openldap-technical

openldap-technical@openldap.org

16 participants
9696 discussions

openldap 2.4.7 Segfault when deleting olcAccess parameter from cn=config
by Faraz Khan 22 Jan '08

22 Jan '08

When trying to delete a single olcAccess attribute from cn=config the openldap server crashes. The client library (php) returns error code -1 (cant contact LDAP Server) and the openldap server crashes. The delete operation is: dn: olcDatabase={2}bdb,cn=config changetype: modify delete: olcAccess olcAccess: 2 This behavior is not consistent. Sometimes the server crashes while sometimes it will report back : modifying entry "olcDatabase={2}bdb,cn=config" ldap_modify: No such attribute (16) It might continue to say Error 19 for a while (3-4 times) and on the 5th time the operation completes successfully. However, the dn at this time seems to contain NO entries. After this slapd crashes. Restarting will show that the operation was never ACTUALLY completed. The segfault trace is: ber_dump: buf=0x82c1ef0 ptr=0x82c1ef3 end=0x82c1f2c len=57 0000: 66 37 04 1c 6f 6c 63 64 61 74 61 62 61 73 65 3d f7..olcdatabase= 0010: 7b 32 7d 62 64 62 2c 63 6e 3d 63 6f 6e 66 69 67 {2}bdb,cn=config 0020: 30 17 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 0.0....0...olcac 0030: 63 65 73 73 31 03 04 01 32 cess1...2 conn=0 op=3 do_modify: dn (olcdatabase={2}bdb,cn=config) ber_scanf fmt ({e{m[W]}}) ber: ber_dump: buf=0x82c1ef0 ptr=0x82c1f15 end=0x82c1f2c len=23 0000: 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 63 65 0....0...olcacce 0010: 73 73 31 03 04 01 32 ss1...2 >>> dnPrettyNormal: <olcdatabase={2}bdb,cn=config> => ldap_bv2dn(olcdatabase={2}bdb,cn=config,0) <= ldap_bv2dn(olcdatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 <<< dnPrettyNormal: <olcDatabase={2}bdb,cn=config>, <olcDatabase={2}bdb,cn=config> conn=0 op=3 modifications: delete: olcaccess one value, length 1 conn=0 op=3 MOD dn="olcDatabase={2}bdb,cn=config" conn=0 op=3 MOD attr=olcaccess <= acl_access_allowed: granted to database root Segmentation fault -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

2 1

> posixGroup & memberOf
by vip43＠mail.ru 22 Jan '08

22 Jan '08

Hi colleagues, HOW to make posixGroup a memberOf another posixGroup?? ... : nis.schema > posixGroup objectclass : ---------- objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ member $ description ) ) ----------- and where is "memberOf" ?? it seems it must present in MUST.., IMHO openldapAdminGuide promised to add "memberOf attr to posixGroup..,. can i do it myself ?? And what GUI-tool can rule this moment ??,- i'm using http://ldapadmin.sourceforge.net/ , but it can't.

2 3

AD-style AUX classes
by Andrew Bartlett 21 Jan '08

21 Jan '08

I'm not quite sure what I'm looking for here, sorry: In Samba4, we don't yet have full schema validation. In some ways it just has not been a priority - we validate that the attribute and objectClasses exist, but not that they match up. In using OpenLDAP, I'm hoping to avoid having to write that logic, so I stopped adding extensibleObject to all our objectClass values, and replaced it with samba4Top, contaning all the things that AD's top contains, but OpenLDAPs does not. So far so good, but AD has: dn: CN=Domain-DNS,${SCHEMADN} objectClass: top objectClass: classSchema subClassOf: domain systemAuxiliaryClass: samDomain Looking at http://www.grotan.com/ldap/microsoft.ext.schema I created entries in my schema file like: dITContentRule ( 1.2.840.113556.1.5.67 NAME 'domainDNS' AUX ( samDomain ) ) dITContentRule ( 1.2.840.113556.1.5.3 NAME 'samDomain' AUX ( samDomainBase ) ) This created two problems: It appears that you cannot create a ditContentRule for a non-structural objectClass (samDomain is AUXILIARY), and even if I do, I can't tack on the samba4Top on the end, because of: Adding DomainDN: DC=samba,DC=example,DC=com (permitted to fail) ldb load failed: LDAP error 65 LDAP_OBJECT_CLASS_VIOLATION - <class 'samba4Top' not allowed by content rule 'domainDNS'> <> Is there a different approach I should be taking? I need to extend 'top' without extending OpenLDAP's hardcoded top, and I need something that looks like dITcontentRule without the restrictions. Any hints? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

5 16

MinGW, OpenLDAP and OpenSSL
by Jonathan Bowman 20 Jan '08

20 Jan '08

Greetings all, I recently set out to compile OpenLDAP with SSL/TLS on Windows using MinGW, so that I could compile Ruby/LDAP and python-ldap. It took me a while to find my way, and I frequently wished there were easy instructions online, all in one place. Once I successfully finished, I posted my instructions here: http://bowmansolutions.com/mingw-openldap/ I would love feedback on these instructions, affirmation or criticism. My apologies if they duplicate what is already out there. Regards, Jonathan Bowman

2 2

sql to ldap MD5 conversion
by Antoine Jacoutot 18 Jan '08

18 Jan '08

Hi. After several failed attempts, I need some help regarding the following issue. I need to import some users from a MySQL database to OpenLDAP. I cannot find a working way of converting the md5 password stored in the database (using md5() ) to the {MD5} password format for Ldap. e.g: SQL: the md5 value of 'password' is 5f4dcc3b5aa765d61d8327deb882cf99 OpenLDAP: the result of `slappasswd -h {MD5} -s password` is {MD5}X03MO1qnZdYdgyfeuILPmQ== So obviously I won't be able to use {MD5}5f4dcc3b5aa765d61d8327deb882cf99 >From what I could gather it has to do with Base64 encoding but all my attemps at scripting something failed miserably :( Any hint would be appreciated. Thanks! -- Antoine

2 2

automatic charset conversion?
by Stefan Palme 18 Jan '08

18 Jan '08

Hi, using an OpenLDAP server installation for several things. One thing is a shared addressbook which is used by different persons with different client applications. Some of them have a locale of "de_DE.utf8", some of them work with "de_DE.latin1", some of them use windows and so have a win-1250-or-whatever encoding. When creating new addressbook entries these are transfered from the client to the server in the clients charset encoding. When clients with other encodings read these entries they seem somehow broken - of course. How to solve this problem? When the server known the "client encoding" the server could automatically convert clients data into e.g. utf8 before storing it. Before sending data back to a client it could convert all the stored utf8-data into client's encoding. But I did not found a way to tell the server the client's encoding, so this seems to be no way. Are there any working solutions for this? Regards -stefan- -- ------------------------------------------------------------------- Dipl. Inf. (FH) Stefan Palme email: kleiner(a)hora-obscura.de www: http://hbci4java.kapott.org http://converter-db.de icq: 36376278 key fingerprint: 1BA7 D217 36A1 534C A5AD F18A E2D1 488A E904 F9EC -------------------------------------------------------------------

2 2

Coverity Report for Openldap library
by meow＠computer.org 17 Jan '08

17 Jan '08

Hi : Our development project is using Openldap library, currently using version 2.2.26, planning to migrate to a newer version. And, recently, I saw in scan.coverity is generating Error report for Openldap library . So, I downloaded the latest stable release 2.3.39, check the CHANGES doc to see if coverity fixes were included; but this doc didn;t mention anything regarding fixes for Coverity Error . Just want to know if latest stable release 2.3.39 contain the fixes to the Error reported in the Coverity ? And, how can I get access to the Coverity Report for Openldap library ? Thanks in advance for your time and information! Regards, Yen

2 1

Re: sles 10 synchronize 2 ldapservers
by bakkerru 16 Jan '08

16 Jan '08

Hi, The two directories must contain the same users and groups, and when i add a user on ldapserver off.company.nl it also has to be automativcally create the user on the second ldapserver mail.company.nl. i use openldap 2.3.32 on off.company.nl and 2.2.24 on mail.company.nl regards ruurd -----Oorspronkelijk bericht----- Van: openldap-technical-bounces+ruurd.bakker=ppc.nl(a)OpenLDAP.org [ <mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org> mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org] Namens Buchan Milne Verzonden: woensdag 16 januari 2008 7:48 Aan: openldap-technical(a)openldap.org CC: bakkerru Onderwerp: Re: sles 10 synchronize 2 ldapservers On Tuesday 15 January 2008 17:42:08 bakkerru wrote: > Question: > > How can i sychronize the users and groups of 2 ldap servers. 1 is > setup as pdc with samba and openldap (SLES10) domain "off.company.nl" > and the other is our mailserver installed with ldap and openexchange > (SLES9.3) domain mail.company.nl. how can i sync the users between > both. The mailserver is in a DMZ. You seem to have two issues here, and you're not clear which one you are trying to address. 1)Are you trying to merge the contents of two different directories? or 2)Are you trying to ensure that the contents of the directory on one server is available on another server? or 3)both? I am not aware of tools to merge the contents of two directories, but you could either do it manually, or write some scripts (which would depend on the contents of the directories). Once you have one directory containing all the information, use the replication tools which are provided to keep the directory in sync across your two servers. To be able to recommend which replication tool to use, you need to supply the versions of OpenLDAP you are using (which may generate a recommendation to upgrade at least one of them ...). Regards, Buchan

4 3

Script to check connections made
by Gustavo Mendes de Carvalho 16 Jan '08

16 Jan '08

Hi All, I would like to know if somebody has some script or knows where I can find one, that reads ldap.log file and creates a report where it's possible to check who logged in which machine, and when this connections was made. Regards --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 5

Expired password notification
by Andris Eiduks 16 Jan '08

16 Jan '08

Hi! We use OpenLDAP for user's authentication. And now also implemented password policy. Authentication from Tomcat works without problem but customers find out about expired passwords only after unsuccessful binding when all limits are exceeded. ldapsearch with option "-e ppolicy" shows info about necessary password change. Is possible to get the same info by BIND operation performing from other systems side again OpenLDAP? Or we must create special functions in application for user attributes checking (pwdChangedTime, pwdGraceUseTime) and notification generation ? Thanks in advance,

4 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical