openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Newbie question about ldif
by J. Bakshi 09 Jun '09

09 Jun '09

Dear all, greetings to all. Hope I have joined the right list to discuss about openldap technology. I am working with typo3 and openldap. Typo3 is a CMS ( content management system ) just like Drupal, Joomla etc.. I like to implement an openldap based system where I can have a organization based structure like department, company etc and can store persons with their name, address, contact along with userid/password which will be used to authenticate the front end user login in typo3. To start with I need a well designed ldif file. I have already get some example ldif from internet but those are missing the useris/password authentication. More over the " objectclass: organizationalPerson " " objectclass: inetOrgPerson " "objectClass: dcObject" "objectClass: organization" are very much confusing :-( Could any one kindly enlighten me a little about those "objectcalss" and which one is best suited for my requirement ? A sample ldif file with little explanation will help me a great. Thanks

3 5

Help with ACL's
by Tyler Gates 08 Jun '09

08 Jun '09

Hello, I'm having a hard time setting some ACL's for my particular setup. I have a structure as follows: dn: uid=*,ou=people,dc=example,dc=com # uid contains several unix/linux user ids dn: cn=*,ou=groups,dc=example,dc=com # cn contains several unix/linux groups. uid's (not the complete dn) are supplied to the memberUid fields What I would like to do is place an organizationalRole in each group and have ACL's setup so that it's uniqueMembers have access to certain attrs (say for example sn) for the uid's (which correspond to those in ou=people) specified in the memberUid fields of the group in which the organizationalRole is placed. psuedo code would be something as follows: access to group/posixAccount/memberUid.regex("cn=(.*),ou=groups,dc=example,dc=com") attrs sn by group/organizationalRole/uniqueMembers/.regex("cn=admin,cn=$1,ou=groups,dc=example,dc=com") write Thanks, Tyler

3 9

ldapi -> "Confidentiality required" problem
by Gunnar Frenzel 08 Jun '09

08 Jun '09

Hello, I've configured openldap (v2.4.16 on FreeBSD 7.2) to listen on ldaps (with self signed certificate) as well as ldapi. rc.cof: slapd_enable="YES" slapd_flags='-h "ldapi:///var/run/openldap/ldapi/ ldaps:///"' slapd_owner="ldap:ldap" slapd_sockets="/var/run/openldap/ldapi" slapd.conf: database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Manager,dc=mydomain,dc=com" rootpw password directory /var/db/openldap-data index objectClass eq security ssf=128 TLSCACertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/ssl/cert.key TLSVerifyClient never Connecting to ldaps (port 636) with clients such as Thunderbird, Apache Directory Studio works fine. But when I try to connect via ldapi (port 389) from a webmail tool on the same server I always get the error "Confidentiality required" from openldap. I want to connect to ldapi (as it is local on the server) without TLS or other encryption but openldap doesn't seem to allow that in my configuration. I tried localSSF set to 0 which doesn't make any difference... I'd be thankful for any advice with this issue. Best regards, Gunnar

3 6

openldap, bdb versions and performance issue
by jakjr 08 Jun '09

08 Jun '09

Hello Guys, Last week I upgraded our openldap server to 2.4.16 and we had terrible performance problems. Quanah suggested me to use this options with bdb compilation: --enable-posixmutexes --with-mutex=POSIX/pthreads I compiled and tested openldap with different versions of BDB and the results are odd: OpenLDAP version BDB version Test time 1 (seconds) Test time 2 (seconds) Test time 3 (seconds) 2.4.16 BDB 4.5.20 256.2008 260.5799 273.933 2.4.16 BDB 4.6.21 265.428 260.2496 255.0599 2.4.16 BDB 4.7.25 261.5573 254.2001 259.9456 2.3.30-5 (debian package) BDB 4.2.52 257.7173 251.3512 250.8456 The test consist on make some operations: for ($i=0; $i<=1; $i++) { make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); } Like you can see, the best result was using to old version of openldap server with the old version of BDB. Even more odd was the use of CPU. Using these old versions, the consume of CPU was half then using the new ones. The slapd.conf and DB_CONFIG were the same on all tests. Here are the compilation lines: BDB: CFLAGS="-Wall -g -O2" CPPFLAGS="-I/usr/include/tcl8.5" LDFLAGS="-lpthread" ../dist/configure --enable-cxx --enable-compat185 --enable-rpc --enable-tcl --enable-posixmutexes --with-uniquename --with-tcl=/usr/lib/tcl8.5 --with-mutex=POSIX/pthreads --enable-test Openldap: CFLAGS="-Wall -g -D_FILE_OFFSET_BITS=64 -O2" ./configure --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc --localstatedir=/var --mandir=/usr/share/man --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --enable-spasswd --enable-modules --enable-rewrite --enable-slp --enable-wrappers --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-meta=mod --enable-monitor=mod --enable-relay=mod --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc DB_CONFIG: set_cachesize 0 524288000 0 set_lk_max_objects 15000 set_lk_max_locks 15000 set_lk_max_lockers 15000 set_shm_key 5 slapd.conf: some index and cachesize 10000 idlcachesize 10000 Is there some wrong or these are the expected results ? I appreciate any tip. Best regards, João Alfredo

1 0

slapcat unable to make ldif file with size > 2GB
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am trying to create backup of database using slapcat. But as soon as .ldif file reaches size of 2GB, it is giving me an error of File Size Limit Exceeded and quitting the process. I am using bdb 2.3.43. Is there anything I can do about it? Regards, Mukim Pathan

3 4

CRL expired
by joakim＠comex.se 08 Jun '09

08 Jun '09

Hello, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all" in it. When the CRL has expired the client is not allowed to make an TLS connect. My question is whether it is possible to configure openldap to still let the client connect to the server (possibly with a warning) when the CRL has expired. Does anyone know if it is possible and of it can be achieved in that case? Regards, Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

1 0

Bind/search more than one tree and server
by Schneider, Thomas-P65851 05 Jun '09

05 Jun '09

I am seeking a solution to be able to bind to, and search more than one tree and server per request using Linux. My goal is to maintain separate groups of user accounts on an OpenLDAP server -- e.g. local and network. The groups of users can have overlapping posixAccount uid attributes, but will have unique uidNumber attributes. My main use case is authentication, which requires checking a remote LDAP server first -- currently AD which requires attribute re-mapping), then network tree on the local LDAP (openldap) if not in remote server, then the local tree on local server if not in the first tree. I have tried referrals and rewrites, but nothing I've tried worked. It looks like the creation of a custom overlay will work, but I'd rather not go down that path. I have also tried using PAM, but pam_ldap is limited to one configuration per service (modifying pam_ldap is an option at this point). Thanks, Craig

2 2

pool of Ldap-Directories
by alois blasbichler 05 Jun '09

05 Jun '09

Hello list I have this question - maybe somebody can give me a hint : I need a pool of Ldap-Directories (possible openldap, AD and other) where i can search for. The reason is : there are a lot of applications where can i get my users from one Ldap but where i cant define more Ldaps with different search bases. Is this possible for example with 2 different Openldap-Directories ? Thank you luis

3 3

Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral
by paulpierre.brun＠free.fr 05 Jun '09

05 Jun '09

Thanks for answer, With updateref after syncrepl slave slapd.conf syncrepl rid=000 provider=ldap://ldap-v000 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=mydomain,dc=mydomain2,dc=fr" attrs="*,+" bindmethod=simple binddn="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" credentials=secret updateref "ldap://ldap-v000/" master slapd.conf access to attrs=userPassword by dn="cn=Manager,dc=mydomain,dc=mydomain2,dc=fr" write by dn="cn=samba,dc=mydomain,dc=mydomain2,dc=fr" write by dn.base="cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr" write by self write by * none I have LDAP password information update failed: Referral passwd Changing password for user paul-pierre.brun. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Referral passwd: Permission denied Nothing in master ldap log In slave ldap log Jun 5 12:51:34 ldap-v002 slapd[18734]: conn=2 op=2 SRCH base="dc=mydomain,dc=mydomain2,dc=fr" scope=2 deref=0 filter="(&(objectClass=ipHost)(cn=ldap-v000))" Jun 5 12:51:35 ldap-v002 slapd[18734]: conn=2 op=2 SRCH attr=cn ipHostNumber Jun 5 12:51:35 ldap-v002 slapd[18734]: ==> limits_get: conn=2 op=2 self="[anonymous]" this="dc=mydomain,dc=mydomain2,dc=fr" Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_search Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_dn2entry("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access to "dc=mydomain,dc=mydomain2,dc=fr" "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_get: [1] attr entry Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: result not in cache (entry) Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: access to entry "dc=mydomain,dc=mydomain2,dc=fr", attr "entry" requested Jun 5 12:51:35 ldap-v002 slapd[18734]: => acl_mask: to all values by "", (=0) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=manager,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=samba,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: cn=replication_ldap,dc=mydomain,dc=mydomain2,dc=fr Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: self Jun 5 12:51:35 ldap-v002 slapd[18734]: <= check a_dn_pat: * Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] applying read(=rscxd) (stop) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= acl_mask: [5] mask: read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => slap_access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: => access_allowed: search access granted by read(=rscxd) Jun 5 12:51:35 ldap-v002 slapd[18734]: search_candidates: base="dc=mydomain,dc=mydomain2,dc=fr" (0x00000001) scope=2 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_dn2idl("dc=mydomain,dc=mydomain2,dc=fr") Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: OR Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa1 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [b49d1940] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read: failed (-30989) Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=0, first=0, last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=0 first=0 last=0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: AND Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_list_candidates 0xa0 Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:35 ldap-v002 slapd[18734]: => bdb_equality_candidates (objectClass) Jun 5 12:51:35 ldap-v002 slapd[18734]: => key_read Jun 5 12:51:35 ldap-v002 slapd[18734]: bdb_idl_fetch_key: [7ec2180d] Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_index_read 6 candidates Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_equality_candidates: id=6, first=15, last=21 Jun 5 12:51:35 ldap-v002 slapd[18734]: <= bdb_filter_candidates: id=6 first=15 last=21 Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_filter_candidates Jun 5 12:51:36 ldap-v002 slapd[18734]: EQUALITY Jun 5 12:51:36 ldap-v002 slapd[18734]: => bdb_equality_candidates (cn) Regards ----- Mail Original ----- De: masarati(a)aero.polimi.it À: "paulpierre brun" <paulpierre.brun(a)free.fr> Cc: openldap-technical(a)openldap.org Envoyé: Jeudi 4 Juin 2009 17h03:05 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: LDAP password information update failed: Server is unwilling to perform shadow context; no update referral > > Objet: LDAP password information update failed: Server is unwilling to > perform shadow context; no update referral > > > Hello, > I try to change password on customer, to a referal thru a overlay chain > config. > I have answer LDAP password information update failed: Server is unwilling > to perform. > OS REDHAT 5.2. > openldap openldap-2.4.16 > > could you help me ? The message looks pretty self explanatory. You don't post the whole config, so it's hard to tell, but the database the update is trying to modify should contain an "updateref" statement, and according to the error message this is not present. slapo-chain(5) can chain databases by chasing referrals only when referrals are returned. p.

1 0

create new ldap database query
by mukim pathan 04 Jun '09

04 Jun '09

Hi, I am trying to create new ldap database on new machine and I want to transfer full ldap database from old machine to new machine. Can I just transfer all the database files (.bdb,_db,alock) and expect new database to be at the same stage of old database?? Thanks in advance. Regards, Mukim Pathan

5 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical