openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

slurpd replication problmes
by Almir Karic 30 May '08

30 May '08

i'm trying to set up the repliacation with openldap 2.3 (using the one debian etch), when i add things to master everything is fine, it replicates it to slave just fine, on the other hand when i add things to slave it simply writes it to it's own tree. here is slapd.conf of the slave (stripped of any comments): include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ldap/cacert.pem TLSCertificateFile /etc/ldap/servercrt.pem TLSCertificateKeyFile /etc/ldap/serverkey.pem loglevel stats database bdb suffix "dc=kiberpipa,dc=org" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=kiberpipa,dc=org" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=kiberpipa,dc=org" write by * read updatedn "cn=admin,dc=kiberpipa,dc=org" updateref "ldaps://chat.kiberpipa.org:636" with this command "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00" (on slave) i'm getting http://static.kiberpipa.org/~redduck666/local_adding.txt with "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00 -H ldaps://chat.kiberpipa.org:636" i get http://static.kiberpipa.org/~redduck666/add_to_master.txt (passing it the same password they write to i have seen the certificate error there, if i change the ldap.conf on slave to point to ldap:// instead of ldaps:// that error goes away, however it still doesn't touch master. i also read i really shouldn't set updatedn to be the same as rootdn, well, tried changing it and granting full priviledges to the newly created account, no difference any pointers appreciated :-) -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

2 1

Multithreaded LDAP client
by Rakesh Yadav 30 May '08

30 May '08

Hi, LDAP version: openldap-2.3.38 I want to write multithreaded ldap client but don't have any idea about multithreaded ldap client. I have seen somewhere a sample code for multithreaded client but it is having some structures which r available only on Solaris. struct ldap_thread_fns : available on Solaris but not present in linux Please give me a solution for writting a multithreaded client on linux .. waiting for reply Thanks -- Rakesh Yadav Pune.

1 0

Password management question
by daniel rahmeh 29 May '08

29 May '08

hi, I have a question about the password management. As i know, it is possible to use hach functions into openLDAP, for exemple: password-hash {CRYPT} password-crypt-salt-format "$1$somesalt$" my question is about the compatibility with applications. today, we have some applications that uses openLDAP to create and authenticate users. Is there a way to say to openLDAP to hash received userPassword before inserting it into his database? exemple: imagine an application (application1) that wants to insert a new record (user account) in a openLDAP directory. Application1 doesn't know how to hash a password, is there a way to say to openLDAP to hash this password before adding the entry. application1 ----------userPassword: testpasswd-----> openLDAP (hash(testpasswd))------------->bdb ({CRYPT}$1$salt$EdFRTTT.BNHH. the goal is to make openLDAP manage the hashing process and avoid to patch the applications thank you

3 4

ldap_sasl_bind_s
by Gavin Henry 27 May '08

27 May '08

Hi All, I've been debugging the RealTime Asterisk LDAP driver, namely the function: static int ldap_reconnect(void) { int bind_result = 0; struct berval cred; if (ldapConn) { ast_debug(2, "Everything seems fine.\n"); return 1; } if (ast_strlen_zero(url)) { ast_log(LOG_ERROR, "Not enough parameters to connect to ldap database\n"); return 0; } if (LDAP_SUCCESS != ldap_initialize(&ldapConn, url)) { ast_log(LOG_ERROR, "Failed to init ldap connection to '%s'. Check debug for more info.\n", url); return 0; } if (LDAP_OPT_SUCCESS != ldap_set_option(ldapConn, LDAP_OPT_PROTOCOL_VERSION, &version)) { ast_log(LOG_WARNING, "Unable to set LDAP protocol version to %d, falling back to default.\n", version); } if (!ast_strlen_zero(user)) { ast_debug(2, "bind to '%s' as user '%s'\n", url, user); cred.bv_val = (char *) pass; cred.bv_len = strlen(pass); bind_result = ldap_sasl_bind_s(ldapConn, user, LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL); } else { ast_debug(2, "bind %s anonymously\n", url); bind_result = ldap_sasl_bind_s(ldapConn, "", LDAP_SASL_SIMPLE, NULL, NULL, NULL, NULL); } if (bind_result == LDAP_SUCCESS) { ast_debug(2, "Successfully connected to database.\n"); connect_time = time(NULL); return 1; } else { ast_log(LOG_WARNING, "bind failed: %s\n", ldap_err2string(bind_result)); ldap_unbind_ext_s(ldapConn, NULL, NULL); ldapConn = NULL; return 0; } } The line: bind_result = ldap_sasl_bind_s(ldapConn, NULL, LDAP_SASL_SIMPLE, NULL, NULL, NULL, NULL); is giving: May 26 14:52:03 asterisk slapd[30075]: conn=1 fd=12 ACCEPT from IP=127.0.0.1:57926 (IP=0.0.0.0:389) May 26 14:52:03 asterisk slapd[30075]: bind: ber_scanf failed May 26 14:52:03 asterisk slapd[30075]: conn=1 op=0 DISCONNECT tag=120 err=2 text=decoding error May 26 14:52:03 asterisk slapd[30075]: conn=1 fd=12 closed (operations error) Any debug tips would be greatly appreciated. Two different libldap have been tested (Centos 5.1 package and Symas OpenLDAP Devel package): openldap-devel-2.3.27-8.el5_1.3 cdsdevel-3.9-2 Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

3 4

ldap database backend vs requests
by Ricardo Moreira 26 May '08

26 May '08

Hi there, I would like to know if in a database backend it's possible to know the request binded DN at on the search call? What I want is to build a wrapper database backend and integrate LDAP protocol with the private protocol used on the backend authentication/authorization system at my work. Our backend system deals with authentication/authorization and search in one request, usually our request is composed of: user + pass + input parameters + atributes (to be returned). I appreaciate any help! Regards, -- :: Ricardo Moreira

2 1

[Fwd: 2 identical names in address book]
by Thomas De Reyck 23 May '08

23 May '08

Hello, I am not sure if this is the correct place to ask this kind of information, so if I am mistaken, I apologize.. I am quite new to LDAP, however I have used some applications that require it and am now a semi-decent openLDAP administrator. So, as a next step, I am trying to program an address book with an LDAP backend. I have noticed that usually the cn is used as a dn when working with address book entries. This seems to lead to an interesting conflict which I need to resolve before I begin to program: What can be done when one has to import 2 people with an identical name? This seems to be irrelevant, since the chances of an identical name are small, but I for one know 2 people with the same first and last ames. Lets face it: names are not MD5 hashes ;-).. I guess someone must have thought this over before.. how oes one resolve this problem cleanly? Does one use another property? f so, which one? I am aware that this might be a very silly question, but I have een wondering about this for a few days now and google doesn't eem to satisfy my need for a solution.. :-). Thanks in advance, Thomas De Reyck

2 2

n-way multi master setup
by Joshua Miller 23 May '08

23 May '08

Good morning, I am attempting to follow the admin guide in setting up n-way multi-master replication. re: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master I'm running OpenLDAP 2.4.7, from Buchan Milne's RPMs, DB 4.6 on CentOS 5.1. I have setup a working directory on both nodes, then removed all data to start fresh, converting my slapd.conf to a slapd.d with slaptest. ie, # /etc/init.d/ldap stop # rm -rf /var/lib/ldap/* # slaptest -f slapd.conf -F slapd.d # /etc/init.d/ldap start Since I already had cn=config setup from my slapd.conf file, I skipped that part of the admin guide's instructions. I then modified the directory with the following LDIF, replacing the URI and credential values with my environment specific ones: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldapserver1 olcServerID: 2 ldap://ldapserver2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldapserver2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldapserver1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I received no errors on running the modify command to add the changes from this LDIF. I then attempted to make a change and have it replicated, very simple to start with, using the following LDIF: dn: cn=config changetype: modify replace: olcSecurity olcSecurity: ssf=256 Once I successfully made this change on ldapserver1, I received the following errors in the logs of ldapserver2 (continuously repeating): ldapserver2 slapd2.4[12172]: conn=15 op=0 EXT oid=1.3.6.1.4.1.1466.20037 ldapserver2 slapd2.4[12172]: conn=15 op=0 STARTTLS ldapserver2 slapd2.4[12172]: conn=15 op=0 RESULT oid= err=0 text= ldapserver2 slapd2.4[12172]: conn=15 fd=17 ACCEPT from IP=10.12.2.25:4174 (IP=0.0.0.0:389) ldapserver2 slapd2.4[12172]: conn=15 fd=17 TLS established tls_ssf=256 ssf=256 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" method=128 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 ldapserver2 slapd2.4[12172]: conn=15 op=1 RESULT tag=97 err=0 text= ldapserver2 slapd2.4[12172]: conn=15 op=2 SRCH base="cn=config" scope=2 deref=0 filter="(cn=config)" ldapserver2 slapd2.4[12172]: conn=15 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= ldapserver2 slapd2.4[12172]: conn=15 op=3 UNBIND ldapserver2 slapd2.4[12172]: conn=15 fd=17 closed ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <80>A<C2> ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <D0>A<C2> ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 ldapserver2 slapd2.4[12172]: syncrepl_entry: rid=002 be_modify failed (80) ldapserver2 slapd2.4[12172]: do_syncrepl: rid=002 retrying (4 retries left) ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 Any idea what I may have done wrong here? Thanks! Josh Miller, RHCE

5 6

Remote LDAP servers and parallel queries
by Julien Cassignol 20 May '08

20 May '08

Hi, I recently tried to build a setup as follows : Tree : dc=mycompany,dc=com Subtree 1 : dc=subtree1,dc=mycompany,dc=com Subtree 2 : dc=subtree2,dc=mycompany,dc=com Assuming that my needs are to store subtrees 1 and 2 in separate and remote LDAP servers, I used the LDAP backend. It worked pretty fine, and then I tried to check what was the behaviour if a link went down, or a remote server was unavailable. Testing, I saw that if I have a 10 seconds timeout for each server, if they're both down, my server spends 20 seconds waiting for the timeouts. I assume that's because the queries are done sequentially and not in parallel. Is there any way to be able to parallelize the queries and build a "buffer" for each remote backend in order to reconstruct it later, allowing a user not only to use each remote server, but also to find which subtree a user belongs to, without having those kind of problems ? My test case is pretty simple, but as the final implementation I want to build involves a lot more remote LDAP servers, and as I can't modify the architecture, I'm wondering what are the available solutions. Thanks, -- Julien Cassignol

1 0

OpenSSL clients connect over TLS, GnuTLS clients cannot.
by Ben Goldsbury 20 May '08

20 May '08

Hello, I'm having a problem getting TLS connections working properly when clients of the server are built against GnuTLS. When clients are built against OpenSSL, TLS connections work properly. If OpenLDAP is built against GnuTLS, TLS connections fail with this error (some debug included): TLS: peer cert untrusted or revoked (0x42) ldap_err2string ldap_start_tls: Connect error (-11) For testing, I've tried the following setups. Each use the same configuration: GnuTLS (client) -> GnuTLS (server) = failure OpenSSL (client) -> GnuTLS (server) = success GnuTLS (client) -> OpenSSL (server) = failure OpenSSL (client) -> OpenSSL (server) = success Also, I have used GnuTLS's testing tools (gnutls-serv and gnutls-cli) to verify that GnuTLS is working properly with the certificate. gnutls-serv \ --x509certfile /etc/ssl/my_ssl/server.key \ --x509keyfile /etc/ssl/my_ssl/server.crt gnutls-cli \ --x509cafile /etc/ssl/certs/ca-certificates.crt \ -p 5556 \ ldapserver.mydomain.com GnuTLS output: - Peer's certificate is trusted - Version: TLS1.1 - Key Exchange: DHE-RSA - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed Versions used: GnuTLS 2.2.1 OpenSSL 0.9.8c OpenLDAP 2.4.9 Does anyone have any ideas whats going on, or any idea how to troubleshoot this further? Is this something that should go to the openldap-bugs mailing list? Thank you.

2 1

tls issues with clients
by Kyle Corupe 20 May '08

20 May '08

I'm pretty confused, because my clients are setup with almost identical configs, and the server(localhost), and one of my client PC's can connect and use SSL (ldapsearch -H ldaps://heracross.corpedia.internal/ -b dc=corpedia,dc=internal -x -Z), and it returns the correct results, and I can see it using TLS in the slapd log. I copied the same configs to both boxes /etc/ldap.conf ---- #host heracross.corpedia.internal base dc=corpedia,dc=internal uri heracross.corpedia.internalheracross.corpedia.internal ldap://heracross.corpedia.internal/ binddn cn=root,dc=corpedia,dc=internal bindpw ***************** scope sub bind_policy hard nss_base_passwd dc=corpedia,dc=internal?sub nss_base_shadow dc=corpedia,dc=internal?sub nss_base_group dc=corpedia,dc=internal?sub pam_password md5 ssl yes tls_cacertdir /etc/openldap/cacerts ----- I see the following in my slapd error log as I connect as one of the nonworking boxes root@kyle-laptop:/etc/ldap# ldapsearch -H ldaps://heracross.corpedia.internal/ -b dc=corpedia,dc=internal -x -Z ldap_start_tls: Can't contact LDAP server (-1) ldap_bind: Can't contact LDAP server (-1) ----- connection_get(14): got connid=25 connection_read(14): checking for input on id=25 TLS trace: SSL_accept:before/accept initialization TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=25, closing connection_closing: readying conn=25 sd=14 for close connection_close: conn=25 sd=14 ----- Here is a nopaste link for my slapd.conf file http://rafb.net/p/NHjV1a33.html -- Kyle Corupe Unix Administrator Corpedia Corporation 2020 North Central Avenue, Suite 1050 Phoenix, Arizona 85004-4576 Desk:(602)443-2148 Cell: (623)261-2874 kcorupe(a)corpedia.com

3 4

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical