openldap-technical

openldap-technical@openldap.org

2 participants
9961 discussions

bindpw and SSHA
by Nick Kasparidis 29 Sep '08

29 Sep '08

Hello everyone, I have a small problem setting up my ldap client. The issue comes from trying to force authenticated queries. So I have set the following lines in my slapd.conf disallow bind_anon require authc on the client side I have added the following lines to my ldap.conf binddn cn=manager,dc=domain,dc=com bindpw {SSHA}<the hash> Using this approach I cannot get a connection to the ldap server. I checked through wireshark, and I get a packet bindResponse(1) invalidCredentials () If on the other hand I when use the cleartext password, instead of SSHA then everything works fine. I am not sure if it is important but the 'bindRequest(1) simple' packet contains the text {SSHA}<hash> exactly as it appears in the ldap.conf file. Should it be processed on the client end? I have created the SSHA hash using slappasswd on the server machine, and then I copied and pasted the text across to my ldap.conf file. The hashes used by the server and client are identical. Have I done something wrong, should I encrypt the password using another way? Also if there is another way to initiate an authenticated query without using plaintext passwords, please let me know. By the way my server is openldap 2.4.10 on solaris 10 (sparc) and the client I experiment with openldap 2.2.13-12 on RHEL4.7 (i386) Thank you Nick

2 3

Error with OpenLDAP
by Arun NAIR 28 Sep '08

28 Sep '08

Hey Guys, My configuration I'm not sure doesn't seems to be working too well, it was working this morning now its not. If you could analyze it for me and tell me how I can achieve 100% success with this would be great. Thanks in advance for all the time extended Regards, Arun Nair The current error that I'm getting is * [root@centserver ~]# service ldap start Checking configuration files for slapd: WARNING: No dynamic config support for database sql. backend_startup_one: bi_db_open failed! (1) slap_startup failed (test would succeed using the -u switch) [FAILED] * *My slapd.conf file is as under: * # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema loglevel -1 # Define global ACLs to disable default read access. defaultaccess read access to * by * read access to * by self write # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap moduleload back_sql.la ####################################################################### # sql database definitions ####################################################################### database sql suffix dc=abc,dc=corp rootdn cn=Manager,dc=abc,dc=corp rootpw {CRYPT}2aFSZAS2uxw.. dbname ldap dbuser ldap dbpasswd password subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_query "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no TLSCertificateFile /etc/openldap/ldap.cert TLSCertificateKeyFile /etc/openldap/ldap.key *My odbc.ini configuration is as under: * *[ODBC Data Sources] *myodbc5 = MyODBC 5.1.5 Driver DSN *[myodbc5] *Driver = /usr/lib/libmyodbc5.so Description = LDAP Connector SERVER = localhost PORT = USER = ldap Password = password Database = ldap SOCKET = /var/lib/mysql/mysql.sock

1 0

index_param failed
by Denis BUCHER 27 Sep '08

27 Sep '08

Hello ! I have cyrus (IMAP mailserver) working perfectly based on openldap, BUT I have some strange messages in the logs that I would like to understand/correct : * bdb_equality_candidates: (accountStatus) index_param failed (18) * bdb_equality_candidates: (virtualdomain) index_param failed (18) * bdb_equality_candidates: (description) index_param failed (18) This is exactly ONE session where one of our users (description=dbucher(a)ourcompany.ch) is sending a mail to the outside world (dbucher(a)destdomain.ch). If someone would be nice enough to explain me exactly what it means, and how to solve this problem, it would be very nice... I already searched a lot to find help on this topic, without success, I found some possible solutions but I don't know exactly how to test them : 1. define the approriate indexes in slapd.conf, reindex and restart 2. Check the actual index files to make sure they're correct permissions, etc, and then try a db_recover. In slapd.conf I have : index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub I tryed to add : index accountStatus,description eq but : # slapindex bdb_db_open: database already in use backend_startup_one: bi_db_open failed! (-1) slap_startup failed Thanks a lot in advance for your help Denis Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND anonymous mech=implicit ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1273 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(|(&(objectClass=CourierMailAccount)(mail=dbucher@ourcompany.ch)(accountStatus=active))(&(cn=mailadmin)(description=dbucher@ourcompany.ch)))" Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SRCH attr=dn Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (accountStatus) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (description) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1274 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND anonymous mech=implicit ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND dn="cn=dbucher,ou=users,ou=ourcompany.ch,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 BIND dn="cn=dbucher,ou=users,ou=ourcompany.ch,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=21436 op=1275 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=dbucher(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24035 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=dbucher(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=4 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=(a)destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24036 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 fd=20 ACCEPT from IP=127.0.0.1:41775 (IP=0.0.0.0:389) Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" method=128 Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 BIND dn="cn=mailadmin,ou=mailservices,dc=ourcompany,dc=ch" mech=SIMPLE ssf=0 Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=0 RESULT tag=97 err=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierMailAlias)(mail=destdomain.ch)(accountStatus=active))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SRCH attr=maildrop Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SRCH base="ou=mailservices,dc=ourcompany,dc=ch" scope=2 deref=0 filter="(&(objectClass=CourierDomainAlias)(virtualdomain=destdomain.ch))" Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SRCH attr=virtualdomain Sep 11 20:19:29 mailhost slapd[2099]: <= bdb_equality_candidates: (virtualdomain) index_param failed (18) Sep 11 20:19:29 mailhost slapd[2099]: conn=24038 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 11 20:19:35 mailhost slapd[2099]: conn=24038 fd=20 closed (connection lost)

2 4

DB_KEYEXIST: Key/data pair already exists
by Stelios A. 26 Sep '08

26 Sep '08

Hello all, I have 2 users with identical Full Name and their ldif change on mail, uid, username and home directory in order to avoid ldap constraints. However, even though I have no other constraints apart from unique_attributes uid mail uidNumber homeDirectory I'm getting the following error and cannot add the 2nd user. root@masterldap:~# slapadd -l debug.ldif -f /etc/ldap/slapd.conf => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="cn=Full Name,ou=Users,dc=mydomain,dc=com" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) root@masterldap:~# Any ideas how I can see which attribute is causing the problem? -- Stelios A

3 4

RFT0001 : Request For Thoughts
by Christopher Barry 24 Sep '08

24 Sep '08

Hi everyone, If this post here is in poor taste, please pardon my interruption. It's just that I figured those here would have a high probability of trying to do as I am trying to do. Background: I'm a debian-head from the early 90's, but I'm new to OpenLDAP, and this is my first post here. I'm about halfway done with Mastering OpenLDAP, and I've been lurking here for a month or so, trying to understand how things work, and looking for questions like mine. I also just read Kerberos, the definitive guide as a primer into understanding how my team can make everyone 'Just Get Along(tm)' in a multi-platform global enterprise, while leveraging open source projects. Rough Goals: * We're exploring ways in which we can have a single user/group database for everything, everywhere in our domain. * Additionally, we want as 'SSO' an environment as possible. * We also want to keep, and even extend all the other NIS functionality we use today - only without the NIS limitations. * We also need to be able to phase it in, or even have it overlap with our current situation for a period, so it's not an all-or-nothing kind of change. The Parts Bin: There's a bunch of parts around, and they all kind of fit together, but to my current understanding anyway, seem to create a few different incomplete solutions, such as: * Samba/Winbind/Kerberos (possibly backed by OpenLDAP) * OpenLDAP/Kerberos with trusts to AD * AD using 2003R2 and possibly custom schema modifications if required. My question really is what are others doing to solve this type of problem? Architecturally, what is the best approach given the above desired outcome? Thanks to all for your thoughts and insight on this, Regards, Christopher Barry Systems Engineer QLogic

2 3

Re: Configuring MirrorMode via cn=config
by p_pavlos＠freemail.gr 24 Sep '08

24 Sep '08

> > ----- "Pavlos Parissis" <p_pavlos(a)freemail.gr> wrote: > > > Hello all, > > > > I am writing to ask for a confirmation on the steps that I followed > > to > > configure MirrorMode replication via cn=config > > > > The step is the typical, 2 nodes where m1 is the first node and m2 is > > the second one. > > > > 1) start m1 > > 2) create dit > > 3) add mirrormode_user > > OK. > > > 4) slaptest -f slapd.conf -F slapd.d > > chown -R ds-ldap.ds-ldap slapd.d > > Why do this? Why not start m1 from a basic slapd.d and then add all > above on the fly via cn=config? Because I don't have a basic slapd.d, the dir is empty. The replica configuration are added via cn=config when I have converted my basic slapd.conf to slapd.d on both servers. I don't think that I do something wrong here or stupid, what do you think? > > 5) stop m1 ;start m1 > > 6) enable sync log > > 7) start m2 > > 8) slaptest -f slapd.conf -F slapd.d > > chown -R ds-ldap.ds-ldap slapd.d > > 9) stop m2;start m2 > > 10) enable sync log > > 11) add replication configuration on m1 [1] > > 12) add replication configuration on m2 [2] > > See above. Cheers, Pavlos

1 0

accesslog misses out on entries during slapd failure
by Sean Burford 23 Sep '08

23 Sep '08

Hi, An add operation was underway on my HDB backend. Around one second later, a large group modification ran slapd out of memory. Slapd was then unresponsive until a watchdog killed and restarted it two minutes later. The add operation successfully modified the database but never appeared in the audit log nor the syncrepl access log, so it was never replicated to the replicas. Is it by design that modifications hit the database before being recorded in the audit and access logs? This is with OpenLDAP 2.3.39, BDB 4.4. Logs: Sep 22 09:15:16 host slapd[27404]: conn=102591 op=5 ADD dn="uid=username,ou=people,dc=example,dc=com" ... Sep 22 09:15:17 host slapd[27404]: conn=99395 op=131974 MOD dn="cn=biggroup,ou=groups,dc=example,dc=com" Sep 22 09:15:17 host slapd[27404]: conn=99395 op=131974 MOD attr=member memberuid Sep 22 09:15:17 host slapd[27404]: ch_malloc of 242464 bytes failed Sep 22 09:15:17 host slapd[27404]: conn=102732 op=2 UNBIND Sep 22 09:15:17 host slapd[27404]: conn=102732 fd=124 closed Sep 22 09:17:33 host slapd: allocation failed: 0 Sep 22 09:17:33 host slapd: allocation failed: 12 Config snippet: database hdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw ... directory /var/lib/ldap cachesize 25000 idlcachesize 75000 checkpoint 512 1 lastmod on ... indexes ... ... ACLs ... overlay auditlog auditlog /var/lib/ldif/auditlog/example.com.ldif overlay syncprov syncprov-sessionlog 1000 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 02+23:46 01+23:46 -- Thanks, Sean Burford

2 1

slapd stops accepting connections - OpenSolaris
by Josh Rivel 23 Sep '08

23 Sep '08

Hello. I am running OpenLDAP 2.4.11 on OpenSolaris snv_91 on a Sun X2200. After a few minutes, the box stops accepting connections on port 389, even though the slapd process is still running, and the machine still shows itself listening on port 389. I am attaching my slapd.conf, ldap.conf, and DB_CONFIG files. I had the same behaviour with the Blastwave package which was version 2.3.39, so I figured "OK Let me upgrade to 2.4.11" but same behaviour. I have roughly 800 OpenSolaris clients that need to connect to the box, and I currently see roughly 300 established connections to the server on port 389. Thanks, Josh

1 0

Pls help : how to make mail id as unique attribute
by Somnath Pal 22 Sep '08

22 Sep '08

Hi list, We have an openldap server 2.4 on redhat enterprise linux 4 update 7. We import users from Windows Active Directory(AD) running Windows Server 2003. We are mapping the mail attribute from the source (AD) to the destination (openldap) & want the mail id to be unique accross the ldap directory so that no two email ids will be same while replicating from different Source . How to achive that ? Do we have to modify our schema ? We are using the following schema in our slapd.conf - include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema Can you pls help ? Thanks & Regards, Somnath Pal Server Management Unit International Computing Centre (ICC) E-mail: pal(a)unicc.org

2 2

Configuring MirrorMode via cn=config
by Pavlos Parissis 21 Sep '08

21 Sep '08

Hello all, I am writing to ask for a confirmation on the steps that I followed to configure MirrorMode replication via cn=config The step is the typical, 2 nodes where m1 is the first node and m2 is the second one. 1) start m1 2) create dit 3) add mirrormode_user 4) slaptest -f slapd.conf -F slapd.d chown -R ds-ldap.ds-ldap slapd.d 5) stop m1 ;start m1 6) enable sync log 7) start m2 8) slaptest -f slapd.conf -F slapd.d chown -R ds-ldap.ds-ldap slapd.d 9) stop m2;start m2 10) enable sync log 11) add replication configuration on m1 [1] 12) add replication configuration on m2 [2] I did testing on the replication and it worked. But, I noticed that when I configured the syncpro overlay after the replicas both servers stopped responding. I will try to reproduce that issue and get some debug messages, may be I didn't something wrong or it is a bug. Cheers, Pavlos [1] Replication configuration for node m1 dn: cn=config changetype: modify add: olcServerID olcServerID: 1 dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcLimits olcLimits: {0}dn.base="cn=mirrormode_user,o=solution.acision.com" size.soft=un limited size.hard=unlimited time.soft=unlimited time.hard=unlimited - add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://m2 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://m1 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcMirrorMode olcMirrorMode: TRUE - add: olcDbIndex olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq ############################### [2] replication configuration for node m2 dn: cn=config changetype: modify add: olcServerID olcServerID: 2 dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcLimits olcLimits: {0}dn.base="cn=mirrormode_user,o=solution.acision.com" size.soft=un limited size.hard=unlimited time.soft=unlimited time.hard=unlimited - add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://m2 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://m1 bindmethod=simple timeout=0 network-ti meout=0 binddn="cn=mirrormode_user,o=solution.acision.com" credentials="mirro r" starttls=no filter="(objectclass=*)" searchbase="o=solution.acision.com" s cope=sub schemachecking=off type=refreshAndPersist retry="10 3 60 +" - add: olcMirrorMode olcMirrorMode: TRUE - add: olcDbIndex olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical