openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

get_ava: illegal value with translucent proxy
by Petteri Heinonen 27 Jul '09

27 Jul '09

Hi, I've setup a translucent proxy. Now, I have tried to do some test searches. For example this works ok: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "OU=Users,OU=Department,DC=company,DC=com" "(givenName=Myname)" Search is proxied through proxy to the actual server, and correct result is returned. However, if I try this: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "OU=Users,OU=Department,DC=company,DC=com" "(objectClass=User)" I get no results. I have monitored the traffic between proxy and backend server, and the query is not even sent there. In OpenLDAP log there is: Jul 27 15:51:00 ldaptr01 slapd[17772]: begin get_filter Jul 27 15:51:00 ldaptr01 slapd[17772]: EQUALITY Jul 27 15:51:00 ldaptr01 slapd[17772]: get_ava: illegal value for attributeType objectClass Jul 27 15:51:00 ldaptr01 slapd[17772]: end get_filter 0 What would be the problem here? Regards, Petteri Heinonen

2 1

Problem - ldapadd invalid syntex (21)
by Bruno Steven 24 Jul '09

24 Jul '09

Hello I am newbie in use OpenLdap , I have simple problem I can´t add structure of tree directory, the file org.lidf show my structure dn: dc=labcom,dc=factory objectClass: top objectClass: dcObject #objectClass: organization dc: labcom o : Linuxtech When I type this command ldapadd -f /etc/openldap/lidfs/org.ldif -x -D "cn=adm,dc=labcom,dc=factory" -W Show this message error Enter LDAP Password: adding new entry "dc=labcom,dc=factory " ldapadd: Invalid syntax (21) Why this message error ? I have include the follow schemas include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema The process slapd have been started by user root, so haven´t problem of permission That is ... Thanks -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx

4 5

syncrepl and "no equality matching rule"
by Alain ZAMBONI 24 Jul '09

24 Jul '09

Hello, I run an LDAP directory on 3 servers : one master, and two slaves, synchronised with syncrepl. The 3 servers are running FreeBSD 7.0 and openLDAP 2.4.13. I encountered yesterday an issue with syncrepl that should have been solved with openLDAP 2.4.13 http://www.openldap.org/lists/openldap-software/200812/msg00040.html The synchronisation was blocking on the deletion of a facsimileTelephoneNumber. When the problem occured, the master entry was (only showing the facsimileTelephoneNumber attribute) : dn: uid=veinantep,ou=uds,ou=people,o=annuaire facsimileTelephoneNumber: 0388613347 And the slave entry was : dn: uid=veinantep,ou=uds,ou=people,o=annuaire facsimileTelephoneNumber: 0388612908 facsimileTelephoneNumber: 0388613347 The application doing the modification on the master is always using a "replace" operation, to avoid the "no equality matching rule" problem. It seems that syncrepl tries to synchronise the slave by generating the forbidden operation of deleting a precise facsimileTelephoneNumber. Is this problem known ? the release between 2.4.13 and 2.4.16 don't mentionned something about it. I managed to unlock the situation by completely deleting the "facsimileTelephoneNumber" on the master, then adding it again. The big problem of this little issue is that it is blocking all the synchronisation process between master and slaves ... By the way, is there a way to check the good state of the synchronisation with syncrepl (besides parsing the sync logs or doing recurring diff between the servers) ? I must admit that I miss slurpd's .rej files. Just in case, here are the log of one of the slaves : syncrepl_entry: rid=101 be_search (0) syncrepl_entry: rid=101 uid=veinantep,ou=uds,ou=people,o=annuaire bdb_modify: uid=veinantep,ou=uds,ou=people,o=annuaire bdb_dn2entry("uid=veinantep,ou=uds,ou=people,o=annuaire") bdb_modify_internal: 0x0001fc23: uid=veinantep,ou=uds,ou=people,o=annuaire <= acl_access_allowed: granted to database root bdb_modify_internal: delete facsimileTelephoneNumber bdb_modify_internal: 18 modify/delete: facsimileTelephoneNumber: no equality matching rule bdb_modify: modify failed (18) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=18 matched="" text="modify/delete: facsimileTelephoneNumber: no equality matching rule" null_callback : error code 0x12 syncrepl_entry: rid=101 be_modify (18) syncrepl_entry: rid=101 be_modify failed (18) Thanks, -- Alain ZAMBONI Direction Informatique Université de Strasbourg

2 2

access control
by Darryl Moore 24 Jul '09

24 Jul '09

I'm trying to set up access controls for the server. Here are the rules I am trying to impliment olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none olcAccess: {1}to dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none olcAccess: {2}to dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none olcAccess: {3}to dn.regex="cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=Admin,cn=$1,ou=Groups,dc=moores,dc=ca" write by group="cn=Management,ou=Groups,dc=moores,dc=ca" write by users read olcAccess: {4}to dn.base="ou=Groups,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {5}to dn.base="ou=People,dc=moores,dc=ca$" by group.exact="cn=Management,ou=Groups,dc=moores,dc=ca$" write by users read olcAccess: {6}to * by users read by * none - Basically I have groups, and within those groups I have Contact lists and administrators. I want the administrator to have write access, other members to have read access, and non members to have none. This rule is what I think should work for that: dn.regex="ou=Contacts,cn=([^,]+),ou=Groups,dc=moores,dc=ca$" by group.exact,expand="cn=$1,ou=Groups,dc=moores,dc=ca" write by * none I know this rule works for individual user contact lists: dn.regex="ou=Contacts,uid=([^,]+),ou=People,dc=moores,dc=ca$" by dn.exact,expand="uid=$1,ou=People,dc=moores,dc=ca" write by * none I think the problem I am running into is having the <who> field as group.exact,expand Can I not do this? If not, is there any way to acheive the same result? thanks, darryl

3 5

Dying LDAP process and TLS
by Florian Götz 24 Jul '09

24 Jul '09

Hello everybody, I got some two serious problems with my LDAP, maybe you got a hint for it. Problem 1 might have a connection to nr 2, but I´m not sure. I use OpenLDAP 2.4.12 on a SLES11 system. The initscript to start/stop the service called "rcldap" know 3 states: unused, running and dead. When I startup the LDAP it´s in state running. It takes about 10-15min, the LDAP doesn´t respond anymore and a "rcldap status" tells me that the service is dead. I have no clue why it behaves this way. The logs tell me, that the Backup-System fetches some data and then the log ends without any further notice. The pid file still exists, but the process is gone. Problem 2 has to do with TLS. I got the CA of our (sub)company, a certificate for the ldap-machine and the associated private key file. The certificate chain is: Deutsche Telekom Root CA -> Company CA -> Subcompany CA -> Certificate of LDAP machine. The certificate for the ldap machine seems to be generated with/by the Company CA. If I put these files into the slapd config with: TLSCACertificateFile /etc/openldap/certs/SubcompanyCA.pem TLSCertificateFile /etc/openldap/certs/ldapcert.pem TLSCertificateKeyFile /etc/openldap/certs/ldapprivkey.pem TLSVerifyClient demand and the following lines in the /etc/ldap.conf: TLS_CACERT /etc/openldap/certs/SubcompanyCA.pem TLS_REQCERT demand it crashes at the TLS certificate verification, because he can´t get the local issuer certificate. If I use the Company CAs in both places instead of the Subcompany CA it´s failing too. If I mix it up with the SubcompanyCA in the slapd.conf and the CompanyCA in the ldap.conf, the certificate verification succeeds, but I get a TLS trace: SSL3 alert read:fatal:handshake failure I don´t know how to handle that problem. -- Best regards, Florian Götz -----

2 1

Propagation of proxyAuthz control
by Javier Manteiga 24 Jul '09

24 Jul '09

Hi all, We are trying to set a system with the DIT split in several servers, using the Meta backend to proxy the LDAP requests among them. In the remote servers we would like to check the ACLs using the identity of the client that sent the request, instead of the identity used to create the proxy connections. For this we have configured the idassert parameters in the meta targets as follows: idassert-bind bindmethod=simple binddn="cn=manager,dc=operator,dc=com" (root user of the backend receiving the proxied query) credentials="manager" mode=self iddassert-authzFrom "dn:*" When the first proxy is made everything is OK. The proxyAuthz extension control is added to the LDAP message and the remote server behaves as expected. Our problem is that in some cases we have requests that must be proxied several times. E.g: consider a scenario with three servers in A, B and C. in which the LDAP request sent by the external client is received in A, this server proxies it to B. Finally B proxies it to C. When B tries to set the proxyAuthz control it detects that there is already one and it returns the error "proxyAuthz not allowed within namingContext". Is there anyway in which we can avoid this error and propagate the credentials of the external client to the last server?. Thank you very much for your help. Best regards. Javier Manteiga

2 1

ACL processing performance
by Christian Manal 24 Jul '09

24 Jul '09

Hi, I've got a question regarding ACLs and their processing performance. I use the NIS-schema to store userinformation and the likes in OpenLDAP (using the maps passwd, group, services, ethers, hosts, automount stuff etc.) plus samba-schema plus some self defined stuff. I have ACLs defined for some special attributes, like userPassword, and for each OU (People, Groups, ...). If I start multiple searches without a filter (so everythin accessible will be displayed) anonymously or with some user, I can get the CPU load of my servers up to 80-90%. It's definitely the ACLs, since I have no problems when using the rootDN or if I reduce the ACLs. What I'd like to know now is, what is so damn expensive in my ACLs and how I could reduce the cost without lessening the access restrictions... OpenLDAP version is 2.4.17 using back-hdb with BDB 4.4 from opencsw respository on Solaris 10 (SunOS 5.10 Generic_139556-08). There are around 30k entries in my database. I have one master and four slaves using delta-syncrepl for replication. Configuration files can be found here: http://www.informatik.uni-bremen.de/~moenoel/ldap/ Thanks in advance. Regards, Christian Manal

3 2

Use of syncprov overlay in slave
by rommel＠buxit.nl 24 Jul '09

24 Jul '09

I am wondering whether it is possible to use the syncprov overlay in the slave database? The configuration at hand consists of two masters in mirror-mode and n-replica's in syncrepl-mode. The client application connects to one of the replica's and attempt to use the SyncControl to monitor the replica for changes. Both the master's and replica's have been configured with 'overlay syncprov'. When the client application connects to one of the masters and a changes in made in the other master, the application gets notified about the change through the SyncControl. However when I connect the client application to one of the replica's and make a change in one of the master's the client does not get notified about the change. When I look into the replica database directly the change made on the master is visible though. So I'm wondering is it possible to use the syncprov overlay in the slave database? And what would be the correct configuration to achieve this? The version of openldap I'm using is 2.4.13 Any help is appreciated. /Rob

3 2

openldap and dadlauthd
by Olivier Nicole 24 Jul '09

24 Jul '09

Hi, I have problems to get saslauthd to work with my openldap server: - saslauthd binds/autneticates if I connect to the non SSL port ldap://ldap.cs.ait.ac.th/ - saslauthd fails to bind/autneticate if I connect to the SSL port ldaps://ldap.cs.ait.ac.th/ Jul 23 12:02:00 ldap slapd[41289]: conn=22 fd=19 ACCEPT from IP=192.41.170.50:62502 (IP=192.41.170.6:636) Jul 23 12:02:00 ldap slapd[41289]: connection_closing: readying conn=22 sd=19 for close Jul 23 12:02:00 ldap slapd[41289]: connection_close: conn=22 sd=-1 Jul 23 12:02:00 ldap slapd[41289]: conn=22 fd=19 closed (TLS negotiation failure) I really don't know where to look. TIA, Olivier

2 7

Help with slurpd referral error
by phamp008＠yahoo.com 23 Jul '09

23 Jul '09

Hi, I am new to Openldap + Keberos project. I am setting up slurpd from ldap1(master) to ldap2(replica). I am hopping someone can give me some suggestion to troubleshoot this. I ran into this error when slurpd attempt to add new DN to ldap2. This is the error when I run slurpd -d 4 begin replication thread for ldap2.test.domain:389 Initializing session to ldap2.test.domain:389 request done: ld 0x9b27778 msgid 1 bind to ldap2.test.domain as host/krbmaster.test.domain(a)TEST.DOMAIN via GSSAPI (SASL) request done: ld 0x9b27778 msgid 2 request done: ld 0x9b27778 msgid 3 request done: ld 0x9b27778 msgid 4 replica ldap2.test.domain:389 - add dn "uid=ppham4,ou=people,dc=test,dc=domain" request done: ld 0x9b27778 msgid 5 Error: ldap_add_s failed adding DN "uid=ppham4,ou=people,dc=test,dc=domain": Referral Error: ldap operation failed, data written to "/var/lib/ldap/replica/ldap2.test.domain:389.rej Here's the slapd.conf on ldap1(master) include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org disallow bind_simple #security tls=1 #require authc # Create a replication log in /var/lib/ldap for use by slurpd. # REPLICA: Comment this out on the replicas replogfile /var/lib/ldap/master-slapd.replog TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd1-cert.pem TLSCertificateKeyFile /etc/openldap/slapd1.key sasl-secprops noanonymous,noplain,noactive # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=domain # This should be a ^ plus, not a star, but slapd won't accept it # REPLICA: # On replica servers replace the first line of each section below (the # line that allows /admin principals to write to things) with the # following line (allowing the primary server to write instead). Thus # admins can make changes on the primary server, and the primary # server can push changes to the replicas. #by dn.exact="uid=host/foo.example.com,cn=GSSAPI,cn=auth" write # Users with /admin principals can change anything # Users can change their shell, anyone else can see it access to attrs=loginShell by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self read by * none # Default read access for everything else access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read sizelimit 5000 threads 8 loglevel 256 # Allow LDAPv2 for Mozilla's address book #allow bind_v2 database bdb suffix "dc=test,dc=domain" cachesize 10000 checkpoint 256 15 # Uncomment these only for the initial load, then comment them back # out and restart slapd. rootdn "cn=Manager,dc=test,dc=domain" rootpw Secret! # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial # REPLICA: Comment this out on replicas replica host=ldap2.test.domain:389 tls=critical bindmethod=sasl saslmech=GSSAPI authcId=host/krbmaster.test.domain(a)TEST.DOMAIN Here's the copy of my slapd.conf on replica ldap2 server: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema #referral ldap://root.openldap.org #pidfile /var/run/slapd.pid #argsfile /var/run/slapd.args # Create a replication log in /var/lib/ldap for use by slurpd. # REPLICA: Comment this out on the replicas #replogfile /var/lib/ldap/master-slapd.replog TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd1-cert.pem TLSCertificateKeyFile /etc/openldap/slapd1.key sasl-secprops noanonymous,noplain,noactive saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=$1,ou=people,dc=test,dc=domain access to attrs=loginShell by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write by self read by * none # Default read access for everything else access to * by dn.exact="uid=host/krbmaster.test.domain,cn=GSSAPI,cn=auth" write sizelimit 5000 threads 8 idletimeout 14400 loglevel 256 # Allow LDAPv2 for Mozilla's address book allow bind_v2 database bdb suffix "dc=test,dc=domain" # Increase the size of slapd's entry cache. Note that this is a cachesize 10000 checkpoint 256 15 # Uncomment these only for the initial load, then comment them back # out and restart slapd. rootdn "cn=Manager,dc=test,dc=domain" rootpw Secret! # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial # The purpose of the updatedn is to tell slapd not to send the updateref # if that DN tries to make changes. Any other user which attempts to # submit a change will be refered to the master LDAP server found in # updateref. # REPLICA: Uncomment these on replicas updatedn "uid=host/krbmaster.test.domain" updateref ldaps://ldap1.test.domain/ Greatly appreciate any help. Thanks Phil

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical