openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

ldapadd: Invalid syntax (21)
by François Mehault 24 Apr '09

24 Apr '09

Hi All I am a novice with openldap. I just install on a freeBSD 7.0 with ports. I configure slapd.conf as best as i can. I configure rc.conf, I test my slapd daemon with slapdtest and it's ok. I start slapd with /usr/local/etc/rc.d/slapd start. Well, I create a little .ldif file to test. And I add at my database with : ldapadd -x -D "cn=root,dc=toto,dc=fr" -W -f test.ldif And I have : Enter LDAP Password: adding new entry "dc=toto,dc=fr" ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax The content of my test.ldif : dn: dc=toto,dc=fr objectClass: dcObject objectClass: organizationUnitName ou: test dc: toto My slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #Radius include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema schemascheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel 4 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb #Basic ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=root,dc=toto,dc=fr" write by * none access to * by dn="cn=root,dc=toto,dc=fr" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=toto,dc=fr" rootdn "cn=root,dc=toto,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}ERk1pX08CCoUT2Hixj/kR9Zx8NpJmx+0 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data # Indices to maintain index objectClass eq Why I can't add my ldif ? If someone can help me, thanks If I put organisation instead of organisationalUnit in my ldif, it works ! (and o instead ou of course) Regards François

3 3

Re: Setting up LDAP server
by Santosh Balan 24 Apr '09

24 Apr '09

Hi, My Server is a RHEL 5.0 i386 Architecture and the Clients are RHEL5.0 WS or RHEL4 WS or Thin Client which has minimal installation of Linux. I need information how those schemas will look and what data will it have. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Thu, 23 Apr 2009 11:15:04 +0100 On Thu, Apr 23, 2009 at 02:41:58AM -0500, Santosh Balan wrote: > I am on the look out for free support and advise. I have implemented a > basic LDAP server such that it authenticates for my mail server. However > this time I have been given a project wherein my LDAP works as an > authentication server for user login as well as mails. Also it should > have policies while authentication viz. it should disable USB ports for > the user, it should set a background wallpaper and screensaver which > should start within 20 secs. of the PC's idle time. It should also if > possible mount automatically a partition which will be user dependent > rather that PC dependent. You do not say what operating system you are using. I think you need to start by looking at the mechanisms available on the target OS to implement these policies. This is much more of an OS issue than an LDAP one. For example, with most Linux distros you can use PAM and NSS modules to link authentication and authorisation to LDAP. Solaris has similar mechanisms, and the *BSD systems too (but they are not identical). I suspect that you will do better to ask about this in OS-specific groups or mailing lists. Controlling the wallpaper and screensaver will require configuration of the window system: Gnome, KDE and MSWindows all have ways to do this but they are different. It may be possible to link them to LDAP-hosted policies, but again you need to look at the mechanisms first. You cannot just setup some data in an LDAP server and expect it to magically control user desktops. Once you have identified some control mechanisms you will be able to look at the way they interact with LDAP. This may require new schema, which this group certainly is qualified to discuss. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Syncrepl connections failing
by John Kane 24 Apr '09

24 Apr '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

editing objects with back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

While trying to understand the whole process that makes back-sql work, the following quote was really useful: Pierangelo Masarati wrote on Fri, 4 Jun 2004 16:03:39 +0200 > I'm talking about 2.2.X (2.2.11 at present). > > - slapd uses the structuralObjectClass of the entry to look up the > objectClass mapping according to ldap_oc_mappings; > - it does some sanity checks (I'll discuss these later) > - it checks for the existence of the entry's parent > - it uses the ldap_oc_mappings create_proc to create the objectClass > entry in ldap_entries > - then, for each attribute, the corresponding values are inserted if > possible. I'll discuss later how to decide whether an add should succeed > or not if some (required?) attribute mapping is not available; now I > really have to go :) Q1: Is this process still correct and is there more documentation around this process? Q2: What is the process for editing or remove data? When I add an OU, the ldap_entry_objclasses shows the oc_name of the OU object to be 'top', while the ldap_entries table shows the oc_map_id to be that of organizationalUnit. When I now try to edit the name of this object, I get the following error, which I get as well on trying to edit any other object: Could not rename the entry / Could not perform ldap_modify operation. LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass. Any clue what that could be? Marcel

2 1

Problem to Authenticate Users with openLDAP on Solaris 9
by panagiotis polychronopoulos 23 Apr '09

23 Apr '09

hi to everyone, I try to permit solaris 9 box to authenticate users with openLDAP Server. But I can not get access to "/etc/passwd" of LDAP Server. I have configured the solaris system as LDAP client with "ldapclient" command and I confirmed with the "ldapclient list" that give us the following: root@foivos:/> ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=Manager,dc=tesyd,dc=teimes,dc=gr NS_LDAP_BINDPASSWD= {NS1}5e10c25544515e26 NS_LDAP_SERVERS= 10.0.0.221 NS_LDAP_SEARCH_BASEDN= dc=tesyd,dc=teimes,dc=gr NS_LDAP_AUTH= simple NS_LDAP_SEARCH_SCOPE= sub NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I also updated the /etc/nsswitch.conf but I still not get access to /etc/passwd file of LdapServer. It is checked by "getent passwd" Please, .any help would be appreciated Thanks in advance _________________________________________________________________ Έχετε Messenger; Έχετε και Windows Live. Μάθετε περισσότερα. http://www.microsoft.com/windows/windowslive

1 0

Comparable and replaceable fax numbers
by Sean Burford 23 Apr '09

23 Apr '09

Hi, On my servers I've redefined facsimileTelephoneNumber as a telephoneNumber: attributetype ( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SUP telephoneNumber ) This requires reimporting the database since the normalisation changes, but it adds comparison rules to fax numbers (allowing comparison and replacement of them): Before: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== Compare Result: Inappropriate matching (18) Additional info: inappropriate matching request UNDEFINED After: ldapcompare -x uid=person1234,dc=example,dc=com facsimiletelephonenumber::KzEoNTU1KS01NTUtNTU1NQ== TRUE Is there any reason to follow the RFC in this case? The RFC itself doesn't make a good argument for or against fax numbers having a separate syntax with no matching rules. -- Thanks, Sean Burford

4 7

entryCSN and back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

Am I correct in my understanding that 'entryCSN' is updated on every change to an object in order for the replication process to work properly? In a back-sql implementation, I do not see this attribute stored in the database but when requesting the internal attributes of objects i do get the 'entryCSN' back. however, the value changes every time I do the request. Can I assume correctly that 'entryCSN' is not being stored and is therefore of no real use when using back-sql and is only being shown to comply with the LDAP standards? Is it possible to store this attribute in the database by defining it and creating the SQL functions to update it? (same question for creatorsName, createTimestamp, modifiersName, modifyTimestamp, etc) -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

1 0

Re: Setting up LDAP server
by Santosh Balan 23 Apr '09

23 Apr '09

Hi Team, I am on the look out for free support and advise. I have implemented a basic LDAP server such that it authenticates for my mail server. However this time I have been given a project wherein my LDAP works as an authentication server for user login as well as mails. Also it should have policies while authentication viz. it should disable USB ports for the user, it should set a background wallpaper and screensaver which should start within 20 secs. of the PC's idle time. It should also if possible mount automatically a partition which will be user dependent rather that PC dependent. I hope your getting the picture for which i require your assistance. This is the first time I am working on such a setup. I would appreciate your valuable help and guidance in resolving and setting up an LDAP server as per requirement. Thanking you in advance for your guidance. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Wed, 22 Apr 2009 11:09:40 +0100 On Wed, Apr 22, 2009 at 03:05:56AM -0500, Santosh Balan wrote: > Can anyone help me on implementing and configuring LDAP server to > authenticate users with system policies and auto mount a user's partition > provided to him. Also, I want it to authenticate qmail users using LDAP. Are you looking for paid support? Several of us on this list are in the business of determining client requirements then designing and building solutions to fit, so I am sure you would get offers if you were to ask for that service. On the other hand, if you want free advice then I think you will have to do more of the basic research yourself so that you can ask more specific questions. There are lots of papers and guides on the web that will help to get you started. Here is a pointer to some of mine: http://www.skills-1st.co.uk/dir/ Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Adding OU with PSQL backend
by Marcel Berteler 23 Apr '09

23 Apr '09

For a project that requires a large user authentication database, we are currently using OpenLDAP with a BDB backend. We have about 150K users in the tree and all works well. Authentication and new user creation is fast and we are happy. But, when we try and get statistical data from the tree, we run into the limitations of LDAP: trying to find all user that have registered last month, using a filter with 2 dates, is just too slow. It takes minutes to come back with a result. To get around this limitation, we want to experiment with a PSQL backend so we can do some comparative testing. (If any of you have a way of allowing us to interrogate our BDB backend with SQL like queries that are relatively fast, than please let me know.) Our test environment: openldap 2.4.16 with Postgres backend I have loaded CORE in slapd.conf as well as our custom schema for our users The only ACL in the conf is ACCESS TO * BY * WRITE Our tree looks like this and I have loaded the data tables and meta-data tables: dc=example,dc=come ou=people,dc=example,dc=com cn=user1,dc=example,dc=com The setup is working about 60%. with openLdapAdmin, I can see the tree and I can add users. What I can not do, is add an OU. It gives me: LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation. If I get this on our custom schema, I can explain this by not having the right meta-data and procedures loaded. But as this is part of the CORE schema, am I right in only adding the meta-data for OU in ldap_attr_mappings without add or delete procedures? I have looked at the log files and outputs but I can not figure out what is going wrong and why it is not accepting any new OU Any help is appreciated. -- Regards, Marcel Berteler *Chief Information Officer */"May the source be with you"/ Website: http://www.bdsolutions.co.za Email Legal Notice: http://www.bdsolutions.co.za/legal/

7 16

just curious
by Piotr Wadas 22 Apr '09

22 Apr '09

Hello, I've been trying past weeks upgrading my production openldap software. I started from 2.4.11 when it was available, through all available versions, up to 2.4.16. I tried package builds, and my own builds. Each version except 2.4.10 was likely to hang, as it's production, and load is quite high, I haven't too much patience to debug and researching what's actually going on, but I tried disabling syncrepl (no effect), some different settings for bdb backend and slapd thread, concurrency etc ( starting from settings which caused no problems with 2.4.10 ), and finally, got back to 2.4.10 which works fine. Between version change I noticed that 2.4.11+ is build with newer libdb versions (package depends), starting from libdb4.2 (2.4.10), up to libdb4.7 (newer openldap version). I didn't try to build 2.4.15+ with some old (4.2) libdb. Is it some major significant jump between 2.4.10 and all later versions? some general rewrite of some feature ? It's not syncrepl related, as daemon hang no matter whether configured as slave or standalone. The symptoms was, it was (in general) producing BIGGER server load than 2.4.10, and, although daemon process did not segfaults, server stopped responding for requests (?). With higher load I wasn't able to try logging and use of debug symbols. I expected it will work without any slapd.conf, anyway nor leaving it untouched, nor some minor reasonable changes had no effect. So, what's going on? :) Is it possibly related to libdb ? or what? What else could it be ? Except libdb ( 5 different versions available in my system with one default, usually newest ), there was no other software change, just upgrading openldap/libldap. Any clues you may have? I'm sorry I cannot provide more information, anyway config is rather standard and simple, some custom schemas added with indexing, that's all. 2.4.10 has no problems at all, and significantly lower general machine load. ( if 2.4.10 = 100%, 2.4.11+ makes 300-400% ) Actually I'm not expecting some miracle explanation, anyway it's interesting what could it be.. I have about 25 000 entries total in my directory tree, it's used as NSS source, and other information for various applications. regards :) P.

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical