openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

Re: AW: Invalid syntax (21)
by Luke Lee 22 Apr '08

22 Apr '08

Hi Claus, Thank you for your valuable opinion. I tried to "fix" the syntax problem by removing the _ from the username. It worked! However, I want to use the _ because this is my company's user naming convention. I have to point out that when I ran the early version of OpenLDAP (version 2.2-13), there were no syntax problems when I used the ldif with the nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP (version 2.3-39). Then, I immediately encountered the invalid syntax problem when I triled to load the same ldif. Do you have any thought on the wierd problem? Thanks. Luke ----- Original Message ---- From: "Kick, Claus" <claus.kick(a)siemens.com> To: Luke Lee <leeluke77(a)yahoo.com>; Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Tuesday, April 22, 2008 3:59:49 AM Subject: AW: Invalid syntax (21) Hello, nisnetgrouptriple = "(" hostname "," username "," domainname ")" You have nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/ <http://mydomain.com/> > ) which I would translate to: <empty>,username, domainname. Perhaps you just have to add the hostname and not leave it blank? Cheers, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Luke Lee Gesendet: Dienstag, 22. April 2008 01:21 An: Dieter Kluenter; openldap-technical(a)openldap.org Betreff: Re: Invalid syntax (21) Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [...] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,sam_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,amy_s,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,anita_c,mydomain.com <http://mydomain.com/> ) > nisNetgroupTriple: (,jim_f,mydomain.com <http://mydomain.com/> ) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de <http://www.dkluenter.de/> GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. <http://us.rd.yahoo..com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ahu06i62sR…> Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

configuring ldap client
by Melanie Pfefer 22 Apr '08

22 Apr '08

hi I have a Solaris 10 client that I want to configure ldap instead of dns on it. I am using this: ldapclient init -a profileName=default -a domainName=siroe.com -a proxyDN=cn=proxyagent,ou=profile,dc=siroe,dc=com -a proxyPassword=password ZEUS I am getting this: Failed to find defaultSearchBase for domain siroe.com I also noticed that the nisDomain attribute is missing: ldapsearch -h ZEUS -b "dc=siroe,dc=com" "nisdomain=*" returns nothing. This attribute (nisDomain)is necessary for Solaris clients to find a server for a specific domain. The client searches for an entry on the LDAP server that has the nisDomain matching the desired domain. The DN for the entry found will be used as the BaseDN for the naming information. Any idea please? thanks __________________________________________________________ Sent from Yahoo! Mail. A Smarter Email http://uk.docs.yahoo.com/nowyoucan.html

1 0

Solairs PAM Password Policy
by farhan ahmed 22 Apr '08

22 Apr '08

Hi Guys, I have implemented password policy on linux but Solaris clients are not giving any info/error message other than permision denied. For example, I have pwdInHostory 6, if i try to change password on linux and use old password I get straight away error message -bash-3.00$ passwdChanging password for user test.Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Can't contact LDAP server Password is in history of old passwords But When I do same on Solaris I get following -bash-3.00$ passwd wbarreraEnter existing login password: New Password: Re-enter new Password: Permission denied But on server side debug I can see following send_ldap_result: err=19 matched="" text="Password is in history of old passwords" Why Solaris is not showing "Password is in history of old passwords" to user. Solaris is using its native client to connect openldap over TLS Any help would be appreciatedThanks, -- Regards, Farhan Ahmed Find out: SEEK Salary Centre Are you paid what you're worth? _________________________________________________________________ Are you paid what you're worth? Find out: SEEK Salary Centre http://a.ninemsn.com.au/b.aspx?URL=http%3A%2F%2Fninemsn%2Eseek%2Ecom%2Eau%2…

2 1

lt-ldapsearch: error while loading shared libraries
by Rodrigo Castro 22 Apr '08

22 Apr '08

Hello to all. I`ve been struggling with the following error: make test cd tests; make test make[1]: Entrando no diret=F3rio `/root/openldap-2.3.39/tests' make[2]: Entrando no diret=F3rio `/root/openldap-2.3.39/tests' Initiating LDAP tests for BDB... Cleaning up test run directory leftover from previous run. Running ./scripts/all... >>>>> Executing all LDAP tests for bdb >>>>> Starting test000-rootdse ... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to retrieve the root DSE... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ./scripts/test000-rootdse: line 66: kill: (2801) - Processo inexistente /root/openldap-2.3.39/clients/tools/.libs/lt-ldapsearch: error while loadin= g shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory >>>>> Test failed >>>>> ./scripts/test000-rootdse failed (exit 127) make[2]: ** [bdb-yes] Erro 127 make[2]: Saindo do diret=F3rio `/root/openldap-2.3.39/tests' make[1]: ** [test] Erro 2 make[1]: Saindo do diret=F3rio `/root/openldap-2.3.39/tests' make: ** [test] Erro 2 Even though in my configure result I have: configure:19451: checking openssl/ssl.h usability configure:19463: cc -c -g -O2 -I/usr/local/BerkeleyDB.4.5/include conftest.= c >&5 configure:19469: $? =3D 0 configure:19473: test -z || test ! -s conftest.err configure:19476: $? =3D 0 configure:19479: test -s conftest.o configure:19482: $? =3D 0 configure:19492: result: yes configure:19496: checking openssl/ssl.h presence configure:19506: cc -E -I/usr/local/BerkeleyDB.4.5/include conftest.c configure:19512: $? =3D 0 configure:19532: result: yes configure:19567: checking for openssl/ssl.h configure:19574: result: yes configure:19589: checking for SSL_library_init in -lssl configure:19619: cc -o conftest -g -O2 -I/usr/local/BerkeleyDB.4.5/include -L/usr/local/lib -L/usr/local/ssl/lib -L/root/krb5-1.6.3/src/lib -L/root/tcp_wrappers_7.6 conftest.c -lssl -lcrypto -lresolv -ldl >&5 configure:19625: $? =3D 0 configure:19629: test -z || test ! -s conftest.err configure:19632: $? =3D 0 configure:19635: test -s conftest configure:19638: $? =3D 0 configure:19651: result: yes configure:19757: checking OpenSSL library version (CRL checking capability) configure:19791: result: yes and: find / -name libssl.so.0.9.8 /root/openssl-0.9.8g/libssl.so.0.9.8 /usr/local/ssl/lib/libssl.so.0.9.8 If this isn`t the place for this post I apologize. Thanks for any help. -- __________________________________ Rodrigo de Castro Cosme Ciência da Computação - Universidade Federal do Espírito Santo Suporte mailing list - suporte(a)inf.ufes.br MSN - rdccosmo(a)gmail.com

1 0

Password Policy
by farhan ahmed 22 Apr '08

22 Apr '08

Hi Guys, I have implemented password policy on linux but Solaris clients are not giving any error message other than permision denied. For example, I have pwdInHostory 6, if i try to change password on linux and use old password I get straight away error message -bash-3.00$ passwdChanging password for user test.Enter login(LDAP) password: New UNIX password: Retype new UNIX password: LDAP password information update failed: Can't contact LDAP server Password is in history of old passwords But When I do same on Solaris I get following -bash-3.00$ passwd wbarreraEnter existing login password: New Password: Re-enter new Password: Permission denied But on server side debug I can see following send_ldap_result: err=19 matched="" text="Password is in history of old passwords" Why Solaris is not showing "Password is in history of old passwords" to user. Solaris is using its native client to connect openldap over TLS Any help would be appreciatedThanks, -- Regards, Farhan Ahmed _________________________________________________________________ Are you paid what you're worth? Find out: SEEK Salary Centre http://a.ninemsn.com.au/b.aspx?URL=http%3A%2F%2Fninemsn%2Eseek%2Ecom%2Eau%2…

1 0

Re: Invalid syntax (21)
by Luke Lee 22 Apr '08

22 Apr '08

Hi Dieter, I tried several modifications but still couldn't get it working. Can you or anyone else help please? What's wrong with my syntax? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, April 19, 2008 4:27:20 AM Subject: Re: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi, > > I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use > ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The > following is the error message: > > adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" > ldapadd: Invalid syntax (21) > additional info: nisNetgroupTriple: value #0 invalid per syntax > > My ldif file is like the following: [....] > dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com > objectClass: nisNetgroup > objectClass: top > cn: LocalSales > nisNetgroupTriple: (,luke_l,mydomain.com) > nisNetgroupTriple: (,sam_c,mydomain.com) > nisNetgroupTriple: (,amy_s,mydomain.com) > nisNetgroupTriple: (,anita_c,mydomain.com) > nisNetgroupTriple: (,jim_f,mydomain.com) > description: Local Sales The nisnetgrouptriple syntax is described in RFC-2307 as follows: Values in this syntax are represented by the following: nisnetgrouptriple = "(" hostname "," username "," domainname ")" hostname = "" / "-" / keystring username = "" / "-" / keystring domainname = "" / "-" / keystring See RFC-2307 for examples. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 2

"to" rules
by uri_gr1＠tut.by 21 Apr '08

21 Apr '08

Hi, people! I have openldap-2.4.8 up and running. I have ou=People subtree with posixAccounts and I need to grant access to, let's say, ou=Clients,ou=AddressBook by all rdn's in ou=People, having gidNumber=10008. How can I do so?

2 1

ldapbind() timeout can't work .
by lijx 20 Apr '08

20 Apr '08

LDAP APIS confused me, anyone can tell my what's wrong with my code? I have call ldap_set_option() and set the LDAP_OPT_NETWORK_TIMEOUT or the LDAP_OPT_TIMEOUT opt, before call the ldap_bind_s() or the non synchronize APIS, but the authentication result still return after almost 70 seconds later, am I miss something (note: my server is windows active directory, simple authentication.)? struct timeval tv_select_timeout; tv_select_timeout.tv_sec = 10; tv_select_timeout.tv_usec = 0; int t; t=ldap_set_option(pLdapConnection, LDAP_OPT_NETWORK_TIMEOUT, &tv_select_timeout); #ifdef BIND_TIME_CONTROL { int msgid, err; LDAPMessage *result = NULL; char *error_msg; struct timeval tv; if ((msgid = ldap_simple_bind(pLdapConnection, pUserDN, pPassword)) == -1) { error_msg = NULL; ldap_get_option(pLdapConnection, LDAP_OPT_ERROR_STRING, &error_msg); if (error_msg != NULL) { ldap_memfree(error_msg); } ldap_unbind_s(pLdapConnection); return AUTH_AGENT_ERR_LDAPSIMPLEBIND_FAIL; } ret = ldap_result(pLdapConnection, msgid, LDAP_MSG_ALL, & tv_select_timeout, &result); if (ret == -1) { ldap_unbind_s(pLdapConnection); if (result != NULL) ldap_msgfree(result); return AUTH_AGENT_ERR_LDAPRESULT_FAIL; } else if (ret == 0) { /*timeout & result ==NULL */ ldap_unbind_s(pLdapConnection); if (result != NULL) ldap_msgfree(result); return AUTH_AGENT_ERR_LDAPRESULT_TIMEOUT; } ret = ldap_result2error(pLdapConnection, result, 1); } #else { ret = ldap_bind_s(pLdapConnection, pUserDN, pPassword, LDAP_AUTH_SIMPLE); } #endif

2 2

Invalid syntax (21)
by Luke Lee 19 Apr '08

19 Apr '08

Hi, I encounter a situation where I couldn't find any syntax errors in my ldif file but failed to use ldapadd to add entries. I didn't find any trailing spaces at the end of each objectClass. The following is the error message: adding new entry "cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com" ldapadd: Invalid syntax (21) additional info: nisNetgroupTriple: value #0 invalid per syntax My ldif file is like the following: # # LocalSales # dn: cn=LocalSales,ou=Netgroup,dc=mydomain,dc=com objectClass: nisNetgroup objectClass: top cn: LocalSales nisNetgroupTriple: (,luke_l,mydomain.com) nisNetgroupTriple: (,sam_c,mydomain.com) nisNetgroupTriple: (,amy_s,mydomain.com) nisNetgroupTriple: (,anita_c,mydomain.com) nisNetgroupTriple: (,jim_f,mydomain.com) description: Local Sales # # Corporate Accountants # dn: cn=CorpAcct,ou=Netgroup,dc=mydomain,dc=com objectClass: nisNetgroup objectClass: top cn: CorpAcct nisNetgroupTriple: (,hannah_m,mydomain.com) nisNetgroupTriple: (,judy_j,mydomain.com) description: Corporate Accountants I have included the following schema files in my slapd.conf: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema Could anyone please help resolve the above problem? Thanks. Luke ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

pwdExpirationWarned not present
by Paul Lee 18 Apr '08

18 Apr '08

Dear all, I am using openldap 2.4.8 and testing with the pwdExpireWarning and the pwdMaxAge I set the pwdExpireWarning = 100 and the pwdMaxAge = 120 Then, I preform a change in password operation. and wait for 20 seconds (120 - 100). I then preform a Authentificaiton to the LDAP several times, I see from the log indicate that it now falls in the warning period (i.e. about to expire but not yet expired) Apr 17 19:47:47 ldap0 slapd[7519]: ppolicy_bind: Setting warning for password expiry for cn=paul,ou=SCIG,ou=Govt-Dept,o=HKSARG = 96 seconds However, when I retrieve the operational attributes for that user, I can't see the pwdExpirationWarned attribute. How can I detect the user is in the "about to expire" state ? Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical