openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

LDAP Monitoring CN=Monitor
by Andreas Andersson 23 Oct '09

23 Oct '09

Hi! My name is Andreas and I want to inform you about a little project I've been working on called CN=Monitor. It's about monitoring and verifying directory servers with focus on open source LDAP servers. From single installed servers to large scaled deployments. Its a webbased application where you can: * Verify availability, compare load and performance between servers * Collect historical events for long term analysis (and get weekly reports by mail) * Verify cluster and load balancing functionality * Query several directories at the same time for data consistancy verification ... and a lot more. Why the name CN=Monitor. Well.. a lot of the information collected and analyzed is gathered from the CN=Monitor base DN. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor I appreciate all feedback I can get so let me know if there are any features you are missing or other things that can improve the application. Replication and cache monitoring is currently only available for 389 DS. Hopefully this can be added for OpenLDAP in the future. Best regards - Andreas Andersson

2 1

OpenLDAP/TLS+SASL (mech: EXTERNAL) with JNDI
by Stefan Jurisch 22 Oct '09

22 Oct '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I am implementing a custom Java LDAP library for our custom needs, and now I am at the point where I have to write the methods for a TLS authentication. I am searching for a solution since yesterday in the morning, but nothing matched. All found standard examples break with more or less heavy exceptions. I must connect to an OpenLDAP 2.4.x with complete TLS/SASL authentication, meaning the same thing like ldapsearch -T EXTERNAL -ZZ [...] It works well with my certs on CLI, but all tested Java implementations did not work properly yet. The best result I get at the moment, where I receive *only* one exception: [...] LDAP server connection URL: ldap://kungfu.in.siegnetz.de:389/dc=kungfu-local,dc=net javax.naming.AuthenticationNotSupportedException: [LDAP: error code 7 - SASL(-4): no mechanism available: ] at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3032) at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987) at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789) at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703) at com.sun.jndi.ldap.LdapCtx.ensureOpen(LdapCtx.java:2602) at com.sun.jndi.ldap.LdapCtx.extendedOperation(LdapCtx.java:3156) at javax.naming.ldap.InitialLdapContext.extendedOperation(InitialLdapContext.java:164) at de.siegnetz.ldaptools.connection.LDAPServerConnection.open(LDAPServerConnection.java:295) at de.siegnetz.test.SomeLdapTests.ldap_test1(SomeLdapTests.java:29) at de.siegnetz.test.SomeLdapTests.main(SomeLdapTests.java:13) dn: uid=dkent,ou=users,ou=Siegen,dc=kungfu-local,dc=net sambaPrimaryGroupSID: S-1-5-21-3205579064-1077270308-3928157200-513 sambaDomainName: KUNGFU-NET displayName: Kent, Dark (the sincerly unknown evil twin) givenName: Dark [...] where the interesting thing is, that, as you can see, the searchresult of the JNDI request is printed out, broke by the exception. TLS section in slapd.conf looks like this: TLSCertificateFile /etc/openldap/certs/kungfu-cert.pem TLSCertificateKeyFile /etc/openldap/certs/kungfu-key.pem TLSCACertificateFile /etc/openldap/certs/kungfu_ca.pem TLSVerifyClient demand I try to use it with a TinyCA2 created cert with 4096Bit RSA, exported as [...].pem cert and key files for the client + the ca.cert and the server cert and key. Is there perhaps a special X509 format that has to be used? Or are there other traps when using Java and OpenLDAP? I first used the library found here on the page, but I thought it would not fit my needs, because it did neither not work properly. Is there anyone out there who can help me on that issue? Thanks in advance and best regards Stefan - -- S T E F A N J U R I S C H - -------------------------------- System Engineer - VMware Support SIEGNETZ.IT GmbH Schneppenkauten 1a D-57076 Siegen Tel. +49 271 68193- 0 Fax: +49 271 68193-28 http://www.siegnetz.de Amtsgericht Siegen HRB4838 Geschäftsführer: Oliver Seitz Sitz der Gesellschaft ist Siegen - -------------------------------- Das Wort "WINDOWS" stammt aus einem alten Sioux-Dialekt und bedeutet: "Weißer Mann starrt durch Glasscheibe auf Sanduhr." - -------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iEYEARECAAYFAkrgD8AACgkQqdb99cbyCz4fMACdEG25Vo2LCTN+jZbX4dDIEtYs qGkAn2iDEQ7j9fO1oEb4RrXaOVpXLJPz =Jks5 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

why didn't ldap client validate ssl certificate?
by leilei175＠gmail.com 21 Oct '09

21 Oct '09

hi, I have a question on using tls on ldap. Hopefully anybody could give a hint on this. On the client side,I have set the TLS_REQCERT as demand. The TLS_CACERTDIR is also set, but I didn't put any certificate in the directory. To my surprise, even though no certificate is provided, ldapsearch could still succeed returning the data. Is this a bug? the openldap is running on redhat enterprise linux 4, openldap version is openldap-servers-sql-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-clients-2.2.13-12.el4 Any idea is appreciated! Thanks lei

3 2

bug report "ldap_simple_bind_s"
by cress 21 Oct '09

21 Oct '09

A backend daemon using openldap was frequently halted, The problem was finally located at an openldap function ldap_simple_bind_s. Below is a trace back of the running system: #0 0x00a0c7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x004e0b24 in poll () from /lib/tls/libc.so.6 #2 0x00ab8128 in ldap_int_select (ld=0x1, timeout=0x0) at os-ip.c:983 #3 0x00aa7f5f in wait4msg (ld=0x8f0a2c0, msgid=21, all=1, timeout=0x0, result=0x36fc1c4) at result.c:355 #4 0x00aa7b32 in ldap_result (ld=0x8f0a2c0, msgid=21, all=1, timeout=0x0, result=0x36fc1c4) at result.c:127 #5 0x00aad5d2 in ldap_sasl_bind_s (ld=0x8f0a2c0, dn=0x36fc260 "uid=chenming,domain=vip.eyou.net,o=vip.eyou.net", mechanism=0x0, cred=0x36fc208, sctrls=0x0, cctrls=0x0, servercredp=0x0) at sasl.c:194 #6 0x00aadc74 in ldap_simple_bind_s (ld=0x8f0a2c0, dn=0x36fc260 "uid=chenming,domain=vip.eyou.net,o=vip.eyou.net", passwd=0x36fca4a "") at sbind.c:113 #7 0x003ab2b0 in eyou_db_alias_auth (pdbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", alias=0x36fc5c0 "") at ldap/eyou_db.c:153 #8 0x003ab1ae in eyou_db_real_auth (dh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", realuid=0x36fc5c0 "", realdomain=0x36fc570 "") at ldap/eyou_db.c:123 #9 0x003c7669 in get_user_info_by_ldap (uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", userinfo=0x8efbd18, edbh=0x36fd3a8, password=0x36fca40 "xxxxxxxxx") at utils/user_info.c:559 #10 0x003c5cd9 in get_user_info (edbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", userinfo=0x8efbd18) at utils/user_info.c:160 #11 0x003a18da in user_validate (edbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", pass=0x36fca40 "chenkane1", userinfo=0x8efbd18) at utils/user_validate.c:61 #12 0x0804b6f2 in pop3_pass (arg=0x36fce80 "xxxxxxxxx", fun_arg=0x8efd8a0) at pop3_protocol.c:363 #13 0x0804d41a in new_commands (eio_fp=0x8f15cb8, tls_start=0, ssl=0x0, c=0x36fd2e0, fun_arg=0x8efd8a0) at commands.c:63 #14 0x0804ad94 in eyou_pop3 (eyou_db_hander=0x36fd3a8, eyou_socket_hander=0x8eff7e8) at pop3d.c:138 #15 0x08050470 in net_deliver (arg=0x8eef300) at gaea/deliver.c:219 #16 0x00b873cc in start_thread () from /lib/tls/libpthread.so.0 #17 0x004ea96e in clone () from /lib/tls/libc.so.6 The problem may be in the lines with red marked, However, this should not cause the program be halted。 Can i resolve the problem by set a timeout with openldap ？And how to do ?

1 0

Map attributes to access LDAP addressbook with thunderbird too
by Matthias Fechner 19 Oct '09

19 Oct '09

Hi, I have written a small web application some time ago which stores all information inside a openldap directory. When I access now information via thunderbird it displays some value, but some values are not shown. I searched now a little why and it seems that thunderbird asks his own fields like mozillaHomeStreet, mozillaHomeUrl and so on. But i stored my information in homepostaladdress and some other field the schema file give you. My question now is: Is it possible that when tunderbird ask for the field mozillaHomeStreet return there the field homepostaladdress? Thanks a lot for answers Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

2 2

how difference x509 attribute and extensions
by owen nirvana 19 Oct '09

19 Oct '09

sorry , I am a newbie. I could not know how to use x509 attribute, maybe do not. in x509.h, all functions about x509 attribute are not related with other parts. and if I might add an unstandard attribute to x509 certificate, so , why I need x509 extentions gtalk:freeespeech@gmail.com

2 1

ldap_bind error
by Mburu, Patrick 19 Oct '09

19 Oct '09

When i use this command; /usr/bin/ldapadd -x -D 'uid=root,dc=fedora,dc=directory,dc=server' -W -f /tmp/domain.ldif after entering the LDAP password i get this error: ldap_bind cannot contact ldap server. Any help or guideline will be appreciated. Regards, -- Patrick Mburu | Systems Engineer OPENWORLD LTD | Kenindia House |2nd Floor | P.O. Box 10918 00100 GPO NAIROBI Tel: 020 6750212, 2210772/3 | Fax: 020 2210772 Cell: 0725 550 906 - 0770 078 804 Email: pmburu(a)openworld.co.ke Web: www.openworld.co.ke Awards: CSK ' Open Source Solution Provider of the Year 2006 Award'

3 2

sasl binding with ssl encryption
by Xu, Qiang (FXSGSC) 19 Oct '09

19 Oct '09

Hi, all: My LDAP SASL binding is successful, but when I want to channel the traffic over SSL, it fails: ===================================================================== qxu@durian(pts/0):/etc[201]$ kinit XCTEST100(a)XCIPV6.COM Password for XCTEST100(a)XCIPV6.COM: ... qxu@durian(pts/0):/etc[203]$ klist Ticket cache: FILE:/tmp/krb5cc_20153 Default principal: XCTEST100(a)XCIPV6.COM Valid starting Expires Service principal 10/19/09 10:31:28 10/19/09 20:28:25 krbtgt/XCIPV6.COM(a)XCIPV6.COM renew until 10/20/09 10:31:28 ... qxu@durian(pts/0):/etc[204]$ ldapsearch -Y GSSAPI -H ldap://13.198.97.42:389 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started SASL username: XCTEST100(a)XCIPV6.COM SASL SSF: 56 SASL installing layers dn: CN=XCTEST100,CN=Users,DC=XCIPV6,DC=COM mail: XCTEST100(a)xcipv6.com # refldap://ForestDnsZones.XCIPV6.COM/DC=ForestDnsZones,DC=XCIPV6,DC=COM # refldap://DomainDnsZones.XCIPV6.COM/DC=DomainDnsZones,DC=XCIPV6,DC=COM # refldap://XCIPV6.COM/CN=Configuration,DC=XCIPV6,DC=COM ... qxu@durian(pts/0):/etc[205]$ ldapsearch -Y GSSAPI -H ldaps://13.198.97.42:636 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Server is unwilling to perform (53) additional info: 00002029: LdapErr: DSID-0C09048A, comment: Cannot bind using sign/seal on a connection on which TLS or SSL is in effect, data 0, v1771 ... qxu@durian(pts/0):/etc[206]$ ldapsearch -Y GSSAPI -O maxssf=0 -H ldaps://13.198.97.42:636 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Server is unwilling to perform (53) additional info: 00002029: LdapErr: DSID-0C09048A, comment: Cannot bind using sign/seal on a connection on which TLS or SSL is in effect, data 0, v1771 ===================================================================== Someone has mentioned that in order to do sasl binding over ssl, the security property " -O maxssf=0" must be set. However, this still fails. Any suggestions? Thanks, Xu Qiang

1 1

Database corruption revisited.
by Cliff Pratt 18 Oct '09

18 Oct '09

In an email of 5 August 2009 Howard Chu says "If your disks are working and haven't run out of space, database corruption pretty much never happens. You probably should describe the situation that leads you to believe there was a corruption. You should also list the versions of software in use." We have been plagued over the years with instances where the database appears to have been corrupted. I'm quite happy to be proved wrong, and would be pleased, very pleased to find a solution. As I said this has happened over the years, on ancient Debian systems, through RedHat's RHEL3, RHEL4, and maybe RHEL5. I'm not sure of the last. Every three or four months the application that uses OpenLDAP stops responding. We then run 'slapcat' against the LDAP datastore and if it hangs we stop slapd, run a recovery on the BDB and start everything up again. Now and then slapd refuses to start and we have to restore from a backup (also taken by slapcat). As I said, this has happened on many versions of OpenLDAP and on different operating systems. The latest version that I am sure it has happened on is RHEL 4.2 and OpenLDAP 2.2.13-4 (I think that is the version - I'm not able to access the servers at present so I'm going by memory). I'd be very pleased, ecstatic even, to find a solution to this. It's been a thorn in my side for many years. What information would be useful in pointing me at a solution? I'd only add that I am not an LDAP or OpenLDAP expert - the systems only get touched when an upgrade is necessary. Any advice would be appreciated. Cheers, hoping for a solution, or at least pointers to one. Cliff

4 6

2.4.18 refint getting "no such attribute" in bdb_modify_internal with removal; works with rename
by Andreas Hasenack 17 Oct '09

17 Oct '09

Hi, I'm using the refint overlay with a few attributes, but I can't get it to work with krbPwdPolicyReference from MIT kerberos 1.7. I get the error from the subject when deleting the entry this attribute references. If, however, I *rename* the entry, the krbPwdPolicyReference attribute gets updated correctly. It seems to fail only when I remove the entry. This is the config: dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config objectClass: olcRefintConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: krbObjectReferences olcRefintAttribute: member olcRefintAttribute: krbPwdPolicyReference olcRefintNothing: cn=localroot,cn=config This is the entry which has the attribute pointing to the entry I will remove (some attributes omitted for brevity): dn: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc= example,dc=com krbPrincipalName: andreas(a)EXAMPLE.COM objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux krbObjectReferences: uid=andreas,ou=people,dc=example,dc=com krbPwdPolicyReference: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example ,dc=com This is the entry I'm deleting. I would expect the krbPwdPolicyReference attribute from my entry above to be deleted. If I rename this cn=default, then krbPwdPolicyReference gets updated correctly. dn: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com cn: default objectClass: krbPwdPolicy krbMaxPwdLife: 36000 krbMinPwdLife: 0 krbPwdMinDiffChars: 1 krbPwdMinLength: 1 krbPwdHistoryLength: 1 These are the relevant logs (level 16383): Oct 7 16:55:33 maestro slapd[6381]: refint_search_cb <NOTHING> Oct 7 16:55:33 maestro slapd[6381]: ==> unique_modify <krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com> Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("cn=default,ou=password policies,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 0x00000042: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: <= acl_access_allowed: granted to database root Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: dnMatch 0#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com"#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: replace modifiersName Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 16 modify/delete: krbPwdPolicyReference: no such attribute Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: modify failed (16) Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: conn=-1 op=0 p=0 Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: err=16 matched="" text="modify/delete: krbPwdPolicyReference: no such attribute" Oct 7 16:55:33 maestro slapd[6381]: refint_repair: dependent modify failed: 16 Any hints?

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical