openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

NOOP and case change renames
by Andrew Bartlett 11 Jan '08

11 Jan '08

I'm up against my next challenge in the great challenge of Samba4 and OpenLDAP. As metioned on openldap-devel, I've hit up against renaming DNs onto themselves. For example, I previously mentioned cn=ldaptestuser2,cn=users,DC=samba,DC=example,DC=com into cn=ldaptestuser3,cn=users,DC=samba,DC=example,DC=com This should become: dn: cn=ldaptestuser2,cn=users,DC=samba,DC=example,DC=com changetype: modrdn newrdn: cn=ldaptestuser2 deleteoldrdn: 1 > RFC 4511 states that a modify DN operation must fail with the > entryAlreadyExists result code if there was already an entry with that > name. However, a broad interpretation would recognize that such a > modify DN operation is going to be a no-op and simply ignore it. The > specific case doesn't seem to be explicitly dealt with in RFC 4511. I've written a module to cause this to never reach the DB, but my next test (which AD also permits) is: cn=ldaptestuser3,cn=users,DC=samba,DC=example,DC=com into cn=ldaptestUSER3,cn=users,DC=samba,DC=example,DC=com So it seems I need some backend help. Is there another way I should be handling case changes in a DN, or could/should the DB be modified to allow these operations? (These tests arose because a user tried to do exactly this from the windows management tools, and we also failed to allow it in ldb). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 5

Newbie - how to change display name settings
by Winanjaya - CBN 10 Jan '08

10 Jan '08

Hello All, I am very new with this, I have configured openldap on my FC1 .. Currently, the Display name settings is Last Name, First Name .. how to change it to FirstName, Last Name? Please help Thanks & Regards Winanjaya *********************** Our outgoing mail has been scanned by MSS. ***********-***********

4 7

simple-auth to SASL mapping?
by Stefan Palme 09 Jan '08

09 Jan '08

Hi all, I have setup an OpenLDAP server for users authenticating using SASL. The authz-regexp "converts" the SASL identity into a DN which is used only for authorization purposes - there are no real LDAP entries with these DNs. This setup works fine. Now I have some LDAP client applications that only support simple authentication, but no SASL authentication. So I am looking for a way to "map" simple authentication to SASL authentication, e.g. when a user uses simple auth with DN "cn=user1,ou=users,dc=domain,dc=com" this mechanism should authenticate this user via SASL using username "user1" and the provided password. I absolutely DO NOT WANT to create real LDAP entries for these users, because the user database is an external one accessed via SASL->PAM->COMPLICATED_PAM_MODULES, and I dont want to manage user accounts in two places :-) Is this possible? I already thought about using an "ldap"-backend to proxy simple-auth-connections, but I did not found a way to just "rewrite" the authentication information and make the proxy server using SASL with a username extracted from the simple auth DN... Thanks and best regards -stefan-

2 2

Regarding ldap client library with php ldap exop patch
by Faraz Khan 09 Jan '08

09 Jan '08

This is regarding the php ldap exop patch published by Pierangelo Masarati at : http://www.sys-net.it/~ando/Download/#PHP%3E I BADLY require paged results for my ldap based application. The patch applies fine to PHP 5_2 HEAD. However, two things need to be changed. 1. the zstr struct does not exist, which needs to be defined. This is not a problem. Solved with some help from PHP developers on what zstr is. 2. In the function php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope) in ldap.c, timelimit is set to -1 as follows: int ldap_attrsonly = 0; int ldap_sizelimit = -1; int ldap_timelimit = -1; The ldap_search operation keeps on returning a LDAP ERROR : Timeout in this case. Modifying timelimit to : int ldap_timelimit = 300; for example fixes the issue and pagination works. I'm guessing the following is what causes problems: #ifdef HAVE_LDAP_SEARCH_EXT_S /* Run the actual search */ { int rc; struct timeval tv; tv.tv_sec = ldap_timelimit; tv.tv_usec = 0; rc = ldap_search_ext(ld->link, ldap_base_dn, scope, ldap_filter, ldap_attrs, ldap_attrsonly, NULL, NULL, &tv, ldap_sizelimit, &rcs[i] ); /* TODO: check rc == LDAP_SUCCESS */ } the tv.tv_usec=0 when tv.tv_sec = -1 Just a hunch. How does ldap_search_ext handle timelimit? Thank you. I currently have it set to 300, which is bad, and it seems to be working fine. Please remember the problem (with the patch applied) happens not only to paged requests but any ldap_search request (keeps timing out instantaneously) -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

1 0

Password expiration question (ppolicy and smbk5wpd interaction)
by Pat Riehecky 08 Jan '08

08 Jan '08

Like many before me I would love to get the smbk5pwd module up and running, but I have a question. In OpenLDAP 2.4.7: If I set a password expiration time up (with ppolicy), and the user's password expires, does it lock the Heimdal, Samba, and ldap passwords? On the flip side, if I set a password expiration time up (with smbk5pwd), and the user's password expires, does it lock the Heimdal, Samba, and ldap passwords? Or perhaps more to the point, what can I do to keep all three of these passwords either all valid or all expired at the same time? The documentation is a bit vague on this one point, and the archives left me still in confusion..... Pat

3 2

Decoding error when splitting a DN with ldap_str2dn()
by Michael Ströder 07 Jan '08

07 Jan '08

HI! I have a problem splitting a DN with ldap_str2dn(). Actually I'm using it from python-ldap but judging from the debug output there does not seem to be an issue with passing the DN to the OpenLDAP API (see Python console output below). Any clue what's wrong with this DN? OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE BTW: Removing the spaces around , and + does not help either. Ciao, Michael. -------------------------------- snip -------------------------------- Python console: >>> ldap.set_option(ldap.OPT_DEBUG_LEVEL,65535) >>> dn 'OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE' >>> ldap.dn.str2dn(dn) => ldap_bv2dn(OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE,0) ldap_err2string <= ldap_bv2dn(OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE)=-4 Decoding error Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.5/site-packages/ldap/dn.py", line 50, in str2dn return ldap.functions._ldap_function_call(_ldap.str2dn,dn,flags) File "/usr/lib/python2.5/site-packages/ldap/functions.py", line 59, in _ldap_function_call result = func(*args,**kwargs) ldap.DECODING_ERROR >>>

3 4

Relative Distinguished Name searches
by Andrew Bartlett 06 Jan '08

06 Jan '08

In Samba4, I currently have a module that creates and maintains the 'name' attribute for our AD look-alike. Unlike in other systems, where this is related to 'cn', in AD this is always the relative distinguished name. I wondered if it might be possible (by some extended matching of some kind) to transform a search of 'name=foo' into something that does not require the manual maintenance of a samba4RDN attribute? (such a matching might then avoid problems if, in future, we allow clients direct access to the backend). Any thoughts? Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 1

CN must be indexed?
by Andrew Bartlett 06 Jan '08

06 Jan '08

Working on the OpenLDAP backend for Samba4, I'm wondering if this is expected: Is 'cn' a special attribute in the OpenLDAP code? It seems that the builtin schema definition (or something else) requires that the 'cn' attribute be indexed with index cn eq Otherwise, searches for cn=foo fail, where cn=foo* succeeds... I'm using current CVS, and trying to have Samba4 automatically generate configuration files for OpenLDAP, possibly based on the (AD) schema-data we will load into the directory. As such, knowing any (particularly other, similar) OpenLDAP-imposed constraints will be very useful, so that I can ensure these are met by the provision-backend script in Samba4. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

2 5

Packaging libldap and libldap_r
by Russ Allbery 06 Jan '08

06 Jan '08

I'm one of the people who works on packaging OpenLDAP for Debian, and I'm trying to figure out what the right way to deal with libldap and libldap_r would be. Here's the problem that Debian has (which I expect is shared by other distributors): As I understand it, libldap_r is the thread-safe library and libldap is not thread-safe, so threaded applications have to link with libldap_r. However, libldap and libldap_r both contain the same symbols and don't use symbol versioning. So if both are loaded into the same process space at the same time, it's undefined which library is called, which can cause all sorts of problems. Therefore, for modules like nss-ldap that are loaded into the process space of almost every system process, there is no good option for which library to link against in the presence of both libraries: Linking with libldap because nss-ldap isn't threaded means that threaded applications that link with libldap_r may resolve symbols to the wrong library. Threaded applications may also get undefined results if they call NSS functions. But linking nss-ldap with with libldap_r to be safe for threaded applications will cause problems for any application linked with libldap. Note that nss-ldap is just an example, useful because it's fairly obvious. The same problem applies to any situation where multiple libraries may be mingled in a process space: PAM-using servers with pam-ldap, Apache with mod_ldap and mod_python or mod_perl loading LDAP modules, etc. What's the recommended way of dealing with this problem? I'd like whatever solution we use to be something that you're comfortable with. It's worth noting, btw, that glibc provides stubs for pthread functions, allowing libraries that need to be thread-safe in threaded programs but not in unthreaded programs to gain back the speed lost to locking when running without threads. In order to use this, the library should *not* be linked directly with the pthread library. glibc will provide stubs that do nothing if libpthread isn't loaded, and if it is, they will be transparently replaced by the correct threading code. This would eliminate the need to have two separate libraries. However, glibc only provides these stubs for a limited number of functions, and libldap_r currently references pthread functions outside of that set. I believe the other symbols may only be used in the code that supports slapd, although I could be wrong. Attached is the list of functions for which stubs are provided. pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_cond_broadcast pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_init pthread_equal pthread_exit pthread_getschedparam pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock pthread_self pthread_setcancelstate pthread_setcanceltype pthread_setschedparam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

1 0

openldap adressbook
by digitom 04 Jan '08

04 Jan '08

Hello, I've want to set up an email server with dovecot, postfix openldap etc. Now my problem is to set up an openldap adressbook for Evolution. I've could add a new contact to the database via Evolution, and can see the contact via phpldapadmin and with Evolution. But if I restart Evolution, all contacts are lost (in Evolution, in phpldapadmin I still could see the conatcts.) Where is the problem? I've activated all possible log statements, but there's no needful information. (for me:) I've using debian etch with slapd 2.3.30-5 and Evolution 2.12.1. Now my slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/evolutionperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel conns filter config trace args BER ACL stats stats2 shell parse index modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb suffix "dc=testdomain" rootdn "cn=admin,dc=testdomain" rootpw {SSHA} ... and my ldif: dn:dc=testdomain objectClass: dcObject objectClass: organization o: my-example dc:testdomain dn:cn=admin,dc=testdomain objectClass: organizationalRole cn:admin dn:ou=contacts,dc=testdomain ou: contacts objectClass: organizationalUnit Do you need any further information to help me??? Thanks in advance. Thomas

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical