openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Practices : DN filtering alternatives
by Lorenzo Pastrana 09 Jun '09

09 Jun '09

I've been reading (and actually experienced) that DN, not being a full class attribute, is not filterable (read : with wildcards / patterns). I've been thinking about 'duplicating' the DN in an attribute since the hidden 'entryDN' attribute is not accessible either but that sounds ugly and redundant to me. If there is a commonly used alternative to filtering DNs I'd be glad to hear. Thanks. Lorenzo Pastrana R&D Head @ Happy End -------------------------- Web Shop Multimédia Design Visual Communication & Publishing -------------------------- Tél.: +33 1 42 47 83 09 Fax.: +33 1 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

4 4

Problems with replication (syncrepl, syncprov)
by Florian Götz 09 Jun '09

09 Jun '09

Hi everybody, i got two OpenLDAPs (2.4.12) running. One providing the syncrepl Overlay and one the syncprov. The LDAP system is used for user authentication over a samba server. I created a user "backup" with all the rights to see all parts of the DIT of the primary ldap. If I connect to the primary with this user I can see all entries. The sync-configuration used on both machines is attached at the end of this mail. Now I got the following problem that only the ou´s group and users get syncronized on the backup machine. The rest like "computers" and other ou´s don´t get replicated, so I don´t get a full backup of the primary LDAP. Can someone help me with the config? I think the one attached should work, but ... :) Mit freundlichen Grüßen Florian Götz Primary LDAP ===================== # Provide Backupdata for second machine overlay syncprov syncprov-checkpoint 10 2 syncprov-sessionlog 100 Backup LDAP ====================== # Backup from primary LDAP syncrepl rid=1 provider=ldap://x.x.x.x binddn="uid=backup,ou=Users,dc=example,dc=de" bindmethod=simple credentials="*********" searchbase="dc=example,dc=de" filter="objectClass=*" type=refreshAndPersist retry="5 10 30 +" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6569 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Uncategorized exception
by mukim pathan 09 Jun '09

09 Jun '09

Hi, I am getting following exception while i am doing search using spring-ldap. org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' Caused by: javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at javax.naming.directory.InitialDirContext.search(Unknown Source) at org.springframework.ldap.core.LdapTemplate$4.executeSearch(LdapTemplate.java:230) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:272) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:234) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:548) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:532) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:383) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:406) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:424) I don't see any reason for this as everything was working fine and suddenly this exception came. Can you tell me any reason for this? Regards, Mukim Pathan

2 1

Newbie question about ldif
by J. Bakshi 09 Jun '09

09 Jun '09

Dear all, greetings to all. Hope I have joined the right list to discuss about openldap technology. I am working with typo3 and openldap. Typo3 is a CMS ( content management system ) just like Drupal, Joomla etc.. I like to implement an openldap based system where I can have a organization based structure like department, company etc and can store persons with their name, address, contact along with userid/password which will be used to authenticate the front end user login in typo3. To start with I need a well designed ldif file. I have already get some example ldif from internet but those are missing the useris/password authentication. More over the " objectclass: organizationalPerson " " objectclass: inetOrgPerson " "objectClass: dcObject" "objectClass: organization" are very much confusing :-( Could any one kindly enlighten me a little about those "objectcalss" and which one is best suited for my requirement ? A sample ldif file with little explanation will help me a great. Thanks

3 5

Help with ACL's
by Tyler Gates 08 Jun '09

08 Jun '09

Hello, I'm having a hard time setting some ACL's for my particular setup. I have a structure as follows: dn: uid=*,ou=people,dc=example,dc=com # uid contains several unix/linux user ids dn: cn=*,ou=groups,dc=example,dc=com # cn contains several unix/linux groups. uid's (not the complete dn) are supplied to the memberUid fields What I would like to do is place an organizationalRole in each group and have ACL's setup so that it's uniqueMembers have access to certain attrs (say for example sn) for the uid's (which correspond to those in ou=people) specified in the memberUid fields of the group in which the organizationalRole is placed. psuedo code would be something as follows: access to group/posixAccount/memberUid.regex("cn=(.*),ou=groups,dc=example,dc=com") attrs sn by group/organizationalRole/uniqueMembers/.regex("cn=admin,cn=$1,ou=groups,dc=example,dc=com") write Thanks, Tyler

3 9

ldapi -> "Confidentiality required" problem
by Gunnar Frenzel 08 Jun '09

08 Jun '09

Hello, I've configured openldap (v2.4.16 on FreeBSD 7.2) to listen on ldaps (with self signed certificate) as well as ldapi. rc.cof: slapd_enable="YES" slapd_flags='-h "ldapi:///var/run/openldap/ldapi/ ldaps:///"' slapd_owner="ldap:ldap" slapd_sockets="/var/run/openldap/ldapi" slapd.conf: database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Manager,dc=mydomain,dc=com" rootpw password directory /var/db/openldap-data index objectClass eq security ssf=128 TLSCACertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/ssl/cert.key TLSVerifyClient never Connecting to ldaps (port 636) with clients such as Thunderbird, Apache Directory Studio works fine. But when I try to connect via ldapi (port 389) from a webmail tool on the same server I always get the error "Confidentiality required" from openldap. I want to connect to ldapi (as it is local on the server) without TLS or other encryption but openldap doesn't seem to allow that in my configuration. I tried localSSF set to 0 which doesn't make any difference... I'd be thankful for any advice with this issue. Best regards, Gunnar

3 6

openldap, bdb versions and performance issue
by jakjr 08 Jun '09

08 Jun '09

Hello Guys, Last week I upgraded our openldap server to 2.4.16 and we had terrible performance problems. Quanah suggested me to use this options with bdb compilation: --enable-posixmutexes --with-mutex=POSIX/pthreads I compiled and tested openldap with different versions of BDB and the results are odd: OpenLDAP version BDB version Test time 1 (seconds) Test time 2 (seconds) Test time 3 (seconds) 2.4.16 BDB 4.5.20 256.2008 260.5799 273.933 2.4.16 BDB 4.6.21 265.428 260.2496 255.0599 2.4.16 BDB 4.7.25 261.5573 254.2001 259.9456 2.3.30-5 (debian package) BDB 4.2.52 257.7173 251.3512 250.8456 The test consist on make some operations: for ($i=0; $i<=1; $i++) { make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); } Like you can see, the best result was using to old version of openldap server with the old version of BDB. Even more odd was the use of CPU. Using these old versions, the consume of CPU was half then using the new ones. The slapd.conf and DB_CONFIG were the same on all tests. Here are the compilation lines: BDB: CFLAGS="-Wall -g -O2" CPPFLAGS="-I/usr/include/tcl8.5" LDFLAGS="-lpthread" ../dist/configure --enable-cxx --enable-compat185 --enable-rpc --enable-tcl --enable-posixmutexes --with-uniquename --with-tcl=/usr/lib/tcl8.5 --with-mutex=POSIX/pthreads --enable-test Openldap: CFLAGS="-Wall -g -D_FILE_OFFSET_BITS=64 -O2" ./configure --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc --localstatedir=/var --mandir=/usr/share/man --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --enable-spasswd --enable-modules --enable-rewrite --enable-slp --enable-wrappers --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-meta=mod --enable-monitor=mod --enable-relay=mod --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc DB_CONFIG: set_cachesize 0 524288000 0 set_lk_max_objects 15000 set_lk_max_locks 15000 set_lk_max_lockers 15000 set_shm_key 5 slapd.conf: some index and cachesize 10000 idlcachesize 10000 Is there some wrong or these are the expected results ? I appreciate any tip. Best regards, João Alfredo

1 0

slapcat unable to make ldif file with size > 2GB
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am trying to create backup of database using slapcat. But as soon as .ldif file reaches size of 2GB, it is giving me an error of File Size Limit Exceeded and quitting the process. I am using bdb 2.3.43. Is there anything I can do about it? Regards, Mukim Pathan

3 4

CRL expired
by joakim＠comex.se 08 Jun '09

08 Jun '09

Hello, I'm using Openldap with TLS and CRL. My slapd.conf file has the line "TLSCRLCheck all" in it. When the CRL has expired the client is not allowed to make an TLS connect. My question is whether it is possible to configure openldap to still let the client connect to the server (possibly with a warning) when the CRL has expired. Does anyone know if it is possible and of it can be achieved in that case? Regards, Jocke ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.f-secure.com/

1 0

Bind/search more than one tree and server
by Schneider, Thomas-P65851 05 Jun '09

05 Jun '09

I am seeking a solution to be able to bind to, and search more than one tree and server per request using Linux. My goal is to maintain separate groups of user accounts on an OpenLDAP server -- e.g. local and network. The groups of users can have overlapping posixAccount uid attributes, but will have unique uidNumber attributes. My main use case is authentication, which requires checking a remote LDAP server first -- currently AD which requires attribute re-mapping), then network tree on the local LDAP (openldap) if not in remote server, then the local tree on local server if not in the first tree. I have tried referrals and rewrites, but nothing I've tried worked. It looks like the creation of a custom overlay will work, but I'd rather not go down that path. I have also tried using PAM, but pam_ldap is limited to one configuration per service (modifying pam_ldap is an option at this point). Thanks, Craig

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical