openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

"new style" on ubuntu 8.04
by Luis Paulo 31 Mar '10

31 Mar '10

Hi, all I am installing openldap for the first time. On ubuntu 8.04 server. Things are going, I have a server, still without SASL, and a client working. I used the migration tools, and set rootdn and rootpw on my database conf I was reading a bit more, and I saw a command that didn't work $ ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}hdb on https://help.ubuntu.com/9.10/serverguide/C/openldap-server.html (note, 9.10, not 8.04) A bit more reading, and I tried to get the "new style" configuration as in http://www.openldap.org/doc/admin24/slapdconf2.html with $ sudo mkdir /etc/ldap/slapd.d $ sudo chown -R openldap:openldap /etc/ldap/slapd.d $ sudo slaptest -f /etc/ldap/slapd.conf -F /etc/ldap/slapd.d and change, in */etc/default/slapd*, SLAPD_CONF=/etc/ldap/slapd.d Still can't run the command (with the plain rootpw password from the old slapd.conf) $ ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}hdb ldap_bind: Invalid credentials (49) I've read http://www.openldap.org/doc/admin24/appendix-common-errors.html and am now trying to check things and reading around the "new style" and ACL's. Should I be able to run that command and use the "new style" with ubuntu 8.04 (hardy)? If so, I'll thank you for any help. PS: ii slapd 2.4.9-0ubuntu0.8.04.3 OpenLDAP server (slapd) ii ldap-utils 2.4.9-0ubuntu0.8.04.3 OpenLDAP utilities ii migrationtools 47-3ubuntu2 Migration scripts for LDAP Linux main 2.6.24-27-server #1 SMP Fri Mar 12 01:23:09 UTC 2010 x86_64 GNU/Linux

1 0

ldap_ssl_client_init equivalent?
by phiroc＠free.fr 30 Mar '10

30 Mar '10

Hi, is there a ldap_ssl_client_init function in the openldap C API? I couldn't find any in the openldap header files. What is the equivalent of the following ldapsearch query in C using the API, on Linux? ldapsearch -x -H 'ldaps://activedirectory.abc.com/636' -b 'dc=abc,dc=com' -D 'testdn' -W '(&(objectclass=user)(!(objectclass=computer))(samaccountname=myname))' samaccountname Many thanks. p

2 1

Re: ldap_ssl_client_init equivalent?
by masarati＠aero.polimi.it 30 Mar '10

30 Mar '10

> Hi, > > is there a ldap_ssl_client_init function in the openldap C API? I couldn't > find any in the openldap header files. Because there isn't. > > What is the equivalent of the following ldapsearch query in C using the > API, on Linux? > > ldapsearch -x -H 'ldaps://activedirectory.abc.com/636' > -b 'dc=abc,dc=com' -D 'testdn' > -W '(&(objectclass=user)(!(objectclass=computer))(samaccountname=myname))' > samaccountname You can find that information in clients/tools/common.c clients/tools/ldapsearch.c p.

1 0

Re-engaging the Samba4 LDAP backend
by Andrew Bartlett 30 Mar '10

30 Mar '10

I'm trying to pick up the ball again on the OpenLDAP and Fedora DS backends, and hopefully to bring them back up to speed as a working and respectable solution. LDB will always be the Samba Team's primary backend for Samba4. This is particularly the case as there seems no reasonable prospect that we will do DRS replication against the OpenLDAP or FedoraDS backeed. (This simplifies the requirements dramatically). However, we do need them to work, as far as practical, for the rest of Samba4's DC functionality. The things I need soon from the backends are: - a replacement for the Samba4 rdn_name module. For OpenLDAP I have tried out ITS#6055 but it fails, sadly. http://www.openldap.org/its/index.cgi/Development?id=6055;selectid=6055 I don't know of any comparable effort in Fedora DS. - A RID allocation tool. Fedora DS has the 'distributed numeric assignment' plugin, and I'm sure it will be no challenge for OpenLDAP to match it. Safely adding new users to an OpenLDAP backend really does need a safe way to allocate RID values. - A way to invoke slpad -Ttest -f <config file> -F <config dir> without issuing errors because of the missing databases - Transaction support. While most of the transaction-aware tasks in Samba have now been either pushed off as 'too hard on LDAP' or into modules that are now in the LDAP backend, we still do need transactions over LDAP. - A way to easily detect that we have OpenLDAP or Fedora DS installed on the system, and what it's version is. Once we have that, we could start trying to run at least some of Samba4's tests against such a backend regularly (and stop breaking it so often). - Some help debugging the existing 'make test' failures! To address a broader range of use cases, I'm looking forward to the work Endi has promised for a 'ldap backend config file' as input to provision. Hopefully this will reduce the options we have to present to users on the provision command line. (Apologies in advance for the cross-post to multiple member-only lists, but I just wanted to get everyone on the same page). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Cisco Inc.

3 2

Re: ldap
by Patrick Mburu 30 Mar '10

30 Mar '10

Hi all, Thanks for your help, i created another domain and from my slapcat output i get this dn: dc=mycompnay,dc=com objectClass: dcObject objectClass: organization o: mycompany dc: mycompany structuralObjectClass: organization entryUUID: e235aa56-cd4a-102e-9e99- 4f8ab88a5141 creatorsName: cn=root,dc=mycompany,dc=com modifiersName: cn=root,dc=mycompany,dc=com createTimestamp: 20100326174351Z modifyTimestamp: 20100326174351Z entryCSN: 20100326174351Z#000000#00# 000000 dn: dc=mycompany,dc=local objectClass: dcObject objectClass: organization o: mycompany dc: mycompany structuralObjectClass: organization entryUUID: 4c85f2e4-cf9e-102e-9a60- f35afa4f4768 creatorsName: cn=root,dc=mycompany,dc=local modifiersName: cn=root,dc=mycompany,dc=local createTimestamp: 20100329164559Z modifyTimestamp: 20100329164559Z entryCSN: 20100329164559Z#000000#00# 000000 i want to delete the first domain entry "dc=mycompany,dc=com"so i am left with the last one ie "dc=mycompany,dc=local" Also, i get this error from ldasearch; ldap_bind Can't contact LDAP server, i have gotten a lead on linuxquestions which i will try end of day, but a quick suggestion will be appreciated. I am doing some good reading on openldap so it wont be long until i get openldap right. I am also checking on the forums. This is a small project i am working on, and soon i will be doing ZCS running on CentOS. Thanks in advance. ________________________________ From: Patrick Mburu <patrick_lists(a)yahoo.com> To: openldap-technical(a)openldap.org Sent: Mon, March 29, 2010 12:37:01 PM Subject: ldap Hi all, I have been trying to work with my .ldif file which looks like below but i get an error: All Services are started in this scenario; My ldif file dn: dc=mycompany,dc=COM objectclass: dcObject objectclass: organization o: mycompany dc: mycompany dn: cn=root,dc=mycompany,dc=COM objectclass: organizationalRole cn: root Error => bdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => bdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=mycompnaye,dc=com" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) What am i not getting right, urgent help needed.

2 1

ldap
by Shabbir Ahmed 30 Mar '10

30 Mar '10

hi, i am running a directory service which will hold about a million entries which is running openldap mean time, i m runnig a oracle DB which holds the same db for SQL clients and i store the same data in openldap as well for the client of directory services, now what i want is to run a single DB (oracle) and openldap should be able to access it from there or any other directory service, now i want a good suggestion from you people whether i should run Oracle Internet Directory and make changes in SQL db which is reflected in Directory. second option is to run ldap but compiled with oracle DB as backend besides BDB so the data is saved in one place and when ever directory client accesses it openldap fetches it from the oracle DB and replies to client. third option is that i run it as it is with duplicating data in both oracle db and openldap but i am only worried for the performance issues in future ill face. Ill be thank full for the help.

3 2

Active Directory schema into OpenLDAP
by Shahzad Fateh Ali 30 Mar '10

30 Mar '10

Hi, I need to store Active Directory Data into OpenLDAP and for that I want to create the Active Directory schema into OpenLDAP. How to do it? -- Shahzad Fateh Ali C: +92 334 392 4334

4 5

libldap mutex hang on ldap_int_sasl_mutex
by Jeremiah Martell 29 Mar '10

29 Mar '10

I'm using openldap-2.4.18, library libldap_r. I have three windows active directory servers setup: childA.parent.example.com parent.example.com childB.parent.example.com I do a LDAP+GSSAPI bind to childA.parent.example.com. The bind succeeds. I do a search that returns referrals, (I know I need to be referred to parent, and then childB in order to find my result), and I have openldap follow referrals for me. My rebind proc is a function that only calls: ldap_sasl_interactive_bind_s( ld, NULL, NULL, NULL, NULL, LDAP_SASL_AUTOMATIC, sasl_driver, params ); where sasl_driver and params is the same parameters that I used for the initial bind call to childA. After the seach call, the debug it looks like this: > ldap_chase_v3referrals, where ref[0] = parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s < ldap_sasl_interactive_bind_s < myGSSAPIrebindProc < ldap_chase_v3referrals > ldap_chase_v3referrals, where ref[0] = childB.parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s > ldap_chase_v3referrals, where ref[0] = childA.parent.example.com < ldap_chase_v3referrals > ldap_chase_v3referrals, where ref[0] = ForestDnsZones.parent.example.com > myGSSAPIrebindProc > ldap_sasl_interactive_bind_s ... HANG ON MUTEX Since this is hanging on a mutex, that would suggest a code bug. Perhaps the ldap_int_sasl_mutex needs to be a recursive mutex? Or should my rebind proc do something different than call ldap_sasl_interactive_bind_s? Any other ideas appreciated too. Thanks, - Jeremiah

1 0

ldap
by Patrick Mburu 29 Mar '10

29 Mar '10

Hi all, I have been trying to work with my .ldif file which looks like below but i get an error: All Services are started in this scenario; My ldif file dn: dc=mycompany,dc=COM objectclass: dcObject objectclass: organization o: mycompany dc: mycompany dn: cn=root,dc=mycompany,dc=COM objectclass: organizationalRole cn: root Error => bdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => bdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=mycompnaye,dc=com" (line=6): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) What am i not getting right, urgent help needed.

2 1

Starting OpenLDAP: slapd - failed: Unrecognized database type (bdb)..Help required!
by Shamika Joshi 29 Mar '10

29 Mar '10

I'm a beginner with Openldap & trying to bring up LDAP server on UbuntuServer with Berkleys db-4.8.26 installed gives following error on starting the slapd service. Previously I have done sucessful configuration on RHEL & Fedora but for some reason it is not working for me on Ubuntu server. Could someone throw some light on this? Am I missing something? shamika@ns1:/etc/ldap$ sudo /etc/init.d/slapd start Starting OpenLDAP: slapd - failed: Unrecognized database type (bdb) shamika@ns1:~$ uname -msrnv Linux ns1.cmsqalab.com 2.6.31-14-server #48-Ubuntu SMP Fri Oct 16 15:07:34 UTC 2009 x86_64 Snapshot from /var/log/syslog Mar 29 19:41:47 x6u slapd[17730]: @(#) $OpenLDAP: slapd 2.4.18 (Sep 8 2009 17:47:22) $#012#011buildd@crested :/build/buildd/openldap-2.4.18/debian/build/servers/slapd Mar 29 19:41:49 x6u slapd[17730]: /etc/ldap/slapd.conf: line 88: <database> failed init (bdb) Mar 29 19:41:49 x6u slapd[17730]: slapd stopped. Mar 29 19:41:49 x6u slapd[17730]: connections_destroy: nothing to destroy. Here is my slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema #include /etc/ldap/schema/dnszone.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la access to * by * write # access to * # by self write # by users read ## by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix dc=cmsqalab,dc=com rootdn cn=Manager,dc=cmsqalab,dc=com # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}+1DFJ0tLWAd1u3zDUw04rDtnwPKbEFy9 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/cmsqalab.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub 69,1 91%

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical