openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

lastmod in slapd.conf
by Srinidhi Sharma 31 Jul '09

31 Jul '09

Hi, Is it possible to detect using JNDI api's if the lastmod is turned on in Open-ldap slapd.conf file ? any pointers would be helpful. -- Thanks, Srinidhi

2 1

RE: entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16)
by Robert Hanson 31 Jul '09

31 Jul '09

What I need is to have the "glue" items returned as part of the search. It looks to me like I can get nodes that are "glue" nodes to be part of the results by commenting out these lines: in src\servers\slapd\back-bdb\search.c, lilnes 908-91 if ( !manageDSAit && is_entry_glue( e )) { goto loop_continue; } If I comment out these lines, then I get the results I'm looking for. Are there any other implications to the "glue" nodes? It looks like I'm able to edit and delete these nodes as well. But there is code in delete.c, modify.c, modrdn.c that worry about glue nodes. Another option would be to redefine the is_entry_glue macro to always return false. Is that a better approach? ________________________________ From: Robert Hanson Sent: Thursday, July 30, 2009 11:08 AM To: 'openldap-technical(a)openldap.org' Subject: entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16) Is this bug ITS#4626? Or is there a workaround? ==== Using a build of 2.4.16 on RedHat linux; in a multi-master environment with 2 nodes. On both nodes, I have a tree that has a node "ou=Company, o=MyCompanyName". Under that are several nodes that are "glue" nodes. Following those is a actual data node. Slapd 2.4.16, built from source, running on redhat linux) I have seen this occur several times on various test systems with similar configurations. The data in these nodes is inserted, in the proper order, (parent then children) using ldap client calls (ldap_add_s). Later, when I go to look at the output of slapcat, I see that some nodes are replaced with "glue" nodes. Questions: 1) Why are these glue nodes created? Is there a known bug that will cause existing nodes to be deleted without the children being deleted? Is this an issue in replication? (where syncrepl needs to create a node where the parent does not exist). Is that why the glue nodes are created later? 2) How can I change the "glue" to some other class? Can that be done programmatically? 3) ======== This is a dump of slapcat (with unnecessary nodes removed) dn: o=MyCompanyName objectClass: organization o: MyCompanyName structuralObjectClass: organization entryUUID: feb5b352-2eb7-102d-8c1f-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.418938Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z contextCSN: 20090728202448.877262Z#000000#001#000000 contextCSN: 20090728202123.336320Z#000000#002#000000 dn: ou=Company,o=MyCompanyName ou: Company description: 3.0.0 objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: feb7a41e-2eb7-102d-8c28-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.432024Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z dn: lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 0136f8e0-0ff7-102e-8da5-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Servers,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 014e7632-0ff7-102e-8db3-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Application Data,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: e5a152de-0fff-102e-923c-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: appName=Configurations,ou=Application Data,lcc=Call Center 1,ou=Company,o= MyCompanyName entryUUID: e5a299f0-0fff-102e-923d-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z structuralObjectClass: applicationUnit appName: Configurations objectClass: applicationUnit entryCSN: 20090728202143.649526Z#000000#001#000000 modifiersName: cn=Client,ou=People,o=MyCompanyName modifyTimestamp: 20090728202143Z

3 3

entries exist in ldap (as glue entries), but are missing from the tree (v2.4.16)
by Robert Hanson 30 Jul '09

30 Jul '09

Is this bug ITS#4626? Or is there a workaround? ==== Using a build of 2.4.16 on RedHat linux; in a multi-master environment with 2 nodes. On both nodes, I have a tree that has a node "ou=Company, o=MyCompanyName". Under that are several nodes that are "glue" nodes. Following those is a actual data node. Slapd 2.4.16, built from source, running on redhat linux) I have seen this occur several times on various test systems with similar configurations. The data in these nodes is inserted, in the proper order, (parent then children) using ldap client calls (ldap_add_s). Later, when I go to look at the output of slapcat, I see that some nodes are replaced with "glue" nodes. Questions: 1) Why are these glue nodes created? Is there a known bug that will cause existing nodes to be deleted without the children being deleted? Is this an issue in replication? (where syncrepl needs to create a node where the parent does not exist). Is that why the glue nodes are created later? 2) How can I change the "glue" to some other class? Can that be done programmatically? 3) ======== This is a dump of slapcat (with unnecessary nodes removed) dn: o=MyCompanyName objectClass: organization o: MyCompanyName structuralObjectClass: organization entryUUID: feb5b352-2eb7-102d-8c1f-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.418938Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z contextCSN: 20090728202448.877262Z#000000#001#000000 contextCSN: 20090728202123.336320Z#000000#002#000000 dn: ou=Company,o=MyCompanyName ou: Company description: 3.0.0 objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: feb7a41e-2eb7-102d-8c28-f1b463e2c47e creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20081015034921Z entryCSN: 20081015034921.432024Z#000000#000#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20081015034921Z dn: lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 0136f8e0-0ff7-102e-8da5-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Servers,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: 014e7632-0ff7-102e-8db3-59a5102cad9a creatorsName: cn=Client,ou=People,o=MyCompanyName createTimestamp: 20090728191715Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: ou=Application Data,lcc=Call Center 1,ou=Company,o=MyCompanyName entryUUID: e5a152de-0fff-102e-923c-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z objectClass: top objectClass: glue structuralObjectClass: glue entryCSN: 20090728202123.336320Z#000000#002#000000 modifiersName: cn=MyDivision,ou=People,o=MyCompanyName modifyTimestamp: 20090728202123Z dn: appName=Configurations,ou=Application Data,lcc=Call Center 1,ou=Company,o= MyCompanyName entryUUID: e5a299f0-0fff-102e-923d-cf0948a0ceb1 creatorsName: cn=MyDivision,ou=People,o=MyCompanyName createTimestamp: 20090728202054Z structuralObjectClass: applicationUnit appName: Configurations objectClass: applicationUnit entryCSN: 20090728202143.649526Z#000000#001#000000 modifiersName: cn=Client,ou=People,o=MyCompanyName modifyTimestamp: 20090728202143Z

1 0

Radius authentication and storing passwords in cleartext
by Eric Bourkland 30 Jul '09

30 Jul '09

I have zimbra openLDAP v2.3.43 running on RHEL4.7 ES and I am trying to connect our freeRadius server to authenitcate against LDAP. I have also being trying to stand up plane openLDAP v2.4.17 to see if I can get that to work. Free Radius requires PEAP/CHAPv2 to authenticate, which means it needs to be handed a clear text password in order to work. Yes, I know in general this is not a good idea. How can I configure openLDAP to store passwords (userpassword attribute) in cleartext. Or at the very least create a script that will be able to take the encrypted password and store it in cleartext as another attribute. Thanks,

5 4

Member-of plugin support for nested membership
by Mathias Gug 29 Jul '09

29 Jul '09

Hi, While discussing the possibility of using openldap in place of 389 directory in the FreeIPA project [1] the following technical detail was mentioned. [1]: https://www.redhat.com/archives/freeipa-devel/2009-July/msg00333.html According to the memberof overlay man page: The memberof overlay to slapd(8) allows automatic reverse group member‐ ship maintenance. Any time a group entry is modified, its members are modified as appropriate in order to keep a DN-valued "is member of" attribute updated with the DN of the group. Does the memberOf overlay deal with nested membership? Or is it strictly a 1:1 relationship (forward pointer, reverse pointer)? The 389 memberOf plug-in maintains reverse pointers for inherited membership which IPA takes advantage of. -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

1 0

Re: get_ava: illegal value with translucent proxy
by Petteri Heinonen 29 Jul '09

29 Jul '09

Pierangelo Masarati [masarati(a)aero.polimi.it] kirjoitti: > Petteri Heinonen wrote: > > Pierangelo Masarati [masarati(a)aero.polimi.it] wrote: > >> Petteri Heinonen wrote: > >> > Hi, I've setup a translucent proxy. Now, I have tried to do some > >> test > searches. For example this works ok: > >> > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > >> "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" > >> > > Search is proxied through proxy to the actual server, and correct > >> result > is returned. However, if I try this: > >> > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > >> "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" > >> > > I get no results. I have monitored the traffic between proxy and > >> backend > server, and the query is not even sent there. In OpenLDAP > >> log there is: > >> > > Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for > > >> attributeType objectClass > >> > Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 > >> > > What would be the problem here? > >> > >> The objectClass "User" is not defined in the proxy's schema? > >> > >> p. > >> > > > > That's correct. But in translucent overlay's documentation, there is: > > > > "Note: The Translucent Proxy overlay will disable schema checking in the > > local database, so that an entry consisting of overlay attributes need > > not adhere to the complete schema." > > > > But it seems that schema checking is still in affect when doing > > searches. Is there a way to disable local schema checking altogether? Or > > do I have to build some dummy schema so that OpenLDAP is aware about > > objectClasses I want to search for? > > What happens is that you use unknown schema items in the *filter*, which > requires it to be known in order to apply appropriate matching rules and > so. The schema relaxation in the documentation refers to enforcing > adherence with allowed and required attributes of an objectclass, and > with stored objectclasses complying with structural inheritance > relationship. Schema items need to be known anyway. > > p. > Ok, thanks for the clarification. I guess that my goal to have an Active Directory proxied properly is not going to happen. I would need a complete AD schema for OpenLDAP, and that's probably now available anywhere.

2 1

Mirror mode with additional consumer
by Jens Thomas 29 Jul '09

29 Jul '09

Hi, i am new at this list, please forgive me my broken english. I have two questions, first, is it possible to setup two slapd (2.4.x) in mirror mode and add later one or more additional consumer slapd with syncrepl? The goal is to have a 2-server-HA system (where one server is always writeable) and distributed cache slapd's. Are there theoretical issues? A second problem, maybe you can give me a pointer: I would like to assign the right to add, modify and delete an object to an attribute inside the same object (and necessarily to the container object). Maybe ACI and the corresponding overlay is what i need. Or can this be solved by using regex? Thanks a lot, with kind regards Jens -- linux systeme thomas Jens Thomas Völklinger Straße 9 42285 Wuppertal Telefon: +49.202.3097507 Mobil: +49.177.9301386 eFax: +49.202.85064329 Web: http://linux-systeme-thomas.de USt-ID: DE250711901

3 3

Re: get_ava: illegal value with translucent proxy
by Petteri Heinonen 28 Jul '09

28 Jul '09

Pierangelo Masarati [masarati(a)aero.polimi.it] wrote: > Petteri Heinonen wrote: > > Hi, I've setup a translucent proxy. Now, I have tried to do some test > > searches. For example this works ok: > > > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" > > > > Search is proxied through proxy to the actual server, and correct result > > is returned. However, if I try this: > > > > ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b > > "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" > > > > I get no results. I have monitored the traffic between proxy and backend > > server, and the query is not even sent there. In OpenLDAP log there is: > > > > Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter > > Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY > > Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for > > attributeType objectClass > > Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 > > > > What would be the problem here? > > The objectClass "User" is not defined in the proxy's schema? > > p. > That's correct. But in translucent overlay's documentation, there is: "Note: The Translucent Proxy overlay will disable schema checking in the local database, so that an entry consisting of overlay attributes need not adhere to the complete schema." But it seems that schema checking is still in affect when doing searches. Is there a way to disable local schema checking altogether? Or do I have to build some dummy schema so that OpenLDAP is aware about objectClasses I want to search for? -Petteri Heinonen --

2 1

send_search_entry: conn 9279837 ber write failed
by jakjr 27 Jul '09

27 Jul '09

Hello, some time ago I upgraded our server to version 2.4.16. Since then, for 3 times, the server hangs with this message: Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 fd=110 ACCEPT from IP=XXX.XXX.XXX.XX:41577 (IP=0.0.0.0:389) Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 BIND dn="cn=admin" method=128 Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 BIND dn="cn=admin" mech=SIMPLE ssf=0 Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=0 RESULT tag=97 err=0 text= Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=1 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=2 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:50 sseed0013 slapd[22555]: conn=9279837 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=3 SRCH base="ou=seed" scope=2 deref=0 filter="(uidNumber=12916)" Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=4 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=12916)(phpgwAccountType=u))" Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 09:31:51 sseed0013 slapd[22555]: conn=9279837 op=5 SRCH base="ou=seed" scope=2 deref=0 filter="(&(gidNumber=20877)(phpgwAccountType=g))" Jul 27 09:32:33 sseed0013 slapd[22555]: conn=9279837 op=6 SRCH base="ou=seed" scope=2 deref=0 filter="(&(uidNumber=20877)(phpgwAccountType=u))" Jul 27 09:32:36 sseed0013 slapd[22555]: conn=9279837 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= *Jul 27 09:32:42 sseed0013 slapd[22555]: send_search_entry: conn 9279837 ber write failed.* The config and load of this server is almost the same of the old version (2.3.30) Thanks for any tip, Regards, João Alfredo

2 2

ACL on referral object (chaining) does not work
by Kay.Kirchhoefer＠t-systems.com 27 Jul '09

27 Jul '09

Hi, I have a question regarding ACL used together with chaining overlay configuration. I´m building several ldap servers which should chain each other, based on the selected path. I now wanted to prevent a chaining loop by using ACLs, but that doesn´t work for me. It seems like the ACL is not used for the referral objects. sample referral object: dn: o=testldap2,c=de objectClass: referral objectClass: extensibleObject o=testldap2 ref: ldap://testldap2/c=de <ldap://testldap2/c=de> chaining config: overlay chain chain-uri ldap://testldap2 <ldap://testldap2> chain-rebind-as-user yes chain-idassert-bind bindmethod="simple" binddn="cn=xxxxxx" credentials="yyyy" mode="self" chain-max-depth 1 chain-return-error TRUE ACL config: access to dn.base="o=testldap2,c=de" by peername.ip=192.168.1.1 none by * read 192.168.1.1 is the ip address of "testldap2". Everytime a request from this ip occurs, the server should block the access to the (referral) object because it must be a "chained" request But that doesn´t work. Also the parameter "chain-max-depth" seems not to work. I´m currently using OpenLDAP version 2.3.20 (but I also tried the latest one). Yours sincerely, Kay

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical