openldap-technical

openldap-technical@openldap.org

2 participants
9961 discussions

date/time attributes
by Ildar Mulyukov 03 Apr '08

03 Apr '08

Hello again! Can anyone point me to attributes designating date or/and time? For example, is there a counterpart of VCard BDAY attribute? Thanks! Regards, Ildar -- Ildar Mulyukov, free SW designer/programmer ================================================ email: ildar(a)users.sourceforge.net home: http://tuganger.narod.ru/ ALT Linux Sisyphus ================================================

4 5

Need help to export ldap user home directory "/home/ldapuser" to client LDAP
by ashwani singh 03 Apr '08

03 Apr '08

Hi, I have created LDAP user "ldapuser" and exported its home directory "/home/LDAP/ldapuser" to LDAP client by following steps and its working but when I replace /home/LDAP/ with /home/testdir/ or only /home it is not allowing to modify  database. How can I export the user home directory from same location /home on client with "/home/ldapuser"? Please help me. [root@sc1435-7 home]# ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Enter LDAP Password: modifying entry "ou=auto.master,dc=ldapserver,dc=com" modifying entry "ou=auto.home,dc=ldapserver,dc=com" modifying entry "cn=/home, ou=auto.master,dc=ldapserver,dc=com" modifying entry "cn=testdir,ou=auto.home,dc=ldapserver,dc=com" ldap_modify: No such object (32)         matched DN: ou=auto.home,dc=ldapserver,dc=com Working Steps with "/home/LDAP/" Step 1. #mkdir /home/LDAP cp -dpR  /home/ldapuser /home/LDAP/ Step 2. Modify data base for "ldapuser" home directory :(as bellow) Create ldif file for auto mount of home directory:(as bellow) Step 3. Edit /etc/exports for shard directory [root@sc1435-7 home]# cat /etc/exports /home/LDAP                  *(rw,sync) # /usr/sbin/exportfs -a  Step 4. Add changes in LDAP data base : ldapmodify -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/ldapuser.ldif ldapadd -x -D "cn=Manager,dc=ldapserver,dc=com" -W -f /etc/openldap/automount.ldif Modify data base for "ldapuser" home directory : # cat /etc/openldap/ldapuser.ldif dn: uid=ldapuser,ou=People,dc=ldapserver,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$lxxxxxxxxxxxxxxxxxxxxxx. shadowLastChange: 13968 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 100 homeDirectory: /home/test/ldapuser Create ldif file for auto mount of home directory: # cat /etc/openldap/automount.ldif dn: ou=auto.master,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.master dn: ou=auto.home,dc=ldapserver,dc=com objectClass: top objectClass: automountMap ou: auto.home dn: cn=/home, ou=auto.master,dc=ldapserver,dc=com objectClass: automount automountInformation: ldap:ou=auto.home,dc=ldapserver,dc=com --timeout 60 cn: /home dn: ou=auto.home,dc=ldapserver,dc=com objectClass: automount automountInformation: -rw,hard,intr sc1435-7:/home Thanks and regards, Ashwani

1 0

Deadlocks when writing in parallell (two processes)
by Stelios Grigoriadis 02 Apr '08

02 Apr '08

We get a lot of DB_LOCK_DEADLOCK when using to programs that for a period of time continuosly writes to OpenLDAP. Version is 2.3.39. The information added is of the form: ebcmdCustomer=0+ebcmdDir=220xx,ou=AuthCodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com where xx varies. Snippet of the output: Mar 27 13:03:21 ldapt1 slapd[7589]: => bdb_dn2id_add: subtree (ebcmdCustomer=0+ebcmdDir=22037,ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) put failed: -30995 Mar 27 13:03:26 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Mar 27 13:03:26 ldapt1 slapd[7589]: => bdb_dn2id_add: parent (ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) insert failed: -30995 Mar 27 13:03:28 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Mar 27 13:03:28 ldapt1 slapd[7589]: => bdb_dn2id_add: parent (ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) insert failed: -30995 Mar 27 13:03:36 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Mar 27 13:03:36 ldapt1 slapd[7589]: => bdb_dn2id_add: parent (ou=authcodes,ebcmdVersion=0,ebcmdProduct=ebcmd,dc=example,dc=com) insert failed: -30995 Mar 27 13:03:38 ldapt1 slapd[7589]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) I see in the code that a key (the same it seems to be) is repeatedly written, and a comment is stating that /* Don't worry if it's already there */ (line 862 in servers/slapd/back-bdb/idl.c). Is this to be expected or have we done something wrong? /Stelios Grigoriadis

2 2

Applying ppolicy to a user
by Bryan Payne 02 Apr '08

02 Apr '08

I need to apply an alternate policy to a specific user. I can't for the life of me remember what attribute needs to be set for the user. Any help is appreciated. Thanks.

2 1

Re: OpenLDAP Group ACL
by Pierangelo Masarati 01 Apr '08

01 Apr '08

Please keep replies on the list. Luke Lee wrote: > Sir, > > I have the following in my base ldif: snip > > and I have the following under the group ou: > > dn: cn=pwmanager,ou=Group,dc=mydomain,dc=com > objectClass: groupOfNames > cn: pwmanager > member: cn=l_luke,ou=People,dc=mydomain,dc=com > member: w_smith,ou=People,dc=mydomain,dc=com snip > The access defined in the slapd.conf file: > > access to attrs=userPassword > by self write > by group.exact="cn=pwmanager,ou=Group,dc=mydomain,dc=com" write > by * none > > access to * > by self write > by group.exact="cn=pwmanager,ou=Group,dc=mydomain,dc=com" write > by users read > by * none > > Will I be able to use the following command to change user's password? > > ldappasswd -x -W -D "uid=l_luke,ou=People,dc=mydomain,dc=com" -S > "uid=w_smith,ou=People,dc=mydomain,dc=com" No. > How can I use the Netgroup and netgroup.byhost nisMap to achive the same purpose? Would you please help? Thanks! You can't. You can't use anything but groupOfNames/member for group membership. The only alternative, discussed thousands of times in the archives (the last time three days ago, <http://www.openldap.org/lists/openldap-software/200803/msg00241.html>) consists in using sets, but performance and deadlock issues will probably bite you. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Blank Password for a ldap user
by Rocky S 01 Apr '08

01 Apr '08

I am very new ldap programming, so bear with me if my query is naive. I am trying to write a program using the OpenLDAP SDK. The program should take an LDAP servername/port, a CN & a password. The program should then report if the CN/password combination is correct or incorrect. This is how I am trying to do this. [ error checks removed for making it simple] LDAP *pldap; ldap_initialize(&pldap, "ldap://myhost:389) ; int desired_version = LDAP_VERSION3; ldap_set_option(pldap, LDAP_OPT_PROTOCOL_VERSION, &desired_version); int ret = ldap_bind_s(pldap, "uid=Jack,ou=People,dc=vss,dc=veritas,dc=com", "jack123", LDAP_AUTH_SIMPLE); if(ret == LDAP_SUCCESS) puts("VERIFIED"); else puts("FAILURE"); This works fine for for Jack/jack123. I have another user in the directory - John who has a null/empty password I tried both ldap_bind_s(pldap, "uid=John,ou=People,dc=vss,dc=veritas,dc=com", NULL, LDAP_AUTH_SIMPLE); ldap_bind_s(pldap, "uid=John,ou=People,dc=vss,dc=veritas,dc=com", "", LDAP_AUTH_SIMPLE); Both cases ldap_bind_s returns 53 - which I think means LDAP UNWILLING TO PERFORM I know the server allows null passwords.

2 2

logs and I/O Performances
by Andre Stoffel 31 Mar '08

31 Mar '08

Hi all, We are using 3 LDAP Directories based on Openldap 2.2.23 (number of objects : between 4000 and 11000 in the DBs) . The hardware is based on HP servers correctly dimensioned but not oversized disks resided on an EMC Symmetrix We try to implement the ldap logs but we have to stop after the first test: a common request taking between 1 up to 2 seconds instead of some milliseconds. Has anybody an idea of whats going wrong: setting, architecture Thanks. André.

2 1

OpenLDAP as a Meta directory for eDirectory and Active Directory
by Jon Gerdes 30 Mar '08

30 Mar '08

I have a requirement to link up the contents of an AD and an eDir into a single meta dir. I am testing all this on a small system. The basic idea is that a user will be able to do a search on their uid and then bind to it. Their account could be in either the AD or the eDir. I would want to support both simple and digest-md5 binds. Both eDir and AD support SASL digest md5 binds but AD does not allow simple binds. I do not wish to change the back ends but just work with what is there. In my test system I have dc=blueloop,dc=net at the top with ou=edir and ou=ad to be mapped under the top level. My gerdesj account has all the relavent rights in all cases. I have gone around in circles on this several times! I can do a browse of the edir container fine ie a search of the ou=edir,dc=blueloop,dc=net as anon returns stuff as I would expect. This seems to work OK: ldapsearch -h localhost '(objectclass=*)' -D "cn=gerdesj,ou=edir,dc=blueloop,dc=net" -b "ou=edir,dc=blueloop,dc=net" -x -W Trying to use SASL fails: ldapsearch -h localhost -b 'ou=edir,dc=blueloop,dc=net' '(objectclass=*)' -Y DIGEST-MD5 -U "dn:cn=gerdesj,ou=edir,dc=blueloop,dc=net" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database This seems to imply to me that the OpenLDAP box is trying to auth me rather than passing this off to the system it is proxying. Why ? I would also like to make the AD side of things such that it will allow a simple anonymous connection to search and then allow through a simple bind I've read everything I can find but have run out of steam. Thanks for any advice or pointers. Cheers Jon Here is a chunk out of my slapd.conf ##### eDir #ldapsearch -h localhost -b 'ou=edir,dc=blueloop,dc=net' -s sub -x -D '' '(objectclass=*)' database ldap suffix "ou=edir,dc=blueloop,dc=net" uri "ldap://port.blueloop.net/" subordinate overlay rwm rwm-suffixmassage "ou=edir,dc=blueloop,dc=net" "ou=users,o=blueloop" ##### AD database ldap suffix "ou=ad,dc=blueloop,dc=net" uri "ldap://baileys.blueloop.net/" subordinate idassert-authzFrom "dn:regex=.*" acl-bind bindmethod=sasl saslmech=DIGEST-MD5 authcId=gerdesj authzId=gerdesj credentials="{SSHA}xxxxxx" idassert-bind bindmethod=sasl saslmech=DIGEST-MD5 binddn="cn=gerdesj,ou=users,ou=blueloop,dc=blueloop,dc=net" credentials="{SSHA}xxxxxxxxxxxxxx" mode=self overerlay rwm rwm-suffixmassage "ou=ad,dc=blueloop,dc=net" "ou=users,ou=blueloop,dc=blueloop,dc=net" Registered Address : 7 Manor Buildings, North Perrott, Crewkerne, Somerset, TA18 7ST Registered England & Wales - 3981322 CONFIDENTIAL INFORMATION This e-mail and any files attached with it are confidential and for the sole use of the intended recipient(s). If you are not the intended recipient(s) you are prohibited from using, copying or distributing this or any information contained in it and should immediately notify the sender and delete the message from your system. Internet communications are not secure and Blueloop Limited is not responsible for unauthorised use by third parties nor for alteration or corruption in transmission. Furthermore, while Blueloop Limited have taken reasonable precautions to minimise the risk of software viruses, it cannot accept liability for any damage which you may suffer as a result of such viruses, and we therefore recommend you carry out your own virus checks on receipt of any e-mail.

2 1

DSMLReader(dsmlFile) gives Invalid beginning tag :attr error
by Hamidreza Hamedtoolloei 29 Mar '08

29 Mar '08

var YAHOO = {'Shortcuts' : {}}; YAHOO.Shortcuts.hasSensitiveText = false; YAHOO.Shortcuts.sensitivityType = []; YAHOO.Shortcuts.doUlt = false; YAHOO.Shortcuts.location = "us"; YAHOO.Shortcuts.document_id = 0; YAHOO.Shortcuts.document_type = ""; YAHOO.Shortcuts.document_title = "DSMLReader(dsmlFile) gives Invalid beginning tag :attr error"; YAHOO.Shortcuts.document_publish_date = ""; YAHOO.Shortcuts.document_author = "hamedtoolloei(a)yahoo.com"; YAHOO.Shortcuts.document_url = ""; YAHOO.Shortcuts.document_tags = ""; YAHOO.Shortcuts.annotationSet = { "lw_1206833257_0": { "text": "prabbit(a)dsml.org", "extended": 0, "startchar": 1507, "endchar": 1522, "start": 1507, "end": 1522, "extendedFrom": "", "predictedCategory": "", "predictionProbability": "0", "weight": 1, "type": ["shortcuts:/us/instance/identifier/email_address"], "category": ["IDENTIFIER"], "context": "" } }; Hey guys, I am using jldap to communicate with ldap, and I get an exception when I am parsing a dsml file. In more details, the following line of code LDAPReader in = new DSMLReader(dsmlFile); gives the following error Thefollowing error occured handling a DSML file:LDAPLocalException: Thefollowing error occured while parsing DSML: org.xml.sax.SAXException:Invalid beginning tag :attr (84) Decoding Error org.xml.sax.SAXException: Invalid beginning tag :attr when dsmlFile is <dsml:directory-entries> <dsml:entry dn="uid=prabbit,ou=development,o=bowstreet,c=us"> <dsml:objectclass> <dsml:oc-value>top</dsml:oc-value> <dsml:oc-value>person</dsml:oc-value> <dsml:oc-value>organizationalPerson</dsml:oc-value> <dsml:oc-value>inetOrgPerson</dsml:oc-value> </dsml:objectclass> <dsml:attr name="sn"><dsml:value>Rabbit</dsml:value></dsml:attr> <dsml:attr name="uid"><dsml:value>prabbit</dsml:value></dsml:attr> <dsml:attr name="mail"><dsml:value>prabbit(a)dsml.org</dsml:value></dsml:attr> <dsml:attr name="givenname"><dsml:value>Peter</dsml:value></dsml:attr> <dsml:attr name="cn"><dsml:value>Peter Rabbit</dsml:value></dsml:attr> </dsml:entry> </dsml:directory-entries> </dsml:dsml> Any suggestions?? thanks Never miss a thing. Make Yahoo your homepage. ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

Unable to add attribute to cn
by Frank, Hans, 232 28 Mar '08

28 Mar '08

Hi there, I would like to add the attribute "orclnetdescstring" to the following ldap object: cn=TESTDB,cn=OracleContext,dc=test,dc=de When trying this, I get the following error message: 09:44:42 AM: Failed to add 'orclnetdescstring' attribute for ldap://***:389/cn=TESTDB,cn=OracleContext,dc=test,dc=de Root error: [LDAP: error code 65 - attribute 'orclnetdescstring' not allowed] I did include the attributetype into the core.schema, which is included in slapd.conf the following way: attributetype ( 1.3.6.1.4.1.9232.6 NAME 'orclnetdescstring' DESC 'Oracle-OID spezific A-Type' SUP name ) or: attributetype ( 1.3.6.1.4.1.9232.6 NAME 'orclnetdescstring' SUP name ) But that doesn't change anything. I am very new to openldap, so if there are any good tutorials which describe such simple things (I suppose this is something simple), please let me know. I just need this object with some specific attributes, how can I realise this? Best Regards Hans Frank

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical