openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

create new ldap database query
by mukim pathan 04 Jun '09

04 Jun '09

Hi, I am trying to create new ldap database on new machine and I want to transfer full ldap database from old machine to new machine. Can I just transfer all the database files (.bdb,_db,alock) and expect new database to be at the same stage of old database?? Thanks in advance. Regards, Mukim Pathan

5 6

log files and recovery
by mukim pathan 04 Jun '09

04 Jun '09

Hi all, I am unable to understand the answers for following question which i got on net. This might be naive questions but I really need to know the answers. 1. why does ldap write log files and what are its content? 2. why does ldap go through all log files during recovery? Thank you in advance. Regards, Mukim pathan

2 2

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by masarati＠aero.polimi.it 04 Jun '09

04 Jun '09

> > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 04 Jun '09

04 Jun '09

Objet: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral Hello, I try to change password on customer, to a referal thru a overlay chain config. I have answer LDAP password information update failed: Server is unwilling to perform. OS REDHAT 5.2. openldap openldap-2.4.16 could you help me ? Thanks Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral passwd: Permission denied Master conf ldap-v000 ---------------------- overlay syncprov syncprov-checkpoint 100 10 # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none Slave conf ---------- overlay chain chain-uri ldap://ldap-v000/ chain-idassert-bind bindmethod=simple binddn="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" credentials=secret mode=self flags=non-prescriptive # allow the world read access access to * by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * read # restrict userPassword for authentication only, allowing changes by user #access to dn.subtree="ou=Aliases,dc=mydomaine,dc=mydomaine2,dc=fr" by * read access to attrs=userPassword by dn="cn=Manager,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn="cn=samba,dc=mydomaine,dc=mydomaine2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomaine,dc=mydomaine2,dc=fr" write by self write by * none

1 0

openldap login issues
by Serge Fonville 04 Jun '09

04 Jun '09

Hi, I'm new to ldap, so please be gentle ;-) I have a box running CentOS 5.3 wit OpenLDAP 2.3.43. When I run getent passwd fo0072 (which is my username), this was advised as a check I get nothing. when I su - fo0072 as root, it logs in as expected, when I try to login trough GDM I get a invalid username/passwd error when I press CTRL-F1 and login to the console it logs on without any trouble. This suggests to me thatt there is something wrong in my config, but I checked everything, but could not find it. I'll post the necessary config files and ldifs when requested Any help is greatly appreciated. Thanks in advance. Regards, Serge Fonville

2 3

OpenLDAP support for DIT Structure Rules
by James Lentini 04 Jun '09

04 Jun '09

The OpenLDAP FAQ http://www.openldap.org/faq/index.cgi?_highlightWords=structure&file=1474 and TODO file http://www.openldap.org/devel/cvsweb.cgi/doc/devel/todo?hideattic=1&sortbyd… indicate that OpenLDAP does not currently support DIT Structure Rules. Is this correct? -james

7 11

LDAP service doesn't start
by Emanuele Gesuato 03 Jun '09

03 Jun '09

Hi there, We are using OpenLDAP 2.2.29 (the full name of the setup is "openldap-2.2.29-db-4.3.29-openssl-0.9.8a-win32_Setup.exe") for a large number of Windows 2000 oses with service pack 4. Often, it happens that the openldap service doesn't start and in the event log i can see the error code "21". Right now i can solve the problem reinstalling openldap and it works but i would like to know the cause of the problem (if any) and if there is another way to solve it. Maybe it is a dumb question but is it possible to retrieve the dump of ldap if the service doesn't start ? Thanks for any help, Emanuele Gesuato

3 2

Adding a attribute of a new schema to an existing entry
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Hi everyone. I'm trying to add a attribute of a new schema to an existing entry. I've created the schema called 'owlco' (I've remove almost fields to concision): ---------------------------------------------------------------------- attributetype ( 1.3.6.1.4.1.4203.666.0.1 NAME 'owlChurchNumber' DESC 'Church Number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) attributetype ( 1.3.6.1.4.1.4203.666.0.2 NAME 'owlSupernatural' DESC 'You wouldn't understand' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{8} ) ... objectclass ( 1.3.6.1.4.1.4203.666.1.1 NAME 'owlco' DESC 'Classe utilizada pela Owl Corporation' SUP inetOrgPerson STRUCTURAL MUST ( owlChurchNumber ) MAY ( owlDevotes $ owlSupernatural ) ) ---------------------------------------------------------------------- And I've added the schema: ---------------------------------------------------------------------- include /etc/openldap/schema/owlco.schema ---------------------------------------------------------------------- So, before all that actions I've created my whole directory and now I have all the entries without some mandatory owlco's fields (mandatory not to LDAP but to my business). So, now I'm trying: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber owlChurchNumber: 3212 And I've got: ---------------------------------------------------------------------- ldap_modify: Object class violation (65) additional info: attribute 'owlChurchNumber' not allowed ---------------------------------------------------------------------- Ok, absolutely normal. My schema depends on inetorgperson. So... ---------------------------------------------------------------------- dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: owlco # ldapmodify: wrong attributeType at line 4, entr ---------------------------------------------------------------------- I didn't stop on that try, I've tried a lot more combinations without success. I've read the 'http://www.zytrax.com/books/ldap/ch5/', specially the topic 'To add a new AUXILIARY objectclass to an existing entry requires'. dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify objectclass: inetorgperson objectclass: owlco But all I get is: ldapmodify: modify operation type is missing at line I'm stuck on that... Yep, I've tried too: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: objectclass objectclass: inetorgperson objectclass: owlco And: dn: uid=holykid,ou=saints,dc=clouds,dc=heaven,dc=god changetype: modify add: owlChurchNumber objectclass: inetorgperson objectclass: owlco owlChurchNumber: 2342 But... got nothing... []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Adding a attribute of a new schema to an existing entry - FIXED
by alexander＠nautae.eti.br 02 Jun '09

02 Jun '09

Ok, I think I got it. I was using a 'SUP inetOrgPerson STRUCTURAL' to my new scheme. So, when I've changed to 'SUP top AUXILIARY' I finally could add my new attributes. I think it's because ldapmodify was trying to modify the structural object to my entry and it's impossible (just at creation time). So, here's my ldif (it's working): dn: uid=unicorn,ou=ground,dc=dinosaurs,dc=jurassic,dc=history changetype: modify add: objectClass objectClass: oilCorporation - add: oilCorporationTypeOfThing oilCorporationTypeOfThing: withcandle []'s Alexander Brazil - Rio de Janeiro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

'unary operator expected' error when TLS turned on
by John Kane 02 Jun '09

02 Jun '09

I've also posted this message on the OpenSSL forum: I just turned on TLS on my LDAP (per instructions on http://www.openldap.org/faq/data/cache/185.html). Now all of my Linux servers (RH EL5) give the following error on login: -bash: [: =: unary operator expected The error goes away when I turn TLS off. I cannot determine what is causing this error, or even which file contains the error. I've gone through my LDAP config files, cannot find an issue in any of these. Other than my cacert.pem, and the LDAP config files, are there other files that are read only when TLS is turned on? Thanks, John I am running Openldap 2.3.43-2.el5 & OpenSSL 0.9.8b-10.el5 (RPMs from Red Hat, which I am required to use unless I put up a BIG fight). ++++ Here's my configs ++++ I turn on TLS by adding the following in my /etc/ldap.conf (pam/nss file): ssl start_tls tls_checkpeer yes tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts/ and have the following in my /etc/openldap/ldap.conf (openldap file): HOST 172.25.3.97 BASE dc=example,dc=net TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow and my (self-signed) cacert: [root@serverx cacerts]# openssl x509 -text -in /etc/openldap/cacerts/cacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Validity Not Before: May 28 04:37:13 2009 GMT Not After : May 27 04:37:13 2012 GMT Subject: C=US, ST=Utah, O=Bigtime CA, OU=Signers, CN=Integration Root CA/emailAddress=john.smith(a)myco.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:b3:bf:f0:18:5d:7e:57:0a:ce:15:3c:28:2a:81: 6d:e6:c5:31:98:7e:cc:09:03:d2:28:f2:33:3e:88: 11:5f:7d:e1:18:33:38:7d:f5:fa:9d:89:a8:95:16: 08:00:81:08:29:ac:37:b3:b1:2b:f3:20:52:15:d7: 19:44:92:9c:45:e7:2e:58:fe:7e:07:d4:1f:5a:ad: 59:91:37:84:14:a8:4e:df:54:a2:62:66:38:9b:f0: cf:48:01:68:0d:3a:7c:93:83:02:48:e0:76:a1:5c: f9:05:3b:49:1e:03:9a:fd:ea:ee:79:f7:87:66:96: b0:69:39:e1:e6:1a:bd:9e:0d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C X509v3 Authority Key Identifier: keyid:0B:FB:7D:0B:0D:17:A3:CD:79:02:A3:A3:92:57:15:6F:DE:38:07:3C Signature Algorithm: sha1WithRSAEncryption 28:52:3d:9c:90:d1:89:00:d7:9d:3b:06:a6:32:28:e8:c0:8d: 9d:5a:0b:79:bb:1a:c9:1a:8d:c6:3a:a5:ec:5d:4c:9f:20:4c: c6:1e:41:df:7d:d5:fc:45:09:2b:4b:7c:ff:38:aa:ea:33:a0: 4a:be:7c:84:7c:58:e8:98:9b:c9:0e:4b:5b:11:c6:28:84:b1: 3f:bb:30:03:f6:38:40:9f:2d:32:bc:3a:97:b8:6f:fd:aa:9f: 67:a6:27:07:53:b2:40:41:86:b7:02:f2:6b:07:6f:1b:74:87: 63:3b:1b:89:13:08:cb:32:f0:3c:3b:5e:d6:df:e3:91:19:86: 7a:d4 -----BEGIN CERTIFICATE----- MIIDDzCCAnigAwIBAgIBADANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UERhMCVVMx DjAMBgNVBAgTBVRleGFzMRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdT aWduZXJzMRwwGgYDVQQDExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcN AQkBFhtqb2huLmthbmVAcHJvZGVhc3lzdGV3cy5jb20wHhcNMDkwNTI4MDQzNzEz WhcNMTIwNTI3MDQzNzEzWjCBjjELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFz MRMwEQYDVQQKEwpCaWd0aW1lIENBMRAwDgYDVQQLEwdTaWduZXJzMRwwGgYDVQQD ExNJbnRlZ3JhdGlvbiBSb290IENBMSowKAYJKoZIhvcNAQkBFhtqb2huLmthbmVA cHJvZGVhc3lzdGVtcy5jb20wgZ8wDQYJKoZIhvcNAQE1BQADgY0AMIGJAoGBALO/ 8BhdflcKzhU8KCqBbebFMZh+xAkD0ijyMz6IEV994RgzNX31+p2JqJUWCACBCCms N7OxK/MgUhXXGUSSnEXnLlj+fgfUH1qtWZE3hBSoTd9UomJmOJvwz0gBaA06fJOD AkjgdqFc+QU7SR4Dmv3q7nn3h2aWsGl54eYavZ4NAgMBAAGjezB5MAkGA1UdEwQC MAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRl MB0GA1UdDgQWBBQL+30LDRejzXkCo6OSVxVv3jgHPfAfBgNVHSMEGDAWgBQL+30L DRejzXkCo6OSVxVv3jgHPDANBgkqhkiG9w0BAQUFAAOBgQAoUj2ckOGJANedOwam MijowI2dWgt5uxrJGo3GOqXsXUyfIEzGHkHffdD8RQkrS3z/OKrqM6BKvnyEfFjo mJ7JDktbEcYohLE/uzAD9jhAny0yvDqXuG/9qp9npicHU7JAQYa3AvJrB28bdIdo OxuJEwjLNvA8O17W3+ORGYZ61A== -----END CERTIFICATE----- This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical