openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

RWM overlay bind operation
by Rui Ramos 28 Feb '08

28 Feb '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello *, I'm having some troubles with the rwm overlay maybe someone can give some ligths on the subject. We have a non standard schema which in turn has an atribute pass1 that we want to use for the LDAP BIND operation. From what i've seen the BIND operation is hardcoded to use userPAssword attribute (please correct me if i'm wrong). So what we did was the following: we have server A with pass2 filled running on port 7001. and server B with the following config ... database ldap suffix "dc=example,dc=org" uri "ldap://localhost:7001" overlay rwm rwm-map attribute userPassword pass2 ... With this configuration the attribute userPassword gets filled with the content of pass2. But if we try to make Bind search in server B with that user password it fails because it tries to make the bind in ldap://localhost:7001. Is there a way to make the bind operation the the changed data ? Best Regards, Rui Ramos - -- Rui Ramos ============================================== Universidade do Porto - IRICUP Praça Gomes Teixeira, 4099-002 Porto, Portugal email: rramos[at]reit.up.pt phone: +351 22 040 8164 ============================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEVAwUBR8aDvL1uR0bdnTWSAQIuhQgAw5rF8zSs0MapMSUMsb96j0PiUV2TdQ9V GTyB6RTeAJmNqh6/bvEoUO3m8a1UaNffQzYpj03S7y4moVVz4r8+bJQ4Xs0eM8C0 PSU1SXisJbVTcqbEoccma6Yllnd2ZYke8zo/kF/4EPycFxGVj36N+krEB7L/ouO8 jx+Mg6KhteqdxX4Pwz+WyG5g1jhxw4/RKiZC5BaWtP5Cv6pz810DZv9W9C9B0/tJ BYuiWWl3ntzI50Vgm3dmdBt3yUBvngfk/e6RIyRA0rDxpu9uslzCm3Q1acU72tOH Rj32AHuciyf6697rvZE/XQHao09AUhOrZliY/lmpLNc0LHKjDkvDCA== =uBz4 -----END PGP SIGNATURE-----

1 0

ldapsearch returns Could not create LDAP session handle (3): Time limit exceeded
by Brooks Campbell 28 Feb '08

28 Feb '08

We upgraded some client servers from RedHat ES3U4 to Redhat ES4U2 and now the ldapsearch string we used in our monitoring software to check if the customers openldap server is working is returning errors. We were using: ldapsearch -x -H ladps://host.domain.com:636 Which worked find with the open ldap-client on redhat 3 (I do not no the version number) but in redhat 4 openldap-clients 2.2.13-3 we get the error "Could not create LDAP session handle (3): Time limit exceeded" immediately. Ldap is working our application authenticates users it is just the ldapsearch we are using to monitor the service which seems to not be working. Does anyone see anything wrong with the line above or is there something else we can use in a automated script to check if the ldap server is running? Brooks Campbell IT Manager, Waterloo CA and Hersham UK Navtech Systems Support Inc. 295 Hagey Blvd Suite 200 Waterloo, ON, N2L 6R5 W:519-747-1170 xt263 brooks(a)navtechinc.com

3 4

integrating LDAP onto EPrints and Dspace
by divya shree 28 Feb '08

28 Feb '08

Hi I am doin a project..where in i hav to integrate LDAP on to Eprints n DSpace..for providin a single user authentication to the users of Eprints n DSapce... For this i am trying to install OpenLdap-2.4.7..software..i would like to knw if i am on the ryt track and also would like to knw the diff between openldap n ldap..if there is any... Thanks and Regards Divya --------------------------------- Forgot the famous last words? Access your message archive online. Click here.

2 1

OpenLDAP question
by Keith Conger 27 Feb '08

27 Feb '08

Hi, I was wondering if the following is possible with OpenLDAP: I'd like to have an OpenLDAP Server or two(load balanced) with an extended custom schema that will proxy certain attributes back to a non-openldap ldap server. Reading through the list archives it seems like it may be possible but does anyone know for sure from experience? Keith -- Keith Conger Server Systems Administrator Onondaga Community College 4585 West Seneca Turnpike Syracuse, N.Y. 13215-4585 Email/JID: congerk(a)sunyocc.edu http://www.sunyocc.edu/~congerk/

2 1

LDAP add fails with Protocol Error
by Alexander Hartner 27 Feb '08

27 Feb '08

After generating an LDIF file using ldapsearch having a direct fast connect to the LDAP directory, attempt to re-import the file have succeeded while being on the local network. However attempt to import the same LDIF file over a WAN connection fail with the following error: ldapadd -c -D "..." -w ... -x -h ... -p 389 -f test2.ldif adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Already exists (68) adding new entry "..." ldap_add: Protocol error (2) additional info: no attributes provided adding new entry "..." ldap_add: Already exists (68) .. adding new entry "..." adding new entry "..." .. adding new entry "..." ldapadd: update failed: ... ldap_add: Can't contact LDAP server (-1) .. All messages after this file with the same error (-1). It seems that the slower connection is causing a Protocol error which results in LDAP falling over, or at least becoming un-available. Any ideas what could be causing this problem and what I could to address this. Regards Alex

2 1

nss_ldap periodic errors
by Kamil Kisiel 27 Feb '08

27 Feb '08

I'm using nss_ldap on a whole bunch of machines on the network, and while it works great most of the time, I continuously get errors in my syslog. A sampling from today (these are actually from different machines, but I have anonymized the hostnames to be the same.): Feb 25 09:30:25 server.example.com sshd[17495]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 11:11:08 server.example.com -bash: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:50:01 server.example.com automount[5030]: nss_ldap: could not search LDAP server - Server is unavailable Feb 25 21:55:16 server.example.com nscd: nss_ldap: could not search LDAP server - Server is unavailable I get a few of these errors in our syslogs every hour, and occasionally it seems I can't log in via SSH. However typically when I log in to the machine and do a "getent passwd" everything is fine. The LDAP server is from Open Directory in OS X Server 10.5.2. The version of nss_ldap is the one from Gentoo Linux, version nss_ldap-258. My /etc/ldap.conf looks like this: uri ldap://ldap1.example:389 base dc=example,dc=com timelimit 30 bind_timelimit 30 bind_policy soft nss_reconnect_maxconntries 5 idle_timelimit 3600 pam_password_prohibit_message Please use System Preferences on your Mac to change your directory password. nss_base_group cn=Groups,dc=zymeworks,dc=com nss_base_passwd cn=Users,dc=zymeworks,dc=com Does anyone have any suggestions as to what I can try to do to debug and fix this ? It's really becoming irritating. -- Kamil

3 4

log fields
by Gustavo Mendes de Carvalho 26 Feb '08

26 Feb '08

Hi there, I would like to get some documentation that can describe, in details, which fiileds there are present in ldap.log file, and the meaning of each field. I need some information about 7th field (op=33 in first line). Where can I find all codes used in this field ? Jan 10 11:50:21 ldap01 slapd[10819]: conn=1702 op=33 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:25 ldap01 slapd[10819]: conn=1702 op=34 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SRCH base="uid=gustavo,ou=company,c=org" scope=0 deref=0 filter="(objectClass=*)" Jan 10 11:50:26 ldap01 slapd[10819]: conn=1702 op=35 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 op=36 UNBIND Jan 10 12:28:13 ldap01 slapd[10819]: conn=1702 fd=21 closed Thanks --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 7

Re: using LDAP as central authentication unit
by Hamidreza Hamedtoolloei 26 Feb '08

26 Feb '08

Hey Buchan, Thanks alot for your help... it make sense now....during the configuration process , I modified the NSS service to consult the OpenLDAP server by adding the following lines in the /etc/nsswitch.conf file passwd: files ldap shadow: files ldap group: files ldap So ldap server is called for NSS lookup regardless of what authentication mechanism is used. got it Again, thanks alot ~Hamid ----- Original Message ---- From: Buchan Milne <bgmilne(a)staff.telkomsa.net> To: openldap-technical(a)openldap.org Cc: Hamidreza Hamedtoolloei <hamedtoolloei(a)yahoo.com> Sent: Tuesday, February 26, 2008 1:13:56 AM Subject: Re: using LDAP as central authentication unit On Monday 25 February 2008 20:52:08 Hamidreza Hamedtoolloei wrote: > so if a user is in both /etc/passwd and ldap, linux authentication is used. > However, if a user is ONLY in ldap directory, linux authentication fails > and ldap is called. Analysing the case that a user is only in the > etc/passwd: > In this case, there are some activities in the ldap site which I dont > understand. If a user is only in etc/passwd and pam.d/system.auth file > says call ldap only if linux fails, then why ldap is called when linux > authentication is successful? Because, this is NOT PAM. It is a NSS lookup. For example, when you type 'ls', the filesystem returns the uid that owns the files. To show the username of the owner, the c library invokes a function from nss, to look up the username. This has nothing to do with pam. In a similar way, group memberships have nothing (much) to do with PAM, but with nss. > You say this is expected... but if I understood the pam.d/system.auth file > correctly, ldap should not be called if a user is only in etc/passwd We can't tell, as you haven't provided your /etc/nsswitch.conf file, and none of the queries from your log look like pam_ldap, they look more like nss_ldap ... Regards, Buchan ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

OpenLDAP Support for cpCPS objectClass??
by Patrick Patterson 26 Feb '08

26 Feb '08

Hi All; I am working on a PKI project, and would like to be able to use OpenLDAP, however, the certificate policy that we have to conform to mandates that CA entries be a member of pkiCA and cpCps auxiliary object classes. Now, the pkiCA requirement is easy, as it looks like OpenLDAP supports that just fine, however, I'm wondering if cpCPS is able to be supported. I guess my question is twofold: Have the syntax checking routines mandated for the cpCps object class (I presume out of ITU-T X.509 chapter 11) been implemented in OpenLDAP, and if so, does anyone happen to have a schema file available so that I don't have to write one myself to add this objectClass to OpenLDAP. If not, is it possible to add these syntax checking routines in the same way as one can extend the schema for object classes and attributes? (I know that I could probably cheat, turn schema checking off and just build have the server support the attributes in a somewhat custom fashion, but since this is for a PKI system that needs a certain level of trust, I am a bit loath to do this). Thanks in advance. -- Personal Mail from Patrick Patterson No company affiliation

3 4

Re: Limit daily query number
by cariparo＠libero.it 26 Feb '08

26 Feb '08

Overlays seems to be the right way to follow. Now I perform some investigation... Grazie! ---------- Initial Header ----------- >From : "Pierangelo Masarati" ando(a)sys-net.it To : "cariparo(a)libero.it" cariparo(a)libero.it Cc : openldap-technical(a)openldap.org Date : Mon, 25 Feb 2008 15:06:57 +0100 Subject : Re: Limit daily query number > Gavin Henry wrote: > > <quote who="cariparo\(a)libero\.it"> > >> Thanks Gavin, > >> We have a LDAP service for out customers, under subscription, and we want > >> to release a light free service for everyone on Internet, by narrowing the > >> daily queries number. > >> I'm thinking to create a PHP bridge, so free customers call a php page > >> instead to connecting directly to LDAP server, and mantain an IP list on > >> MySQL. Any other idea? > > What you need would best be dealt with by a custom overlay. I suggest > you look at overlay development (servers/slapd/overlays/slapover.txt, > <http://www.openldap.org/faq/data/cache/1169.html>), or hire someone > that can develop it for you. > > <advertisement> > One of SysNet's specialties is custom overlay development > <http://open.sys-net.it> > </advertisement> > > p. > > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > --------------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: pierangelo.masarati(a)sys-net.it > --------------------------------------- > > >

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical