openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Help migrating an OpenLdap 1.x directory to 2.x
by Diego Lima 23 Dec '09

23 Dec '09

Hello All, I'm currently working on migrating a directory that is currently running on OpenLDAP 1.x to OpenLDAP 2.x. Is there any online documents which detail how to convert the old schemas (which are on ldif format) to the format used by 2.x? I tried to google for that but I could not find much info on the subject. Currently the settings, acls and schemas are all present on ldif format. Any help would be greatly appreciated. Thanks a lot, Diego Lima

2 1

MD5 password hash with ppolicy
by Joe Friedeggs 23 Dec '09

23 Dec '09

I am working (with RH via Dell support) to solve an issue (that I believe to be a pam_ldap issue). The problem is that the password policy control messaging does not occur when I set 'pam_password md5', thus the Linux client never knows that the password expires. They have informed me that the password policy overlay in LDAP requires clear-text passwords, and will not handle the password policy stuff if the password is hashed. This makes no sense to me, since ppolicy is only handling expiry times, etc. and pam is handling the rest (length, strength, etc., prior to hash). Does the ppolicy overlay require clear-text? Thanks, Joe _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. http://clk.atdmt.com/GBL/go/177141665/direct/01/

2 1

Re: openldap-2.4.20 installation
by vishesh kumar 22 Dec '09

22 Dec '09

Thanks friends It require BDB 4.4 and i have 4.3.29 on my system. So what next i should do, should i upgrade existing BDB 4.3 to 4.4 or i should install BDB4.4 in separate path. Thanks On Wed, Dec 9, 2009 at 8:34 PM, Gattegno, Victor (EMEA BSS CC) < victor_gattegno(a)hp.com> wrote: > Hi, > > You may know which bdb version is required by current openldap package by > reading the 2.4.20 Release README: > http://www.openldap.org/software/release/readme.html > > SLAPD: > BDB and HDB backends require Oracle Berkeley DB 4.4, 4.5, > 4.6, 4.7, or 4.8. It is highly recommended to apply the > patches from Oracle for a given release. > > Regards, > Victor > > -----Original Message----- > > On Monday, 7 December 2009 11:26:18 vishesh kumar wrote: > > Dear friends > > Today i tried to install openldap2.4.20 on RHEL 5.2. After firing > > ./configure script, i got following error > > > > *Configure:error: Berkeley DB version incomptible with BDB/HDB > > backend. > > > > *But after investigation i found that db4 with version 4.3.29 is > installed > > on my system. So what i should do now, > > Should i replace my Berkeley DB package? I want to be sure that other > > running programs not get any issue after bdb upgradation. > > How one know which bdb version is required by current openldap package > ? > > > > thanks > > -- http://linuxinterviews.blogspot.com

2 1

Finding a provider to write to
by Jaap Winius 22 Dec '09

22 Dec '09

Hi all, Although I've figured out the basics of synchronization between providers and consumers, I'm not yet clear about one aspect from the client's perspective. In particular, if you've set up an LDAP consumer server with a synchronized, read-only copy of the DIT to service a particular group of clients, and you've configured those clients* to use that consumer server for all of their directory queries, how do those clients know where to find the correct provider in case it becomes necessary for them to write to the DIT (e.g. to change a password)? Thanks, Jaap *) With the URI option in /etc/ldap/ldap.conf

3 2

need help with my backup copy of ldap database...
by Louis-M. Carrière 22 Dec '09

22 Dec '09

Hi ! I had a problem with my system and decided to backup my /var/ /etc, etc. files and reinstall everything (Mandriva 2009). But now, my openldap installation complains about my openldap database being corrupted or something (here is the log): Dec 21 21:23:09 p4server slapd[12999]: @(#) $OpenLDAP: slapd 2.4.11 (Sep 15 2008 10:30:35) $ mandrake@n4.mandriva.com:/home/mandrake/rpm/BUILD/openldap-2.4.11/servers/slapd Dec 21 21:23:09 p4server slapd[12999]: daemon_init: listen on ldap://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon_init: listen on ldaps://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon_init: 2 listeners to open... Dec 21 21:23:09 p4server slapd[12999]: daemon: listener initialized ldap://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon: listener initialized ldaps://ldap.louismc.org/ Dec 21 21:23:09 p4server slapd[12999]: daemon_init: 2 listeners opened Dec 21 21:23:09 p4server slapd[12999]: slapd init: initiated server. Dec 21 21:23:09 p4server slapd[12999]: slap_sasl_init: initialized! Dec 21 21:23:09 p4server slapd[12999]: bdb_back_initialize: initialize BDB backend Dec 21 21:23:09 p4server slapd[12999]: bdb_back_initialize: Berkeley DB 4.6.21: (February 11, 2009) Dec 21 21:23:09 p4server slapd[12999]: hdb_back_initialize: initialize HDB backend Dec 21 21:23:09 p4server slapd[12999]: hdb_back_initialize: Berkeley DB 4.6.21: (February 11, 2009) Dec 21 21:23:09 p4server slapd[12999]: backend_startup_one: starting "cn=config" Dec 21 21:23:09 p4server slapd[12999]: => ldif_enum_tree: failed to open /etc/openldap/slapd.d/cn=config.ldif: No such file or directory Dec 21 21:23:09 p4server slapd[12999]: send_ldap_result: conn=-1 op=0 p=0 Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): file id2entry.bdb has LSN 2/4451165, past end of log at 1/140 Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): Commonly caused by moving a database from one database environment Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): to another without clearing the database LSNs, or by removing all of Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): the log files from a database environment Dec 21 21:23:09 p4server slapd[13000]: bdb(dc=louismc,dc=org): /var/lib/ldap/id2entry.bdb: unexpected file type or format Dec 21 21:23:09 p4server slapd[13000]: bdb_db_open: database "dc=louismc,dc=org": db_open(/var/lib/ldap/id2entry.bdb) failed: Invalid argument (22). Dec 21 21:23:09 p4server slapd[13000]: backend_startup_one: bi_db_open failed! (22) Dec 21 21:23:09 p4server slapd[13000]: bdb_db_close: database "dc=louismc,dc=org": alock_close failed Dec 21 21:23:09 p4server slapd[13000]: slapd stopped. Is there anything I can do to restore it like it was??? Also, but far less important, I have another error but less important since it never prevent me from using openldap before... /etc/openldap/slapd.d/cn=config What can I do about it??? Why does it complain? I never confiruged slapd.conf to use cn=config there... it should look in ldap itself for the config entry.... ?!?!? I'm puzzled and never had chance with google solving this one. thanks ! Louis-Martin Carrière _________________________________________________________________ Tirez parti d’une offre Windows 7 exceptionnelle et voyez comment il vous simplifie la vie. http://go.microsoft.com/?linkid=9691828

2 1

Re: Re : OpenLDAP 2.4 - Problem with rewrite overlay
by masarati＠aero.polimi.it 21 Dec '09

21 Dec '09

> I see your problem, it's when you restart the server using the > in-directory configuration. I couldn't investigate things further right > now; please file an ITS <http://www.openldap.org/its/> I've fixed the problem. I need you to file an ITS to track the issue. p.

2 1

Syncprov & synrepl indices
by Jaap Winius 20 Dec '09

20 Dec '09

Hi all, When configuring a provider for replication with the syncprov option, using the syncprov-sessionlog option requires searching for the entryUUID attribute. While not a requirement, setting an eq index for this attribute can improve the performance of the session log considerably. For the same reason, setting an eq index for the entryCSN attribute when using the syncprov-checkpoint option is also recommended. My question is in regard to the consumer. This documentation... http://www.openldap.org/doc/admin24/replication.html#Syncrepl ... shows an example consumer configuration (18.3.1.3) that also includes setting eq indices for entryCSN and entryUUID. Is this really useful, or only if the consumer is configured to act as a provider as well? Thanks, Jaap

2 1

objectClass=posixAccount search anomaly.
by Prentice Bisbal 19 Dec '09

19 Dec '09

Dear OpenLDAP Tech list: I can't tell if the problem below is with OpenLDAP, or nss_ldap. Since I can reproduce the problem with the ldapsearch command, I'm inclined to think it's with OpenLDAP. Any assistance will be greatly appreciated. At the academic institution where are work, there are several different departments that maintain their own LDAP directory: dc=sns,dc=example,dc=edu dc=math,dc=example,dc=edu dc=itg,dc=example,dc=edu dc=net,dc=example,dc=edu and a top-level LDAP server that just contains referrals to the individual dept servers: dc=example,dc=edu We are now looking to share access to systems without duplicating account information in all the LDAP servers. So if someone from math would like to log into an SNS system, they can authenticate against their credentials in the math LDAP directory, and get their account information from there, too. We are using an RHEL 5.4-based Linux distro. To facilitate this, I added this to my /etc/openldap/slapd.conf: database ldap suffix "dc=example,dc=edu" uri ldaps://ldap.example.edu/ And in /etc/ldap.conf, I changed the base to dc=example, dc=edu. The clients are still searching my local OpenLDAP server first. After making these changes, 'getent passwd no longer works correctly, and these ldapsearch no longer returns results ldapsearch -x objectClass=posixAccount ldapsearch -x -b dc=example,dc=edu objectClass=posixAccount ldapsearch -x -b dc=sns,dc=example,dc=edu objectClass=posixAccount ldapsearch -x -b dc=math,dc=example,dc=edu objectClass=posixAccount However, these ldapsearches work as expected ldapsearch -x objectClass=account ldapsearch -x ldapsearch -x objectClass=inetorgperson ldapsearch -x objectClass=inetlocalmailrecipient ldapsearch -x objectClass=top ldapsearch -x -b dc=math,dc=example,dc=edu Any ideas why the behavior is different for the posixAccount object class vs. the other object classes? Is there any other configurations for OpenLDAP that would achieve the same goal? -- Prentice

2 1

Syncrepl and rootdn
by Jaap Winius 19 Dec '09

19 Dec '09

Hi all, This question has to do with syncrepl and the use of the rootdn option in slapd.conf. My understanding is that on a provider server (where writes are possible), it is not necessary to use the rootdn option in slapd.conf. Instead it is enough to have an account that only exists in the directory, with ACLs that give it the same unrestricted access. This works fine for me. On syncrepl consumers a rootdn in the local slapd.conf is apparently required (according to the man page for slapd.conf). Why is this, and does it make a difference what the name of the account is? For example, should it be the same as the binddn for syncrepl? For that matter, should rootpw also be set, and should it then be the same as the credentials value used for syncrepl? Thanks, Jaap PS -- I'm using OpenLDAP 2.4.11-1 on Debian lenny.

3 3

slapadd: database doesn't support necessary operations
by Sergey Kharlamov 18 Dec '09

18 Dec '09

Hi all! I'm newbie in openldap. I try to setup openldap with mysql-backend. I try to insert ldif file: dn: o=test objectclass: organization o: tester and get error: ==>backsql_get_db_conn() ==>backsql_open_db_conn(4294967295) [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (DSN). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (Host). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (Trace). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (UserName). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (ReadOnly). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (RowVersioning). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (ShowSystemTables). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (ShowOidColumn). [MYODBCUtilReadDataSource.c][243][ERROR] Unknown attribute (FakeOidIndex). <==backsql_open_db_conn(4294967295) backsql_open_db_conn(4294967295): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_load_schema_map() backsql_load_schema_map(): oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM ldap_oc_mappings" backsql_load_schema_map(): at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" <==backsql_load_schema_map() ==>backsql_free_db_conn() backsql_free_db_conn(): closing db connection 4294967295 (0x8115530) ==>backsql_close_db_conn(4294967295) <==backsql_close_db_conn(4294967295) <==backsql_free_db_conn() <==backsql_db_open(): test succeeded, schema map loaded slapadd: database doesn't support necessary operations. How I can fix that? Tell me if need some more information -- --------------------------- Best Regards Kharlamov Sergey

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical