openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

LDAP Group
by Paul bob 16 Feb '09

16 Feb '09

I have created group called readonly1 in ldap server and added ldap user "jimmy" member of that group. When I try to access he is not getting ldap group access. Whereas I created local group readonly1 and added jimmy" into that group it works fine. dn: cn=readonly1,ou=Group,dc=ndmacb,dc=local objectClass: posixGroup objectClass: top cn: readonly1 gidNumber: 550 memberUid: jimmy Am I missing any config in ldap side? Thanks for your help! - PB

1 0

Howto monitor n-way replication ?
by a.schild＠aarboard.ch 16 Feb '09

16 Feb '09

Hello, during the last years we used a open ldap setup with snycrepl for 3 servers. We monitored them with nagios (http://www.nagiosexchange.org/cgi-bin/page.cgi?g=Detailed%2F2477.html;d=1) with success. Now we changed our setup to a n-way master setup and also wish to monitor replication via nagios. Monitoring the contextcsn value seems to not be usefull in a n-way setup. Any ideas/hints how we can monitor the n-way replication ? Thanks André

1 0

connection.c segfault with new sasl mechanism
by Francesco Grossi ITQL 15 Feb '09

15 Feb '09

Dear team We hope you can help us in discovering where or how we are wrong. We are providing a new sasl mechanism for third party strong authentication and we are in the final delivery step. We are current with openldap 2.3.38. We used strong authentication server to carry out the authorization part of the mech and our backside (sasl client) is Openldap 2.3.38. On the client side we have pam-ldap+ssh. sasl libs are cyrus 2.1.22 os is linux red-hat cent-os 4.7 final During our functional and stress tests everything works fine but once in a while when openldap crashes and this happens only, but not always, under a certain condition: Before explaining such a condition we would like to establish the meaning of some terms: 1) straight authentication session: a simple (not interactive) authentication, being either successfull or not (right or wrong passcode) 2) interactive authentication session: a complex (interactive) authentication with iterated tcp/ip requests such as next-token or new-pin Crash scenario: one ore more straight authentication scripts are running in parallel, emulating parallel ssh authentication sessions with either right or wrong passcode; one interactive authentication session: in the error-originating session the whole user back-and-forth got his way to the authentication server, that is to say next-token or new-pin procedure comes to a complete end: user gives its next token or new pin (twice) and the strong authentication is fully accomplished and reported by the authentication manager. What is wrong is that (by average 2 attempts out of 3) make openldap crash. Sasl speaking our server-step mechanism closes fine and we expect its dispose step to be called by openldap (by the sasl_server_end) That is not going to happen being Openldap crashed meanwhile. Again this happens only but not always when the stress scripts are running. Does it smell of thread concurrency and safety? Our different use cases tests run almost always successfully when done individually or in parallel but manually (real people operating). Conversely when stress test are going on the problem arise very often but not always. We had the Opeldap crash both on linux and solaris installations though on linux the crash happens some steps earlier than with solaris. On linux we have had the opportunity to rebuild openldap with some debug instruction inside. what came out is connection.c crashing at: op->o_tmpfree( op->orb_edn.bv_val, op->o_tmpmemctx ); in both successful and error cases either the values passed and the function address look alike. op->orb_edn.bv_val shows the distinguished name of the user just logged in (op->orb_edn.bv_len is correctly set with its length). Based on the function name we guess ldap is about to free the DN allocated storage. On Solaris9 we had the segfault symptom but we have some more line on the log, one of which shows a almost empty DN (!!!) made just of uid="" GDB has the following from the linux core dump: gdb -c core.5785 GNU gdb Red Hat Linux (6.3.0.0-1.159.el4rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu". Core was generated by `/usr/sbin/slapd -h ldap:///'. Program terminated with signal 11, Segmentation fault. #0 0x00268934 in ?? () THE FOLLOWING CODE IS AN EXCERPT OF THE FINAL SERVER_MECH_STEP FUNCTION OF THE MECHANISM WHICH RUN BEHIND THE SASL_SERVER_STEP ONLY WHEN CRASH HAPPENS: static int mymech_server_mech_step(void *conn_context __attribute__((unused)), sasl_server_params_t *params, const char *clientin, unsigned clientinlen, const char **serverout, unsigned *serveroutlen, sasl_out_params_t *oparams) { server_context_t *text = (server_context_t *) conn_context; *serverout = NULL; *serveroutlen = 0; oparams->doneflag = 1; oparams->mech_ssf = 0; oparams->maxoutbuf = 0; oparams->encode_context = NULL; oparams->encode = NULL; oparams->decode_context = NULL; oparams->decode = NULL; oparams->param_version = 0; oparams->authid = text->authid; return SASL_OK; } SLAPD.LOG OF THE CRASH CASE (WITH OUR ADDED SYSLOGS): Feb 4 12:09:15 yavcentos slapd: SASL [conn=48] Debug MMYMECH====================== SERVER mymech_server_mech_step END == Feb 4 12:09:15 yavcentos mymech: sasl.c label slap_sasl_authorize Feb 4 12:09:15 yavcentos slapd: SASL proxy authorize [conn=48]: authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:09:15 yavcentos slapd: conn=48 op=4 BIND authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:09:15 yavcentos slapd: SASL Authorize [conn=48]: proxy authorization allowed authzDN="" Feb 4 12:09:15 yavcentos mymech: sasl.c label1 Feb 4 12:09:15 yavcentos mymech: result.c label2 Feb 4 12:09:15 yavcentos slapd: send_ldap_sasl: err=0 len=-1 Feb 4 12:09:15 yavcentos mymech: result.c label6a Feb 4 12:09:15 yavcentos mymech: result.c label61 Feb 4 12:09:15 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:09:15 yavcentos mymech: result.c label61b Feb 4 12:09:15 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x8926cb0 rs=0x17551a0 Feb 4 12:09:15 yavcentos mymech: connection.c label1 Feb 4 12:09:15 yavcentos mymech: connection.c label1a Feb 4 12:09:15 yavcentos mymech: connection.c label11a Feb 4 12:09:15 yavcentos mymech: connection.c label111a Feb 4 12:09:15 yavcentos mymech: connection.c label12a Feb 4 12:09:15 yavcentos mymech: connection.c label12a op->o_tmpfree=0x809c3e8 op->orb_edn.bv_val=uid=alfredo@yavcentos,ou= people,dc=my-domain,dc=com op->orb_edn.bv_len=51 op->o_tmpmemctx=0x8926c10 (slab malloc context) END SLAPD.LOG OF A SUCCESSFUL LOGIN CASE (WITH OUR ADDED SYSLOGS): Feb 4 12:13:13 yavcentos mymech: sasl.c label slap_sasl_authorize Feb 4 12:13:13 yavcentos slapd: SASL proxy authorize [conn=3]: authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:13:14 yavcentos slapd: conn=3 op=4 BIND authcid="alfredo@yavcentos" authzid="alfredo@yavcentos" Feb 4 12:13:14 yavcentos slapd: SASL Authorize [conn=3]: proxy authorization allowed authzDN="" Feb 4 12:13:14 yavcentos mymech: sasl.c label1 Feb 4 12:13:14 yavcentos mymech: result.c label2 Feb 4 12:13:14 yavcentos slapd: send_ldap_sasl: err=0 len=-1 Feb 4 12:13:14 yavcentos mymech: result.c label6a Feb 4 12:13:14 yavcentos mymech: result.c label61 Feb 4 12:13:14 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:13:14 yavcentos mymech: result.c label61b Feb 4 12:13:14 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x86667b8 rs=0x51271a0 Feb 4 12:13:14 yavcentos mymech: connection.c label1 Feb 4 12:13:14 yavcentos mymech: connection.c label1a Feb 4 12:13:14 yavcentos mymech: connection.c label11a Feb 4 12:13:14 yavcentos mymech: connection.c label111a Feb 4 12:13:14 yavcentos mymech: connection.c label12a Feb 4 12:13:14 yavcentos mymech: connection.c label12a op->o_tmpfree=0x809c3e8 op->orb_edn.bv_val=uid=alfredo@yavcentos,ou= people,dc=my-domain,dc=com op->orb_edn.bv_len=51 op->o_tmpmemctx=0x86660c0 (slab malloc context) Feb 4 12:13:14 yavcentos mymech: connection.c label13a Feb 4 12:13:14 yavcentos mymech: connection.c label14a Feb 4 12:13:14 yavcentos mymech: connection.c label15a Feb 4 12:13:14 yavcentos mymech: connection.c label151a Feb 4 12:13:14 yavcentos mymech: connection.c label151b Feb 4 12:13:14 yavcentos mymech: connection.c label2 Feb 4 12:13:14 yavcentos slapd: conn=3 op=4 BIND dn="uid=alfredo@yavcentos,ou=people,dc=my-domain,dc=com" mech=MYMECH sasl_ ssf=0 ssf=0 Feb 4 12:13:14 yavcentos slapd: do_bind: SASL/MYMECH bind: dn="uid=alfredo@yavcentos,ou=people,dc=my-domain,dc=com" sasl_ss f=0 Feb 4 12:13:14 yavcentos mymech: connection.c label3 Feb 4 12:13:14 yavcentos mymech: result.c label61c Feb 4 12:13:14 yavcentos mymech: result.c label61d Feb 4 12:13:14 yavcentos mymech: result.c label61d2 Feb 4 12:13:14 yavcentos mymech: result.c label61e Feb 4 12:13:14 yavcentos slapd: send_ldap_response: msgid=5 tag=97 err=0 Feb 4 12:13:14 yavcentos mymech: result.c label1 Feb 4 12:13:14 yavcentos mymech: result.c label11 Feb 4 12:13:14 yavcentos mymech: result.c label12 Feb 4 12:13:14 yavcentos mymech: result.c label13 Feb 4 12:13:14 yavcentos mymech: result.c label14 Feb 4 12:13:14 yavcentos mymech: result.c label14e Feb 4 12:13:14 yavcentos mymech: result.c label14f Feb 4 12:13:14 yavcentos mymech: result.c label14g Feb 4 12:13:14 yavcentos mymech: result.c label14h Feb 4 12:13:14 yavcentos mymech: result.c label15 Feb 4 12:13:14 yavcentos mymech: result.c label16 Feb 4 12:13:14 yavcentos mymech: result.c label18 Feb 4 12:13:14 yavcentos mymech: result.c label19 Feb 4 12:13:14 yavcentos mymech: result.c label20 Feb 4 12:13:14 yavcentos mymech: result.c label21 Feb 4 12:13:14 yavcentos mymech: result.c label6b e qui2 Feb 4 12:13:14 yavcentos mymech: daemon: activity on 1 descriptor Feb 4 12:13:15 yavcentos slapd: daemon: activity on: Feb 4 12:13:15 yavcentos slapd: 13r Feb 4 12:13:15 yavcentos slapd: Feb 4 12:13:15 yavcentos slapd: daemon: read active on 13 Feb 4 12:13:15 yavcentos slapd: connection_get(13) Feb 4 12:13:15 yavcentos slapd: connection_get(13): got connid=3 Feb 4 12:13:15 yavcentos slapd: connection_read(13): checking for input on id=3 Feb 4 12:13:15 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:15 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 4 12:13:15 yavcentos slapd: conn=3 op=4 RESULT tag=97 err=0 text= Feb 4 12:13:15 yavcentos mymech: sasl.c label4 Feb 4 12:13:15 yavcentos slapd: <== slap_sasl_bind: rc=0 Feb 4 12:13:15 yavcentos mymech: bind.c do_bind label1 Feb 4 12:13:15 yavcentos slapd: do_bind Feb 4 12:13:15 yavcentos slapd: conn=3 op=5 BIND anonymous mech=implicit ssf=0 Feb 4 12:13:15 yavcentos slapd: >>> dnPrettyNormal: <> Feb 4 12:13:15 yavcentos slapd: <<< dnPrettyNormal: <>, <> Feb 4 12:13:15 yavcentos slapd: do_bind: version=3 dn="" method=128 Feb 4 12:13:15 yavcentos slapd: conn=3 op=5 BIND dn="" method=128 Feb 4 12:13:15 yavcentos mymech: sasl.c label slap_sasl_reset Feb 4 12:13:15 yavcentos slapd: send_ldap_result: conn=3 op=5 p=3 Feb 4 12:13:15 yavcentos slapd: send_ldap_result: err=0 matched="" text="" Feb 4 12:13:15 yavcentos mymech: result.c label22a Feb 4 12:13:15 yavcentos mymech: result.c label61 Feb 4 12:13:15 yavcentos mymech: result.c label61a (tra qui) Feb 4 12:13:15 yavcentos mymech: result.c label61b Feb 4 12:13:15 yavcentos mymech: result.c label61b2 op->o_callback->sc_response=0x805e1fc op=0x8668158 rs=0x2afc1a0 Feb 4 12:13:15 yavcentos mymech: connection.c label1 Feb 4 12:13:15 yavcentos mymech: connection.c label3 Feb 4 12:13:15 yavcentos mymech: result.c label61c Feb 4 12:13:15 yavcentos mymech: result.c label61d Feb 4 12:13:15 yavcentos mymech: result.c label61d2 Feb 4 12:13:15 yavcentos mymech: result.c label61e Feb 4 12:13:15 yavcentos slapd: send_ldap_response: msgid=6 tag=97 err=0 Feb 4 12:13:15 yavcentos mymech: result.c label1 Feb 4 12:13:15 yavcentos mymech: result.c label11 Feb 4 12:13:15 yavcentos mymech: result.c label12 Feb 4 12:13:15 yavcentos mymech: result.c label13 Feb 4 12:13:15 yavcentos mymech: result.c label14 Feb 4 12:13:15 yavcentos mymech: result.c label14e Feb 4 12:13:15 yavcentos mymech: result.c label14f Feb 4 12:13:15 yavcentos mymech: result.c label14g Feb 4 12:13:15 yavcentos mymech: result.c label14h Feb 4 12:13:15 yavcentos mymech: result.c label15 Feb 4 12:13:15 yavcentos mymech: result.c label16 Feb 4 12:13:15 yavcentos mymech: result.c label18 Feb 4 12:13:15 yavcentos mymech: result.c label19 Feb 4 12:13:16 yavcentos mymech: result.c label20 Feb 4 12:13:16 yavcentos mymech: result.c label21 Feb 4 12:13:16 yavcentos mymech: result.c label22b Feb 4 12:13:16 yavcentos mymech: result.c label5 e qui1 Feb 4 12:13:16 yavcentos slapd: conn=3 op=5 RESULT tag=97 err=0 text= Feb 4 12:13:16 yavcentos slapd: do_bind: v3 anonymous bind Feb 4 12:13:15 yavcentos mymech: daemon: activity on 1 descriptor Feb 4 12:13:16 yavcentos slapd: daemon: activity on: Feb 4 12:13:16 yavcentos slapd: 13r Feb 4 12:13:16 yavcentos slapd: Feb 4 12:13:16 yavcentos slapd: daemon: read active on 13 Feb 4 12:13:16 yavcentos slapd: connection_get(13) Feb 4 12:13:16 yavcentos slapd: connection_get(13): got connid=3 Feb 4 12:13:16 yavcentos slapd: connection_read(13): checking for input on id=3 Feb 4 12:13:16 yavcentos slapd: ber_get_next on fd 13 failed errno=0 (Success) Feb 4 12:13:16 yavcentos slapd: connection_read(13): input error=-2 id=3, closing. Feb 4 12:13:16 yavcentos slapd: connection_closing: readying conn=3 sd=13 for close Feb 4 12:13:16 yavcentos slapd: connection_close: conn=3 sd=-1 Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_close Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:16 yavcentos slapd: SASL [conn=-1] Debug: MMYMECHSERVER mymech_server_mech_dispose Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:16 yavcentos slapd: SASL [conn=-1] Error: MMYMECHSERVER mymech_server_mech_dispose: start - receives *conn_co ntext=0x8666a10 *utils=0x8666188 Feb 4 12:13:16 yavcentos mymech: sasl.c label slap_sasl_log Feb 4 12:13:17 yavcentos slapd: SASL [conn=-1] Error: MMYMECHSERVER mymech_server_mech_dispose Feb 4 12:13:17 yavcentos slapd: daemon: removing 13 Feb 4 12:13:17 yavcentos slapd: conn=3 fd=13 closed (connection lost) Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: activity on 1 descriptor Feb 4 12:13:17 yavcentos slapd: daemon: activity on: Feb 4 12:13:17 yavcentos slapd: Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=7 active_threads=0 tvp=NULL Feb 4 12:13:17 yavcentos slapd: daemon: epoll: listen=8 active_threads=0 tvp=NULL END Compile and link options of mymech: gcc -I ..... -v -Wall -W -O2 -MT mymech.lo -MD -MP -MF .deps/mymech.Tpo -c mymech.c -fPIC -DPIC -o mymech.lo gcc -shared mymech.lo mymech _init.lo plugin_common.lo -lpthread -lcrypt -lresolv -lc -Wl,-soname -Wl,lib mymech.so.2 -o .libs/lib mymech.so.2.0.22 Would you have a clue or a though for us about some further check to do over either our code or compile options, (maybe particularly on the thread-safe topic)? Would you suggest some thread safe programming strategy? Many many thanks Francesco Grossi

2 6

Question about subtree renaming
by Philipp Foeckeler 14 Feb '09

14 Feb '09

Hi, Could someone explain me please the prerequisites for subtree renames/moves support by slapd (LDAP ModifyDN for non-leaf objects)? Currently i use slapd 2.2.6-37.19 with bdb backend without. What backend do i need to support subtree renames/moves? What slapd versions could support it? Do i need any special config for this? I understand that Overlay salpo-refint would be a good idea, any other overlays i should use then? Thank you, Philipp

2 1

OpenLDAP coredumps on startup (Solaris 10)
by Daniel Hoffend 14 Feb '09

14 Feb '09

Hello I'm setting up an openldap directory server (2.4.13) including a 2nd one for as backup/failover partner. After i compiled everything, installing, configuring everything (database, sync, schema, etc) and imported the basic LDAP Layout (ou=Users,ou=Groups, etc), I wanted to use this directory as Userdirectory for Userauthentication on ldap. I was switching user/group lookups using the 'ldapclient' command and modified to /etc/nsswitch.conf to refer for "files ldap" for passwd and group. Everything seems to work. 'genent passwd' and 'getent group' is listing my ldap user and groups. But when i try to restart the slapd server it crashes sometimes with a coredump. ---------------------------------------------------------------------- # /usr/local/libexec/slapd -d 65535 -u openldap -g openldap @(#) $OpenLDAP: slapd 2.4.13 (Jan 30 2009 12:02:48) $ root@ldapserver:/usr/local/src/openldap-2.4.13/servers/slapd ldap_pvt_gethostbyname_a: host=ldapserver, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened ldap_create Bus Error (core dumped) ---------------------------------------------------------------------- Not everytime, sometimes several times in a row, sometimes after a 2nd start. I've no clue what it could be. In the ldap logfile, i found the 2 following lines ---------------------------------------------------------------------- an 30 16:26:56 ldapserver slapd[9494]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported Jan 30 16:26:56 ldapserver slapd[9494]: [ID 555073 local4.error] tid= 1: multiple threads per connection not supported ---------------------------------------------------------------------- I started to run the slapd server using "truss" to see when the server starts to coredump. ---------------------------------------------------------------------- # truss /usr/local/libexec/slapd -d 65535 -u openldap -g openldap [...] open("/etc/nsswitch.conf", O_RDONLY|O_LARGEFILE) = 9 fcntl(9, F_DUPFD, 0x00000100) Err#22 EINVAL read(9, " #\n # C o p y r i g h".., 1024) = 1024 read(9, " g u r e i t o u t ".., 1024) = 245 read(9, 0xFF092400, 1024) = 0 close(9) = 0 fstat(3, 0xFFBFCAE8) = 0 time() = 1233329411 getpid() = 9512 [9511] putmsg(3, 0xFFBFC1A0, 0xFFBFC194, 0) = 0 open("/var/run/syslog_door", O_RDONLY) = 9 door_info(9, 0xFFBFC0D8) = 0 getpid() = 9512 [9511] door_call(9, 0xFFBFC0C0) = 0 close(9) = 0 fstat(3, 0xFFBFCB88) = 0 time() = 1233329411 getpid() = 9512 [9511] putmsg(3, 0xFFBFC240, 0xFFBFC234, 0) = 0 open("/var/run/syslog_door", O_RDONLY) = 9 door_info(9, 0xFFBFC178) = 0 getpid() = 9512 [9511] door_call(9, 0xFFBFC160) = 0 close(9) = 0 Incurred fault #5, FLTACCESS %pc = 0x0008E1FC siginfo: SIGBUS BUS_ADRALN addr=0x00000191 Received signal #10, SIGBUS [default] siginfo: SIGBUS BUS_ADRALN addr=0x00000191 ---------------------------------------------------------------------- It looks like after reading nsswitch.conf, the server starts to crash. I changed the following lines in the nsswitch.conf and the server starts fine without any further problems. (even 20x in a row) ---------------------------------------------------------------------- Before: group files ldap After: group files ---------------------------------------------------------------------- Another thing is: If the server could startup without problems, it never crashed again. It's only sometimes during the initial startup. I would be happy if anyone could help me or point me what i could adjust. If needed i could provide more information. -- Best regards Daniel Hoffend

6 10

run time link options
by Brett ＠Google 14 Feb '09

14 Feb '09

Is there any likelyhood of -R${PREFIX}/lib making it into the default build options to help mitigate system library mismatches ? Likewise a -with-bdb-home=/my/berkeley/home, which results in a -L/my/berkeley/home/lib and/or -R/my/berkeley/home/lib option being added to the LDFLAGS variable (-L in the case of a static build, -L and -R in the case of a dynamic build) and -I/my/berkeley/home/include being added to CPPFLAGS ? I guess -R may not be available on every platform, buy maybe the presence of -R is detectable ?

1 0

upgrading an openldap v1 ldbm database to a v2 bdb database?
by Kevin Martin 13 Feb '09

13 Feb '09

So I've got an openldap v1 database with .oc.conf and .at.conf files describing the database that get included in the slapd.conf and I need to be able to migrate to a v2 database (bdb or ldbm, I don't care which). I find no mention of how to migrate the .oc and/or .at file entries to a usable .schema/(s) file(s) and I apparently can't ldapsearch and dump the schema from the old database (using ldapsearch -b cn=schema -L “(objectclass=*)” )...it doesn't find a cn=schema. I can copy the ldbm format ldap database lock, stock, and barrel from the old machine to a new machine but ldap2 won't allow me to include the .at.conf and .oc.conf files that describe the database. I've also dumped the old database entries into a .ldif file at this point but have nowhere to import it to. All constructive thoughts appreciated. Kevin

3 2

Can OpenLDAP get password from AD
by Duong Pham Tung 13 Feb '09

13 Feb '09

Hi, I am building a solution for web-based application authentication using OpenLDAP as a backend data source. But, in my case, OpenLDAP acts as a proxy and all user information are stored on AD servers. I can get some field from AD to OpenLDAP, but it is not enough for my apps to authentication user because OpenLDAP can’t get password field from ADs. So, can OpenLDAP have other solutions to solve my problem? Thanks and Best regards, Phạm Tùng Dương

5 5

kerberosSecurityObject object Class
by Chavez, James R. 12 Feb '09

12 Feb '09

Hello List, I am inquiring about the kerberosSecurityObject object class and the krbName Attribute type. How can these be utilized in the LDAP environment? I do have an associated kerberos realm that I would not mind using for authentication. Can these help me to leverage this? Any pointers to documentation is appreciated as are any explanations. I have extended the OPenLDAP schema to include the kerberos schema in a test environment but am unsure how to leverage it. Thanks James CONFIDENTIALITY This e-mail message and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail message, you are hereby notified that any dissemination, distribution or copying of this e-mail message, and any attachments thereto, is strictly prohibited. If you have received this e-mail message in error, please immediately notify the sender and permanently delete the original and any copies of this email and any prints thereof. ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING. Notwithstanding the Uniform Electronic Transactions Act or the applicability of any other law of similar substance and effect, absent an express statement to the contrary hereinabove, this e-mail message its contents, and any attachments hereto are not intended to represent an offer or acceptance to enter into a contract and are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any other person or entity.

1 0

Multiple Databases not replicating.
by Tom Cooper 12 Feb '09

12 Feb '09

Hi all, I am running openldap-2.4.12 in a mirror configuration with each master also having a slave updated with syncrepl. Each master contains multiple databases but replication between the masters happens only for the first database. I have checked my configuration and there is nothing obvious. An extract of my slapd.conf follows: # Free Radius OpenLDAP Server database bdb suffix "dc=radius,dc=xxxxxxx,dc=co,dc=za" rootdn "cn=Manager,dc=radius,dc=xxxxxxxx,dc=co,dc=za" directory /var/lib/ldapradius rootpw XXXXXXXXX access to * by * read overlay syncprov syncprov-checkpoint 5 1 syncrepl rid=001 provider=ldap://dev-ldap-master-03.xxxxxxxx.co.za bindmethod=simple binddn="cn=Manager,dc=radius,dc=xxxxxxxxx,dc=co,dc=za" credentials=XXXXXXXXXX searchbase="dc=radius,dc=xxxxxxxxx,dc=co,dc=za" schemachecking=off type=refreshAndPersist interval=00:00:05:00 retry="60 +" mirrormode true # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq ################################################################### # Portal OpenLDAP Server database bdb suffix "dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" rootdn "cn=Manager,dc=portal,dc=xxxxxxxxxxx,dc=co,dc=za" directory /var/lib/ldapPortal rootpw XXXXXXXXXXXXXXXX access to * by * read overlay syncprov syncprov-checkpoint 5 1 syncrepl rid=002 provider=ldap://dev-ldap-master-03.xxxxxxxxxxx.co.za bindmethod=simple binddn="cn=Manager,dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" credentials=XXXXXXXXXXX searchbase="dc=portal,dc=xxxxxxxxxx,dc=co,dc=za" schemachecking=off type=refreshAndPersist interval=00:00:05:00 retry="60 +" mirrormode true # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index fnbConnectProfileId eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq Thanks, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical