openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

RE: Some servers are delay synced...
by Quanah Gibson-Mount 01 Dec '08

01 Dec '08

Look for any change noting fixes to slapo-syncprov and/or syncrepl. --Quanah --On Monday, December 01, 2008 1:56 PM +0000 Bad Guy <badguy9588(a)hotmail.com> wrote: > Would you mind telling me the ITS# related to this ? > > I can't find it in the changes of 2.4.12 and 2.4.13 about this one. > > Thanks > >> Date: Mon, 1 Dec 2008 00:30:24 -0800 >> From: quanah(a)zimbra.com >> To: badguy9588(a)hotmail.com; openldap-technical(a)openldap.org >> Subject: Re: Some servers are delay synced... >> >> --On Monday, December 01, 2008 7:39 AM +0000 Bad Guy >> <badguy9588(a)hotmail.com> wrote: >> >> > Dear sir, >> > >> > We have got a N-way master (N=4) openldap running in version 2.4.11 >> > under linux environment. >> > >> > Any idea on this ? >> >> Yes, read the changelog for the changes between 2.4.11 and 2.4.13. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Principal Software Engineer >> Zimbra, Inc >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration > > > > __________________________________________________ > 用部落格分享照片、影音、趣味小工具和最愛清單，盡捊> 秀出你自己 — Windows Live Spaces -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Authenticate a user
by Mansour Al Akeel 01 Dec '08

01 Dec '08

Hello all, I am trying to create a user and authenticate this user. I need to give an admin a way to access and modify account. I was able to succeffuly add a user, but can not connect using this account. The only way I am able to connect is using the Manager's DN. I keep on getting invalid credentials. I have reset the password for this user few times to make sure it's correct. Still unable to authenticate. I am using JXplorer to connect to that server. Here's the corresponding section from the log file. I hope it helps. Dec 1 13:52:11 neptune slapd[13518]: >>> slap_listener(ldap:///) Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: do_bind Dec 1 13:52:11 neptune slapd[13518]: >>> dnPrettyNormal: <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: <<< dnPrettyNormal: <uid=user,dc=test,dc=com>, <uid=user,dc=test,dc=com> Dec 1 13:52:11 neptune slapd[13518]: do_bind: version=3 dn="uid=user,dc=test,dc=com" method=128 Dec 1 13:52:11 neptune slapd[13518]: bdb_dn2entry("uid=user,dc=test,dc=com") Dec 1 13:52:11 neptune slapd[13518]: send_ldap_result: conn=13 op=0 p=3 Dec 1 13:52:11 neptune slapd[13518]: send_ldap_response: msgid=1 tag=97 err=49 Dec 1 13:52:11 neptune slapd[13518]: connection_get(12): got connid=13 Dec 1 13:52:11 neptune slapd[13518]: connection_read(12): checking for input on id=13 Dec 1 13:52:11 neptune slapd[13518]: ber_get_next on fd 12 failed errno=0 (Success) Dec 1 13:52:11 neptune slapd[13518]: connection_closing: readying conn=13 sd=12 for close Dec 1 13:52:11 neptune slapd[13518]: connection_close: conn=13 sd=-1 I don't know what I am missing, but I have been trying to resolve this for few hours with no success.

1 1

how group work with samba & openldap ?
by franck dufau 01 Dec '08

01 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hye all, i have install samba as PDC with openldap authentification everything work fine. But i want to create différent group with différent privileges on folder How gestion of group work with Openldap authentification because users are not in /etc/passwd and domain group are not in /etc/group !? I don't find information about this... can you help me ? cordialement Franck Dufau -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkkz66UACgkQrKIazktK/hICSgCeOiQGmEHKk5qHGiC5sMTzyux7 uMgAn2LY3axBykW29YkGQy1k4+5vi0dE =hPaV -----END PGP SIGNATURE-----

2 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 01 Dec '08

01 Dec '08

---- Original message ---- >Date: Tue, 25 Nov 2008 15:52:57 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Monday, November 24, 2008 10:00 PM -0800 Quanah Gibson-Mount ><quanah(a)zimbra.com> wrote: > >> --On Monday, November 24, 2008 6:05 PM -0800 Quanah Gibson-Mount >> <quanah(a)zimbra.com> wrote: >> >>> --On Monday, November 24, 2008 9:00 PM -0500 William Jojo >>> <w.jojo(a)hvcc.edu> wrote: >>> >>>> >>>> >>>> ---- Original message ---- >>>>> Date: Thu, 20 Nov 2008 11:02:40 -0800 >>>>> From: Quanah Gibson-Mount <quanah(a)zimbra.com> >>>>> Subject: Re: Delta-sync symptom in 2.4.11 >>>>> To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org >>>>> >>>>> --On Thursday, November 20, 2008 10:38 AM -0500 William Jojo >>>>> <w.jojo(a)hvcc.edu> wrote: >>>>> >>>>> >>>>>> Otherwise this is just like test043, except or the missing dn's. :-) >>>>>> >>>>>> Any ideas? >>>>> >>>>> Try current RE24 CVS. There have been a number of replication related >>>>> fixes made since 2.4.11. >>>>> >>>> >>>> I just tried 2.4.13. The problem still persists. I will check out the >>>> CVS version in the morning. >>> >>> There's nothing different between RE24 and 2.4.13 at this point in time, >>> so there's no point in trying RE24 if you've tried 2.4.13 and it still >>> fails. >>> >>> I suggest you submit an ITS with a way to easily reproduce the issue. >> >> Also make sure to include your exact configuration on the master & >> replica, and any log messages at loglevel sync, so the contextCSN data is >> gathered. > >Also, does the replicator have unlimited time and size limits to search the >master with? > Quanah, Just got back from holiday to find that tests I launched before hand had completed successfully. I had realized that I had not set unlimited prior to my previous tests. Thank you very much for your persistence in following up. Although not a bug (thankfully), I did realize my ignorance of some configuration options. Cheers, Bill

1 0

Can join domain but cannot login
by Emil Sicad - ISD 01 Dec '08

01 Dec '08

Good day! I badly need your help. I can join the domain using the root but after restart i cannot login anymore My client is windows XP sp4. The message was this:` "The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect." i have already disable the following in Local Security Settings 1. Domain member: Digitally encrypt or sign secure channel data (always) 2. Domain member: Digitally encrypt secure channel data (when possible) 3. Domain member: Digitally sign secure channel data (when possible) 4. Domain member: Disable machine account password changes I can add and delete user using smbldap-useradd and smbldap-userdel and also using webmin 1.41 Pls help me with this. This is my config files: ######################################### -rw-r--r-- 1 root root 2715 Dec 1 18:15 smb.conf [global] idmap gid = 16777216-33554431 enable privileges = Yes passwd program = /usr/local/sbin/smbldap-passwd %u dns proxy = no netbios name = smbldap ldap passwd sync = yes idmap uid = 16777216-33554431 default = global dos charset = 850 local master = yes workgroup = fcb.net os level = 34 security = User log level = 0 log file = /var/log/samba/log.%m max log size = 500 socket options = TCP_NODELAY domain master = yes encrypt passwords = yes winbind use default domain = no keepalive = 10 template shell = /bin/false netbios aliases = smbldap.fcb.net password server = smbldap valid users = %U domain logons = yes encrypt passwords = yes unix charset = ISO8859-1 password server = smbldap # Samba-Ldap Declarations # passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=fcb.net,dc=. ldap suffix = dc=fcb.net,dc=. ldap delete dn = yes ldap ssl = on ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups add user script = /usr/local/sbin/smbldap-useradd -a "%u add machine script = /usr/local/sbin/smbldap-useradd -w "%u" add user to group script = /usr/local/smbldap-groupmod -m "%u" "%g" add group script = /usr/local/sbin/smbldap-groupadd -p '%g' set primary group script = /usr/local/sbin/smbldap-groupmod -g "%g" "%u" delete user script = /usr/local/sbin/smbldap-userdel -r "%u" delete group script = /usr/local/sbin/smbldap-groupdel '%g' delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" [netlogon] comment = Domain Logon Service path = /home/netlogon browseable = No [ISD] comment = Information Systems Division path = /home/isd valid users = @isd read only = No create mask = 0660 directory mask = 0770 [profiles] path = /home/samba/profiles valid users = %U, "@Domain Admins" ########################################## -rwxr-xr-x 1 ldap ldap 1010 Nov 28 16:29 slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/samba.schema allow bind_v2 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb directory /var/lib/ldap suffix "dc=fcb.net,dc=." rootdn "cn=Manager,dc=fcb.net,dc=." index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName eq,pres,sub index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq rootpw smbldap access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowLastChange by dn.children="dc=fcb.net,dc=." write by self write by anonymous auth by * none access to * by dn.children="dc=fcb.net,dc=." write by * read ###################################### -rw-r--r-- 1 ldap ldap 851 Dec 1 17:56 ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never host 127.0.0.1 base dc=fcb.net,dc=. #inserted nov 24, 2008 #rootbinddn cn=Manager,dc=fcb.net,dc=. rootbinddn cn=Manager,dc=fcb.net,dc=. nss_base_passwd dc=fcb.net,dc=. nss_base_shadow dc=fcb.net,dc=. nss_base_group dc=fcb.net,dc=. #Security Options ssl no pam_passwd md5 bind_policy soft TLS_CACERTDIR /etc/openldap/cacerts ######################################## -rw-r--r-- 1 root root 1119 Nov 27 13:38 smbldap.conf SID="S-1-5-21-2796061091-2530429657-3897351620" sambaDomain="smbldap" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" #verify="" #clientcert="" #clientkey="" suffix="dc=fcb.net,dc=." usersdn="ou=User,dc=fcb.net,dc=." computersdn="ou=Computers,dc=fcb.net,dc=." groupsdn="ou=Groups,dc=fcb.net,dc=." binddn="cn=Manager,dc=fcb.net,dc=." bindpasswd="smbldap" #idmapdn="fcb,${suffix}" #sambaUnixIdPooldn="sambaDomainName=workgroup,${suffix}" scope="sub" hash_encrypt="SSHA" crypt_salt_format="" userLoginShell="/bin/bash" userHome="/home/samba/users/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" userSmbHome="\\smbldap\home\samba\users\%U" userProfile="\\smbldap\home\samba\profiles\%U" userHomeDrive="H" userScript="%U.bat" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" ####################################### -rw------- 1 root root 428 Nov 25 18:34 smbldap_bind.conf slaveDN="cn=Manager,dc=fcb.net,dc=." slavePw="smbldap" masterDN="cn=Manager,dc=fcb.net,dc=." masterPw="smbldap" ############################################### -rw-r--r-- 1 root root 1658 Nov 29 15:14 /etc/nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: files ldap publickey: files automount: files ldap aliases: files Thanks in advance! Emil Sicad Cebu Mitsumi Inc Information Systems Division

1 0

{SSHA} for PHP
by Jack van Rock 01 Dec '08

01 Dec '08

Hi, I want to modify a website-login-system (PHP) to check passwords which are deocoded with SSHA. My script should compare the clear password, which I get from a FORM, with the SSHA-hash of the password, which is in the database (MySQL). The dates in the MySQL-DB comes from a LDAP. This is my script: <?php $password_sub = "test"; //Das Passwort erhalte ich über ein HTML-Formular $passsowrd_hash_db = base64_decode("e1NTSEF9aH...."); //Diesen base64-Hash erhalte ich aus der Datenbank. //Er wird gleich decodiert, da man daraus das $salt benötigt. //Dann hat er die Form {SSHA}hxtMi.... $salt = base64_decode(substr($passsowrd_hash_db , 32)); //Berechnung des $salt $hash = "{SSHA}" . base64_encode(pack("H*", sha1($password_sub.$salt)).$salt); ?> But the script doesn't work, because the generated hash isn't the same as the hash from the database. But I don't now, what's wrong? May someone help me? m@xx

2 1

Some servers are delay synced...
by Bad Guy 01 Dec '08

01 Dec '08

Dear sir, We have got a N-way master (N=4) openldap running in version 2.4.11 under linux environment. The 4 servers can be synced immediately. However, after running for several hours, 2 of the servers are synced immediately while the other 2 servers are synced after around 60 mins. Scenairo : - Server 1, 2, 3, 4 are synced. After running for several hours, the following symptoms occur : - update record in server 3, server 4 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 4, server 3 will be updated immediately, but server 1 and server 2 got the update 1 hour later. - update record in server 1, server 2 will be updated immediately, but server 3 and server 4 got the update 1 hour later. - update record in server 2, server 1 will be updated immediately, but server 3 and server 4 got the update 1 hour later. Server 1 and server 2 are in same LAN segment, server 3 and server 4 in another LAN segment. There are firewalls between server 1/2 and server 3/4, but for same LAN segment, no firewall in between, only firewall in between different LAN segment. Any idea for this 1 hour delay synced ? Every server are config with syncrepl as shown below : bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=ABCDE" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" # Performance tuning directives sizelimit 5000 threads 50 idletimeout 0 cachesize 10000 checkpoint 256 15 Also, from the LDAP log, it shows a lot of "cmp -1, too old" message. Also, from the log, some error message like the following is found : server01 slapd[6386]: do_syncrep2: rid=004 (-1) Can't contact LDAP server server01 slapd[6386]: do_syncrepl: rid=004 retrying server01 slapd[6386]: syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) server01 slapd[6386]: syncrepl_entry: rid=004 be_search (0) server01 slapd[6386]: syncrepl_entry: rid=004 cn=test1,ou=test,o=ABCD server01 slapd[6386]: syncrepl_entry: rid=004 be_modify (0) Any idea on this ? Thanks a lot.... _________________________________________________________________ 下載 Windows Live Messenger 8.5 搶鮮版，多元溝通、盡情分享，和即時傳訊好友線上同樂！— 立即下載 http://get.live.com/zh-cht-tw/betas/messenger_betas

2 1

SASL error
by Mansour Al Akeel 30 Nov '08

30 Nov '08

I am not able to modify a user from CLI. [root@neptune ~]# ldapsearch -D "cn=Manager,dc=test,dc=com" -W -b "dc=test,dc=com" -x -h localhost I get the all the enteries. However, When I do: [root@neptune ~]# ldapmodify -D "cn=Manager,dc=test,dc=com" -W -h localhost Enter LDAP Password: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database If I use -x option, it hangs there for ever after I enter the password. Any idea ?

2 2

hello
by Donny George 28 Nov '08

28 Nov '08

Hello I installed ldap client and software on two ubuntu machines. but when i try to log in with the phpldapadmin gui it displays Network Error (tcp_error) A communication error occurred: "Connection refused" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time. i am new to ldap and i cudnt really find a forum or thread which was talking about this problem. hope someone can help me -- Donny George

2 1

Community request: Real World OpenLDAP Deployments
by Gavin Henry 28 Nov '08

28 Nov '08

Dear All, I'd like to get some examples written up for http://www.openldap.org/doc/admin24/appendix-deployments.html If anyone is interested and allowed to share some information, I'd love to hear from you. The more strange the setup the better! Many thanks, Gavin. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical