openldap-technical

openldap-technical@openldap.org

13 participants
9794 discussions

CPU IOWAIT
by Sergio Cioban Filho 14 Mar '09

14 Mar '09

Hi all, I have 2 openldap servers running on CentOS 5.2 (openldap-2.4.11 RPM: http://staff.osuosl.org/~jeff/openldap/el5/i386/<http://staff.osuosl.org/%7Ejeff/openldap/el5/i386/>), the single-master replication works fine, but when I have activated mirrormode, any ldap interaction is so slowly and CPU IOWAT is 100% (in ldapsearch or ldapadd...). I have tried the same configuration with openldap-2.4.15 + db-4.7.25, but this problem still occurred. Have any idea about this problem? ** Sorry for my poor english... :) Thanks, Regards, --- Sergio Cioban Filho

2 2

newbie question: No anonymous authentication = problems
by Andreas Brudin 13 Mar '09

13 Mar '09

Hi, I hope I am on the right list for questions like this. I manage a OpenLDAP server installation on Ubuntu 8.10, and when I upgraded from 8.04 the configuration changed quite a bit. I am trying to turn off anonymous access, but I get problems connecting to the ldap database even when not using anonymous bind. I managed to find the configuration options I was looking for (at least i think so) with phpldapadmin. I found an object with dn olcDatabase={1}bdb,cn=config, in which I found an attribute called olcAccess, which I think is what I need to change. From the beginning it said: {0}to attrs=userPassword,shadowLastChange by dn.base="cn=manager,dc=mydomain,dc=com" write by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to * by dn.base="cn=manager,dc=mydomain,dc=com" write by * read (of course with my dc values). I tried to change the last entry to by * none, as I do not right now need my users to be able to read their or other users' values. It worked as expected, from an LDAP point of view, I still could log in anonymously, but I could not browse the database, however, logged in as manager it worked as it should. The problem came in postfix, because I use my LDAP database (among other things) as an alias table. So I configured postfix not to bind anonymously, but to use server_host = localhost server_port = 389 search_base = dc=mydomain, dc=com bind = yes bind_dn = cn=manager, dc=mydomain, dc=com bind_pw = mysecret result_attribute = mail query_filter = (|(uid=%s)(mailAlias=%s)) But I got dict_ldap_lookup: Search error 50: Insufficient access from the mail.log When I changed back, it worked again. I have tried to change various things (such as put in by anonymous auth before by * read, and changing dc.base="..." to dc="..." both in the first and in the last attribute value above, but it does not seem to change. What am I doing wrong? Any help would be much appreciated. Best regards, Andreas

1 0

[Fwd: Re: OpenLDAP event in Paris - programme details]
by Howard Chu 13 Mar '09

13 Mar '09

As already mentioned, I'll be in London later this month to give a talk on OpenLDAP and MySQL at the UKUUG LISA conference. Since I'm going to be in Europe for a few days, the folks at Linagora in France invited me to give a talk in Paris as well. I look forward to meeting up with our friends on the Continent.... 8<------------------------------------------------------------ Community event with Howard Chu, OpenLDAP Chief Architect, in Paris Linagora is proud to welcome Howard Chu, OpenLDAP Chief Architect, for a conference on OpenLDAP version 2.4, Monday 23rd March at 6 PM in Paris. In a relaxed after-work atmosphere, come and learn more about the new features of the open source directory server, and meet other members of the French OpenLDAP community. Sign-up for free by a simple email to <ldap+event2009(a)linagora.com>. Warning : this conference will be given in English. Where : 27 rue de Berri, 75008 Paris - http://www.linagora.com/societe/contacts/nous_contacter/_r45.html Professional needs? Attend a seminary on industrializing OpenLDAP with Symas and Linagora, on Tuesday 24th March morning: http://www.linagora.com/actualites/evenement_exceptionnel_openldap_pour_les… 8<------------------------------------------------------------ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ldap delete and modifying by delete problems
by Catalin 12 Mar '09

12 Mar '09

Hello! I'm trying to write a php script in order to manage my LDAP Directory easier. Everything works fine when I'm adding new entries and when I'm modifying an attribute. When it comes to delete an entry from my directory or to remove an attribute, I get error no. 8 which means "PHP Warning: ldap_delete() [<a href='function.ldap-delete'>function.ldap-delete</a>]: Delete: Strong(er) authentication required in /var/www/html/admin.mydomain.tld/responsabil/sterge.php on line 34, referer: http://admin.mydomain.tld/responsabil/index.php?nav=del [Tue Mar 10 07:15:03 2009] [error] [client 172.17.26.57] PHP Warning: ldap_mod_del() [<a href='function.ldap-mod-del'>function.ldap-mod-del</a>]: Modify: Strong(er) authentication required in /var/www/html/admin. mydomain.tld /responsabil/sterge.php on line 37, referer: http://admin. mydomain.tld /responsabil/index.php?nav=del" Here is how I'm trying to do these: <?php $ldap = ldap_connect("localhost"); ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); $r = @ldap_bind($ldap, "root","password"); $arrayCN=array("cn=",$login,",ou=people,dc=mydomain,dc=tld"); $CN=implode($arrayCN); $arraygroup=array("cn=",$row_verifica[5],",ou=departments,dc=mydomain,dc=tld "); $group=implode($arraygroup); $entry["member"]=$CN; $stergere=ldap_delete($ldap,$CN); $modificare=ldap_mod_del($ldap,$group,$entry); $closing=ldap_close($ldap); ?> I think it has something to do with LDAP settings. I'm using default settings for LDAP , I've only included a supplemental schema to fit it for my needs. I've generated a {SSHA} password for root. If needed, I can send all these files. Can anyone help? Any suggestion would be greatly appreciated. Thanks in advance! Best regards! Catalin

4 3

new ldap installation -LDAP newbie question
by Swenson, Chris 12 Mar '09

12 Mar '09

This is a bit difficult to articulate. Is there a way to move only the passwords from a passwd file into ldap? I have built out an ldap server and a client box and can successful authenticate from one to the other. I am using this to replace an old RHEL that has depended on the passwd file with nearly 10,000 users. To add the users to the new server I have parsed and imported a good deal of the data in the passwd file into on Oracle Db that has all the HR stuff and then scripted an output ldif to add the users into the new ldap server. Good so far, this works. My concern is thus. Ldap is on a new box. There is a lot of junk in the old box I want to leave behind, hence the rewrite via oracle. I want to extract only the passwords from the passwd file and write them to the new ldap server. If I run migrate_passwd.pl and pull the passwords out, they are hashed in some way and I cannot write them to the ldap nor script setting the password from the old one. Even if I run the passwd file through pwunconv they seem to be unusable. I dread the thought of having to communicate with 9000 students and nearly 1000 faculty and staff with new passwords. Regards Chris S.

2 1

API to read config file before ldap_search.
by Santosh Kumar 12 Mar '09

12 Mar '09

Dear friends,looking to where we could specify config file path to be read by  ldapsearch.c  to /openldap/ldap.conf  will be trying to pass the query to ldapclient and obtain the result. should we write program starting from ldap_open , ldap_init, ldap_bind , ldap_search  or its suffice only by modifying ldapsearch.c.RegardsSantosh

2 1

what ldap configuration paramentrs for ldapclient
by Santosh Kumar 12 Mar '09

12 Mar '09

Hi,  bharath , thanks for the link,command  working fine ,ldapsearch -v -x -W -h 10.10.20.50 -D cn=testuser1,ou=testusers,dc=kpairtest,dc=local -b ou=testusers,dc=kpairtest,dc=localwhat is binddn  , rootbinddn , basepart that needs to be specified in ldap.conf for openldap client,can we  have either in /etc/ldap.conf or  /etc/openldap/ldap.conf  ?and does ldapsearch()  automatically looks for configuration in /etc/ldap.confThanksSantosh Kumar Sr Software Engineer On Tue, 10 Mar 2009 05:21:58 -0400 "Kantrapati, Bharath" wrote Hi santosh,   Your mail is not clear , what is it you are exactly looking for??   But as the error says the objects you are trying to query would require you to bind to the active directory with a set of credentials.   Regards Bharath   From: openldap-technical-bounces+bharath.kantrapati=gs.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+bharath.kantrapati=gs.com@OpenLDAP.org] On Behalf Of Santosh Kumar Sent: Tuesday, March 10, 2009 11:39 AM To: openldap-technical(a)openldap.org Subject: ldap-client connection to AD - LdapErr: DSID-0C090627,   Trying to query Active Directory  via command line for searching all Please let me know what this error refers to ./ldapsearch  -h 10.10.10.50 -b "ou=users,DC=SFBAY,DC=tech,DC=com"  -s sub "objectclass=*" # extended LDIF # # LDAPv3 # base with scope subtree # filter: objectclass=* # requesting: ALL # # search result search: 2 result: 1 Operations error text: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope  ration a successful bind must be completed on the connection., data 0, vece # numResponses: 1  i'm  looking to extract -b option and -D from AD Please if anyone is aware let me know. Thanks Santosh  

1 0

Developing client in c
by Michael Luich 11 Mar '09

11 Mar '09

Hello Everyone, I'm trying to develop my application in c. And since I've never done LDAP before I thought i'd do a test program to work out the how's of retrieving from an ldap directory. in this case I'm pulling a X509 certificate from the verisign directory. I successfully run the search and can retrieve the data, but the certificate;binary is incomplete. I've tried a number of different things but cannot seem to get the whole certificate. Below is the hard coded test program, and any help would be greatly appreciated! -- Michael Luich Stone's Rose mluich(a)stonesrose.com #include <stdio.h> #include "ldap.h" /* Specify the search criteria here. */ #define HOSTNAME "directory.verisign.com" #define PORTNUMBER 389 #define BASEDN "" #define SCOPE LDAP_SCOPE_SUBTREE #define FILTER "(mail=mluich(a)stonesrose.com)" char *encode_64 (char *message); int main (int argc, char **argv) { LDAP *ld; LDAPMessage *result, *e; char *dn, *cert; char **vals; int rc; LDAPMessage *res; char *a; int version, i; BerElement *ber; // /* Print out an informational message. */ // // printf ("Connecting to host %s at port %d...\n\n", HOSTNAME, PORTNUMBER); /* STEP 1: Get a handle to an LDAP connection and set any session preferences. */ if ((ld = ldap_init (HOSTNAME, PORTNUMBER)) == NULL) { perror ("ldap_init"); return (1); } /* Use the LDAP_OPT_PROTOCOL_VERSION session preference to specify that the client is an LDAPv3 client. */ version = LDAP_VERSION3; ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version); /* STEP 2: Bind to the server. In this example, the client binds anonymously to the server (no DN or credentials are specified). */ rc = ldap_simple_bind_s (ld, NULL, NULL); if (rc != LDAP_SUCCESS) { fprintf (stderr, "ldap_simple_bind_s: %s\n", ldap_err2string (rc)); return (1); } /* STEP 3: Perform the LDAP operations. In this example, a simple search operation is performed. The client iterates through each of the entries returned and prints out the DN of each entry. */ rc = ldap_search_ext_s (ld, BASEDN, SCOPE, FILTER, NULL, 0, NULL, NULL, NULL, 0, &result); if (rc != LDAP_SUCCESS) { fprintf (stderr, "ldap_search_ext_s: %s\n", ldap_err2string (rc)); return (1); } if ((vals = ldap_get_values_len (ld, result, "usercertificate;binary")) != NULL) { for (i = 0; vals[i] != NULL; i++) { printf ("%d - %s: %s\n", i, a, vals[i]); // if (!strcmp (a, "usercertificate;binary")) // { printf ("%s: %s\nlength: %d\n\n", a, vals[i], sizeof (vals[i])); encode_64 (vals[i]); // } } } else { fprintf (stderr, "ldap_get_values_len: %s\n", ldap_err2string (rc)); } ldap_value_free (vals); ldap_msgfree (result); /* STEP 4: Disconnect from the server. */ ldap_unbind (ld); return (0); } char * encode_64 (char *message) { #include <openssl/bio.h> #include <openssl/evp.h> BIO *bio, *b64; //char message[] = "Hello World \n"; b64 = BIO_new (BIO_f_base64 ()); bio = BIO_new_fp (stdout, BIO_NOCLOSE); bio = BIO_push (b64, bio); BIO_write (bio, message, strlen (message)); BIO_flush (bio); BIO_free_all (bio); }

2 1

Nway multimaster sync having weird functionality
by Mathew Rowley 11 Mar '09

11 Mar '09

I am experiencing some really strange behavior with nway multimaster. Does anyone know why this would be happening? I have 2 boxes set up to sync, called rsa01, rsa02 If I create ou=groups,dc=comcast,dc=com¹ on rsa02, it will create it on rsa01 If I create cn=test,ou=groups,dc=comcast,dc=com¹ on rsa02 it will NOT create on rsa01 If I delete ou=groups,dc=comcast,dc=com¹ on rsa02, it will delete on rsa01 If I create anything on rsa01, it will NOT create on rsa02 I have the sync set up for searchBase¹ set to dc=comcast,dc=com. Here is the olcSyncrepl configuration (for both boxes): dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcbdbConfig olcDatabase: {1}bdb olcSuffix: dc=comcast,dc=com olcDbDirectory: /usr/var/openldap-data/ olcRootDN: cn=Manager,dc=comcast,dc=com olcRootPW: {SSHA}kJTEcfOmPf7fKv71AtxDjlUZNPqN9pIT olcLimits: dn.exact="cn=Manager,dc=comcast,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=004 provider=ldap://10.252.152.76 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="test" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://10.252.152.77 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="test" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov -- MAT

2 4

ldap-client connection to AD - LdapErr: DSID-0C090627,
by Santosh Kumar 11 Mar '09

11 Mar '09

Trying to query Active Directory  via command line for searching all Please let me know what this error refers to./ldapsearch  -h 10.10.10.50 -b "ou=users,DC=SFBAY,DC=tech,DC=com"  -s sub "objectclass=*"# extended LDIF## LDAPv3# base <ou=users,DC=SFBAY,DC=keypairtech,DC=com> with scope subtree# filter: objectclass=*# requesting: ALL## search resultsearch: 2result: 1 Operations errortext: 00000000: LdapErr: DSID-0C090627, comment: In order to perform this ope ration a successful bind must be completed on the connection., data 0, vece# numResponses: 1 i'm  looking to extract -b option and -D from AD Please if anyone is aware let me know.ThanksSantosh

5 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical