openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

Database corruption revisited.
by Cliff Pratt 18 Oct '09

18 Oct '09

In an email of 5 August 2009 Howard Chu says "If your disks are working and haven't run out of space, database corruption pretty much never happens. You probably should describe the situation that leads you to believe there was a corruption. You should also list the versions of software in use." We have been plagued over the years with instances where the database appears to have been corrupted. I'm quite happy to be proved wrong, and would be pleased, very pleased to find a solution. As I said this has happened over the years, on ancient Debian systems, through RedHat's RHEL3, RHEL4, and maybe RHEL5. I'm not sure of the last. Every three or four months the application that uses OpenLDAP stops responding. We then run 'slapcat' against the LDAP datastore and if it hangs we stop slapd, run a recovery on the BDB and start everything up again. Now and then slapd refuses to start and we have to restore from a backup (also taken by slapcat). As I said, this has happened on many versions of OpenLDAP and on different operating systems. The latest version that I am sure it has happened on is RHEL 4.2 and OpenLDAP 2.2.13-4 (I think that is the version - I'm not able to access the servers at present so I'm going by memory). I'd be very pleased, ecstatic even, to find a solution to this. It's been a thorn in my side for many years. What information would be useful in pointing me at a solution? I'd only add that I am not an LDAP or OpenLDAP expert - the systems only get touched when an upgrade is necessary. Any advice would be appreciated. Cheers, hoping for a solution, or at least pointers to one. Cliff

4 6

2.4.18 refint getting "no such attribute" in bdb_modify_internal with removal; works with rename
by Andreas Hasenack 17 Oct '09

17 Oct '09

Hi, I'm using the refint overlay with a few attributes, but I can't get it to work with krbPwdPolicyReference from MIT kerberos 1.7. I get the error from the subject when deleting the entry this attribute references. If, however, I *rename* the entry, the krbPwdPolicyReference attribute gets updated correctly. It seems to fail only when I remove the entry. This is the config: dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config objectClass: olcRefintConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: krbObjectReferences olcRefintAttribute: member olcRefintAttribute: krbPwdPolicyReference olcRefintNothing: cn=localroot,cn=config This is the entry which has the attribute pointing to the entry I will remove (some attributes omitted for brevity): dn: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc= example,dc=com krbPrincipalName: andreas(a)EXAMPLE.COM objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux krbObjectReferences: uid=andreas,ou=people,dc=example,dc=com krbPwdPolicyReference: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example ,dc=com This is the entry I'm deleting. I would expect the krbPwdPolicyReference attribute from my entry above to be deleted. If I rename this cn=default, then krbPwdPolicyReference gets updated correctly. dn: cn=default,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com cn: default objectClass: krbPwdPolicy krbMaxPwdLife: 36000 krbMinPwdLife: 0 krbPwdMinDiffChars: 1 krbPwdMinLength: 1 krbPwdHistoryLength: 1 These are the relevant logs (level 16383): Oct 7 16:55:33 maestro slapd[6381]: refint_search_cb <NOTHING> Oct 7 16:55:33 maestro slapd[6381]: ==> unique_modify <krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com> Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: ndn: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: oc: "(null)", at: "(null)" Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("cn=default,ou=password policies,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: => bdb_entry_get: found entry: "cn=default,ou=password policies,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_entry_get: rc=0 Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: bdb_dn2entry("krbPrincipalName=andreas(a)EXAMPLE.COM,cn=example.com,ou=kerberos realms,dc=example,dc=com") Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 0x00000042: krbPrincipalName=andreas(a)EXAMPLE.COM,cn=EXAMPLE.COM,ou=Kerberos Realms,dc=example,dc=com Oct 7 16:55:33 maestro slapd[6381]: <= acl_access_allowed: granted to database root Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: dnMatch 0#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com"#012#011"cn=default,cn=example.com,ou=kerberos realms,dc=example,dc=com" Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: replace modifiersName Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: delete krbPwdPolicyReference Oct 7 16:55:33 maestro slapd[6381]: bdb_modify_internal: 16 modify/delete: krbPwdPolicyReference: no such attribute Oct 7 16:55:33 maestro slapd[6381]: hdb_modify: modify failed (16) Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: conn=-1 op=0 p=0 Oct 7 16:55:33 maestro slapd[6381]: send_ldap_result: err=16 matched="" text="modify/delete: krbPwdPolicyReference: no such attribute" Oct 7 16:55:33 maestro slapd[6381]: refint_repair: dependent modify failed: 16 Any hints?

2 1

ldap_search: LDAP Adminstration Limit Error
by Parag Kalra 17 Oct '09

17 Oct '09

Hello Friends, I am using a 'ldapsearch' command from Ubuntu machine to fetch entries from SunOne directory server hosted on Windows machine. I am able to retrieve the records but not all. At one stage it aborts abruptly and throws following error - ldap_search: LDAP Adminstration Limit Error Any pointers on what this error is all about and how can I get rid of it? Cheers, Parag

5 7

OpenLDAP 2.4.16: LDAP entry deletions not propaged in certain syncrepl multimaster scenario
by Alvin Wong 16 Oct '09

16 Oct '09

Hi I've encounter a problem in OpenLDAP 2.4.16 on 2 LDAP servers system setup with syncrepl multimaster and all data are synchronized. If server A is down and LDAP entries (leaf or subtree) are deleted on server B, when server A comes up, those LDAP entries are not removed from server A by syncrepl. If LDAP operations are done on either servers while both are up, syncrepl correctly propagates them to the other server. Below are the slapd.conf files for both server A and B. Is there something wrong with the way they are configured or is this a known issue? Thanks in advance. ========= SERVER A SLAPD.CONF ============== ucdata-path "C:/Program Files/MyApp/database" include "C:/Program Files/MyApp/schemaconf/core.schema" include "C:/Program Files/MyApp/schemaconf/corba.schema" include "C:/Program Files/MyApp/schemaconf/cosine.schema" include "C:/Program Files/MyApp/schemaconf/inetorgperson.schema" include "C:/Program Files/MyApp/schemaconf/nis.schema" include "C:/Program Files/MyApp/schemaconf/spanlink.schema" pidfile "C:/Program Files/MyApp/bin/slapd.pid" argsfile "C:/Program Files/MyApp/bin/slapd.args" idletimeout 300 sizelimit unlimited allow bind_v2 conn_max_pending_auth 2000 access to dn.subtree="ou=People,o=Spanlink Communications" by dn="cn=user,ou=People,o=Spanlink Communications" read by * read access to * by dn="cn=user,ou=People,o=Spanlink Communications" write by dn="cn=replication1,ou=People,o=Spanlink Communications" write by dn="cn=replication2,ou=People,o=Spanlink Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=Spanlink Communications" rootdn "cn=super,ou=People,o=Spanlink Communications" checkpoint 10 1 cachesize 50000 searchstack 8 rootpw secret directory "C:/Program Files/MyApp/database" # Indices to maintain index objectClass eq index entryCSN eq # for sync repl serverID 1 syncrepl rid=123 searchbase="o=Spanlink Communications" provider=ldap://10.10.10.75:38983 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=replication1,ou=People,o=Spanlink Communications" credentials=secret mirrormode true overlay syncprov syncprov-checkpoint 100 1 ========= SERVER B SLAPD.CONF ============== ucdata-path "C:/Program Files/MyApp/database" include "C:/Program Files/MyApp/schemaconf/core.schema" include "C:/Program Files/MyApp/schemaconf/corba.schema" include "C:/Program Files/MyApp/schemaconf/cosine.schema" include "C:/Program Files/MyApp/schemaconf/inetorgperson.schema" include "C:/Program Files/MyApp/schemaconf/nis.schema" include "C:/Program Files/MyApp/schemaconf/spanlink.schema" pidfile "C:/Program Files/MyApp/bin/slapd.pid" argsfile "C:/Program Files/MyApp/bin/slapd.args" idletimeout 300 sizelimit unlimited allow bind_v2 conn_max_pending_auth 2000 access to dn.subtree="ou=People,o=Spanlink Communications" by dn="cn=user,ou=People,o=Spanlink Communications" read by * read access to * by dn="cn=user,ou=People,o=Spanlink Communications" write by dn="cn=replication1,ou=People,o=Spanlink Communications" write by dn="cn=replication2,ou=People,o=Spanlink Communications" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=Spanlink Communications" rootdn "cn=super,ou=People,o=Spanlink Communications" checkpoint 10 1 cachesize 50000 searchstack 8 rootpw secret directory "C:/Program Files/MyApp/database" # Indices to maintain index objectClass eq index entryCSN eq # for sync repl serverID 2 syncrepl rid=123 searchbase="o=Spanlink Communications" provider=ldap://10.10.10.196:38983 type=refreshAndPersist retry="5 5 300 +" schemachecking=on attrs=* bindmethod=simple binddn="cn=replication2,ou=People,o=Spanlink Communications" credentials=secret mirrormode true overlay syncprov syncprov-checkpoint 100 1 [cid:image001.gif@01CA4E62.2F0CA5C0] ALVIN WONG SENIOR SOFTWARE ENGINEER DIRECT +1 (763).795.7752 alvin.wong(a)calabrio.com<mailto:alvin.wong@calabrio.com> Download vCard File Products<http://www.calabrio.com/products.asp> | Partners<http://www.calabrio.com/partners.asp> | Contact Us<http://www.calabrio.com/contact.asp> This message is confidential, and any unauthorized disclosure, use or dissemination (either whole or in part) is prohibited. If you are not the intended recipient of the message please notify the sender immediately and delete the message from your system.

1 0

ipv6 support in openldap
by Bad Guy 16 Oct '09

16 Oct '09

Dear sir, I want to ask whether openldap support ipv6, if yes, which version of openldap support it ? Thanks _________________________________________________________________ 隨身的 Windows Live Messenger 和 Hotmail，不限時地掌握資訊盡在指間 — Windows Live for Mobile http://3c.msn.com.tw/mobile/

3 2

Replication
by Márcio Luciano Donada 15 Oct '09

15 Oct '09

Hi People My LDAP server (master) is debian Lenny with 2.4.11-1 version, I am implementing a server that will be in a unit of the company, I need to replicate the LDAP, but because of the hardware I am using CentOS 5.3 with ldap version openldap-servers-2.3.43-3.el5. This will be a problem for replication or can do do otherwise? -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

3 3

Change user Password from an AIX on openLDAP server
by CASEIRO Philippe 15 Oct '09

15 Oct '09

Hello I'm running openldap-2.3.43 on an RHEL 5.3 All works fine (like usual) with the linux clients but I have some troubles with AIX I have done this tests with An AIX 5.3 TL9 host. When I change my password with AIX it runs like that [user@host] $ passwd Changing password for "user" user's Old password: user's New password: Enter the new password again: And it's done, over. When I check the modification on openLDAP server the password is in clear in the field < userPassword >. On my linux clients it ask the new password 2 times (normal ?) and is not in clear in userPassword filed. [user@host] $ passwd Changing password for user user. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: New password: Re-enter new password: LDAP password information changed for user passwd: all authentication tokens updated successfully. An extract of logs : >From an Aix : Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=0 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" method=128 Sep 17 14:51:19 srvldap slapd[8270]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=0 BIND dn="uid=user,ou=users,dc= xxx,dc=xx" mech=SIMPLE ssf=0 Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=0 RESULT tag=97 err=0 text= Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=1 MOD dn="uid=user,ou=users,dc= xxx,dc=xx" Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=1 MOD attr=userpassword userpassword Sep 17 14:51:19 srvldap slapd[8270]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=1 RESULT tag=103 err=0 text= Sep 17 14:51:19 srvldap slapd[8270]: conn=9 op=2 UNBIND Sep 17 14:51:19 srvldap slapd[8270]: conn=9 fd=22 closed Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=6 SRCH base="ou=users,dc= xxx,dc= xx " scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=in205))" Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=7 MOD dn="uid=user,ou=users,dc= xxx,dc= xx " Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=7 MOD attr=shadowlastchange Sep 17 14:51:19 srvldap slapd[8270]: conn=7 op=7 RESULT tag=103 err=8 text=modifications require authentication ... some troubles .... >From Linux : Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 fd=34 ACCEPT from IP=192.168.3.30:51023 (IP=0.0.0.0:636) Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 fd=34 TLS established tls_ssf=256 ssf=256 Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=0 BIND dn="" method=128 Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=0 RESULT tag=97 err=0 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=1 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=1001))" Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=2 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=user))" Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 6 15:37:40 srvldap slapd[2420]: conn=5764 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 fd=38 ACCEPT from IP=192.168.3.30:51024 (IP=0.0.0.0:636) Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 fd=38 TLS established tls_ssf=256 ssf=256 Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=0 BIND dn="" method=128 Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=0 RESULT tag=97 err=0 text= Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=1 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(|(&(accessTo=host22)(trustModel=byhost))(trustModel=fullaccess))(uid=user))" Oct 6 15:37:40 srvldap slapd[2420]: <= bdb_equality_candidates: (accessTo) not indexed Oct 6 15:37:40 srvldap slapd[2420]: <= bdb_equality_candidates: (trustModel) not indexed Oct 6 15:37:40 srvldap slapd[2420]: <= bdb_equality_candidates: (trustModel) not indexed Oct 6 15:37:40 srvldap slapd[2420]: conn=5765 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=2 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" method=128 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=2 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" mech=SIMPLE ssf=0 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=2 RESULT tag=97 err=0 text= Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=3 BIND anonymous mech=implicit ssf=0 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=3 BIND dn="" method=128 Oct 6 15:37:43 srvldap slapd[2420]: conn=5765 op=3 RESULT tag=97 err=0 text= Oct 6 15:37:46 srvldap slapd[2420]: conn=5764 op=3 SRCH base="ou=users,dc=xxx,dc=xx" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=1001))" Oct 6 15:37:46 srvldap slapd[2420]: conn=5764 op=3 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Oct 6 15:37:46 srvldap slapd[2420]: conn=5764 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=4 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" method=128 Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=4 BIND dn="uid=user,ou=users,dc=xxx,dc=xx" mech=SIMPLE ssf=0 Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=4 RESULT tag=97 err=0 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=5 PASSMOD id="uid=user,ou=users,dc=xxx,dc=xx" new Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=5 RESULT oid= err=0 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=6 MOD dn="uid=user,ou=users,dc=xxx,dc=xx" Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=6 MOD attr=shadowLastChange Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=6 RESULT tag=103 err=0 text= Oct 6 15:37:52 srvldap slapd[2420]: conn=5764 fd=34 closed (connection lost) Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 op=7 UNBIND Oct 6 15:37:52 srvldap slapd[2420]: conn=5765 fd=38 closed Thanks for your help. -- Philippe Caseiro

2 2

ppolicy password warnings
by Gustavo Schroeder 15 Oct '09

15 Oct '09

Hi, I'm planning to implement the ppolicy overlay in our repository and a major doubt came out. Suppose I got ppolicy overlay up and running and pwdMaxAge=10368000 (120 days) and as I've been googling around pam_ldap has the ability to provide user warnings about password expiration. My question is, will the userland apps like Thunderbird, Horde IMP (via passwd module), Samba provide password warnings to the end user? How will the user get warned when his/her password is about to expire? Is this something that the directory server will provide? Regards -Gustavo

4 3

ldap-back usage
by John Kane 14 Oct '09

14 Oct '09

I have a new requirement to proxy requests to a partner's LDAP (3rd party), based on organization. These request come into my slave servers. The slaves are chaining referrals to a single master (for my company's users). I have set up the proxy using back-ldap, along with the rewrite/map overlay (to massage the domain and map attrs). All requests to the partner's LDAP will be read-only. First question: Is back-ldap the correct approach for this? Is there a better way? This set-up is fairly simple and it 'seems' to be working. Second question: If this is the way, are there any rules that apply as far as where the chain overlay (order) should appear in slapd.conf? Here's a portion my slave slapd.conf (with openldap 2.3.43): modulepath /usr/lib/openldap moduleload ppolicy.la moduleload rwm.la #=================================================================== # chain to master for updates overlay chain chain-uri ldap://172.1.1.1 chain-idassert-bind bindmethod="simple" binddn="cn=ldapChain,o=myorg,dc=mycompany,dc=net" credentials="chainsecret" mode="self" chain-max-depth 2 chain-return-error TRUE chain-rebind-as-user TRUE #=================================================================== # back-ldap (partner database) database ldap uri "ldap://172.2.2.2" suffix "o=partnerorg,dc=mycompany,dc=net" lastmod off #=================================================================== # Rewrite/map overlay overlay rwm rwm-suffixmassage "o=partnerorg,dc=mycompany,dc=net" "o=partnerorg,dc=partner,dc=net" rwm-map objectclass top top rwm-map objectclass person person rwm-map objectclass posixAccount posixAccount rwm-map attribute DiagAccessLevel gecos rwm-map attribute DiagGroup description <etc, snip> #=================================================================== # Local database definitions database bdb suffix "dc=mycompany,dc=net" rootdn "cn=ldaproot,dc=mycompany,dc=net" rootpw bigsecret lastmod on directory /var/lib/ldap mode 0660 checkpoint 100 30 # Indices to maintain for this database index objectclass,entryCSN,entryUUID eq,pres <etc> #------------------------------------------------------------------- # ACLs for this database access to attrs=userPassword by self write by group.exact="cn=administrators,o=myorg,dc=mycompany,dc=net" write by dn.sub="o=partnerorg,dc=partner,dc=net" none by anonymous auth by * none access to * by group.exact="cn=administrators,o=myorg,dc=mycompany,dc=net" write by dn.sub="o=partnerorg,dc=partner,dc=net" none by anonymous none by * read #=================================================================== syncrepl rid=004 type=refreshAndPersist provider=ldap://172.1.1.1 retry="30 10 300 3" searchbase="dc=mycompany,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=myorg,dc=mycompany,dc=net" credentials="secretsync" updateref ldap://172.1.1.1 Thanks in advance, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

LDAP password information update failed: Insufficient access
by Roberto Gherardi de Candei 14 Oct '09

14 Oct '09

Hi i'm a newbie doesn't succeed has change the password of the on maturity consumer of the password help where is my error # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/certs/slapdcert.pem TLSCertificateKeyFile /etc/openldap/certs/slapdkey.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! #access to dn.subtree="ou=Utenti,dc=ldap=dc=inail,dc=it" # by dn="cn=adminU,ou=Utenti,dc=ldap=dc=inail,dc=it" # by dn="cn=anonymous,dc=ldap,dc=inail.dc=it" read # by self write # by anonymous auth ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=ldap,dc=inail,dc=it" rootdn "cn=admin,dc=ldap,dc=inail,dc=it" #rootpw {SSHA}PU4cboMpOsn7YBWDaP9xwRdP82k5O7gV rootpw {SSHA}mcFkKPNevo77jAq0+MdWNmX7F7roGk+v # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM thank's -- RGdC -- RGdC

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical