openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

alias problem - report status code 80 - internal error?
by Yan Falken 10 Mar '08

10 Mar '08

Hi, I'm trying to use alias somehow but facing some internal problem and don't know how to fix them. Situation: data for import: dn: ou=Staff,o=JNDITutorial objectclass: top objectclass: alias objectclass: organizationalUnit aliasedObjectName: ou=People,o=JNDITutorial ou: Staff error: ldap_initialize( ldap://localhost ) add objectclass: top alias organizationalUnit add aliasedObjectName: ou=People,o=JNDITutorial add ou: Staff adding new entry "ou=Staff,o=JNDITutorial" modify complete ldap_add: Internal (implementation specific) error (80) additional info: no structuralObjectClass operational attribute the problem is if I try to play with this: if I remove organizationalUnit I get: ldap_add: Object class violation (65) additional info: attribute 'ou' not allowed so I remove ou and surprise - I'm getting: ldap_add: Naming violation (64) additional info: naming attribute 'ou' is not present in entry So - any advice where may be the problem? I'm using bdb backend as a recommended one - have no ldbm modules here - in debian there is no ldbm support. Thanks. YF

2 1

OpenLDAP and Berkeley DB 4.6
by Dongsheng Song 10 Mar '08

10 Mar '08

Since OpenLDAP 2.3 is incompatible[1] with Berkeley DB 4.6, so I must stick to BDB 4.5 or upgrade to OpenLDAP 2.4 ? [1] http://www.openbsd.org/cgi-bin/cvsweb/ports/databases/openldap/Makefile Thanks for some help. Dongsheng

2 1

ldap and nfs from different servers
by VaraPrasad Yalla 10 Mar '08

10 Mar '08

Hello, Please let me know if there is a way to authenticate users from one box and mount the users' home folders from another box. Even without importing autofs details into the ldap database home directories from the same machine are getting mounted on client machines. How is it possible to mount home directories from another machine in the same way? I am getting errors when I do this on client machines. Thanks.

2 1

dynamic groups
by Andreas Moroder 10 Mar '08

10 Mar '08

Dynamic Lists Hello, I have a question about dynamic grousp ( lists ). For every department in our hospital we have six groups DEP_A_GRP1 ... DEP_A_GRP6 DEP_B_GRP1 ... DEP_B_GRP6 and so on. Is it possible to configure openldap the way that every user of any department group becomes also user in a dynamically generate all containing main department group DEP_A contains all the users of DEP_A_GRP1 to 6 DEP_B contains all the users of DEP_B_GRP1 to 6 .... This should work for primary and secondary groups and the added dynamic group should be a secondary group. Because we use also the slapo-memberof the memberof=DEP_A ... attribute should also be returne for the users of DEP_A_GRP1 to 6. Is this possible and could anyone please tell me how to configure this ? Thanks Andreas Moroder

1 0

Samba to Kerberos via OpenLDAP
by Wes Modes 08 Mar '08

08 Mar '08

Thanks for all your advice so far. First, I'll just say this is a question principally about the arcane mysteries of Samba to OpenLDAP authentication. I've had Samba to OpenLDAP authentication running for a while now using the samba.schema and the ldapsam module. Now I'd like to understand a bit more about how that works in order to take it a step further and get openLDAP to bind against a Kerberos database via SASL. An aside; Yes, I'd heard that Samba can be configured to authenticate against Kerberos directly, but for my own reasons, I'd prefer that Samba talk only to OpenLDAP, and OpenLDAP can do the authentication. I'll fall back on the Samba to Kerberos direct route if I can't find a way to do what I want. I've noted that the Samba schema and smbldap-tools add to the user record two Samba specific password fields, sambaNTPassword and sambaLMPassword. If I have the ldapsam module specified as the passdb backend in smb.conf, is OpenLDAP merely storing the samba passwords while Samba does the password comparisons? Or does OpenLDAP do the authentication and return a yes or no? Is it possible to have Samba defer authentication to OpenLDAP? If so, I can have OpenLDAP use the {SASL} method to do authentication via kerberos. Wes -- Wes Modes Server Administrator & Programmer Analyst McHenry Library Computing & Network Services Information and Technology Services 459-5208

3 2

Problem setting up OpenLDAP for user authentication
by Guennadi Liakhovetski 05 Mar '08

05 Mar '08

Hi all I'm new to LDAP, and I must say it took me a LONG time to set it up under Debian etch on both server and client at all to do anything useful. Now I can do "ldapsearch -x -v -L" type requests from remote a host and locally. I then tried switching the remote host to using LDAP for user authentication. I'd like users not registered locally to be able to login using ldap, and for locally-known users nothing should change. I did manage to get logins to use ldap by configuring all /etc/pam.d/common-* files to first try pam_unix and then, if that fails to use ldap: * sufficient pam_unix * sufficient pam_ldap (should this be "required?) where * is "account", "auth", "password" and "session". In "auth" and "password" I also had to put * required pam_deny after ldap, because otherwise wrong passwords were accepted. In nsswitch.conf I put *: files ldap for "passwd", "group", "shadow". Now I would expect that with sequences ("pam_unix" before "pam_ldap" and "files" before "ldap") indeed locally known users wouldn't be authenticated using ldap. Unfortunately, this doesn't seem to be the case. Now _all_ nss / pam requests go to the LDAP server. Including calls from udevd, avahi-daemon, and others, which causes them to fail in various ways. What am I doing wrong? I know SASL is not configured in my setup, but that shouldn't be a problem? At least not for the cases when LDAP shouldn't be attempted at all. Thanks Guennadi --- Guennadi Liakhovetski

2 4

Could I import the data through the slapadd what I export by the ldapsearch
by 何萍 05 Mar '08

05 Mar '08

There are 6,000,000 records in my openldap directory, I want to backup the data, but I found that the slapcat isn't work when the file id2entry.dbbsize over 2G, so I export the data by ldapsearch, but after I use slapadd to import the data to the backup server, there are some strange error happened, some records can't be add to the ldap correctly, and the record coundn't be searched by ldapsearch. As the same time, others data can be correctly operated. Operation system is the redhat linux 9.0. The verson of openldap is 2.0.27, use ldbm. Because there are too many records so I couldn't upgrade the version of the openldap . when I use ldapsearch the result is : # # filter: (&(uid=abc)(domain=123)) # requesting: ALL # # search result search: 2 result: 0 Success when i use ldapadd to add the record, it says: ldap_add: Already exists ldif_record() = 68 when i use ldapdelete to del it, the result is: Delete Result: Invalid DN syntax (34) Additional info: invalid DN (my dn is right) I thought mybe the record format is not correct that I exported by ldapsearch and imported by slapadd, because the ldif file lost entryUUID、entryCSN... and so on. now how can i do? I have tried to rebuild the entryUUID and run the slapindex to rebuild the index, but failed at least.

2 1

Fwd: GSSAPI contexts used in multiple threads
by Russ Allbery 04 Mar '08

04 Mar '08

As part of the discussion of adding additional thread safety guarantees to MIT Kerberos's GSS-API implementation to support OpenLDAP's use case, Sam Hartman had the following additional questions about how OpenLDAP uses SASL in such a way as to run into this problem. I'm happy to forward answers back to him. I don't understand the usage well enough to explain it myself. | From: Sam Hartman <hartmans(a)mit.edu> | Subject: GSSAPI contexts used in multiple threads | Date: Mon, 03 Mar 2008 16:28:13 -0500 | | Hi. I'm catching up on email. I read a discussion (although I cannot | find it now) of adding support so that an established gss-api context | can be used in multiple threads at the same time. This seems like a | fine feature to add to MIT Kerberos. | | However I'm quite puzzled as to how this works for LDAP or any other | SASL application. SASL is a stream protocol; it presents an ordered | stream across the network connection. In order to guarantee this the | sasl security layer requires that tokens be wrapped and unwrapped in | the same order. If you don't do that you can get into a situation | where the wrap order is different from the unwrap order and you get | spurious gap tokens or out of order tokens. You cannot tell the | difference between this and an attack. Also, since SASL applications | may chunk data into GSS-API tokens in arbitrary order, GSS-API tokens | may not line up with LDAP PDU boundaries. | | So, I'm very confused about how an LDAP implementation could be a | correct application and run into problems with MIT's current thread | safety requirements. | | I'd appreciate it if people who do remember the original discussion | could forward my message to the right place to get an answer. | | Thanks, | | --Sam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

2 3

LDAP replication when NTP server sets the time ahead
by Lucky Y 03 Mar '08

03 Mar '08

Hi, I have a system in GMT timezone and the NTP server in GMT-2hrs time zone. In this case when the system time syncs with NTP time(for example the first when the system comes up after configuration ), the time in the system will be set 2hours behind the current time in the system. In this case, LDAP relication is failing. What is the dependancy between LDAP replication and NTP servers ? Thanks in adavce. Regards, Lucky

5 7

ldap group name resolving problem
by Christian Weihrauch 03 Mar '08

03 Mar '08

Hi, I have problems with debian etch Linux clients resolving group names served by our LDAP server. user and passwd work because I can login properly. "getent group" properly shows the group served by the LDAP server. eg: #getent group mygroup:x:1000:chris However "id username" only shows LDAP served groupIDs but not their names. eg: #id chris uid=1002(chris) gid=1000 groups=1000,20(dialout) This means that I can't do things like chgrp eg: "chgroup mygroup directoryname" gives: "chgrp: invalid group `mygroup'" I am using nscd and nsswitch.conf says: passwd: files ldap group: files ldap shadow: files ldap Any ideas? Thanks! -- Christian Weihrauch, The University of Reading

3 4

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical