openldap-technical

openldap-technical@openldap.org

9 participants
9867 discussions

Equality matching on facsimileTelephoneNumber
by Sean Burford 23 Jan '09

23 Jan '09

Hi, ITS 2571 is suspended (since 2003) pending IETF action: http://www.openldap.org/its/index.cgi/Contrib?id=2571 Has the IETF decided how facsimile telephone number matching should work, if at all? Our users would like to replace fax numbers, and there doesn't seem to be an appropriate matching rule. -- Thanks, Sean Burford

1 0

ldap_simple_bind_s fails intermittently, when run in an loop
by bharath.venkata＠wipro.com 22 Jan '09

22 Jan '09

Hi all, I am trying to use openldap api's to connect to ldap from my code. I tried to connect to ldap server 1,00,000 times(just intiliazing , binding and unbinding) Intilaly Binding to the ldap server works fine, but after some time say after reaching more than 10,000 binds. bind continously fails with below error . "Can't connect to the LDAP server - Cannot assign requested address". and error number is 91 below is my code snapshot. int main() { int ret,version,i; i=0; LDAP *ld=0; while(100000) { const char *s=0; cout<<"count is "<<i++<<endl; ld=ldap_init(HOSTNAME,PORTNUMBER); // HOSTNAME and PORTNUMBER are defined if(ld == NULL) { cout<<" error in initiliaze "<<endl; return 2; } ret=ldap_simple_bind_s(ld,"",""); ldap_perror(ld,s); if(ret != LDAP_SUCCESS) { cout<<" error in bin "<<ret<<endl; cout<<ldap_err2string(ret)<<" is the error"<<endl; } else { cout<<"bind success "<<endl; } ldap_unbind(ld); ld=NULL; } return 0; } i am clue less why this happened. Is there any restriction or bug (already present) that only certain number of binds are possible in a given time. Your help will be highly help full in my further proceedings. Regards, Bharath. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

openldap syncrepl
by Brad C 21 Jan '09

21 Jan '09

Hi There, Im having trouble with openldap synrepl. Ive turned on debugging. http://pastebin.com/d2da66c02 OpenLDAP versions itshare:~ # rpm -qa | grep -i openldap openldap2-client-2.4.12-5.3 openldap2-devel-2.4.12-5.3 openldap2-2.4.12-5.4 OpenSUSE 11.1 Linux itshare 2.6.27.7-9-pae #1 SMP 2008-12-04 18:10:04 +0100 i686 i686 i386 GNU/Linux Any advice would be most welcome. This is a vanilla system, is it because it has not created the ldap database locally?Jan 21 16:39:05 itshare slapd[3321]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Kind Regards Brad

1 0

How can I configure overlays during runtime of slapd?
by Andreas Micheler 20 Jan '09

20 Jan '09

Hallo all, I am new to OpenLDAP, and I am trying to configure slapd during runtime to add/remove one or more Overlays. I have already converted slapd.conf to a config directory slapd.d before. The command I use to add the overlay is: slapadd -F slapd.d -n 0 -l myovondelta The ldif file myovondelta is: dn: olcOverlay=constraint,olcDatabase=bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcConstraintConfig olcOverlay: constraint olcConstraintAttribute: mail regex ^[:alnum:]+@mydomain.com$ olcConstraintAttribute: title uri ldap:///dc=catalog,dc=example,dc=com?title?su$ But the output I get is: <= str2entry: str2ad(changetype): attribute type undefined slapadd: could not parse entry (line=1) Can anyone please point me in the right direction? Where is my mistake? Thanks, Andreas

2 1

trailing characters in olcserverids after conversion
by Oliver Liebel 19 Jan '09

19 Jan '09

using openldap 2.4.13 (compiled from openldap.org source-package) i have noticed the following, reproducable behaviour when converting a slapd.conf to slapd.d: if slapd.conf contains serverids with ldap-urls, e.g. in this format: ServerID 1 "ldap://ldapmaster.local.site:9000" ServerID 2 "ldap://ldapslave.local.site:9000" the olcserverids always contains some trailing (garbage) characters after the conversion, and are base64 encoded. when i set them manually in cn=config with ldapmodify, they are displayed "clean". the serverid-lines in slapd.conf are "clean" (they contain no whsp/tabs at the end of the line or similar, invisible chars). i have tested it without \"\ and without portnumber, tested conversion with slaptest and slapd, in virtual and real machines, result is always the same. any ideas? greetings, oliver

2 2

ppolicy in openldap
by Allgood, John 19 Jan '09

19 Jan '09

Hello All I am fairly new to openldap and have some questions about password policys. We are running ldap on RHEL5 and using openldap 2.3.27. The ppolicy overlay gives me a lot of what I need but RHEL5 does not seem to have it installed. How can I get this installed? Also the best that I can tell is that ppolicy does not have any dictionary checks either. Is this true or did I just miss something? What I would like to setup is what we currently have in place using cracklib. Minlen=8 at least 1 Uppercase, 1 Lowercase, 1 Number, 1 special char. Best Regars John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com www.ohl.com

3 2

Ldapsearch
by Juan Pablo Roig 18 Jan '09

18 Jan '09

Hi alln i am new to the list and i have 2 questions: 1- i ve just configured my openldap server in a freebsd to use tls an to require client certificates, my problem is that i cant test the connection with the ldapsearch command. Is this posible? 2- is there any gui ldap browser that supports client certificates? Thanks a lot Juan 2009/1/17, openldap-technical-request(a)openldap.org <openldap-technical-request(a)openldap.org>: > Welcome to the openldap-technical(a)openldap.org mailing list! This list > is intended to be used for technical discussions of issues related to > use of OpenLDAP Software. This list is lightly moderated. > > To submit a message to this list, send your email to > openldap-technical(a)openldap.org. > > General information about the mailing list is at: > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > If you ever want to unsubscribe or change your options (eg, switch to > or from digest mode, change your password, etc.), visit your > subscription page at: > > http://www.openldap.org/lists/mm/options/openldap-technical/juan.pablo.roig… > > > You can also make such adjustments via email by sending a message to: > openldap-technical-request(a)openldap.org > > with the word `help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. > > You must know your password to change your options (including changing > the password, itself) or to unsubscribe. It is: > ilap11 > > Normally, Mailman will remind you of your openldap.org mailing list > passwords once every month, although you can disable this if you > prefer. This reminder will also include instructions on how to > unsubscribe or change your account options. There is also a button on > your options page that will email your current password to you. > -- Enviado desde mi dispositivo móvil

2 1

openldap group filter and websphere
by hai wu 18 Jan '09

18 Jan '09

Hi, We have one openldap server, and for dev environment, groups are put under 'ou=devgroup,dc=example,dc=com', and for production environment, groups are put under 'ou=group,dc=example,dc=com'. When integrating websphere to openldap, we can only specify one search base, which is set to 'dc=example,dc=com', and for the group filter, it is set to '(&cn=%v)(objectclass=posixGroup))'. But in this case, it is pulling all groups from both dev and production environment. Is there a way to set the group filter so that for our dev environment, it would only pull dev groups, and for production environment, it would only pull production groups? I tried ldapsearch by applying the group filter, modified it a little bit, but still could not get it to work in our case. Thanks, Hai

1 0

Why TLS is always fail with OpenLdap 2.4.11
by Hunter hu 16 Jan '09

16 Jan '09

H <openldap-technical(a)openldap.org>i, I have to get help from here , because I was struggling with TLS configuration for weeks. during those days , I searched google include this list , still cant pass ,my god. Does anyone could provide some guide on how to configure the openldap TLS connection with step by step, so can reduce our pain ? Here I expose the step and try to get help from the senior ldap engineer. 1. installed openldap with-tls=openssl I add the openssl specially to avoid use gnutls, sometimes, openldap will goto find gnutls if c header is there install and start slapd succesfully. 2. using ldapsearch -v -h 10.192.183.73 -b "dc=example,dc=com" -s base "objectclass=*" I can get the listed information from openldap server, that is ok 3. now go for certificate genearation with numerous guide in google , but not fit to pass for me 3.1 cd /var/myca /usr/local/ssl/misc/CA.sh -newCA then will generate demoCA, and cacert.pem is there, that is ok 3.2 /usr/local/ssl/misc/CA.sh -newreq newkey.pem newreq.pem notes : I am using 10.192.183.73 as the common name, is there any issue here? 3.3 /usr/local/ssl/misc/CA.sh -sign then you got newcert.pem now copy into /var/ldap and try to insert into slapd and restart TLSCipherSuite MEDIUM:+TLSv1+SSL3+SSL2 TLSCertificateFile /var/ldap/newcert.pem TLSCertificateKeyFile /var/ldap/newkey.pem ( some guide said should be newreq.pem) TLSCACertificateFile /var/ldap/cacert.pem 4. ftp cacert.pem into client and copy into /var/myca using s-client to test at first penssl s_client -connect 10.192.183.73:389 -showcerts -state -CAfile /var/myca/cacert.pem -tls1 you will got the error always CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv3 write client hello A SSL_connect:failed in SSLv3 read server hello A 14719:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: could any kind man to give some help to save me? -- Hunter

2 1

Re: Syncrepl Questions
by Gavin Henry 15 Jan '09

15 Jan '09

> I am not understanding what happens to my clients if something happens > to my provider. In some replication systems when the main server fails > you can start using the machine that was replicated to as your > primary. This is called Active-Active Hot Standby and can be done with MirrorMode. > Does the consumer act as a slave machine? It can be, depends how you've set it up, which you have told us ;-) > On each of my > clients do I point them to the provider/consumer. It depends on what your clients are doing, if it's all readonly, then point them at both. Tell us more. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical