openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

openldap proxy of Windows Server 2003
by Nicolas Michel 15 Feb '10

15 Feb '10

Hello experts, I'm searching a way to set up an openldap proxy for an AD Windows Server 2003. I want to authenticate some clients on the openldap with Windows Server Users. I'm trying doing it for some days with no success... If someone would have some hints or a wonderfull tuto, or even a great paper book which talk about that topic, it would be really nice to tell me! ;) Thank you, nm

3 3

OID for private objectclasses and attributes
by Stefan Palme 15 Feb '10

15 Feb '10

Hi all, I want to extend the schema of an OpenLDAP server installation by some own objectclasses and attributetypes. Now I am not sure which range of OIDs I can safely use for this purposes. I've something calles "Internet Private Enterprise Numbers" with OIDs of the form 1.3.6.1.4.1.X As far as I've understood, the "private" subtree is 1.3.6.1.4, where the ".1" sub-subtree of this is "reserved" for enterprise use. So I think, for my very private and personal solution OID like 1.3.6.1.4.10.1.1 (for an objectclass) and 1.3.6.1.4.10.2.1 (for an attributetype) would be absolutely ok. Any comments? Thanks and regards -stefan-

2 1

dynlist (at least for me) strange behaviour
by Benjamin Griese 14 Feb '10

14 Feb '10

Hello Mailinglist, for some days/weeks now, I try to figure out, how dynlist is meant to be used and how it is to be used. But it is hard for one to get in the game, who is neither familiar with openLDAP at all. :) I tried to build the, I guess, popular 'dynamic posixgroups'. Some older ML posts helped me to build the default structure for the dynlist overlay. i.e. this one http://www.openldap.org/lists/openldap-technical/200912/msg00005.html and this http://www.openldap.org/faq/data/cache/1209.html # getent group testgroup1:*:1011:test1,test2 testgroup2:*:1012:test1,test2 this looks good to me, as expected. # id test1 uid=1011(test1) gid=1011(testgroup1) Gruppen=1011(testgroup1) # id test2 uid=1012(test2) gid=1012(testgroup2) Gruppen=1012(testgroup2) but this isn't what it is expected to be, too bad its not only a display problem, the permissions of testgroup1 and testgroup2 vice versa are really missing. # id test1 uid=1011(test1) gid=1011(testgroup1) Gruppen=1011(testgroup1), 1012(testgroup2) # id test2 uid=1012(test2) gid=1012(testgroup2) Gruppen=1012(testgroup2), 1011(testgroup1) thats what I wish it would be If I delete the Attribute labeledURI and set the memberUid for test1 and test2 by hand, everything works as expected, but it would be nice to have it dynamically managed :) Any help, guide and/or howto is highly appreciated. Thank you for your time reading this :) bye, Benjamin. -------------------------------------------------- my general config: dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=exa mple,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to * by dn="cn=admin,dc=example,dc=com" write by * read olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: memberUid pres,eq olcDbIndex: uniquemember pres,eq olcDbIndex: gidnumber pres,eq olcDbIndex: uid pres,eq olcDbIndex: uidnumber pres,eq olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW: olcSuffix: dc=example,dc=com dn: olcOverlay={0}dynlist,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcDynamicList olcOverlay: {0}dynlist olcDlAttrSet: {0}posixGroup labeledURI memberUid:uid dn: olcOverlay={1}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=Policies,dc=example,dc=com olcPPolicyHashCleartext: TRUE my testgroups: dn: cn=testgroup1,ou=People,ou=Groups,dc=example,dc=com objectClass: posixGroup objectClass: top objectClass: labeledURIObject cn: testgroup1 gidNumber: 1011 labeledURI: ldap:///ou=test,ou=Users,dc=example,dc=com?uid?sub?(objectClass =Posixaccount) memberUid: test1 (dynamically set) memberUid: test2 (dynamically set) dn: cn=testgroup2,ou=People,ou=Groups,dc=example,dc=com objectClass: posixGroup objectClass: top objectClass: labeledURIObject cn: testgroup2 gidNumber: 1012 labeledURI: ldap:///ou=test,ou=Users,dc=example,dc=com?uid?sub?(objectClass =Posixaccount) memberUid: test1 (dynamically set) memberUid: test2 (dynamically set) my testusers: dn: uid=test1,ou=test,ou=Users,dc=example,dc=com objectClass: posixAccount objectClass: inetOrgPerson objectClass: shadowAccount objectClass: top cn: test1 gidNumber: 1011 homeDirectory: /home/test1 sn: test1 uid: test1 uidNumber: 1011 userPassword: dn: uid=test2,ou=test,ou=Users,dc=example,dc=com objectClass: posixAccount objectClass: inetOrgPerson objectClass: shadowAccount objectClass: top cn: test2 gidNumber: 1012 homeDirectory: /home/test2 sn: test2 uid: test2 uidNumber: 1012 userPassword: some log entries with ACL logging enabled: Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access to "dc=example,dc=com" "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr entry Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (entry) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "dc=example,dc=com", attr "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to all values by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr uid Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (uid) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: search access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr entry Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (entry) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "entry" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to all values by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr objectClass Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (objectClass) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "objectClass" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "cn" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr cn Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (cn) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "cn" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "homeDirectory" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr homeDirectory Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (homeDirectory) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "homeDirectory" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "userPassword" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [1] attr userPassword Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (userPassword) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "userPassword" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: anonymous Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying auth(=xd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: auth(=xd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access denied by auth(=xd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: no more rules Feb 14 16:58:13 openldaphost slapd[8673]: send_search_entry: conn 366 access to attribute userPassword, value #0 not allowed Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "uidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr uidNumber Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (uidNumber) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "uidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr uid Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (uid) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "uid" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access to "uid=test1,ou=test,ou=Users,dc=example,dc=com" "gidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_get: [2] attr gidNumber Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: result not in cache (gidNumber) Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: access to entry "uid=test1,ou=test,ou=Users,dc=example,dc=com", attr "gidNumber" requested Feb 14 16:58:13 openldaphost slapd[8673]: => acl_mask: to value by "", (=0) Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: cn=admin,dc=example,dc=com Feb 14 16:58:13 openldaphost slapd[8673]: <= check a_dn_pat: * Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] applying read(=rscxd) (stop) Feb 14 16:58:13 openldaphost slapd[8673]: <= acl_mask: [2] mask: read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => slap_access_allowed: read access granted by read(=rscxd) Feb 14 16:58:13 openldaphost slapd[8673]: => access_allowed: read access granted by read(=rscxd) -- Charles de Gaulle<http://www.brainyquote.com/quotes/authors/c/charles_de_gaulle.html> - "The better I get to know men, the more I find myself loving dogs."

1 0

Expiration of root CA
by Philippe Bloix 12 Feb '10

12 Feb '10

Hi, My root CA will expire soon. What is the best method to avoid break between ldap server and ldap client communication? If i create a new root CA, then i will have to copy this new root CA on each ldap client (several hundred). In this case, is it possible to switch from the old root CA to the new root CA without a break between server and client? How? Regards Philippe

2 2

Re: Where is DB_CONFIG file?
by Echedey Lorenzo 12 Feb '10

12 Feb '10

Hi, The method suggested by Quanah worked perfectly. I also find very useful the information given by Dieter since I'll take of creating a DB_CONFIG file in new deployments. My last question has to be with db_checkpoint. Should I call it periodically or will Berkeley delete logs by its own? Thanks a lot 2010/2/12 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Thursday, February 11, 2010 7:21 PM +0100 Dieter Kluenter < > dieter(a)dkluenter.de> wrote: > > Quanah Gibson-Mount <quanah(a)zimbra.com> writes: >> >> ----- Echedey Lorenzo <echedey(a)gmail.com> wrote: >>> >>>> I think the best option, as you suggest, is to recreate >>>> everything. Is it enough to remove all /var/lib/ldap contents, >>>> restart the ldap service, and populate all again? My intention is to >>>> have 8M entries as max. >>>> >>>> Thanks for your help >>>> >>>> >>> There is zero need to recreate everything. Dieter is wrong. Simply >>> stop slapd, create the DB_CONFIG file, run db_recover to regenerate >>> the bdb database profile, then start slapd. This has been the standard >>> way to do this since OpenLDAP 2.1. Dieter should know this. >>> >> >> I have experienced some problems in the past, that's why I prefer a >> clean recreation. >> > > Then you should have collected data and filed an ITS. I've never had a > problem in nearly 10 years of configuring and modifying DB_CONFIG files back > to 2.1.4 when it's done correctly. > > --Quanah > > -- > > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

2 1

Brining up replication with an already live server?
by Adam Tauno Williams 12 Feb '10

12 Feb '10

I have two DSAs of the same version (2.4.20). One is empty and the other is stand-alone. I want to configure multi-master; can I add the syncrepl directives to the live server and then bring up the other server and add the syncrepl directives - will the second server then syncronize with the live server (which already contains configuration, etc...). Or do I need to start with two empty DSAs? -- Adam Tauno Williams <awilliam(a)whitemice.org> LPIC-1, Novell CLA <http://www.whitemiceconsulting.com> OpenGroupware, Cyrus IMAPd, Postfix, Samba

2 2

Where is DB_CONFIG file?
by Echedey Lorenzo 12 Feb '10

12 Feb '10

Hi, I'm new to this mailing list. I have a simple question... I have deployed a huge subscriber ldap database with more than 400 000 entries in a SUSE machine installing OpenLDAP with Yast. I've found huge log files in /var/lib/ldap that I cannot delete. Google says that I should tune my DB_CONFIG file to optimize the use of the the Berkeley backend, but I don't find this file. Should I create it? Thanks a lot -- -------------------------------------------- | Echedey Lorenzo Arencibia | --------------------------------------------

3 8

nss_map_attribute gidNumber problem
by Liam Gretton 11 Feb '10

11 Feb '10

I have user accounts for various systems within an OpenLDAP db (OpenLDAP 2.4.12 on openSUSE 11.1). Clients are running the same version on the same OS. As accounts have different requirements depending on which host is being logged into, I've created a custom schema which implements the following custom attributes: loginShellSYS1 homeDirectorySYS1 gidNumberSYS1 ...and so on for multiple SYSn systems. On the client using nss_ldap side I am mapping these to the plain attributes as so in /etc/ldap.conf: nss_map_attribute loginShell loginShellSYS1 nss_map_attribute homeDirectory homeDirectorySYS1 nss_map_attribute gidNumber gidNumberSYS1 Everything works perfectly EXCEPT for the gidNumber mapping. If that's in place then 'getent group' does not return the LDAP groups. The logs on the LDAP server suggest that the correct information has been requested, and it does indeed churn out all the expected results, but the client seems to be failing in doing the mapping at the last step. ldapsearch on an account from the client returns all the expected attributes including the gidNumberSYSn ones. The LDAP accounts also have a normal gidNumber attribute, and if I remove the mapping and use that, then getent group returns the expected results. In fact, checking the LDAP server logs, it seems that when gidNumber is mapped, getent is requesting 'cn' instead of 'gidNumber' from the record. Without the mapping, it correctly requests the gidNumber attribute. It's entirely likely that I've done something plain silly which is causing this problem, but is there any special behaviour regarding group mapping that I should have taken into account? -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

1 0

Strange nisMapEntry
by David LEROUX 11 Feb '10

11 Feb '10

Hi all, I have in my ldifs, whatever the way I do them (slapcat ldapsearch -LLL...) some strange entry, like if it was hashed. Here is a sample: nisMapEntry:: LXJ3LHRjcCxpbnRyLHJzaXplPTMyNzY4LHdzaXplPTMyNzY4LHRpbWVvPTUwLHJldHJhbnM9MTAgeWFrMjA6L3VzcjIvdXNlcnMvJiA= Which should be: nisMapEntry: -rw,tcp,intr,rsize=32768,wsize=32768,timeo=50,retrans=10 yak20:/usr2/users/& If I re import them from a fresh "normal" ldif generated from my nis automount maps, it does the same, it's alway the same affected entries... In phpldapadmin I can see it well, but not in my ldifs and its a bit annoying for me... Any idea ? Thanks, -- David Leroux

4 4

OpenLDAP 2.4 replicated to 2.3?
by Jakov Sosic 10 Feb '10

10 Feb '10

Hi to all! I've set up Zimbra LDAP (2.4) as master, and I want to use RHEL v5 LDAP (2.3) as a slave. This is relevant part of my slapd.conf on LDAP 2.3: # syncrepl directives syncrepl rid=101 provider=ldap://192.168.1.86 bindmethod=simple binddn="uid=zimbra,cn=admins,cn=zimbra" credentials=PASSword searchbase="dc=company,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://192.168.1.86 Replication works OK, when I first start LDAP, it populates automatically. But after that initial data, it just doesn't pull anything anymore. I have to restart it, or it won't pull data from Master :( Problem is, when I add user to Zimbra LDAP (master), it does not propagate immediately data to slave LDAP. I don't even know what the interval is, I've never seen it happen in a few minutes after the Master LDAP is updated... Am I missing something? Shouldn't "refreshAndPersist" do it without any delay (or with minimal delay)? Should I run someting on zimbra LDAP side, or is the sync from LDAP 2.4 to LDAP 2.3 impossible? Would it be better to set something like: type=refreshOnly interval=00:00:00:01 but this just seems like a bruteforce to me :( I repeat, after I restart slave LDAP, all the new enteries appear magically. I'm really confused. Ideas? -- | Jakov Sosic | ICQ: 28410271 | PGP: 0x965CAE2D | ================================================================= | start fighting cancer -> http://www.worldcommunitygrid.org/ |

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical