openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

dynlist overlay feature request
by Alexander 'Leo' Bergolth 02 Dec '09

02 Dec '09

Are there any plans to extend the dynlist overlays dynamic group feature to return not the DNs of the matched entries but an attribute of the entries? This would be useful for defining dynamic groups based on posixGroup (which need only the username, not the full DN) and populating them with entries from posixAccounts. If the dynlist-attrset could be extended by one parameter like: dynlist-attrset <group-oc> <URL-ad> [<member-ad>] [<result-ad>] ... where the additional parameter specifies the attribute that should be returned from the search results, a dynamic posixGroup could be configured like that: dynlist-attrset myposixGroup memberURL memberUid uid with a search filter like that: ldap:///ou=users,dc=local,dc=site??sub?(&(objectClass=posixAccount)(<searchfilter>)) I.e. "take the uid attribute of the matched entries and add them as memberUid." Could this extension be easily implemented? Is there currently any workaround? E.g. a way to dynamically add a memberUid to each posixAccount that contains the same data as the uid attribute? If that works, a filter like ldap:///ou=users,dc=local,dc=site?memberUid?sub?(&(objectClass=posixAccount)(<searchfilter>)) ... could work. Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

3 6

PAM EXOP causes chain bind password to change
by Joe Friedeggs 01 Dec '09

01 Dec '09

I am having an issue with my 'chain' bind password getting changed instead of the user's password. In a Red Hat Linux environment, running OpenLDAP 2.3.43(-3.el5 RPM from RH), I am using a master-slave setup, with chaining (as opposed to referral) as a method to allow users to change passwords (most LDAP clients hit the slave). Because I have some other issues when I set (nss_ldap) 'pam_password md5'in ldap.conf, I tried setting it to 'pam_password exop' instead. But, with this setting, when a user attempts a password change from one of the Linux clients, the ldap chain BIND password is changed on the master, instead of the user's password. In my slave slapd.conf, I have: #################################################################### # Chain to Master for updates overlay chain chain-uri "ldap://10.10.1.191" chain-idassert-bind bindmethod="simple" binddn="cn=ldapChain,o=myorg,dc=myco,dc=net" credentials="ldapChain" mode="none" # mode="self" chain-max-depth 2 chain-return-error TRUE chain-rebind-as-user TRUE ####################################################################### # To sync with the LDAP Master database using syncrepl syncrepl rid=222 type=refreshAndPersist provider=ldap://10.10.1.191 retry="30 10 300 3" searchbase="dc=myco,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=myorg,dc=myco,dc=net" credentials="syncRepl" updateref ldap://10.10.1.191 #################################################################### SO, for example, when some user, say 'userbob' issues a 'passwd' and attempts to change his password from a Linux LDAP client (configured to hit the slave LDAP server), the password for "cn=ldapChain,o=myorg,dc=myco,dc=net" instead gets changed. The users password does not get changed. Anyone know what I could possibly have mis-configured that would cause this? Thanks in advance, Joe _________________________________________________________________ Chat with Messenger straight from your Hotmail inbox. http://www.microsoft.com/windows/windowslive/hotmail_bl1/hotmail_bl1.aspx?o…

1 0

ObjectClass for BDB databases
by Peter Mogensen 01 Dec '09

01 Dec '09

Hi, I was trying to manual change and HDB LDIF config to BDB and failed to guess the correct ObjectClass (instead of olcHdbConfig). Looking at the example in section 5.3: http://www.openldap.org/doc/admin24/slapdconf2.html#Configuration%20Example ...It seem the objectclass is olcBdbConfig, but slapd won't accept that and it isn't present in cn=config/cn=schema.ldif where the other objectclasses are defined. Is there a bug in the documentation? /Peter

1 1

Poor Performance on HP-UX 11v3
by 宋杨 30 Nov '09

30 Nov '09

Hi I install openldap(ixOpenLDAP_A.13.00-2.4.16.001_HP-UX_B.11.23_IA_PA.depot) on HP-UX 11v3 But I have a low performance when multi thread search, when one search thead about 0-1 ms, but when 10 search threads about 300+ms. By the way all conf files are default. Any suggestions? Thanks

2 1

/etc/nsswitch cause delay in start
by vishesh kumar 27 Nov '09

27 Nov '09

Dear friends I am facing a unique problem in openldap 2.3.43 on rhel 5. 2. If i specify ldap in /etc/nsswitch.conf like passwd files ldap shadow files ldap group files ldap And then start my ldap server, it takes lots of time to start ldap server. If i remove ldap from /etc/nsswitch.conf , it start immediately. Can anyone suggest be any solution for this problem. Thanks -- http://linuxinterviews.blogspot.com

4 4

Syncrepl : Authentication issue
by smainklh＠free.fr 27 Nov '09

27 Nov '09

Hello guys, I'm meeting an issue when configuring ldap replication. The synchronisation account doesn't authenticate with the provider. Here are my configuration files : /etc/ldap/slapd.conf (provider): ----------------------- moduleload syncprov database bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryCSN,entryUUID eq /etc/ldap/slapd.conf (consumer): -------------------------- Syncrepl rid=666 provider=ldaps://provider.domain.tld:636/ type=refreshOnly retry="60 10 600 +" interval=00:00:30:00 searchbase="dc=domain,dc=tld" scope=sub schemachecking=on bindmethod=simple binddn="cn=syncrepluser,dc=domain,dc=tld" credentials=secret Errors below : >From consumer ------------ slap_client_connect: URI=ldaps://provider.domain.tld:636/ DN="cn=syncrepluser,dc=domain,dc=tld" ldap_sasl_bind_s failed (49) do_syncrepl: rid=666 retrying (9 retries left) >From provider ------------ Nov 26 15:28:47 provider slapd[2514]: do_bind: version=3 dn="cn=syncrepluser,dc=domain,dc=tld" method=128 Nov 26 15:28:47 provider slapd[2514]: bdb_dn2entry("cn=syncrepluser,dc=domain,dc=tld") Nov 26 15:28:47 provider slapd[2514]: => bdb_dn2id("cn=syncrepluser,dc=domain,dc=tld") Nov 26 15:28:47 provider slapd[2514]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) Nov 26 15:28:47 provider slapd[2514]: send_ldap_result: conn=3 op=0 p=3 Nov 26 15:28:47 provider slapd[2514]: send_ldap_response: msgid=1 tag=97 err=49 Nov 26 15:28:47 provider slapd[2514]: connection_get(14): got connid=3 Nov 26 15:28:47 provider slapd[2514]: connection_read(14): checking for input on id=3 Nov 26 15:28:47 provider slapd[2514]: ber_get_next on fd 14 failed errno=0 (Success) Nov 26 15:28:47 provider slapd[2514]: connection_closing: readying conn=3 sd=14 for close Nov 26 15:28:47 provider slapd[2514]: connection_close: deferring conn=3 sd=14 Nov 26 15:28:47 provider slapd[2514]: conn=3 op=1 do_unbind Nov 26 15:28:47 provider slapd[2514]: connection_resched: attempting closing conn=3 sd=14 Nov 26 15:28:47 provider slapd[2514]: connection_close: conn=3 sd=14 Do i have to create an account in the ldap tree? Is there a problem using SSL? Thank you for your help. Regards, Grifith

2 2

LDAP + squid
by Bruno Steven 27 Nov '09

27 Nov '09

Hello ... My squid work fine with Openldap, but I need change method authentication of user for groups , so I made the configuration follow . # As linhas abaixo se referem a autenticaÃ§ de usuÃ¡os no AD auth_param basic program /usr/local/squid/libexec/squid_ldap_auth -R -b "dc=amblivre,dc=com" -D "cn=proxy_user,ou=Internet,dc=amblivre,dc=com" -w "password" -f sAMAccountName=%s -h 192.168.4.55 auth_param basic realm Input your password auth_param basic children 5 auth_param basic credentialsttl 15 minutes #acl senha proxy_auth REQUIRED #http_access allow senha # ACL externa para autenticaÃ§ nas bases LDAP do PDC external_acl_type ldap_group %LOGIN /usr/local/squid/libexec/squid_ldap_group -R -b "dc=amblivre,dc=com" -D "cn=proxy_user,ou=Internet,dc=amblivre,dc=co m" -w "password" -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%a,ou=Internet,dc=amblivre,dc=com))" -h 192.168.4.55 acl AcessoLivre external ldap_group AcessoLivre http_access AcessoLivre When the I input user and passord for auth the Squid doesn´t recognize the credentials . There are some problem in my configuration ? Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

2 1

Migrate BD for Mysql
by Bruno Steven 26 Nov '09

26 Nov '09

Hello I am testing many cenarios of Open-Ldap, now I want test mysql such data base for Openldap . Somebody know how migrate BD Openldap for Mysql ? Thanks. -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

2 1

Search responses with incorrect msgId
by Eduardo Ramos Testillano 26 Nov '09

26 Nov '09

Hi all, My application is an ldap client based on openLdap suite. I'm having problems when receiving search responses with incorrect msgId. The problem is: always returns error -1 being impossible to discriminate other situations like remote server close. The application always detach the connection fd when -1 is received (99% is broken connection). But we don't want to do close this when "receive a search response with out-of-context msgId" (usually "out-of-time search result entries" after sending AbandonRequest from client). I can't use ldap_msgid, because 'LDAPMessage*' is NULL and causes abort() (anyway, no special result code is specified for this situation at ldap_msgid API description). My code: LDAP* handle = (LDAP*) a_ldap; LDAPMessage* hmessage (NULL); resultCode = ldap_result (handle, LDAP_RES_ANY, LDAP_MSG_ONE, NULL, &hmessage); // I test the following, hoping result is not -1 with LDAP_RES_UNSOLICITED, but it returned -1 again... if (resultCode.getValue () == -1) resultCode = ldap_result (handle, LDAP_RES_UNSOLICITED, LDAP_MSG_ONE, NULL, &hmessage); ¿do you know any other way to identify responses with incorrect msgid? thnks Regard, Edu

1 0

Same entry twice in ldapsearch output
by Peter Mogensen 26 Nov '09

26 Nov '09

Hi, It seems weird results are popping up faster than I can assemble test-setups to reproduce. I ran a test in mirrormode were I: 1) Took an slapcat generated LDIF from a 2.3.x setup 2) Removed all entryCSN and contextCSN lines. 3) Ran "slapadd -S 1 -q -w -l ~/load_noCSN.ldif" on server-1 4) Did a "slapcat > toserver2.ldif" on server-1 5) Started server-1 and let applications create and modify objects. 6) Moved toserver2.ldif to server-2. 7) Ran slapadd -q -l toserver2.ldif on server-2 8) Started server-2 Now - I would expect the objects created on step 5 to appear after a while on server-2. They are not. The reason seems to be that the contextCSN has not been updated properly on server-1. The contextCSN in the "toserver2.ldif" file from step 4 is: 20091118173357.690685Z#000000#001#000000 The contextCSN on both servers are now: 20091119140605.714382Z#000000#001#000000 The entry on server-1 having that entryCSN is a modified object, however, the change has not been replicated to server-2. Likewise, the entryCSN for one created object in step 5 is: 20091119094729.719193Z#000000#001#000000 It is not present on server-2, but it appears TWICE in a the result from an ldapsearch (scope sub) on its parent object on server-1. ?!?! .. I'm lost. From all I know this should not happen on a healthy setup - unless there's something badly wrong with the procedure I've described above. It's slapd 2.4.19 with BDB4.8 /Peter

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical