openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

RE:AW: Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 27 Apr '09

27 Apr '09

Actually, I do not have an ACL. Could you provide me further details for what I have to permit with the ACL. The log file of OpenLdapServer, when i execute the command "getent passwd on solaris" is the following: Apr 24 19:37:04 achilles slapd[22086]: conn=19 fd=10 ACCEPT from IP=10.0.0.25:33240 (IP=0.0.0.0:389) Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SRCH base="ou=people,dc=tesyd,dc=teimes,dc=gr" scope=2 deref=3 filter="(objectClass=posixAccount)" Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SRCH attr=cn uid uidnumber gidnumber gecos description homedirectory loginshell Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=0 SEARCH RESULT tag=101 err=32 nentries=0 text= Apr 24 19:37:04 achilles slapd[22086]: conn=19 op=1 UNBIND Apr 24 19:37:04 achilles slapd[22086]: conn=19 fd=10 closed I have not declare the ou=people somewhere and i do not understand the searching on "ou=people,dc=tesyd,dc=teimes,dc=gr". any suggestion would help From: claus.kick(a)siemens.com To: poly_pan78(a)hotmail.com Date: Thu, 23 Apr 2009 16:06:21 +0200 Subject: AW: Problem to Authenticate Users with openLDAP on Solaris 9 Do you have an ACL in place in order to allow binding to read the ldap data? Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von panagiotis polychronopoulos Gesendet: Donnerstag, 23. April 2009 15:04 An: openldap-technical(a)openldap.org Betreff: Problem to Authenticate Users with openLDAP on Solaris 9 hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance Δείξτε το στιλ σας με μια εικόνα στο Messenger. Δείτε τις όλες. Κάντε κλικ εδώ! Δείξτε το στιλ σας με μια εικόνα στο Messenger. Δείτε τις όλες. Κάντε κλικ εδώ! _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 1

bdb_equality_candidates warning
by Gustavo Mendes de Carvalho 27 Apr '09

27 Apr '09

Hi there, I have an OpenLDAP server version 2.3.39, and recentrly (I mean, since last friday) I noticed some delay when athenticating against LDAP base. I got this messages in ldap.log file Apr 27 15:46:39 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:46 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:48 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:54 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:53 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:56 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed Apr 27 15:46:58 ldap01 slapd[4445]: <= bdb_equality_candidates: (uniqueMember) not indexed This is my slapd.conf related to indexes ####################################################################### # Indexes ####################################################################### index objectClass eq,pres index uid,memberUid eq,pres,sub I already checked for duplicate entries in ldif file, but I got nothing. Does anybody has some tip about it ? Which entry do I have to index to avoid this message ? Is there any way to find out which index is it caliming for ? Thanks in advance -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

2 1

Re: slapd_db_archive log rotation
by Andrew Hall 27 Apr '09

27 Apr '09

Thanks for the reply Quanah. On 2009/4/25 Quanah Gibson-Mount wrote: > you fail to note what release you are using of OpenLDAP or BDB. There were > known issues with some earlier releases failing to checkpoint correctly. OpenLDAP 2.3.28 I've no idea the version of BDB - how would I find this out ? > You also fail to note your checkpoint parameter in slapd.conf. There doesn't seem to be a checkpoint setting in either slapd.conf or the DB_CONFIG file. Should there be ? > Also, rather than manually deleting logs, you can set BDB up to do it for you. See the > various options that can be set in DB_CONFIG. Yes, this can be specified with DB_LOG_AUTO_REMOVE but I wish to backup the log files before I remove them which is why I wish to do this manually.

2 3

Filter very strange problem for matching values
by Denis BUCHER 26 Apr '09

26 Apr '09

Hello everyone, I have a very strange problem with openldap... * Strange because it used to work and without reason (no update, no change in config) it suddently stopped to work * Strange because I have the correct configuration as far as I know * Strange because when I do tests, the results are illogical ! The problem is simple to explain, a filter doesn't work as expected ! The filter is : (&(objectclass=CourierMailAccount)(mail=%u)(accountStatus=active)) which mean find all object being : * in class CourierMailAccount * email is %u (this is replaced dynamically) * accountStatus is active The first two criteria are working, the problem is with accountStatus (if I remove this criteria it suddently works). PROBLEM : 1. if "accountStatus" is not present in my filter : it works 2. "accountStatus=active" => NO RESULTS ??? 3. "accountStatus=*" => RESULTS I tried in phpldaptadmin web interface, same problem : 1. "accountStatus=active" => NO RESULTS ??? 2. "accountStatus=*" => RESULTS In my schemas the config is : attributetype ( 1.3.6.1.4.1.7914.1.2.1.12 NAME 'accountStatus' DESC 'The status of a user account: active, noaccess, disabled, deleted' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) Is therefore the problem with caseIgnoreIA5Match ? But this seems correct according to many web pages like http://www.zytrax.com/books/ldap/ape/qmail.html And it always worked before... Any help would be greatly appreciated because I don't see where the problem comes from ? (Maybe some index problem ???) Thanks a lot in advance Denis

2 1

slapd_db_archive log rotation
by Andrew Hall 25 Apr '09

25 Apr '09

Hi there. I'm using slapd_db_archive with the -a flag to identify BDB logs which can be safely deleted. I've recently noticed my logs are building up and -a does not produce any output. However the -l flag does successfully list the log files. Therefore any use of the -d flag to remove them does nothing. I'm almost certain these old logs are not being used (there's about 20 going back for several months now) but still slapd_db_archive does not pick up on them. Can anyone advise what may be happening here or how I can debug this further ? Thanks very much.

2 1

openldap as slave server to windows AD
by Aleksander Kamenik 24 Apr '09

24 Apr '09

Hi, This is my first experience with ldap, there are lots of different approaches to configuring openldap and I'm a bit lost. I'm about to setup a windows domain server with AD for some 50 windows pc's. The windows pc's will use the windows server directly and that's settled. However I also have lots of different services running on linux servers which require the same user authentication and could be configured to use ldap based authentication instead of each having their own account database. It's a hassle to maintain accounts for each service separately. Also, if the windows server should be unavailable, I'd still like to be able to login and use the services running on linux servers. So I imagine having openldap act a slave server (like in DNS) the for the windows active directory service's "User" space. Is this possible and which configuration path should I take? The manual mentions proxy configurations as well as something called chaining. Please point me to the correct chapter and any other hints are appreciated. Regards, -- Aleksander Kamenik System Administrator Krediidiinfo AS an Experian Company Phone: +372 665 9649 Email: aleksander(a)krediidiinfo.ee http://www.krediidiinfo.ee/ http://www.experiangroup.com/

2 1

Missing CSN in do_syncrep2 cookie log line
by Sean Burford 24 Apr '09

24 Apr '09

Hi, I'm new to 2.4 (2.4.16) and I don't know if empty CSNs are expected. The provider restarted and the syncrepl consumer kept sync, however part way through the reconnection the consumer got an empty CSN and decided to do an additional reconnect. This may be a side effect of the provider running 2.3.39. The provider has a syncrepl accesslog and an auditlog that both agree with the CSNs below (no changes were skipped by the sync). The accesslog database has syncprov-nopresent and syncprov-reloadhint set to TRUE. The main database has these values set to FALSE (syncprov-reloadhint will be toggled to TRUE shortly on the main database). At 13:20:42 username1 has an attribute removed. The change is replicated at that time. This is the last entry replicated before the provider is shut down: do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xf966560 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0x155621b8 20090424132042Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username1,dc=example,dc=com (0) slap_queue_csn: queing 0xd2f6cf8 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0xec0a758 20090424132042Z#000000#00#000000 At 13:25:18 slapd on the syncrepl provider is shut down and the consumer notices: do_syncrep2: rid=100 (-1) Can't contact LDAP server do_syncrepl: rid=100 rc -1 retrying At 13:26:12 slapd on the replication provider is restarted. The consumer connects 6 seconds later and receives the same attribute delete again (I assume it isn't an entry delete since there are no entry deletes in the hours bracketing this log): do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100* do_syncrep2: cookie=csn=,rid=100* do_syncrepl: rid=100 rc -1 retrying At 13:27:18 slapd on the replication consumer reconnects and receives the same attribute delete again before continuing normal replication a little later when another user is modified: do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 do_syncrep2: cookie=csn=20090424133119Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xc9fdb67 20090424133119Z#000000#00#000000 slap_graduate_commit_csn: removing 0xf610488 20090424133119Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username2,dc=example,dc=com (0) -- Thanks, Sean Burford

2 1

synrepl delete over 90% of ldap entries
by Monika Strack 24 Apr '09

24 Apr '09

Hallo all, in this week, the syncrepl in RefreshOnly mode has delete over 90% of the ldap entries at the consumer. It is the secont time in last month, it make this mistake. The other time it work ok. After I have remove the database and slapd restart, all entries are back. The consumer is my mailserver, so no user can receive mail in the time his entries are removed. I work with debian, at the consumer with lenny and slapd 2.4.11-1 and at the Provider with entch and slapd 2.3.30-5+etch2 . I use gosa 2.5.16 to adminstrate ldap. Here are the log entries of the consumer: Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064823Z#000003#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae7069c0 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72dc78 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete uid=nutzera,ou=people,ou=arbgrp,ou=abt,ou=my,o=domain,c=de (0) : : slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 33fdb48e-c28c-102d-9d8a-c5d1aca5fa09 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=tz,o=fal,c=de Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_add (0) Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064845Z#000000#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae715640 20090421064845Z#000000#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae702e40 20090421064845Z#000000#00#000000 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 8b82805e-0867-102b-8021-e9137c6ded0b Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=mygrp,ou=groups,ou=my,o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_modify (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421065817Z#000003#00#000000,rid=101 Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5d17de-0867-102b-9fad-e9137c6ded0b, dn c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5e5f86-0867-102b-9fb0-e9137c6ded0b, dn o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5ed024-0867-102b-9fb2-e9137c6ded0b, dn ou=my,o=domain,c=de : (90% of ldapr entries) pr 21 08:58:45 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72cf50 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=my,o=domain,c=de (0) : (90% of entries) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete ou=my,o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete c=de (66) Apr 21 08:58:46 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:46 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xb4d03ff0 20090421065817Z#000003#00#000000 I now, that the logs no show errors, but why can the consumer say no entry found and delete. My colleague has delete 3 user, this change was made right and the al the other entriies are delete. How can I prevent this in the future? The configurations: Provider: slapd 2.3.30-5+etch2 Config: .... moduleload back_bdb moduleload syncprov : : # Fuer syncreply index entryCSN,entryUUID eq : overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: slapd 2.4.11-1 (lenny) Config: ..... index entryCSN,entryUUID eq : : syncrepl rid=101 provider=ldaps://ldap.my.local:636 type=refreshOnly searchbase="c=de" retry="60 10 300 3 600 +" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,ou=my,o=domai,c=de" credentials=ReSumpti0n regards Monika -- ________________________________________________________________________________ Monika Strack Institut fuer Nutztiergenetik Friedrich-Loeffler-Institut 31535 Neustadt e-mail: monika.strack(a)fli.bund.de Germany Tel: +49 5034 /871 154 Fax: +49 5034 /871 239 _______________________________________________________________________________

2 1

invalid credential
by owen nirvana 24 Apr '09

24 Apr '09

debian lenny openldap-2.4.11 , "rootpw 123456 " in /etc/ldap/slapd.conf I try to search in Apache Directory Studio, perl , java, but in term , I input "ldapsearch -D "cn=admin.dc=xxx,dc=org" -b "dc=xxx,dc=org" "(objectClass=*)" -W echo: >> Digest/SASL MD5 start invalid credential I am not user md5 password, and it's not right even if I use md5 password. I don't know how to configure slapd.conf to solve the problem gtalk:freeespeech@gmail.com

3 2

how to paginate the dataset from ldap
by owen nirvana 24 Apr '09

24 Apr '09

I'm a newbie, sometime a query might get hundreds of data from the LDAP server, I could not find a way to display these data by paginating, thanks for help gtalk:freeespeech@gmail.com

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical