openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

2.3.43 master to 2.4.18 slave problem
by Bill MacAllister 23 Oct '09

23 Oct '09

I have hit a replication problem that I am scratching my head over. We are in the midst of migrating from OpenLDAP from 2.3 to 2.4. In our test environment we have a 2.3.43 master with 2.4.18 and 2.3.35 slaves. Replication to the 2.4 slave stopped this morning. When I look at the log I see: Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000000#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000000#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000001#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000001#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000002#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000002#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000003#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000003#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000004#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: rid=000 CSN too old, ignoring 20091022031949.000000Z#000004#000#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: do_syncrep2: cookie=csn=20091022031949Z#000005#00#000000,rid=000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: slap_queue_csn: queing 0x7f09c283b075 20091022031949Z#000005#00#000000 Oct 22 09:38:28 ldap-uat1 slapd[15032]: syncrepl_message_to_op: rid=000 mods check (homePostalAddress: value #0 invalid per syntax) Oct 22 09:38:28 ldap-uat1 slapd[15032]: slap_graduate_commit_csn: removing 0x7f09c1621438 20091022031949Z#000005#00#000000 So, I slapcat'ed the master's database and looked for that contextCSN. The entry that appears to be the problem has a homePostalAddress of: homePostalAddress: c\o Bain & Company, Two Copley Place, Boston, Massachusetts We had hit this problem before when loading a 2.4 server using slapcat output from a 2.3 server and wrote a simple filter to correctly quote the backslash. This is a problem for us because we expect to have a mixed 2.3/2.4 during the transistion to 2.4 on our production servers. The really nasty bit is that the only way I know for sure to fix this problem is to reload the slave. Is there an alterntive way? Bill -- Bill MacAllister, System Software Programmer Unix Systems Group, Stanford University

3 2

shadow context; no update referral
by Venish Khant 23 Oct '09

23 Oct '09

I had configured openldap in master/slave for replication. It's work perfectly. It's replicated entries but one entry not replicated. I try to add that entry using ldapadd command in my slave server. That time I got the below error. adding new entry "uid=test,ou=people,dc=example,dc=com" ldap_add: Server is unwilling to perform (53) additional info: shadow context; no update referral -- Venish Khant www.deeproot.co.in

3 2

LDAP Monitoring CN=Monitor
by Andreas Andersson 23 Oct '09

23 Oct '09

Hi! My name is Andreas and I want to inform you about a little project I've been working on called CN=Monitor. It's about monitoring and verifying directory servers with focus on open source LDAP servers. From single installed servers to large scaled deployments. Its a webbased application where you can: * Verify availability, compare load and performance between servers * Collect historical events for long term analysis (and get weekly reports by mail) * Verify cluster and load balancing functionality * Query several directories at the same time for data consistancy verification ... and a lot more. Why the name CN=Monitor. Well.. a lot of the information collected and analyzed is gathered from the CN=Monitor base DN. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor I appreciate all feedback I can get so let me know if there are any features you are missing or other things that can improve the application. Replication and cache monitoring is currently only available for 389 DS. Hopefully this can be added for OpenLDAP in the future. Best regards - Andreas Andersson

2 1

OpenLDAP/TLS+SASL (mech: EXTERNAL) with JNDI
by Stefan Jurisch 22 Oct '09

22 Oct '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I am implementing a custom Java LDAP library for our custom needs, and now I am at the point where I have to write the methods for a TLS authentication. I am searching for a solution since yesterday in the morning, but nothing matched. All found standard examples break with more or less heavy exceptions. I must connect to an OpenLDAP 2.4.x with complete TLS/SASL authentication, meaning the same thing like ldapsearch -T EXTERNAL -ZZ [...] It works well with my certs on CLI, but all tested Java implementations did not work properly yet. The best result I get at the moment, where I receive *only* one exception: [...] LDAP server connection URL: ldap://kungfu.in.siegnetz.de:389/dc=kungfu-local,dc=net javax.naming.AuthenticationNotSupportedException: [LDAP: error code 7 - SASL(-4): no mechanism available: ] at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3032) at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987) at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789) at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703) at com.sun.jndi.ldap.LdapCtx.ensureOpen(LdapCtx.java:2602) at com.sun.jndi.ldap.LdapCtx.extendedOperation(LdapCtx.java:3156) at javax.naming.ldap.InitialLdapContext.extendedOperation(InitialLdapContext.java:164) at de.siegnetz.ldaptools.connection.LDAPServerConnection.open(LDAPServerConnection.java:295) at de.siegnetz.test.SomeLdapTests.ldap_test1(SomeLdapTests.java:29) at de.siegnetz.test.SomeLdapTests.main(SomeLdapTests.java:13) dn: uid=dkent,ou=users,ou=Siegen,dc=kungfu-local,dc=net sambaPrimaryGroupSID: S-1-5-21-3205579064-1077270308-3928157200-513 sambaDomainName: KUNGFU-NET displayName: Kent, Dark (the sincerly unknown evil twin) givenName: Dark [...] where the interesting thing is, that, as you can see, the searchresult of the JNDI request is printed out, broke by the exception. TLS section in slapd.conf looks like this: TLSCertificateFile /etc/openldap/certs/kungfu-cert.pem TLSCertificateKeyFile /etc/openldap/certs/kungfu-key.pem TLSCACertificateFile /etc/openldap/certs/kungfu_ca.pem TLSVerifyClient demand I try to use it with a TinyCA2 created cert with 4096Bit RSA, exported as [...].pem cert and key files for the client + the ca.cert and the server cert and key. Is there perhaps a special X509 format that has to be used? Or are there other traps when using Java and OpenLDAP? I first used the library found here on the page, but I thought it would not fit my needs, because it did neither not work properly. Is there anyone out there who can help me on that issue? Thanks in advance and best regards Stefan - -- S T E F A N J U R I S C H - -------------------------------- System Engineer - VMware Support SIEGNETZ.IT GmbH Schneppenkauten 1a D-57076 Siegen Tel. +49 271 68193- 0 Fax: +49 271 68193-28 http://www.siegnetz.de Amtsgericht Siegen HRB4838 Geschäftsführer: Oliver Seitz Sitz der Gesellschaft ist Siegen - -------------------------------- Das Wort "WINDOWS" stammt aus einem alten Sioux-Dialekt und bedeutet: "Weißer Mann starrt durch Glasscheibe auf Sanduhr." - -------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iEYEARECAAYFAkrgD8AACgkQqdb99cbyCz4fMACdEG25Vo2LCTN+jZbX4dDIEtYs qGkAn2iDEQ7j9fO1oEb4RrXaOVpXLJPz =Jks5 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

why didn't ldap client validate ssl certificate?
by leilei175＠gmail.com 21 Oct '09

21 Oct '09

hi, I have a question on using tls on ldap. Hopefully anybody could give a hint on this. On the client side,I have set the TLS_REQCERT as demand. The TLS_CACERTDIR is also set, but I didn't put any certificate in the directory. To my surprise, even though no certificate is provided, ldapsearch could still succeed returning the data. Is this a bug? the openldap is running on redhat enterprise linux 4, openldap version is openldap-servers-sql-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-clients-2.2.13-12.el4 Any idea is appreciated! Thanks lei

3 2

bug report "ldap_simple_bind_s"
by cress 20 Oct '09

20 Oct '09

A backend daemon using openldap was frequently halted, The problem was finally located at an openldap function ldap_simple_bind_s. Below is a trace back of the running system: #0 0x00a0c7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x004e0b24 in poll () from /lib/tls/libc.so.6 #2 0x00ab8128 in ldap_int_select (ld=0x1, timeout=0x0) at os-ip.c:983 #3 0x00aa7f5f in wait4msg (ld=0x8f0a2c0, msgid=21, all=1, timeout=0x0, result=0x36fc1c4) at result.c:355 #4 0x00aa7b32 in ldap_result (ld=0x8f0a2c0, msgid=21, all=1, timeout=0x0, result=0x36fc1c4) at result.c:127 #5 0x00aad5d2 in ldap_sasl_bind_s (ld=0x8f0a2c0, dn=0x36fc260 "uid=chenming,domain=vip.eyou.net,o=vip.eyou.net", mechanism=0x0, cred=0x36fc208, sctrls=0x0, cctrls=0x0, servercredp=0x0) at sasl.c:194 #6 0x00aadc74 in ldap_simple_bind_s (ld=0x8f0a2c0, dn=0x36fc260 "uid=chenming,domain=vip.eyou.net,o=vip.eyou.net", passwd=0x36fca4a "") at sbind.c:113 #7 0x003ab2b0 in eyou_db_alias_auth (pdbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", alias=0x36fc5c0 "") at ldap/eyou_db.c:153 #8 0x003ab1ae in eyou_db_real_auth (dh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", realuid=0x36fc5c0 "", realdomain=0x36fc570 "") at ldap/eyou_db.c:123 #9 0x003c7669 in get_user_info_by_ldap (uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", userinfo=0x8efbd18, edbh=0x36fd3a8, password=0x36fca40 "xxxxxxxxx") at utils/user_info.c:559 #10 0x003c5cd9 in get_user_info (edbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", password=0x36fca40 "xxxxxxxxx", userinfo=0x8efbd18) at utils/user_info.c:160 #11 0x003a18da in user_validate (edbh=0x36fd3a8, uid=0x8efd8a0 "chenming", domain=0x8efd8c1 "vip.eyou.net", pass=0x36fca40 "chenkane1", userinfo=0x8efbd18) at utils/user_validate.c:61 #12 0x0804b6f2 in pop3_pass (arg=0x36fce80 "xxxxxxxxx", fun_arg=0x8efd8a0) at pop3_protocol.c:363 #13 0x0804d41a in new_commands (eio_fp=0x8f15cb8, tls_start=0, ssl=0x0, c=0x36fd2e0, fun_arg=0x8efd8a0) at commands.c:63 #14 0x0804ad94 in eyou_pop3 (eyou_db_hander=0x36fd3a8, eyou_socket_hander=0x8eff7e8) at pop3d.c:138 #15 0x08050470 in net_deliver (arg=0x8eef300) at gaea/deliver.c:219 #16 0x00b873cc in start_thread () from /lib/tls/libpthread.so.0 #17 0x004ea96e in clone () from /lib/tls/libc.so.6 The problem may be in the lines with red marked, However, this should not cause the program be halted。 Can i resolve the problem by set a timeout with openldap ？And how to do ?

1 0

Map attributes to access LDAP addressbook with thunderbird too
by Matthias Fechner 19 Oct '09

19 Oct '09

Hi, I have written a small web application some time ago which stores all information inside a openldap directory. When I access now information via thunderbird it displays some value, but some values are not shown. I searched now a little why and it seems that thunderbird asks his own fields like mozillaHomeStreet, mozillaHomeUrl and so on. But i stored my information in homepostaladdress and some other field the schema file give you. My question now is: Is it possible that when tunderbird ask for the field mozillaHomeStreet return there the field homepostaladdress? Thanks a lot for answers Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

2 2

how difference x509 attribute and extensions
by owen nirvana 19 Oct '09

19 Oct '09

sorry , I am a newbie. I could not know how to use x509 attribute, maybe do not. in x509.h, all functions about x509 attribute are not related with other parts. and if I might add an unstandard attribute to x509 certificate, so , why I need x509 extentions gtalk:freeespeech@gmail.com

2 1

ldap_bind error
by Mburu, Patrick 19 Oct '09

19 Oct '09

When i use this command; /usr/bin/ldapadd -x -D 'uid=root,dc=fedora,dc=directory,dc=server' -W -f /tmp/domain.ldif after entering the LDAP password i get this error: ldap_bind cannot contact ldap server. Any help or guideline will be appreciated. Regards, -- Patrick Mburu | Systems Engineer OPENWORLD LTD | Kenindia House |2nd Floor | P.O. Box 10918 00100 GPO NAIROBI Tel: 020 6750212, 2210772/3 | Fax: 020 2210772 Cell: 0725 550 906 - 0770 078 804 Email: pmburu(a)openworld.co.ke Web: www.openworld.co.ke Awards: CSK ' Open Source Solution Provider of the Year 2006 Award'

3 2

sasl binding with ssl encryption
by Xu, Qiang (FXSGSC) 19 Oct '09

19 Oct '09

Hi, all: My LDAP SASL binding is successful, but when I want to channel the traffic over SSL, it fails: ===================================================================== qxu@durian(pts/0):/etc[201]$ kinit XCTEST100(a)XCIPV6.COM Password for XCTEST100(a)XCIPV6.COM: ... qxu@durian(pts/0):/etc[203]$ klist Ticket cache: FILE:/tmp/krb5cc_20153 Default principal: XCTEST100(a)XCIPV6.COM Valid starting Expires Service principal 10/19/09 10:31:28 10/19/09 20:28:25 krbtgt/XCIPV6.COM(a)XCIPV6.COM renew until 10/20/09 10:31:28 ... qxu@durian(pts/0):/etc[204]$ ldapsearch -Y GSSAPI -H ldap://13.198.97.42:389 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started SASL username: XCTEST100(a)XCIPV6.COM SASL SSF: 56 SASL installing layers dn: CN=XCTEST100,CN=Users,DC=XCIPV6,DC=COM mail: XCTEST100(a)xcipv6.com # refldap://ForestDnsZones.XCIPV6.COM/DC=ForestDnsZones,DC=XCIPV6,DC=COM # refldap://DomainDnsZones.XCIPV6.COM/DC=DomainDnsZones,DC=XCIPV6,DC=COM # refldap://XCIPV6.COM/CN=Configuration,DC=XCIPV6,DC=COM ... qxu@durian(pts/0):/etc[205]$ ldapsearch -Y GSSAPI -H ldaps://13.198.97.42:636 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Server is unwilling to perform (53) additional info: 00002029: LdapErr: DSID-0C09048A, comment: Cannot bind using sign/seal on a connection on which TLS or SSL is in effect, data 0, v1771 ... qxu@durian(pts/0):/etc[206]$ ldapsearch -Y GSSAPI -O maxssf=0 -H ldaps://13.198.97.42:636 -b dc=xcipv6,dc=com -s sub -LLL cn=XCTEST100 mail SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Server is unwilling to perform (53) additional info: 00002029: LdapErr: DSID-0C09048A, comment: Cannot bind using sign/seal on a connection on which TLS or SSL is in effect, data 0, v1771 ===================================================================== Someone has mentioned that in order to do sasl binding over ssl, the security property " -O maxssf=0" must be set. However, this still fails. Any suggestions? Thanks, Xu Qiang

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical