openldap-technical

openldap-technical@openldap.org

12 participants
9794 discussions

Question about ldap filter
by Jason Voorhees 06 Jan '09

06 Jan '09

Hi there: I'm trying to understand how ldap filters work. Based on this simple logic expression: EXPR_1 (or) EXPR_2 if EXPR1 returns TRUE, will slapd still try to evaluate EXPR2? or will slapd evaluate EXPR2 anyway even if EXPR_1 is true? I think that while the ldap filter is bigger then performance is worse, right? could somebody explain me a little about this logic of evaluation in ldap filters? Thanks

3 7

acl to allow access to specific parts of the tree only for a particular dn
by ben thielsen 06 Jan '09

06 Jan '09

i'd like to prevent the dn "cn=foo, ou=services, ou=accounts, dc=example, dc=com" from accessing any part of the tree outside of "ou=test, ou=other, ou=users, ou=accounts, dc=example, dc=com" and "ou=test, ou=other, ou=users, ou=groups, dc=example, dc=com", and would like that dn to have only read access to those two subtrees - the exception being that that user should of course be able/required to authenticate. i'm having trouble constructing a working acl that accomplishes this. one example attempt: dn: olcDatabase={2}bdb,cn=config changetype: modify replace: olcAccess olcAccess: to dn.base="" by * read olcAccess: to attrs=userPassword by self write by anonymous auth by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=accounts,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to dn.subtree="ou=montage_test,ou=other,ou=users,ou=groups,dc=ltn,dc=lvc,dc=com" by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" read by self write by users read by * none olcAccess: to * by self write by dn.exact="cn=montage_test,ou=services,ou=accounts,dc=ltn,dc=lvc,dc=com" none by users read by * none that particular example gets me: >ldapsearch -uxLLLWP 3 -H 'ldaps://ldap.ltn.lvc.com' -D 'cn=montage_test, ou=services, ou=accounts, dc=ltn, dc=lvc, dc=com' -b 'dc=ltn, dc=lvc, dc=com' "(objectclass=groupofnames)" dn | grep -i 'dn:' Enter LDAP Password: No such object (32) what am i missing? thanks -ben

1 0

problem with ldap_start_tls_s
by Sankhadip Sengupta 06 Jan '09

06 Jan '09

Hi everyone, I am trying to write an LDAP browser that uses both plain text and TLS.The plain text works fine but when I am using "ldap_start_tls_s" I get an error: ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Also just to note ldapsearch works fine. ldapsearch -vLxZZ -b "dc=example,dc=com" "(objectClass=*)" no problem with this. My code fragment is below: if ((ld = ldap_init(ldap_host, LDAP_PORT)) == NULL ) { perror( "ldap_init failed" ); exit( EXIT_FAILURE ); } /* set the LDAP version to be 3 */ if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version) != LDAP_OPT_SUCCESS) { ldap_perror(ld, "ldap_set_option"); exit(EXIT_FAILURE); } if(ldap_start_tls_s(ld,NULL,NULL)!=LDAP_SUCCESS) { ldap_perror(ld, "ldap_start_tls"); exit(EXIT_FAILURE); } Please help :( Thanks, Shawn

1 0

contextCSN
by jakjr 05 Jan '09

05 Jan '09

Hello, I'm testing a multi-master installation of openldap 2.4.11 (debian lenny). To check if the masters are consistent, I search for the contextCSN of each one, and check this value. If the values are the same, the masters are consistents, rigth ?? But now, after many, many changes (ADD/DELETE), I am searching for the contextCSN and the server is reporting three contextCSN's. Is this correct ?? EG: # ldapsearch -x -h <IP> objectClass=organization contextCSN -b dc=pr,dc=gov,dc=br -LLL -z 1 dn: dc=org contextCSN: 20081226121401.392297Z#000000#000#000000 contextCSN: 20081226173429.931124Z#000000#001#000000 contextCSN: 20081226173327.189304Z#000000#002#000000 Thanks. João Alfredo

2 2

Database is getting corrupted
by Jason Voorhees 05 Jan '09

05 Jan '09

Hi all: I'm running OpenLDAP 2.3.27 from CentOS 5.2 to build from scratch an LDAP tree based on Phamm sample LDIF files. I have these database definition in slapd.conf: database bdb suffix "dc=redtube,dc=com" rootdn "cn=manager,dc=redtube,dc=com" rootpw {SSHA}5b3FNT6a3PrldYD/X58ghCXa7vhUOO24 directory /var/lib/ldap mode 660 index objectClass eq index cn,mail eq,subinitial index vd,delete eq,pres index accountActive,forwardActive eq,pres index smtpAuth eq,pres index sn,uid,displayName pres,eq,sub index uidNumber,gidNumber eq index default sub I always do the following: 1. # rm /var/lib/ldap/* (to be sure i'm starting from scratch) 2. # slapadd -b dc=redtube,dc=com redtube.ldif After step (2) I can see that /var/lib/ldap/alock has rw-r--r-- and all the other files have -w----r-T as permissions and are owned by root.root . Is that correct? Well, as far as I know they should be owned by ldap user and ldap group with 0660 permissions asigned (based on "mode" directive in slapd.conf). So I do the following: 3. # chown ldap.ldap /var/lib/ldap/* # chmod 660 /var/lib/ldap/* (/var/lib/ldap directory is 0700 and owned by ldap.ldap already) 4. I check against posible errors and then start OpenLDAP: # slapd -Tt # service ldap start 5. OpenLDAP starts correctly, it works perfectly. I can even do modificatons to the LDAP tree adding entries based on attributes like vd, cn, mail, among others. I'm aware that there are no uid.bdb created yet in /var/lib/ldap, so I guess that's ok. My problem comes when I try to perform some operation that causes OpenLDAP to create an index file in /var/lib/ldap. In example, when I try to log in with rootdn trough phpldapadmin I get something like this in logs: Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 ACCEPT from IP=127.0.0.1:38395 (IP=0.0.0.0:389) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 BIND dn="" method=128 Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=0 RESULT tag=97 err=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH base="dc=redtube,dc=com" scope=2 deref=0 filter="(uid=cn=manager,dc=redtube,dc=com)" Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SRCH attr=dn Dec 30 11:31:22 ha1 slapd[1889]: bdb(dc=redtube,dc=com): /var/lib/ldap/uid.bdb: Permission denied Dec 30 11:31:22 ha1 slapd[1889]: bdb_db_cache: db_open(uid) failed: Permission denied (13) Dec 30 11:31:22 ha1 slapd[1889]: <= bdb_equality_candidates: (uid) index_param failed (13) Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 30 11:31:22 ha1 slapd[1889]: conn=5 op=2 UNBIND Dec 30 11:31:22 ha1 slapd[1889]: conn=5 fd=12 closed I don't know why phpldapadmin performs a search based on a filter like "(uid=cn=manager,dc=redtube,dc=com)" but well, it doesn't matter to me. Then I stop and start OpenLDAP and I start getting this: # /etc/init.d/ldap stop Stopping slapd: [ OK ] # /etc/init.d/ldap start Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/ldap: (2) Expect poor performance for suffix dc=mailtest,dc=com. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. config file testing succeeded [ OK ] Starting slapd: [ OK ] Question is: Why can't OpenLDAP create /var/lib/ldap/uid.bdb? Why is getting permission denied messages? The hole directory /var/lib/ldap is owned by ldap user with 660 permissions. Can anybody help me? Thanks

3 6

Help with understandig behaviour of crashed OpenLDAP Server
by yukti kaura 04 Jan '09

04 Jan '09

Dear All, I would like to seek clarification with one aspect of LDAP server recovery When a crashed Server in replicated mode is restarted does it immediately start publishing its services or it publishes itself only after resynchronizing Please guide Thanks Yukti Kaura

2 1

LDAP - Samba
by Terry Haley 31 Dec '08

31 Dec '08

Ok, I'm trying to wrangle this under control with this setup I've inherited and have run across a few speed bumps. Here's the state of things as is. I've made a few changes to the setup thinking that I've fixed an issue or two and have in fact only confused myself and possibly my configuration. The downside is that I don't know a few key passwords that was used in the original setup. (yay no overlap with my predecessor). I have a samba server acting as my PDC with an LDAP server used for authentication. Question #1: the password contained within the LDAP directory for my 'admin' account should = the 'rootpw' entry in slapd.conf correct? Question #2: the 'ldap admin dn' entry in my smb.conf file should equal the 'rootdn' entry in my slapd.conf file, afterwhich, this should be updated to samba using smbpasswd -w correct? Question #3: the 'admin users' entry within the smb.conf are the users that allow access to the domain correct? Currently, what I'm working with here is that I don't know the 'admin, samba or the samba-admin' passwords. The samba-admin account is just an LDAP admin account but Not the root account. This should be fixed to the above question 2 yes? I would like to change all of these passwords but am fearful that I could make things worse. Also, regarding the components on my network (machines specifically), will there be an issue if I change the 'samba' account (domain account) password with their ability to connect to the domain? Thank you in advance for any help and advice! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

4 3

Constant corruptions
by Jason Voorhees 30 Dec '08

30 Dec '08

Hi there: I'm still having problems with my OpenLDAP 2.3.27 from CentOS 5. I know that index directive in slapd.conf causes the creation of .bdb files in /var/lib/ldap, right? If I have this in slapd.conf: index uid,smtpAuth eq,pres ... so in some moment uid.bdb and smtpAuth.bdb will be created in /var/lib/ldap, right? When I create my ldap tree using slapadd and an LDIF file then several .bdb files get created under /var/lib/ldap, but some other no because of there are no attributes of that type in LDIF file. But when OpenLDAP is already running thanks to a simple search like "(smtpAuth=TRUE)" then slapd tries to create smtpAuth.bdb but that's when it fails. I get this message: slapd[11954]: bdb(dc=redtube,dc=com): /var/lib/ldap/smtpAuth.bdb: Permission denied slapd[11954]: bdb_db_cache: db_open(smtpAuth) failed: Permission denied (13) Does anybody know why slapd isn't able to create new index files? Permissions and ownership are totally correct. Any help? :( P.D.: I'm running openldap in a centos paravirtualized with Xen. It could be this the problem?

1 0

Re: Re: TLS config causes Object class violation
by forumuser＠online.de 30 Dec '08

30 Dec '08

Thanks!!! That's it! Like you said, I changed my TLSconfiguration.ldif file to point to "dn: cn=config" and it worked. I've once already seen the olcTLS* in the olcGlobal, however, I am new to LDAP backend database configuration, only used slapd.conf before. Thank you very much for the solution! I wish you a happy new year Belem ----- Ursprüngliche Nachricht ----- Von: Pierangelo Masarati Gesendet: 28.12.08 21:35 Uhr An: forumuser(a)online.de Betreff: Re: TLS config causes Object class violation olcTLSCACertificateFile belongs to olcGlobal, while you're trying to add it to a database object. Add it to cn=config instead. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

TLS config causes Object class violation
by forumuser＠online.de 28 Dec '08

28 Dec '08

Recently I upgraded my Ubuntu Server 8.04 to 8.10 and had to reconfigure OpenLDAP (installed by apt-get) through slapd backend database (I used slapd.config before). I have reconfigured OpenLDAP by "sudo dpkg-reconfigure slapd" and confirmed all prior settings, however the old database was moved to /var/backup/ and a fresh one was generated (please see config tree at the end). The problem is, I get following error message..: ldap_modify: Object class violation (65) additional info: attribute 'olcTLSCACertificateFile' not allowed (even olcTLSCertificateFile, if I leave out olcTLSCACertificateFile... olcTLS* seems "not allowed") ..when I try to configure TLS by ldapmodify: ldapmodify -D cn=admin,cn=config -W -x by entering this: dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/servercert.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/serverkey.pem The config tree is as follows (I will change "mydomain" and ACL later): dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=org olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mydomain,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=mydomain,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq Here's my "sudo apt-cache show slapd" packet information: Package: slapd Priority: optional Section: net Installed-Size: 3872 Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Original-Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Architecture: i386 Source: openldap Version: 2.4.11-0ubuntu6 Replaces: apparmor-profiles (<< 2.1+1075-0ubuntu4), ldap-utils (<< 2.2.23-3), libldap2 Provides: ldap-server, libslapi-2.4-2 Depends: libc6 (>= 2.4), libdb4.2, libgcrypt11 (>= 1.4.0), libgnutls26 (>= 2.4.0-0), libldap-2.4-2 (= 2.4.11-0ubuntu6), libltdl7 (>= 2.2.4), libperl5.10 (>= 5.10.0), libsasl2-2, libslp1, libtasn1-3 (>= 0.3.4), libwrap0 (>= 7.6-4~), unixodbc (>= 2.2.11-1), zlib1g (>= 1:1.1.4), coreutils (>= 4.5.1-1), psmisc, perl (>> 5.8.0) | libmime-base64-perl, adduser Pre-Depends: debconf (>= 0.5) | debconf-2.0 Recommends: libsasl2-modules, apparmor (>= 2.1+1075-0ubuntu6) Suggests: ldap-utils Conflicts: apparmor-profiles (<< 2.1+1075-0ubuntu4), ldap-server, libltdl3 (= 1.5.4-1), umich-ldapd Filename: pool/main/o/openldap/slapd_2.4.11-0ubuntu6_i386.deb Size: 1466528 MD5sum: 41047db9f250c0e73e2e3c43c5d90f5a SHA1: 4c23c98d55851fef7ec4ff5e4fa8d7cd1c885da9 SHA256: 107e5df3dea5a0571a2f99df1d7c919247a4223a991a99e8393b0915e39f1fc9 Description-de: OpenLDAP-Server (slapd) This is the OpenLDAP (Lightweight Directory Access Protocol) server (slapd). The server can be used to provide a standalone directory service. Homepage: http://www.openldap.org/ Bugs: mailto:ubuntu-users@lists.ubuntu.com Origin: Ubuntu (libgnutls26 is of version: 2.4.1-1build1) Can someone help me with this "Object class violation (65)" problem concerning TLS? Belem

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical