openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

TLS vs. MirrorMode replication
by Maros Timko 20 Apr '09

20 Apr '09

Hi all, we use OpenLDAP 2.4.11 on CentOS 5 for OS user PAM authentication in Xen-based HA cluster of 2 nodes. We are using MirrorMode replication so that databases are synchronised if change occurs on any node and there is no issue if one node goes down - each node maintains its own database. We use non-TLS local LDAP access (127.0.0.1) on Dom0 and TLS from virtual machines to LDAP. As soon as LDAP replication is set up in non-TLS way, everything works fine. But we are trying to set up TLS also for replication to bring more security into the system. However, it seems like there is a principial issue here - one cannot specify client access config for local access and for remote replication at the same time. Or can we? If we define client config to use TLS for the peer, then each local request goes to peer node. If the peer is down, the request will fail and user cannot log in into the OS. It looks like syncrepl requires client configuration to the peer. We tried to use "start_tls" option in syncrepl section but we still fail to connect to peer node. From the replies on the list I assume, TLS options in syncrepl section are just supposed to overwrite default settings, not to specify explicit option for it. Questions: - Is it possible to use local LDAP database locally together with TLS-enabled replication in a cluster? - Is anybody running such or similar setup successfully? - What would you suggest, if it is not possible? Thanks

2 1

Integration
by A Gilmore 19 Apr '09

19 Apr '09

Hello, I have a technical hurdle to overcome and I'm hoping openldap is the answer. I have contacts in a sql db, I'm wanting to make them available in outlook, blackberries, and other clients such as thunderbird. What I'm currently thinking is to setup an openldap server and import the data into that. I'm not expecting much trouble getting the data into LDAP. But how much effort/time is normally involved in the actual implementation of hooking these devices/applications to an openldap directory so non-technical users can use it? If anyone else has done this, how did it go? Has it been 'quirky'? I've read over the FAQ and what google offers, it seems mostly dealing with overcoming specific technical issues, I haven't found much on how well it works overall. Thank you for your time, - Adrien

2 2

Compile module for pwdCheckQuality
by Dat Duong 19 Apr '09

19 Apr '09

Does anyone have good luck on compiling a module like check_password.so for pwdCheckQuality? Also, what are the configuration for check_password.conf ? I'm having a harding time compiling the cracklib using check_password Makefile. Anyone have for the Makefile? What is the -lcrack ? # Comment out this line if you do NOT want to use the cracklib. # You may have to add an -Ldirectory if the libcrak is not in a standard # location # CRACKLIB_LIB=-lcrack

1 0

Context CSN not updated on OpenLDAP 2.3.11
by Adrien Futschik 17 Apr '09

17 Apr '09

Hy everyone ! I am facing a major issued for the second time with OpenLDAP 2.3.11. I am aware it is a pretty old version of OpenLDAP, but, it has been working in production for almost a year now without any problem. Here is the setup : Master -> Slave For some strange reason, the contextCSN stops updating and therefore the Slave is not updated anymore. The strange thing is that the Master continues to successfully update/add data ! We are using a OpenLDAP 2.3.11, Berkeley DB 4.4.16 & OpenSSL 0.9.8a all running on Solaris 10. Restarting the master solved the problem once, but now that it as failed again, I am very woried, because, restarting isn't a solution, considering that the application is in production. Please see in attachement the configuration files for Master & Slave. I have no log on the master, and only "syncrepl logging" on the slave. We consider restarting the master with "enable all logging" to see if wee can grab some informations.... Is this a bug of OpenLDAP, BerkleyDB or something else ? Thanks in advance, Adrien Futschik

4 11

lda_msgfree causing aborting program
by Santosh Kumar 16 Apr '09

16 Apr '09

Hi everyone,Using ldap_msgfree() needs after ldap_result() , as per man page it is to be used, is resulting in abort , but using the same after search result is working fineldap_init(ldap_host, LDAP_PORT))ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version)id = ldap_simple_bind(ld, root_dn, root_pw) //  ldap_perror(ld, "ldap_set_option");  printf("My ID=%d\n",id);result = ldap_result(ld, id, 1, NULL, &msg);    printf("Ldap_Result=%d\n",result);result = ldap_result2error(ld, msg,  1);    printf("Ldap_Result2error=%d\n",result); ldap_msgfree(msg);Output:ldap_bind: Success (0)My ID=1Ldap_Result=97Ldap_Result2error=0ldap_search_async: io.c:190: ber_free_buf: Assertion `((ber)->ber_opts.lbo_valid==0x2)' failed.Is there a way to get around while seeing the fucnction implemeted  ldap_msgfree() is calling ber_free_element() , which checks BerElement is it valid .in the above program it goes to invalid  this causing program to abort , does removing this check causes problem , i'm not aware about the importance of the check. ThanksSantosh Kumar9881481468

1 0

Fax can't have equality index?
by Min 16 Apr '09

16 Apr '09

Hello, I have the fax in my sldap.conf as the following: index facsimileTelephoneNumber eq,pres,sub index telephoneNumber eq,pres,sub But slaptest will report error as: equality index of attribute "facsimileTelephoneNumber" disallowed slaptest: bad configuration file! Any help will be appreciated. Thanks,

2 1

problem with a lot of databases in openldap 2.3
by Patrick Kaufmann 15 Apr '09

15 Apr '09

Patrick Kaufmann schrieb am 06.04.2009 14:13 Hi, We experience some serious problems with our openldap. We got about 50 databases in our openldap. If I now request single databases everything works fine until I request the 30st database. >From there on every database which I haven't already requested will just return an internal error. After some further investigation I finally figured out that the bdb backend somehow has some problems. If I start the sldap with d -1 I get following error: bdb_locker_id: Not enough space(12) We use openLDAP 2.3 together with DBD 4.2.52 Whole error message: daemon: activity on 1 descriptor daemon: activity on: 4052r daemon: read activity on 4052 daemon: select: listen=1912 active_threads=0 tvp=NULL connection_get(4052) connection_get(4052): got connid=0 connection_read(4052): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 35 02 01 6e 63 30 04 05..nc0. ldap_read: want=47, got=47 0000: 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 2e 63 68 .o=test.domain 0010: 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e 01 01 00 ................ 0020: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. ber_get_next: tag 0x30 len 53 contents: ber_dump: buf=086F29D8 ptr=086F29D8 end=086F2A0D len=53 0000: 02 01 6e 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 ..nc0..o=test.ma 0010: 69 6c 34 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 il4.ch.......... 0020: 02 01 1e 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c ........objectcl 0030: 61 73 73 30 00 ass0. ber_get_next ldap_read: want=8 error=Unknown error daemon: activity on 1 descriptor daemon: waked daemon: select: listen=1912 active_threads=0 tvp=NULL do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=086F29D8 ptr=086F29DB end=086F2A0D len=50 0000: 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 c0..o=test.mail4 0010: 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e .ch............. 0020: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0030: 30 00 0. >>> dnPrettyNormal: <o=test.domain> => ldap_bv2dn(o=test.domain,0) <= ldap_bv2dn(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 <<< dnPrettyNormal: <o=test.domain>, <o=test.domain> SRCH "o=test.domain" 0 0 1000 30 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=086F29D8 ptr=086F29FE end=086F2A0D len=15 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=086F29D8 ptr=086F2A0B end=086F2A0D len=2 0000: 00 00 .. attrs: conn=0 op=109 SRCH base="o=test.domain" scope=0 deref=0 filter="(objectClass=*)" ==> limits_get: conn=0 op=109 dn="[anonymous]" => bdb_search bdb_locker_id: err Not enough space(12) send_ldap_result: conn=0 op=109 p=3 send_ldap_result: err=80 matched="" text="internal error" send_ldap_response: msgid=110 tag=101 err=80 ber_flush: 28 bytes to sd 4052 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error ldap_write: want=28, written=28 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error conn=0 op=109 SEARCH RESULT tag=101 err=80 nentries=0 text=internal error Any help is appreciated. Thanks Patrick Patrick Kaufmann Softwareentwicklung Hauptsitz: Hardstrasse 72 CH - 5430 Wettingen Tel. +41 56 437 80 40 Fax + 41 56 437 80 59 pkaufmann(a)zubler.ch<mailto:pkaufmann@zubler.ch> www.zubler.ch<http://www.zubler.ch> [cid:aussenstelle.jpg]

3 10

OpenLDAP and "reverse" wildcards
by Kjell Gustafsson 15 Apr '09

15 Apr '09

Hi I have a somewhat strange question. We are using OpenLDAP (openldap-server-2.4.11-bdb) and Berkley DB (db-4.6.21) in a project. LDAP is used to store subscribernumbers and the address of the ippbx where the subscriber is registered. Typically every subscriber have a separate DN in the LDAP-database. We have a serverfunction that do ldap-searches for subscribernumbers to retrieve the ippbx-address. This part is going to remain working as is. Now we want to be able to have a "wildcard"-entry in LDAP, that points to an address also. This entry shall respond to any ldap-search matching the wildcard. Let me give an example: We have, let's say four ippbx's with prefixes 111, 222, 333 & 444. A subscriber- number consist of the prefix and five more digits. Each subscriber can be registered in any ippbx and still be reachable. The prefix indicates the subscribers "home-location". Now we want to use a gateway to another telephone-system. We don't want to have all of the subscribers from that system registered in LDAP, so we want a "wildcard"-entry saying that if you dial 99912345 LDAP should have an entry 999xxxx pointing to the gateway for the subscribers in the other telephonesystem. The response to the ldap-search should contain the the gateway address to the telephone-system regardless of the number entered. So if I dial 99912345 I should get the same response as if I dial 99967890. The response shall have the same format as in the ippbx-solution. We want the ldap DIT to look the same for the wildcard and the others - the DN shall look the same. We don't want to change the serverfunction we are using today. So - finally my question: Would it be possible to solve this with OpenLDAP and if so - how can it be done? Looking forward to your suggestions! /Kjell

3 5

Re: search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Pierangelo Masarati 14 Apr '09

14 Apr '09

----- "Daniel" <deepee(a)gmx.net> wrote: > Hi slapd-Gurus out there, > > using the search filter "(test=TRUE)" results in: "candidates not > indexed". The cause for the below slapd trace output seems clear to > me: > In fact there is no entry in my bdb backend existing with an attribute > > description "test" present... > > => bdb_filter_candidates > EQUALITY > => bdb_equality_candidates (test) > <= bdb_equality_candidates: (test) not indexed > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=-1 first=1 last=430 > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=25 first=141 last=430 > <= bdb_filter_candidates: id=25 first=141 last=430 > bdb_search_candidates: id=25 first=141 last=430 > => test_filter > EQUALITY > => access_allowed: search access to "dc=foo,dc=bar" "test" requested > <= root access granted > => access_allowed: search access granted by manage(=mwrscxd) > <= test_filter 5 > bdb_search: 141 does not match filter > > > In regard to the above slapd-trace I've the following question: > Could someone please be so kind and tell me whether there exists a > possibility to search (filter) for "dynamic" (calculated) attribute > values, that do not get stored in a backend (in my case bdb)? Idea: An > > overlay should calculate a dynamic attribute's value based on already > > existing attribute values of an entry each time this dynamic attribute > > is searched for using a filter-statement, e.g. > '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. > > First of all I had a quick look into slapo-collect's sources. The > collective attributes seem to be added dynamically to an entry but the > > collected attributes are not "filterable". I think the reason is that > > slapo-collect operates on the response/slapreply and that's to late in > > the overlay's processing queue... > > Then I thought of something similar to the operational attribute > "hasSubordinates" - this attribute's value is filterable and seems (at > > least sounds) to be dynamically evaluated. On the other hand I'm not > sure whether "hasSuborinates" is dynamically calculated each time an > entry get's searched or accessed. Perhabs the value of > "hasSubordinates" > is only be calculated in case the entrys' childrens get modified and > (thus seldomly) updated within the backend, which could be the reason > to > be search- and filterable?! > > Last but not least I tried to implement a small test-overlay using a > custom search-callback that updates the dynamic "test" attribute > within > the bdb-backend: Imagine an (very simple/stupid) overlay that for > example set a custom attribute named "test" to "TRUE" in case an > entry's > attributes "givenName" and "sn" both contain at least one value. ;-) I > > know, that the filter "(&(givenName=*)(sn=*))" would do the trick but > > the example is just a simple scenario for me to step into > overlay-processing details. > > If I use attr_merge() within the search-callback to store the dynamic > > test attribute's value "TRUE" or "FALSE" within the entry the search > succeeds without problems - I mean the filter (test=TRUE) get's > processed ok. > > So my questions still left is: > Do I always have to store/update the dynamic attribute's calculation > result value within each entry (in the backend) or is there another > posibility that allows filtering for the calculated attribute's value, > > while getting rid of the store and update overhead within the > backend? > > Hopefully this is no hen egg problem concerning the internal > processing > order of filters, candidates, entries, etc. Using dynamically computed attrs in a search filter and pretending it to ber indexed is an oxymoron. If you intend to allow it, you need to be prepared to intercepting the search operation and doing the candidate collection yourself. I don't recall any overlay or so that does it and that could be used as an example, simply because it makes little sense. In any case, the problem can be solved, but the solution may not be trivial and require a fair amount of coding. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

2 2

Modifying password by user
by Franck Royer 14 Apr '09

14 Apr '09

Hi, I'm installing openldap on a ubuntu intrepid server (8.10). Everything is ok except when I want that a user is able to modify his own password using phpldapadmin (0x32 LDAP_INSUFFICIENT_ACCESS). So I tried to modify it using ldappasswd : dante@kollok ~ $ ldappasswd SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) or dante@kollok ~ $ ldappasswd -D "uid=dante,ou=people,dc=kollok,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) The posix user dante is the same user than the ldap one (I use pam libs). And I know that my password is right cause I can log in ldapadmin or ssh with it. My slapd.conf : http://pastebin.com/f44dd2b59 My ldap.conf : http://pastebin.com/f3af1bec3 Any idea ? Cheers, Franck Royer

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical