openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

lda_msgfree causing aborting program
by Santosh Kumar 16 Apr '09

16 Apr '09

Hi everyone,Using ldap_msgfree() needs after ldap_result() , as per man page it is to be used, is resulting in abort , but using the same after search result is working fineldap_init(ldap_host, LDAP_PORT))ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version)id = ldap_simple_bind(ld, root_dn, root_pw) //  ldap_perror(ld, "ldap_set_option");  printf("My ID=%d\n",id);result = ldap_result(ld, id, 1, NULL, &msg);    printf("Ldap_Result=%d\n",result);result = ldap_result2error(ld, msg,  1);    printf("Ldap_Result2error=%d\n",result); ldap_msgfree(msg);Output:ldap_bind: Success (0)My ID=1Ldap_Result=97Ldap_Result2error=0ldap_search_async: io.c:190: ber_free_buf: Assertion `((ber)->ber_opts.lbo_valid==0x2)' failed.Is there a way to get around while seeing the fucnction implemeted  ldap_msgfree() is calling ber_free_element() , which checks BerElement is it valid .in the above program it goes to invalid  this causing program to abort , does removing this check causes problem , i'm not aware about the importance of the check. ThanksSantosh Kumar9881481468

1 0

Fax can't have equality index?
by Min 15 Apr '09

15 Apr '09

Hello, I have the fax in my sldap.conf as the following: index facsimileTelephoneNumber eq,pres,sub index telephoneNumber eq,pres,sub But slaptest will report error as: equality index of attribute "facsimileTelephoneNumber" disallowed slaptest: bad configuration file! Any help will be appreciated. Thanks,

2 1

problem with a lot of databases in openldap 2.3
by Patrick Kaufmann 15 Apr '09

15 Apr '09

Patrick Kaufmann schrieb am 06.04.2009 14:13 Hi, We experience some serious problems with our openldap. We got about 50 databases in our openldap. If I now request single databases everything works fine until I request the 30st database. >From there on every database which I haven't already requested will just return an internal error. After some further investigation I finally figured out that the bdb backend somehow has some problems. If I start the sldap with d -1 I get following error: bdb_locker_id: Not enough space(12) We use openLDAP 2.3 together with DBD 4.2.52 Whole error message: daemon: activity on 1 descriptor daemon: activity on: 4052r daemon: read activity on 4052 daemon: select: listen=1912 active_threads=0 tvp=NULL connection_get(4052) connection_get(4052): got connid=0 connection_read(4052): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 35 02 01 6e 63 30 04 05..nc0. ldap_read: want=47, got=47 0000: 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 2e 63 68 .o=test.domain 0010: 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e 01 01 00 ................ 0020: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. ber_get_next: tag 0x30 len 53 contents: ber_dump: buf=086F29D8 ptr=086F29D8 end=086F2A0D len=53 0000: 02 01 6e 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 ..nc0..o=test.ma 0010: 69 6c 34 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 il4.ch.......... 0020: 02 01 1e 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c ........objectcl 0030: 61 73 73 30 00 ass0. ber_get_next ldap_read: want=8 error=Unknown error daemon: activity on 1 descriptor daemon: waked daemon: select: listen=1912 active_threads=0 tvp=NULL do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=086F29D8 ptr=086F29DB end=086F2A0D len=50 0000: 63 30 04 0f 6f 3d 74 65 73 74 2e 6d 61 69 6c 34 c0..o=test.mail4 0010: 2e 63 68 0a 01 00 0a 01 00 02 02 03 e8 02 01 1e .ch............. 0020: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0030: 30 00 0. >>> dnPrettyNormal: <o=test.domain> => ldap_bv2dn(o=test.domain,0) <= ldap_bv2dn(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=test.domain)=0 <<< dnPrettyNormal: <o=test.domain>, <o=test.domain> SRCH "o=test.domain" 0 0 1000 30 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=086F29D8 ptr=086F29FE end=086F2A0D len=15 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=086F29D8 ptr=086F2A0B end=086F2A0D len=2 0000: 00 00 .. attrs: conn=0 op=109 SRCH base="o=test.domain" scope=0 deref=0 filter="(objectClass=*)" ==> limits_get: conn=0 op=109 dn="[anonymous]" => bdb_search bdb_locker_id: err Not enough space(12) send_ldap_result: conn=0 op=109 p=3 send_ldap_result: err=80 matched="" text="internal error" send_ldap_response: msgid=110 tag=101 err=80 ber_flush: 28 bytes to sd 4052 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error ldap_write: want=28, written=28 0000: 30 1a 02 01 6e 65 15 0a 01 50 04 00 04 0e 69 6e 0...ne...P....in 0010: 74 65 72 6e 61 6c 20 65 72 72 6f 72 ternal error conn=0 op=109 SEARCH RESULT tag=101 err=80 nentries=0 text=internal error Any help is appreciated. Thanks Patrick Patrick Kaufmann Softwareentwicklung Hauptsitz: Hardstrasse 72 CH - 5430 Wettingen Tel. +41 56 437 80 40 Fax + 41 56 437 80 59 pkaufmann(a)zubler.ch<mailto:pkaufmann@zubler.ch> www.zubler.ch<http://www.zubler.ch> [cid:aussenstelle.jpg]

3 10

OpenLDAP and "reverse" wildcards
by Kjell Gustafsson 15 Apr '09

15 Apr '09

Hi I have a somewhat strange question. We are using OpenLDAP (openldap-server-2.4.11-bdb) and Berkley DB (db-4.6.21) in a project. LDAP is used to store subscribernumbers and the address of the ippbx where the subscriber is registered. Typically every subscriber have a separate DN in the LDAP-database. We have a serverfunction that do ldap-searches for subscribernumbers to retrieve the ippbx-address. This part is going to remain working as is. Now we want to be able to have a "wildcard"-entry in LDAP, that points to an address also. This entry shall respond to any ldap-search matching the wildcard. Let me give an example: We have, let's say four ippbx's with prefixes 111, 222, 333 & 444. A subscriber- number consist of the prefix and five more digits. Each subscriber can be registered in any ippbx and still be reachable. The prefix indicates the subscribers "home-location". Now we want to use a gateway to another telephone-system. We don't want to have all of the subscribers from that system registered in LDAP, so we want a "wildcard"-entry saying that if you dial 99912345 LDAP should have an entry 999xxxx pointing to the gateway for the subscribers in the other telephonesystem. The response to the ldap-search should contain the the gateway address to the telephone-system regardless of the number entered. So if I dial 99912345 I should get the same response as if I dial 99967890. The response shall have the same format as in the ippbx-solution. We want the ldap DIT to look the same for the wildcard and the others - the DN shall look the same. We don't want to change the serverfunction we are using today. So - finally my question: Would it be possible to solve this with OpenLDAP and if so - how can it be done? Looking forward to your suggestions! /Kjell

3 5

Re: search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Pierangelo Masarati 14 Apr '09

14 Apr '09

----- "Daniel" <deepee(a)gmx.net> wrote: > Hi slapd-Gurus out there, > > using the search filter "(test=TRUE)" results in: "candidates not > indexed". The cause for the below slapd trace output seems clear to > me: > In fact there is no entry in my bdb backend existing with an attribute > > description "test" present... > > => bdb_filter_candidates > EQUALITY > => bdb_equality_candidates (test) > <= bdb_equality_candidates: (test) not indexed > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=-1 first=1 last=430 > <= bdb_filter_candidates: id=-1 first=1 last=430 > <= bdb_list_candidates: id=25 first=141 last=430 > <= bdb_filter_candidates: id=25 first=141 last=430 > bdb_search_candidates: id=25 first=141 last=430 > => test_filter > EQUALITY > => access_allowed: search access to "dc=foo,dc=bar" "test" requested > <= root access granted > => access_allowed: search access granted by manage(=mwrscxd) > <= test_filter 5 > bdb_search: 141 does not match filter > > > In regard to the above slapd-trace I've the following question: > Could someone please be so kind and tell me whether there exists a > possibility to search (filter) for "dynamic" (calculated) attribute > values, that do not get stored in a backend (in my case bdb)? Idea: An > > overlay should calculate a dynamic attribute's value based on already > > existing attribute values of an entry each time this dynamic attribute > > is searched for using a filter-statement, e.g. > '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. > > First of all I had a quick look into slapo-collect's sources. The > collective attributes seem to be added dynamically to an entry but the > > collected attributes are not "filterable". I think the reason is that > > slapo-collect operates on the response/slapreply and that's to late in > > the overlay's processing queue... > > Then I thought of something similar to the operational attribute > "hasSubordinates" - this attribute's value is filterable and seems (at > > least sounds) to be dynamically evaluated. On the other hand I'm not > sure whether "hasSuborinates" is dynamically calculated each time an > entry get's searched or accessed. Perhabs the value of > "hasSubordinates" > is only be calculated in case the entrys' childrens get modified and > (thus seldomly) updated within the backend, which could be the reason > to > be search- and filterable?! > > Last but not least I tried to implement a small test-overlay using a > custom search-callback that updates the dynamic "test" attribute > within > the bdb-backend: Imagine an (very simple/stupid) overlay that for > example set a custom attribute named "test" to "TRUE" in case an > entry's > attributes "givenName" and "sn" both contain at least one value. ;-) I > > know, that the filter "(&(givenName=*)(sn=*))" would do the trick but > > the example is just a simple scenario for me to step into > overlay-processing details. > > If I use attr_merge() within the search-callback to store the dynamic > > test attribute's value "TRUE" or "FALSE" within the entry the search > succeeds without problems - I mean the filter (test=TRUE) get's > processed ok. > > So my questions still left is: > Do I always have to store/update the dynamic attribute's calculation > result value within each entry (in the backend) or is there another > posibility that allows filtering for the calculated attribute's value, > > while getting rid of the store and update overhead within the > backend? > > Hopefully this is no hen egg problem concerning the internal > processing > order of filters, candidates, entries, etc. Using dynamically computed attrs in a search filter and pretending it to ber indexed is an oxymoron. If you intend to allow it, you need to be prepared to intercepting the search operation and doing the candidate collection yourself. I don't recall any overlay or so that does it and that could be used as an example, simply because it makes little sense. In any case, the problem can be solved, but the solution may not be trivial and require a fair amount of coding. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

2 2

Modifying password by user
by Franck Royer 14 Apr '09

14 Apr '09

Hi, I'm installing openldap on a ubuntu intrepid server (8.10). Everything is ok except when I want that a user is able to modify his own password using phpldapadmin (0x32 LDAP_INSUFFICIENT_ACCESS). So I tried to modify it using ldappasswd : dante@kollok ~ $ ldappasswd SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) or dante@kollok ~ $ ldappasswd -D "uid=dante,ou=people,dc=kollok,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) The posix user dante is the same user than the ldap one (I use pam libs). And I know that my password is right cause I can log in ldapadmin or ssh with it. My slapd.conf : http://pastebin.com/f44dd2b59 My ldap.conf : http://pastebin.com/f3af1bec3 Any idea ? Cheers, Franck Royer

4 4

group of groups
by alois blasbichler 14 Apr '09

14 Apr '09

Hello list Is there a possibility in openldap to make group of groups ? We need this fpr posix- and sambagroups. I dont find any predefined objectclasses or documentation. Somebody can give me a link or other help? Thank you luis

3 3

OpenLDAP groups and Unix users
by Stephen Parry 14 Apr '09

14 Apr '09

Thanks in advance for any answers to this query, and thanks to the geniuses who wrote and maintain OpenLDAP. I have OpenLDAP running on my Ubuntu Intrepid server. I have installed the various PAM and NSS bits and pieces to allow integrated authentication. I can now use users and groups stored in LDAP database to do shell logins, permission files and authenticate Apache secure connections (hooray!). It also is set up so that Unix user accounts and groups still function outside of LDAP as expected. However, there is one quirk to this. I can make LDAP users members of Unix groups and this works fine. I cannot however do the equivalent: make Unix users working members of LDAP groups. I can put them in the groups, but the the system command "id -nG" does not list the LDAP groups and the filesystem fails to pick up the permissions. Is this behaviour by design? Can the relevant modules be configured to allow LDAP groups have Unix users as members?

2 1

Notify mechanism for changes on a specific directory?
by Bahadır Kandemir 13 Apr '09

13 Apr '09

Hello, I'm working on a remote management system that uses LDAP for storing policies. Clients pull policies from server periodically, but we sometimes need to push policies to clients instantly. Polling LDAP every five seconds is not an option, of course. Is there any auto notification mechanism for LDAP that notifies client about changes on a specific directory? I've searched archives but could not find anything. Thanks in advance, Bahadir Kandemir

3 2

search for "dynamic" calculated attribute's value (bdb_equality_candidates: not indexed)
by Daniel 12 Apr '09

12 Apr '09

Hi slapd-Gurus out there, using the search filter "(test=TRUE)" results in: "candidates not indexed". The cause for the below slapd trace output seems clear to me: In fact there is no entry in my bdb backend existing with an attribute description "test" present... => bdb_filter_candidates EQUALITY => bdb_equality_candidates (test) <= bdb_equality_candidates: (test) not indexed <= bdb_filter_candidates: id=-1 first=1 last=430 <= bdb_list_candidates: id=-1 first=1 last=430 <= bdb_filter_candidates: id=-1 first=1 last=430 <= bdb_list_candidates: id=25 first=141 last=430 <= bdb_filter_candidates: id=25 first=141 last=430 bdb_search_candidates: id=25 first=141 last=430 => test_filter EQUALITY => access_allowed: search access to "dc=foo,dc=bar" "test" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 5 bdb_search: 141 does not match filter In regard to the above slapd-trace I've the following question: Could someone please be so kind and tell me whether there exists a possibility to search (filter) for "dynamic" (calculated) attribute values, that do not get stored in a backend (in my case bdb)? Idea: An overlay should calculate a dynamic attribute's value based on already existing attribute values of an entry each time this dynamic attribute is searched for using a filter-statement, e.g. '(&(dynamic-attr-name=xyz)(|((...)(...))...)...)'. First of all I had a quick look into slapo-collect's sources. The collective attributes seem to be added dynamically to an entry but the collected attributes are not "filterable". I think the reason is that slapo-collect operates on the response/slapreply and that's to late in the overlay's processing queue... Then I thought of something similar to the operational attribute "hasSubordinates" - this attribute's value is filterable and seems (at least sounds) to be dynamically evaluated. On the other hand I'm not sure whether "hasSuborinates" is dynamically calculated each time an entry get's searched or accessed. Perhabs the value of "hasSubordinates" is only be calculated in case the entrys' childrens get modified and (thus seldomly) updated within the backend, which could be the reason to be search- and filterable?! Last but not least I tried to implement a small test-overlay using a custom search-callback that updates the dynamic "test" attribute within the bdb-backend: Imagine an (very simple/stupid) overlay that for example set a custom attribute named "test" to "TRUE" in case an entry's attributes "givenName" and "sn" both contain at least one value. ;-) I know, that the filter "(&(givenName=*)(sn=*))" would do the trick but the example is just a simple scenario for me to step into overlay-processing details. If I use attr_merge() within the search-callback to store the dynamic test attribute's value "TRUE" or "FALSE" within the entry the search succeeds without problems - I mean the filter (test=TRUE) get's processed ok. So my questions still left is: Do I always have to store/update the dynamic attribute's calculation result value within each entry (in the backend) or is there another posibility that allows filtering for the calculated attribute's value, while getting rid of the store and update overhead within the backend? Hopefully this is no hen egg problem concerning the internal processing order of filters, candidates, entries, etc. Many thanks for your advice! Kind regards Daniel

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical