openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

slapd + gssapi/heimdal: using false realm in principal
by Friedemann Stoyan 30 Apr '09

30 Apr '09

Hello, I struggle with an Debian GNU/Linux (Lenny) and * slapd 2.4.11-1 * heimdal-kdc 1.2.dfsg.1-2.1 * libsasl2-modules-gssapi-heimdal 2.1.22.dfsg1-23 With this configuration: /etc/ldap/slapd.conf: # Kerberos Configuration sasl-host kerberos.lab.swapon.de sasl-realm LAB.SWAPON.DE # Mapping Kerberos Authentication Identities authz-regexp uid=([^,]*),cn=lab.swapon.de,cn=gssapi,cn=auth ldap:///ou=people,dc=lab,dc=swapon,dc=de??one?(&(uid=$1)(objectClass=person)) /etc/ldap/sasl2/slapd.conf: mech_list: GSSAPI log_level: 7 Then I get a kerberos ticket and start ldapsaerch: $ ldapsearch -H ldaps://ldap.lab.swapon.de/ SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) The slapd logfile isn't very helpfull: slapd[11480]: conn=2 fd=14 ACCEPT from IP=[2001:6f8:12ec:11::389:fefe]:60487 (IP=[2001:6f8:12ec:11::389:fefe]:636) slapd[11480]: conn=2 fd=14 TLS established tls_ssf=128 ssf=128 slapd[11480]: conn=2 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" slapd[11480]: conn=2 op=0 SRCH attr=supportedSASLMechanisms slapd[11480]: conn=2 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[11480]: conn=2 op=1 BIND dn="" method=163 slapd[11480]: SASL [conn=2] Failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) slapd[11480]: conn=2 op=1 RESULT tag=97 err=80 text=SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) slapd[11480]: conn=2 fd=14 closed (connection lost) The KDCs logfile is more interesting: Authentication Server Request from slapd (successfull): 14:37:13 AS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB.SWAPON.DE(a)LAB.SWAPON.DE 14:37:13 Client sent patypes: encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp 14:37:13 Looking for PKINIT pa-data -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE 14:37:13 Looking for ENC-TS pa-data -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE 14:37:13 ENC-TS Pre-authentication succeeded -- host/reliant.lab.swapon.de(a)LAB.SWAPON.DE using aes256-cts-hmac-sha1-96 14:37:13 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, des3-cbc-md5, arcfour-hmac-md5, des-cbc-md5, des-cbc-md4, des-cbc-crc 14:37:13 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96 14:37:13 AS-REQ authtime: 2009-04-27T14:37:13 starttime: unset endtime: 2009-04-28T00:37:13 renew till: unset 14:37:13 sending 670 bytes to IPv6:2001:6f8:12ec:11::88:fefe Ticket Granting Server Request from slapd (fails): 14:37:13 TGS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for digest/LAB(a)LAB.SWAPON.DE [canonicalize] 14:37:13 Searching referral for LAB 14:37:13 Server not found in database: digest/LAB(a)LAB.SWAPON.DE: No such entry in the database 14:37:13 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 TGS-REQ host/reliant.lab.swapon.de(a)LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB(a)LAB.SWAPON.DE 14:37:13 Server not found in database: krbtgt/LAB(a)LAB.SWAPON.DE: No such entry in the database 14:37:13 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe 14:37:13 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe It's clear that this TGS-REQ is failing: the realm "LAB" in the principal "krbtgt/LAB(a)LAB.SWAPON.DE" doesn't exist. Correct would be: "krbtgt/LAB.SWAPON.DE(a)LAB.SWAPON.DE". At present I have no clue how to fix this. Good ideas would be appreciated. Regards Friedemann

1 1

RE: CSN Too Old potential Bug
by Victor Andres Sina Sotomayor 30 Apr '09

30 Apr '09

Hi all I was reading this post in openldap-technical forum. I am in the process to install a full authenticate service here using samba and openldap, my pdc and bdc are ldap based servers, and are in different locations, using a router to connect them, then. a full master ldap is needed in these two locations. I have two ldap servers in mirror mode (in a virtual machines, using vmware), these two servers are time synchronized using the same time server. When a update a ldap entry in one server, the data replicate fine, but when I use the other, I have the following error in my logs. Apr 29 11:50:15 srvped2master slapd[7377]: do_syncrep2: cookie=rid=002,sid=002,csn=20090429165015.624045Z#000000#001#000000 Apr 29 11:50:15 srvped2master slapd[7377]: do_syncrep2: rid=002 CSN too old, ignoring 20090429165015.624045Z#000000#001#000000 The time is very difficult to maintain in sync when virtual machines are in use, and Openldap servers are extremely sensitive to time lag. Apparently this is a bug in ldap 2.4.11 and will be fixed in ldap 2.4.16 <http://www.openldap.org/lists/openldap-bugs/200903/msg00202.html> http://www.openldap.org/lists/openldap-bugs/200903/msg00202.html Anyone could solve the problem? Im using debian lenny srvped2master:/etc/ldap# apt-cache policy slapd slapd: Installed: 2.4.11-1 Candidate: 2.4.11-1 Version table: *** 2.4.11-1 0 500 http://ftp.us.debian.org lenny/main Packages 100 /var/lib/dpkg/status This is my slapd.conf ################# serverID 1 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=avhlima,dc=edu,dc=pe" rootdn "cn=admin,dc=avhlima,dc=edu,dc=pe" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 syncrepl rid=001 provider=ldap://192.168.4.8 type=refreshAndPersist retry="60 +" searchbase="dc=avhlima,dc=edu,dc=pe" attrs="*,+" bindmethod=simple binddn="cn=admin,dc=avhlima,dc=edu,dc=pe" credentials=XXXXXXXXXXXX mirrormode on index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub lastmod on checkpoint 512 30 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn="cn=admin,dc=avhlima,dc=edu,dc=pe" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=avhlima,dc=edu,dc=pe" write by * read ########################## The diff between servers are only in: serverID 2 syncrepl rid=002 provider=ldap://192.168.3.8 Thanx 4 your time Victor

3 2

openldap on windows
by singularity suse 29 Apr '09

29 Apr '09

How do I set openldap running on my windows xp machine. I edited the conf fie, but it doesn't work. Thanks

1 0

backing up openldap using slapcat automatically
by hariharan＠thehindu.co.in 29 Apr '09

29 Apr '09

1 0

Ldap error: Logging region out of memory; you may need to increase its size
by vaibhav lokhande 29 Apr '09

29 Apr '09

Hi all , I am new in world of ldap. following is info about my ldap. *openldap-2.4.11-1.3.el5 openldap-servers-2.4.11-1.3.el5 nss_ldap-253-3 compat-openldap-2.4.11_2.3.27-1.3.el5 openldap-clients-2.4.11-1.3.el5 php-ldap-5.1.6-5.el5 openldap-devel-2.4.11-1.3.el5* And m getting error on command slapcat * bdb(o=******_ldap): Logging region out of memory; you may need to increase its size bdb_db_open: database "o=******_ldap": db_open(/var/lib/ldap/id2entry.bdb) failed: Cannot allocate memory (12). backend_startup_one: bi_db_open failed! (12)* *Can any one please guide me to solve this issues. Other things are working fine. But still m getting this error. Regards Vaibhav *

1 0

Adapt memberof overlay for host attribute
by Vince Rafale 29 Apr '09

29 Apr '09

Hi list, I would like to know whether anybody has succeeded in using the memberof overlay for others attributes. I would like a user entry (specifically the host attribute) to be populated when a user is added to a posixGroup. Let's say this posixGroup contains a "hostOfGroup" attribute. Is it feasible? Or do I need to code my own overlay for that purpose? If writing an overlay is not needed, is there an esaier way to do that? Thanks. Regards, Vince

4 5

getting distinguishedName as a distinct attribute in seach result
by Erik De Zeeuw 29 Apr '09

29 Apr '09

Hello, We need to get a line with "distinguishedName: <dn>" in our search results, in order for a specific software to work with our LDAP setup. I tried to play around with rwm-map and rewrite, but could not find a solution to get this working. To be clear, I would like to get this as a search result: dn: uid=myuser,ou=people,dc=my,dc=suffix givenName: My User ... other attributes ... distinguishedName: uid=myuser,ou=people,dc=my,dc=suffix ... other attributes ... I know this might not be standard, and it indeed looks quite stupid as we already get the dn: line, but this seems to be the way it works when using active directory, and software we bought just wait for this to work. Thanks for any constructive answer that will popup :)

2 1

Segfault during Auth Benchmark request
by SAGNIMORTE Thomas (CAMPUS) 28 Apr '09

28 Apr '09

Hi, I am working on building and benchmarking OpenLDAP v2.4.16 for a large entries directory (actual test: 2 000 000 but final objective 10 000 000 users). I use SLAMD to test authentication in order to evaluate what is the maximum number of authentication I can do on my server. So I try to do 5 authentications per 5ms during 5min. My OpenLDAP 2.4.16 is install on the X86 two core 2.8Ghz server with 4Go of memory. I set 3Go in cache of DB_Config and I have look a lot on how configure properly slapd. Is it normal because I have reach system limits or can I change some parameter to optimize slapd performance? Do some people have some figures about slapd performance with large entries directory on standard server? Regards, --- Thomas

3 11

cannot rename back-sql tables
by Matthew Hallsworth 28 Apr '09

28 Apr '09

Hi list, I have searched far and wide for a solution to this but cannot find anywhere where it is possible to configure back-sql as such. I am trying to interface openldap with a MySQL backend using the standard back-sql configuration, with one exception - every 'ldap_*' prefixed table needs to be named 'custom_ldap_*' as we are trying to fit in LDAP support into an existing product which requires the additional tables to make this work to conform with existing schema. What I've found is, I can get the LDAP requests working perfectly via a test database using standard 'ldap_*' notation, but I cannot for the life of me get the system to handle different table names properly. My config file, "/etc/openldap/slapd.conf", on CentOS 5.2 shows the following: <snip> # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. #allow bind_v2 loglevel -1 logfile /var/log/ldap.log # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib64/openldap # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: moduleload back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # sql definitions for mysql access ####################################################################### database sql dbname ldaptest readonly on suffix "dc=rams,dc=com,dc=au" dbuser ldaptest dbpasswd abc123 subtree_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" children_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM custom_ldap_oc_mappings" at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM custom_ldap_attr_mappings WHERE oc_map_id=?" has_ldapinfo_dn_ru no lastmod off ####################################################################### # ldbm and/or bdb database definitions ####################################################################### #database bdb #suffix "dc=my-domain,dc=com" #rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM </snip> Now, when I run "/usr/sbin/slapd -d -5" and attempt to do a general query on the ldap server using "ldapsearch -x -b 'dc=rams,dc=com,dc=au'" I get the following feedback from openldap: <snip> # extended LDIF # # LDAPv3 # base <dc=rams,dc=com,dc=au> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 </snip> And, the debug output displays: <snip> ... ==>backsql_search(): base="dc=rams,dc=com,dc=au", filter="(objectClass=*)", scope=2, deref=0, attrsonly=0, attributes to load: all ==>backsql_get_db_conn() ==>backsql_open_db_conn(3) daemon: epoll: listen=8 active_threads=0 tvp=NULL <==backsql_open_db_conn(3) backsql_open_db_conn(3): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_dn2id("dc=rams,dc=com,dc=au") matched expected backsql_dn2id("dc=rams,dc=com,dc=au"): id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" backsql_dn2id("dc=rams,dc=com,dc=au"): id=1 keyval=1 oc_id=1 dn=dc=rams,dc=com,dc=au >>> dnPrettyNormal: <dc=rams,dc=com,dc=au> <<< dnPrettyNormal: <dc=rams,dc=com,dc=au>, <dc=rams,dc=com,dc=au> <==backsql_dn2id("dc=rams,dc=com,dc=au"): err=0 ==>backsql_id2entry() backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="organizationalUnit" attr="objectClass" keyval=1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM ldap_entry_objclasses,ldap_entries,company WHERE company.id=? AND ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entries.keyval=company.id and ldap_entries.oc_map_id=1' Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entry_objclasses' doesn't exist" <==backsql_id2entry() ==>backsql_oc_get_candidates(): oc="inetOrgPerson" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '2' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" ==>backsql_oc_get_candidates(): oc="organizationalUnit" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '1' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" send_ldap_result: conn=3 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=80 ber_flush: 14 bytes to sd 9 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... conn=3 op=1 SEARCH RESULT tag=101 err=80 nentries=0 text= ... </snip> In summary, I feel that there is some kind of missing configuration variable either in documentation or tutorials online that really doesn't allow you to fully specify alternate table names for the default 4 main tables in the back-sql implementation. If this is due to the backend being experimental then so be it - however I really need some kind of quantified 'yes' or 'no' as to whether what I'm trying to achieve is possible at all. TIA Matthew Hallsworth

1 0

Re: bdb_equality_candidates warning
by Gustavo Mendes de Carvalho 28 Apr '09

28 Apr '09

Hi Quanah, I included this field to be indexed in ldap database, and after ldap restart I can't see this message anymore. Thanks for while. Gustavo 2009/4/27 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Monday, April 27, 2009 3:59 PM -0300 Gustavo Mendes de Carvalho < > gmcarvalho(a)gmail.com> wrote: > > Hi there, >> >> I have an OpenLDAP server version 2.3.39, and recentrly (I mean, since >> last friday) I noticed some delay when athenticating against LDAP base. >> >> I got this messages in ldap.log file >> >> Apr 27 15:46:39 ldap01 slapd[4445]: <= bdb_equality_candidates: >> (uniqueMember) not indexed >> > > Does anybody has some tip about it ? Which entry do I have to index to >> avoid this message ? Is there any way to find out which index is it >> caliming for ? >> > > Seems pretty clear to me. The log clearly states that the attribute > "uniqueMember" is not being indexed. Your index statements in slapd.conf > agree with that. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical