openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

can syncrepl do this?
by Stefano Zanmarchi 06 Jun '08

06 Jun '08

Hi, I need to replicate in my local openldap server all the entries in a given subtree of a remote openldap server, but the two DITs differ. That means I'd like to replicate all entries under "dc=people,dc=A,dc=it" (remote server) to "dc=employees,dc=B,dc=it" (local server). Can syncrepl do that? Or is there another way to obtain this? Any help is greatly appreciated, thanks a lot, Stefano

1 0

Password Policy and SASL DIGEST-MD5
by alessandro patrissi 06 Jun '08

06 Jun '08

Hi everyone, I'm using openldap-2.4.8 and cyrus-sasl-2.1.22. I've enabled password policy in my OpenLdap Server and I've seen that when I authenticate myself using SASL DIGEST-MD5 I can make any searches even if my account is locked. In fact I have the following results: ./ldapsearch -b 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -D 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -x -W -e ppolicy '(objectClass=*)' Enter LDAP Password: ldap_bind: Invalid credentials (49); Account locked ./ldapsearch -b 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -W -Y DIGEST-MD5 -U apatrissi '(objectClass=*)' DIGEST-MD5 -U apatrissi '(objectClass=*)' Enter LDAP Password: SASL/DIGEST-MD5 authentication started SASL username: apatrissi SASL SSF: 128 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=apatrissi,ou=people,dc=my-domain,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # apatrissi, people, my-domain.com dn: uid=apatrissi,ou=people,dc=my-domain,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson ou: people cn: Alessandro Patrissi givenName: Alessandro sn: Patrissi uid: apatrissi userPassword:: YWxleA== mail: alessandro.patrissi(a)commprove.com telephoneNumber: +0039 description: test LDAP # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 Where I can look to solve the problem? Thanks a lot, Alessandro Patrissi

1 0

sasl problem with Scientific Linux / RedHat but not with debian ?!
by Bjørn Nachtwey 05 Jun '08

05 Jun '08

Dear all, I set up a ldap server and want to use sasl/kerberos5 for authetification. well, using debian/etch it works fine. using scientific linux 5.1 (SL5.1) it does not work, not even testsaslauthd works. the configuration of both systems is the same, besides hostname gives on debian just the name and on SL5.1 the FQN. i also tried to compile cyrus/sasl from sources -- just the same. sl being a clone of RHEL, does anyone have the same problem? does anyone have any idea? thanks & best regards, Bjørn -- ######################################################################## Dipl.-Ing. Bjørn Nachtwey Technische Universität Carolo-Wilhelmina zu Braunschweig Gauss-IT-Zentrum (GITZ) -- Abteilung Server Hans-Sommer-Straße 65, 38106 Braunschweig Telephon: +49 (0)531 / 391 - 5535 TeleFax: +49 (0)531 / 391 - 5549 http://www.tu-braunschweig.de/it mailto: b.nachtwey(a)tu-bs.de mailto: c0034031(a)tu-bs.de ######################################################################## PGP-Schluessel: http://www-public.tu-bs.de:8080/~nachtwey/bjoern_nachtwey.asc PGP-Fingerprint: B472 526A A903 4AEB 9269 EC0B 9CDE 7465 CE87 ########################################################################

2 3

slapd-meta question
by danz＠wustl.edu 04 Jun '08

04 Jun '08

We have a scenario that I’m hoping OpenLDAP can offer a solution to. We are in the process of transitioning from one ldap authentication source to another for several of our applications. During the transition we need to be able to authenticate users against one of two different ldap services. Unfortunately our applications do not support the capability to try authentication against multiple services. Would an OpenLDAP setup be able to take the authentication request and attempt to validate it against 2 different backends? I should note that each of the ldap backends would have different OU structures and that a given userID would not exist in both backends. Based on the slapd-meta man page SCENARIOS section it looks as though this may be possible. The examples don't illustrate whether or not the OU structures need to be the same between the backends. Any help would be greatly appreciated! Regards, Dan

4 5

ACLs Seem to Have No Effect
by nick＠ndmckinney.net 04 Jun '08

04 Jun '08

I am having some difficulty setting up the ACLs on my OpenLDAP server (2.4.8). No matter what I change, the ACL rules I write into my slapd.conf file seem to have no effect at all. I have followed the FAQ here to try to set a simple password change ACL: http://www.openldap.org/faq/data/cache/320.html As well as another to try to block Anonymous binds: http://www.openldap.org/faq/data/cache/318.html But neither seem to have any effect at all. My present slapd.conf ACLs are as follows: --- access to attrs=userPassword by self =xw by anonymous auth # allow only rootdn to read the monitor access to * by self write by anonymous none by users read --- Is there some other part of the configuration that might disable ACLs.

4 4

Re: slapd-meta question
by Gavin Henry 04 Jun '08

04 Jun '08

<quote who="Pierangelo Masarati"> > Gavin Henry wrote: > >> I can't see Ando's example in this thread? > > My fault: during a mail migration, my address got automatically > rewritten from ando(a)sys-net.it to the canonical > pierangelo.masarati(a)sys-net.it, which is not the address I used when > subscribing to the mailing list. I think the problem is now fixed > (hopefully :) > > Ah, makes sense now. I thought I was going mad ;-) -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

slapcat/ldapsearch question
by daniel rahmeh 04 Jun '08

04 Jun '08

Hi, i'm trying to export my openldap entries to an ldif file. My userPassword attribute has the following format: userPassword: {CRYPT}$1$$Y2j3VjkaCXmJ.YsPztha89 when i try to export it using slapcat or ldapsearch it doesn't remain the same, it becomes something like: userPassword:: e0NSWJBUfSQxJCRVMm8zVnpJYUNVbUolWHNXenRJKTgw If you have any idea about the origin of the issue please tell me thank you

2 2

Stupid question about search
by AlexanDER Franca 04 Jun '08

04 Jun '08

Hi all. Again, sorry for my horrible english. So... I implemented a ldap server at my work. All the systems are working fine. OpenLDAP have being a great backend. But now I need to satisfy the users. They must perform some 'intuitive' searches like "who are the persons on group X, or list all telephones of people on group Y". But all of this must be executed by 'normal' users. Phpldapadmin have a good interface, but for admins, not for users (IMO). I don't know, for example, about groups... I have groupOfUniquenames, so... if an user want a list of users, and when choose 'users' node of tree, he get all users. To know about a group, he must go to 'groups' node and look at 'uniqueMember'. It seems not too much intuitive. So... I don't know how to implement (and what) to have this stuffs working for my users. []'s Alexander Brazil - Rio de Janeiro

3 2

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 04 Jun '08

04 Jun '08

Hi, I am using openldap 2.4.9. Deleted entries do not get propagated to slave from master using syncrepl. I had tried the similar use case in 2.4.8 and ran into the same issue. Is this a known issue in 2.4.9 ? Any pointers would be helpful. - Srinidhi. On Tue, May 6, 2008 at 12:42 AM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > >> Hi Gavin, >> Here are the details . >> Following logs were available at -d255 level. >> >> user.ldif file >> ======== >> dn: cn=user19,ou=people,dc=example,dc=com >> objectclass: inetOrgPerson >> cn: user19 >> sn: user19-lastname1 >> uid: user19-user1-lastname1 >> userpassword: welcome1 >> carlicense: HISCAR 123 >> homephone: 555-111-2222 >> mail: user19(a)example.com <mailto:user19@example.com> >> >> description: cool guy >> ou: Human Resources >> >> >> Master node log file snippet: >> ==================== >> >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> >> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) >> <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, >> <cn=user19,ou=people,dc=example,dc=com> >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" >> => bdb_entry_get: oc: "(null)", at: "(null)" >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" >> bdb_entry_get: rc=0 >> ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => access_allowed: delete access to "ou=people,dc=example,dc=com" >> "children" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => access_allowed: delete access to >> "cn=user19,ou=people,dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_delete 0x11: 0 >> => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0096defd] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 >> <= key_change 0 >> <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> ====> bdb_cache_delete( 17 ) >> bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=1 op=15 p=3 >> send_ldap_result: err=0 matched="" text="" >> send_ldap_response: msgid=16 tag=107 err=0 >> ber_flush2: 14 bytes to sd 12 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> ldap_write: want=14, written=14 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> daemon: activity on 1 descriptor >> daemon: activity on: 12r >> daemon: read activity on 12 >> daemon: select: listen=7 active_threads=0 tvp=NULL >> connection_get(12) >> connection_get(12): got connid=1 >> connection_read(12): checking for input on id=1 >> >> >> Slave log snippet: ( I didnt see any log msg for delete entry in the >> slave, so wasnt sure what to cut/paste, so just cut/pasting the user >> addition log msg) >> ============= >> ber_scanf fmt ({mW}) ber: >> ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 >> 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 >> 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 >> 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 >> 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 >> 0#000000 => bdb_search >> bdb_dn2entry("dc=example,dc=com") >> => access_allowed: search access to "dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: search access granted by manage(=mwrscxd) >> search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 >> => bdb_dn2idl("dc=example,dc=com") >> => bdb_filter_candidates >> AND >> => bdb_list_candidates 0xa0 >> => bdb_filter_candidates >> EQUALITY >> => bdb_equality_candidates (entryUUID) >> => key_read >> bdb_idl_fetch_key: [e8d6b696] >> <= bdb_index_read: failed (-30989) >> <= bdb_equality_candidates: id=0, first=0, last=0 >> <= bdb_filter_candidates: id=0 first=0 last=0 >> <= bdb_list_candidates: id=0 first=1 last=0 >> <= bdb_filter_candidates: id=0 first=1 last=0 >> bdb_search_candidates: id=0 first=1 last=0 >> bdb_search: no candidates >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ==> bdb_add: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") >> <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found >> (-30989) >> => access_allowed: add access to "ou=people,dc=example,dc=com" "children" >> requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" >> "entry" requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_add 0x11: 0 >> => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [860433ad] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0096defd] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 >> <= key_change 0 >> <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com >> bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ldap_msgfree >> ldap_result ld 5b9630 msgid 2 >> wait4msg ld 5b9630 msgid 2 (infinite timeout) >> wait4msg continue ld 5b9630 msgid 2 all 0 >> ** ld 5b9630 Connections: >> >> - Srinidhi >> On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org<mailto: >> ghenry(a)openldap.org>> wrote: >> >> Srinidhi Sharma wrote: >> >> Hi, >> I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't >> applied any patch to either open ldap or to Berkeley DB). >> >> When I configure a slave process, the addition and modification >> of users get propogated from master to slave. But the deletion >> of users from the master do not get propogated. the slapd logs >> in the master show that user is getting deleted. >> >> >> Logs needed and an example user please ;-) >> >> >> >> I saw a old note >> "http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" >> which listed similar issue. >> >> >> Not relevant as that's for 2.2. >> >> -- Kind Regards, >> >> Gavin Henry. >> OpenLDAP Engineering Team. >> >> E ghenry(a)OpenLDAP.org >> >> Community developed LDAP software. >> >> http://www.openldap.org/project/ >> >> Suretec Systems is a limited company registered in Scotland. Registered >> number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, >> Aberdeenshire, AB51 4FP. >> >> >> >> >> -- >> Thanks, >> Srinidhi >> > > I'd wait for 2.4.9 as there are lots of syncrepl fixes..coming soon. > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

2 1

Current OpenLDAP Windows Binary
by guse＠kingmedia.de 03 Jun '08

03 Jun '08

Dear all, in a project we use the OpenLDAP proxy feature. Our server infrastructure is based on MS Windows, so it is tough to install a current OpenLDAP version. At the moment we use Cygwin to run OpenLDAP, but this doesn't seem to be the best solution. We searched the web and found OpenLDAP 2.0.27 as a Windows installer. Unfortunately this old version does not accept our configuration which runs like a charm in 2.3.39 we use in Cygwin. Is there anybody out there who can give us a helping hand getting a current windows OpenLDAP build? Regards, Christoph

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical