openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Abandon with ldap search free openldap resources ?
by Eduardo Ramos Testillano 13 Jan '10

13 Jan '10

Hello all, I have my ldap client with always ldap connection up; never unbind is performed. When certain ldap search expire, i send AbandonRequest to the server. ¿openLdap memory resources will grow if i avoid send that? That is to say: openldap 'ldap_abandon' primitive implies free internal openLdap resources? thanks Regards

1 0

openldap
by Aravind Arjunan 13 Jan '10

13 Jan '10

hi, I am having my Openldap server acting as master/slave in RHEL 3 its in 32 bit architecture.It acts as primary authentication for all my services.I need to enhance my servers with new version of OS which will be in high availability. I preferred to go for RHEL 5 in 64 bit architecture. I need to know if i configure Slave LDAP server in my new setup i.e in RHEL 5, whether i can able get all the users informations which is stored in my old setup through Master/Slave communication without any downtime. with regards A.Aravind

1 0

seg fault during slapindex
by tpublic＠metro-email.com 12 Jan '10

12 Jan '10

Hello, I'm looking for help with an index building problem. I am running Apple (Tiger) Open Directory which uses slapd 2.2.19. Upgrading is unfortunately not an option because the OS has tools / GUI built around the database. I had noticed some errors in our slapd.log indicating we needed additional indexes built: bdb_equality_candidates: (kerio-Mail-AccountEnabled) index_param failed (18)\n bdb_equality_candidates: (kerio-Mail-Address) index_param failed (18)\n bdb_substring_candidates: (apple-group-realname) index_param failed (18)\n bdb_substring_candidates: (givenName) index_param failed (18)\n bdb_substring_candidates: (mail) index_param failed (18)\n So I attempted to create the missing indexes, but slapindex crashes with a segmentation fault unless I disable most of my config changes. The lines commented out are the ones which caused a fault: slapd.conf: include /etc/openldap/slapd_macosxserver.conf #index kerio-Mail-Address eq # Seg faults. index kerio-Mail-AccountEnabled eq slapd_macosxserver.conf (included via slapd.conf): # Adding ",sub" to apple-group-realname, due to errors in /var/log/slapd.log #index apple-group-realname eq index apple-group-realname eq,sub [...] # Adding mail & givenName indices, due to errors in /var/log/slapd.log # Both of these cause seg fault on slapindex #index mail sub #index givenName sub I verified that the index names I configured match exactly the spelling in the error messages. Also slaptest ran successfully. I ran db_recover to no avail (slapindex was initially hanging even if I just used my base configuration). Any hints would be greatly appreciated. I realize this is an older version, but hopefully there are some tricks that I could use to work around it? If not, could I install the current openldap, in a different location, build the indexes, and copy them over?

2 1

Standard objectClass for representing web services
by Hung Luu 12 Jan '10

12 Jan '10

Does anyone know of a standard objectClass that is appropriate for representing web services in the directory? I want to represent web services like users in the directory, and assign their DN's to groups for authorization, so I suppose I'm looking for an inetOrgPerson equivalent for web services. Thanks, Hung.

2 2

Multi Master w/ SASL Authentication
by James Dingwall 12 Jan '10

12 Jan '10

Hi, I have been migrating my OpenLDAP 2.3 slapd.conf configuration to a 2.4 slapd.d replacement. Previously I had a single master and two slaves but I have moved it to multi-master with a replicated cn=config and database. I am using Sasl and Heimdal Kerberos with the principles stored in the ldap database. I have managed to almost complete this but I'm now stuck on the following point, I can only get GSSAPI LDAP authentication to work on the host whose name is equal to the value of olcSaslHost. As I have 3 masters and a replicated cn=config this can only be true on one host at a time. i.e. olcSaslHost: ldap1.my.domain ldapsearch -H ldaps://ldap1.my.domain -Y GSSAPI = works ldapsearch -H ldaps://ldap2.my.domain -Y GSSAPI = fails ldapsearch -H ldaps://ldap3.my.domain -Y GSSAPI = fails update olcSaslHost to ldap2.my.domain ldapsearch -H ldaps://ldap1.my.domain -Y GSSAPI = fails ldapsearch -H ldaps://ldap2.my.domain -Y GSSAPI = works ldapsearch -H ldaps://ldap3.my.domain -Y GSSAPI = fails I tried setting olcSaslHost to localhost but then none work so I assume the olcSaslHost value is being used to build a Kerberos principle. Am I missing a trick or do I have to stop replicating cn=config in order to make it work on all 3? I can post configuration files if this will help. Thanks, James This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

1 0

Directory layout help
by Hung Luu 12 Jan '10

12 Jan '10

Hello, Suppose I have the following DN's: inetOrgPerson: [uid=alice,dc=example,dc=com] organizationalRole: [cn=manager,ou=groups,dc=example,dc=com] [cn=supervisor,ou=groups,dc=example,dc=com] locality: [l=phoenix,ou=division,dc=example,dc=com] [l=portland,ou=division,dc=example,dc=com] How can I store in my directory the fact that Alice is a manger at the Phoenix division, but she is only a supervisor at the Portland division? I know group membership is involved here, but what's the best way to represent that group membership to optimize searches such as: Return all the people with a specific role at a specific locality, or return all the roles and localities for a person. -Hung.

4 6

Syncrepl with Kerberos support
by Jaap Winius 12 Jan '10

12 Jan '10

Hi all, Although I know how to configure syncrepl with the "simple" bindmethod, using a clear-text password exchange and clear-text database replication, and I know how to setup an provider server with MIT Kerberos V encryption support, can anyone explain how to configure a consumer so that syncrepl also uses Kerberos? Thanks, Jaap

3 4

Compiling OpenLDAP 2.4.21 on RHEL 5
by Diego Lima 11 Jan '10

11 Jan '10

Hello all, I've recently installed OpenLDAP 2.4.21 on a couple of Debian servers but I ran into problems while trying to install on some RHEL5 servers: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends It seems that it doesn't like Red Hat's shipped version of Berkeley DB (Version: 4.3.29). I installed it via yum (yum install db4-devel). How can I get around this problem? Thanks a lot, -- Diego Lima

3 2

overlay "syncprov" not found
by Andrew Debenham 11 Jan '10

11 Jan '10

Hello - I am new to LDAP and I'm trying to setup Sync Replication on a Fedora Core 8 system (2.6.23.9-85.fc8). However, when I start the LDAP service, I get the following error message: Checking configuration files for slapd: [FAILED] overlay "syncprov" not found slaptest: bad configuration file! I've searched the archived threads for this group (as well as many others) and wasn't able to find any postings that matched what I'm seeing. If I missed an old post by mistake, I apologize in advance. I've included a copy of my slapd.conf file below. The interesting thing is that when I comment out the following lines, LDAP will start without any issues: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 This leads me to believe that the issue is with the replication process, but I can't figure out what I'm doing wrong. I've followed the examples given in the OpenLDAP Admin Guide, but it just doesn't seem to want to work for me. Also, in case anyone asks, here are the packages installed on the server in question: openldap-2.3.39-3.fc8 openldap-devel-2.3.39-3.fc8 openldap-servers-2.3.39-3.fc8 openldap-clients-2.3.39-3.fc8 Any information or recommendations to what is happening would be greatly appreciated. Also, please let me know if I need to supply more information. Thanks in advance. - Andy # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema loglevel -1 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la moduleload back_sql.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=jets,dc=local" write by * none access to * by self write by dn.base="cn=Manager,dc=jets,dc=local" write by * read ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=jets,dc=local" rootdn "cn=Manager,dc=jets,dc=local" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw b0xster rootpw {SSHA}/5PsWrAXNKNKJmhiZAfUPLkMOUcgbtXN # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID,entryCSN eq # Replicas of this database #replogfile /var/lib/ldap/openldap-slave-replog overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #lastmod on serverID 2 syncrepl rid=002 provider=ldap://10.xx.x.xx type=refreshAndPersist searchbase="dc=jets,dc=local" schemachecking=on bindmethod=simple binddn="cn=mirrormode,dc=jets,dc=local" credentials=mirrormode retry="60 +" #updateref ldap://10.xx.x.xx mirrormode on ________________________________ This email and any attachments may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient of this email, the following stipulations govern the use of this information: You may not take any action based upon its contents. You may not copy or show this message or attachments to anyone. You should contact the sender and subsequently delete this message and all attachments. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Special Operations Technology, Incorporated. While antivirus software has been applied, you should perform due diligence to check this email and attachments for the presence of viruses. No warranties or assurances are made in relation to the safety and content of this email and attachments. Special Operations Technology, Incorporated accepts no liability for any damages caused by any virus transmitted by or contained in this email and attachments. No liability is accepted for any consequences arising from this email transmission whatsoever. Special Operations Technology, Incorporated is a premier IT professional services firm focused in the government and law enforcement space.

3 3

OpenLDAP Baseline Security Analyzer
by Inmaculada Bravo 11 Jan '10

11 Jan '10

Hello My name is Inma Bravo, I work at the University of Salamanca (Spain) mainly administrating our OpenLDAP directory. I have done a project called OpenLDAP Baseline Security Analyzer.[1] The project website is written in Spanish and in English. The purpose of this project is to develop a list of criteria that should be taken into account for the initial plan of securing the directory, and to show the most common mistakes that we must try to avoid. It briefly documents the main attacks and threats that we face as directory administrators. It is written to be easy, straightforward, and useful. These criteria are encoded in XML Schema, adhering to OCIL to use the OCIL Interpreter. I presented this project in our technical winter meeting of the institutions that are affiliated with RedIRIS (the Spanish academic and research network) [2], and it was well-received by the technicians. In conclusion, the reason I am writing you is to announce the project and to ask you for suggestions to improve and to correct it. I hope the project will be of your interest. Thanks very much Inmaculada Bravo García [1] http://openldap-bsa.forja.rediris.es/ [2] http://www.rediris.es/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical