on 1 descriptor Jun 4 15:39:31 ldapserver slapd[7683]: daemon: activity on: _________________________________________________________________ Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical