openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

idea for access rules
by Stefan Palme 21 Feb '10

21 Feb '10

Hi all, maybe this is not the right list for this question, in this case I apologize for this post.. I have no idea to define access rules for the following case. Have an LDAP tree like this: ou=users cn=me ou=data ou=data1, owner=cn=me,ou=users cn=fact1 cn=fact2 ou=data2, owner=cn=somebodyelse,ou=users cn=fact3 cn=fact4 (one line represents one LDAP entry with some of its attributes, the level of indentation represents the tree structure) The point is the subtree starting at "ou=data1". The root node of this subtree (ou=data1) has an attribute "owner" with a DN of a user account which can be used to bind to the LDAP server (cn=me,ou=users). Now I want to define, that this specific user has write access to some attributes of cn=fact1,ou=data1 and cn=fact2,ou=data2 etc... I am searching for a rule like this: access to "cn=[^,]+,ou=data1,ou=data" attrs="attr1,attr2,attr3" by dnattr="owner of node ou=data1,ou=data" write Obviously, this dnattr syntax is not valid, but I guess you see what I want. Any ideas how to realize this? Thanks for any hints Regards -stefan-

2 6

attributes order
by Mihamina Rakotomandimby 21 Feb '10

21 Feb '10

Manao ahoana, Hello, Bonjour, Hi all I have 3 custom attributes: - actionDate - commentContent - commentId I populated my OpenLDAP with a shell script and "ldapadd", and when searching with "ldapsearch", attributes are displayed all in the order: - actionDate - commentContent - commentId Now I use the Ocaml LDAP binding (ocamldap) to add several entries. While searching again, entries added with shell+ldap has the same atribute order display, but the ones added through the Ocaml binding are displayed in a different order. That mean while displaying all the objects (stricly of the same objectClass), I have a mixed attribute order display. How could I force openLDAP to always display attributes in the same order for one objectClass? Misaotra, Thanks, Merci. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34 / +261 33 11 207 36

2 1

password change hangs: bug?
by Stefano Zanmarchi 19 Feb '10

19 Feb '10

Hi, I'm running slapd 2.4.9 on Solaris10. I searched with no result: does anyone know if there is a bug on 2.4.9 regarding password changes? I'd like to know if newer releases have bug fixes specifically for this issue This is what happened to me. I have a client performing many password changes, which usually results in my logs like this: ... Feb 19 12:17:33 db1 slapd[49]: [ID 848112 local4.debug] conn=591 fd=22 ACCEPT from IP=192.168.2.253:49108 (IP=0.0.0.0:12312) Feb 19 12:17:33 db1 slapd[49]: [ID 215403 local4.debug] conn=591 op=0 BIND dn="uid=mario.rossi(a)unipd.it,ou=people,dc=unipd,dc=it" method=128 Feb 19 12:17:33 db1 slapd[49]: [ID 600343 local4.debug] conn=591 op=0 BIND dn="uid=mario.rossi(a)unipd.it,ou=people,dc=unipd,dc=it" mech=SIMPLE ssf=0 Feb 19 12:17:33 db1 slapd[49]: [ID 588225 local4.debug] conn=591 op=0 RESULT tag=97 err=0 text= Feb 19 12:17:33 db1 slapd[49]: [ID 270379 local4.debug] conn=591 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Feb 19 12:17:33 db1 slapd[49]: [ID 461300 local4.debug] conn=591 op=1 PASSMOD new Feb 19 12:17:33 db1 slapd[49]: [ID 875301 local4.debug] conn=591 op=1 RESULT oid= err=0 text= Feb 19 12:17:33 db1 slapd[49]: [ID 218904 local4.debug] conn=591 op=2 UNBIND Feb 19 12:17:33 db1 slapd[49]: [ID 952275 local4.debug] conn=591 fd=22 closed ... Always went fine, but yesterday this happened: ... Feb 18 22:45:41 db1 slapd[21872]: [ID 848112 local4.debug] conn=3186 fd=22 ACCEPT from IP=192.168.2.253:49820 (IP=0.0.0.0:12312) Feb 18 22:45:41 db1 slapd[21872]: [ID 215403 local4.debug] conn=3186 op=0 BIND dn="uid=maria.verdi(a)unipd.it,ou=people,dc=unipd,dc=it" method=128 Feb 18 22:45:41 db1 slapd[21872]: [ID 600343 local4.debug] conn=3186 op=0 BIND dn="uid=maria.verdi(a)unipd.it,ou=people,dc=unipd,dc=it" mech=SIMPLE ss f=0 Feb 18 22:45:41 db1 slapd[21872]: [ID 588225 local4.debug] conn=3186 op=0 RESULT tag=97 err=0 text= Feb 18 22:45:41 db1 slapd[21872]: [ID 270379 local4.debug] conn=3186 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Feb 18 22:45:41 db1 slapd[21872]: [ID 461300 local4.debug] conn=3186 op=1 PASSMOD new ... that is, no "RESULT" for PASSMD and the client performing the password change received no answer (hung), and this has caused us many problems. Could it possibly be an openldap bug? Thank you very much, Stefano

2 1

Server-Side Sort Overlay ordering problems
by Diego Lima 19 Feb '10

19 Feb '10

Hello, I have enabled the server-side sorting overlay and I received the following error on a search: sssvlv: no ordering rule specified and no default ordering rule for attribute uid <= get_ctrls: n=1 rc=18 err="serverSort control: No ordering rule" send_ldap_result: conn=1000 op=7 p=3 send_ldap_response: msgid=8 tag=101 err=18 ber_flush2: 50 bytes to sd 13 ldap_write: want=50, written=50 0000: 30 30 02 01 08 65 2b 0a 01 12 04 00 04 24 73 65 00...e+......$se 0010: 72 76 65 72 53 6f 72 74 20 63 6f 6e 74 72 6f 6c rverSort control 0020: 3a 20 4e 6f 20 6f 72 64 65 72 69 6e 67 20 72 75 : No ordering ru 0030: 6c 65 le conn=1000 op=7 do_search: get_ctrls failed Where should I specify the ordering rule for the uid attribute? The core schema? Thank you -- Diego Lima

6 6

ppolicy & sambaNTPassword
by Ralf Zimmermann 17 Feb '10

17 Feb '10

Hi all, I have a problem with overlay ppolicy and samba. My samba backend is openldap-2.4.20. I have a default ppolicy and a pwdCheckModule. If I change the userPassword all works fine. I read the slapo-ppolicy man page and I know that the only pwdAttribute is userPassword. If I change the userPassword with smbpasswd the policy works also fine. But if I want to change the Password with a Windows client the problem begins. The sambaNTPassword is set everytime to the new Password because the ppolicy overlay checks only the userPassword. So the both Passwords are different and there is no control for the sambaNTPassword. Exists any solution or a workaround for this problem. Any help is appreciated. Mit freundlichen Gruessen Ralf Zimmermann -- .''`. Ralf Zimmermann : :' : SIEGNETZ.IT GmbH `. `' Schneppenkauten 1a `- 57076 Siegen Tel.: +49 271 68193 13 Fax.: +49 271 68193 29 Amtsgericht Siegen HRB4838 Geschaeftsfuehrer: Oliver Seitz Sitz der Gesellschaft ist Siegen

3 11

Problem with nss-ldap using GSSAPI
by Wojtek Polcwiartek 17 Feb '10

17 Feb '10

Hello, we use ldap as name source in our system (libnss-ldap). Until now we used anonymous bind with LDAP and it worked fine. Now we want to switch to GSSAPI (MIT Krb5), but getting names ('getent passwd <name>') does not work: no result is returned/printed. Strange is that, when we run the query in debug-mode (debug 7 in /etc/ldap.conf), you can see the correct result in the debug part (in "hexes") but at the end no result is printed . The only error message we could see is: res_errno: 14, res_error: <SASL(0): successful result: >, res_matched: <> Querying LDAP with ldapsearch still works fine. Do You have any idea how to get closer to the source of the problem? We use Ubuntu Karmic as client (repo package) and Solaris10 (with OpenLdap 2.4.16) as server. Greetings! -- Wojtek Polcwiartek ------ tubIT TU-Berlin Web : www.tubit.tu-berlin.de Email : tubit(a)tu-berlin.de Tel : +49.30.314.28000

2 3

binding to an alias entry?
by Stefan Palme 17 Feb '10

17 Feb '10

Hi, I have two ldap entries: dn:cn=me,ou=users,dc=kapott,dc=org objectclass:person cn:me userPassword:... dn:cn=me,ou=imap,ou=groups,dc=kapott,dc=org objectclass:alias objectclass:extensibleObject aliasedObjectName:cn=me,ou=users,dc=kapott,dc=org cn:me I can use the first DN to successfully bind to the LDAP server, but not the second one. It would be nice to be able to use "cn=me,ou=imap,ou=groups,dc=kapott,dc=org" as bind DN too, but without duplicating the whole "person" entry with the userPassword. Is this possible? Thanks and regards -stefan-

2 1

Slightly O/T: Duplicating eDirectory server ...
by Garry 16 Feb '10

16 Feb '10

I have a customer install that is running a Novell based eDirectory setup. As of lately, the setup seems to be a bit flakey, but either way could use a backup server ... I was wondering, is it possible to pull the schema definitions and plain (ldif) data out of an eDirectory and import to OpenLDAP? Don't need a hot standby replication, but daily cron job would suffice ... Tnx, Garry

2 1

ldap rebind proc problem
by Jeremiah Martell 16 Feb '10

16 Feb '10

I'm trying to get my code to rebind appropriately when it's automatically chasing referrals, but I'm running into a strange problem. I bind to server A, which returns me a referral to server B. My rebind proc is called, which tries to bind to server B. That succeeds, and (accoring to Wireshark) I get a couple referrals. (DomainDnsZones, ForestDnsZones, and server C). Then my rebind proc is called to bind to server C, but then recursively it is called (on the same thread, says pthread_self) to bind to DomainDnsZones, and then recursively again it is called to bind to ForestDnsZones, which is where my code hangs for at least 5 minutes before I kill it. My rebind proc is calling ldap_sasl_bind_s, which seems to be what is then re-calling my rebind proc in each case. The problem is that my code hangs in one of the ldap_sasl_bind_s calls, and never returns, but Wireshark shows that it successfully binds to all thee of the referred servers. I'm using openldap-2.3.24. My questions are: - Is my rebind proc correct? It seems that calling ldap_sasl_bind_s is correct and allowed. - Was there a bug that has been fixed since 2.3.24 in direct regard to rebinding? - Any tips or hints on what could be hanging up the code? Thanks, - Jeremiah

1 0

Too many open files?
by Jaap Winius 15 Feb '10

15 Feb '10

Hi all, My latest test system includes a Kerberos server that uses OpenLDAP via IPC as its back-end database. It usually works, but not always. For example, recently, after failing to get kadmin to add a new principal to the Kerberos database, I found this error in the provider's syslog: Feb 10 22:37:29 kls1 slapd[1722]: bdb_db_cache: db_open(entryUUID) failed: Too many open files (24) Feb 10 22:37:29 kls1 slapd[1722]: bdb_index_read: Could not open DB entryUUID Feb 10 22:37:29 kls1 slapd[1722]: conn=4 op=13 RESULT tag=105 err=80 text=index generation failed A restart of the Kerberos KDC and admin servers seemed to solve the problem, but obviously that's not ideal. Later on, I had a look at the numbers of open files on the system: ~# lsof -i |grep slapd slapd 1722 openldap 8u IPv6 4603 TCP *:ldap (LISTEN) slapd 1722 openldap 9u IPv4 4604 TCP *:ldap (LISTEN) slapd 1722 openldap 545u IPv4 12823 TCP kls1.example.com:ldap->kls2.example.com:51555 (ESTABLISHED) slapd 1722 openldap 744u IPv4 8899 TCP kls1.example.com:ldap->kls2.example.com:49100 (ESTABLISHED) 545 and 745u!? A restart of the Kerberos servers didn't make a difference, although restarting slapd brought these values down to 8 and 9u respectively. However, I have no idea what caused these numbers to rise. See my provider/master server's config files below. Does anyone have an idea what might be going on and how I might prevent this situation from occurring again? Thanks, Jaap ==/etc/ldap/slapd.conf================ include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/kerberos.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 tool-threads 1 authz-regexp uid=admin,cn=example.com,cn=gssapi,cn=auth cn=admin,dc=example,dc=com authz-regexp uid=ldap/([^/\.]+).example.com,cn=example.com,cn=gssapi,cn=auth cn=$1,ou=consumers,dc=example,dc=com authz-regexp uid=([^,]+),cn=example.com,cn=gssapi,cn=auth uid=$1,ou=people,dc=example,dc=com sasl-realm EXAMPLE.COM authz-policy to backend hdb database hdb suffix "dc=example,dc=com" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq index uid eq index krbPrincipalName eq,pres,sub index entryUUID eq index entryCSN eq lastmod on checkpoint 512 30 access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by dn="cn=kls2,ou=consumers,dc=example,dc=com" read by anonymous auth by self write by * none access to dn.subtree="ou=krb5,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by dn="cn=adm-srv,ou=krb5,dc=example,dc=com" write by dn="cn=kdc-srv,ou=krb5,dc=example,dc=com" read by dn="cn=kls2,ou=consumers,dc=example,dc=com" read by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ====================================== ==/etc/default/slapd================== SLAPD_CONF= SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_PIDFILE= SLAPD_SERVICES="ldap:/// ldapi:///" SLAPD_SENTINEL_FILE=/etc/ldap/noslapd export KRB5_KTNAME=/etc/krb5.keytab SLAPD_OPTIONS="" ====================================== ==/etc/krb5.conf====================== [libdefaults] default_realm = EXAMPLE.COM forwardable = true proxiable = true [realms] EXAMPLE.COM = { kdc = kls1.example.com admin_server = kls.example.com database_module = openldap_ldapconf } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [login] krb4_convert = true [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kerberos_container_dn = ou=krb5,dc=example,dc=com ldap_kdc_dn = cn=kdc-srv,ou=krb5,dc=example,dc=com ldap_kadmind_dn = cn=adm-srv,ou=krb5,dc=example,dc=com ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_conns_per_server = 5 } [logging] kdc = FILE:/var/log/krb5/kdc.log admin_server = FILE:/var/log/krb5/kadmin.log default = FILE:/var/log/krb5/klib.log ====================================== Note: "ldap_servers" option omitted, as the default is to use IPC. ======================================

2 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical