Hi,
I want to establish communication between two ldap servers at different machines. For this i have used "ref attribute of ldap" by using this attribute, i am able to retrieve entries of second ldap server. Means i can read or search entries of second server from first ldap server.
But the problem comes when i want to modify any attribute of an entry of second server from the first server.
Definitely i am having some access permissions related error.
Here i am attaching slapd.conf files of both ldap servers.
*First Server* *slapd.conf:*
# See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org
pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args
# Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la
# Sample access control policy: # Root DSE: allow anyone to write it # Subschema (sub)entry DSE: allow anyone to write it #Other DSEs: allow update_anon # Allow * write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy:
access to * by * write
####################################################################### # BDB database definitions #######################################################################
database bdb
suffix "dc=cdac,dc=in"
rootdn "cn=Manager,dc=cdac,dc=in"
rootpw secret
index objectClass eq
*access to * by * write*
--------------------------------------------------------------------------------------------------------------------------------
*Second server's slapd.conf:*
# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals.
pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args
####################################################################### # BDB database definitions #######################################################################
database bdb suffix "dc=cdac,dc=in"
rootdn "cn=Manager,dc=cdac,dc=in"
rootpw secret
directory /usr/local/var/gfsMetaData
index objectClass eq
*access to * by * write* ----------------------------------------------------------------------------------------------------------------------------- -----------------------------------------------------------------------------------------------------------------------------
*FIRST LADP SERVER DN*:
fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
where *test_ref* is having *ref* attribute
dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject fn: test_ref ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in
*NOW SECOND LDAP SERVER is having DN*:
dn: fn=test1,fn=test_ref,dc=cdac,dc=in
Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry. I have used ldap command line tool "*ldapdelete*" and executed this tool on *first LDAP machine*.
Then the result of command is:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" "fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap:// 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
*And slapd debug statements:*
do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber:
dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>
<<< dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>, <cn=manager,dc=cdac,dc=in> do_bind: version=3 dn="cn=Manager,dc=cdac,dc=in" method=128 do_bind: v3 bind: "cn=Manager,dc=cdac,dc=in" to "cn=Manager,dc=cdac,dc=in" send_ldap_result: conn=2 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next do_delete ber_scanf fmt (m) ber:
dnPrettyNormal:
<fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> <<< dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>, <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> bdb_dn2entry("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") => bdb_dn2id("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_referrals: op=74 target="fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" matched="fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" ldap_url_parse_ext(ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in) send_ldap_result: conn=2 op=1 p=3 send_ldap_response: msgid=2 tag=107 err=10 ber_flush: 160 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next do_unbind connection_closing: readying conn=2 sd=11 for close connection_resched: attempting closing conn=2 sd=11 connection_close: conn=2 sd=11
* ----------------------------------------------------------------------------------------------------------------------------------------- *
Please do me a favour suggest any solution as soon as possible through which i can update slave ldap server entries from master ldap server.
Rakesh Yadav wrote:
I want to establish communication between two ldap servers at different machines. For this i have used "ref attribute of ldap" by using this attribute, i am
Not sure what you mean, but I presume you're using the LDAP referral mechanism.
able to retrieve entries of second ldap server. Means i can read or search entries of second server from first ldap server.
But the problem comes when i want to modify any attribute of an entry of second server from the first server.
Definitely i am having some access permissions related error.
Here i am attaching slapd.conf files of both ldap servers.
*First Server* *slapd.conf:*
(snip)
*access to * by * write*
^^^ not a wise policy, I hope it's just for testing. In any case you can't have any access privilege issue with it. Granted.
*Second server's slapd.conf:*
(snip)
*access to * by * write*
^^^ same as above
*FIRST LADP SERVER DN*:
fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
where *test_ref* is having *ref* attribute
dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject fn: test_ref ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in
*NOW SECOND LDAP SERVER is having DN*:
dn: fn=test1,fn=test_ref,dc=cdac,dc=in
Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry. I have used ldap command line tool "*ldapdelete*" and executed this tool on *first LDAP machine*.
Then the result of command is:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" "fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap:// 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
This is the expected behavior: ldapdelete provides no means to automatically chase referrals.
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it -----------------------------------
Hi,
On Sat, Feb 28, 2009 at 8:37 PM, Pierangelo Masarati ando@sys-net.itwrote:
Rakesh Yadav wrote:
I want to establish communication between two ldap servers at different
machines. For this i have used "ref attribute of ldap" by using this attribute, i am
Not sure what you mean, but I presume you're using the LDAP referral mechanism.
*If the server *a.example.net* holds *dc=example,dc=net* and wished to delegate the subtree *ou=subtree,dc=example,dc=net* to another server * b.example.net*, the following named referral object would be added to * a.example.net*:*
* dn: dc=subtree,dc=example,dc=net objectClass: referral objectClass: extensibleObject dc: subtree ref: ldap://b.example.net/dc=subtree,dc=example,dc=net *
*The server uses this information to generate referrals and search continuations to subordinate servers.* I think now u have understood what i want to explain.
able to retrieve
entries of second ldap server. Means i can read or search entries of second server from first ldap server.
But the problem comes when i want to modify any attribute of an entry of second server from the first server.
Definitely i am having some access permissions related error.
Here i am attaching slapd.conf files of both ldap servers.
*First Server* *slapd.conf:*
(snip)
*access to * by * write*
^^^ not a wise policy, I hope it's just for testing. In any case you can't have any access privilege issue with it. Granted.
Actually this is just for testing purpose.
*Second server's slapd.conf:*
(snip)
*access to * by * write*
^^^ same as above
*FIRST LADP SERVER DN*:
fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
where *test_ref* is having *ref* attribute
dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject fn: test_ref ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in
*NOW SECOND LDAP SERVER is having DN*:
dn: fn=test1,fn=test_ref,dc=cdac,dc=in
Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry. I have used ldap command line tool "*ldapdelete*" and executed this tool on *first LDAP machine*.
Then the result of command is:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" "fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap://
192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
This is the expected behavior: ldapdelete provides no means to automatically chase referrals.
actually i m using ldap_delete_ext_s() for deleting an entry. *Can this ldap api be used for deleting referral entries?*
One more thing *Can this ldap api ldap_modify_ext_s() be used for updating referral entries ?*
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it
Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it
Rakesh Yadav wrote:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" "fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap://
192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
This is the expected behavior: ldapdelete provides no means to automatically chase referrals.
actually i m using ldap_delete_ext_s() for deleting an entry. *Can this ldap api be used for deleting referral entries?*
You mean: delete the referred object (chase the referral) or delete the referral object (the reference to the real object)?
If you mean delete the referral object, the answer is: yes, but you need to use the manageDSAit control (RFC3296).
If you mean delete the referred object by automatically chasing the referral, the answer is: yes, but you need to register a means to rebind to the referred host, implementing your own rebind procedure and registering it using ldap_set_rebind_proc(3) as appropriate.
One more thing *Can this ldap api ldap_modify_ext_s() be used for updating referral entries ?*
Same as above.
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it -----------------------------------
On Tue, Mar 3, 2009 at 3:02 PM, Pierangelo Masarati ando@sys-net.it wrote:
Rakesh Yadav wrote:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D
"cn=Manager,dc=cdac,dc=in" "fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap://
192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
This is the expected behavior: ldapdelete provides no means to
automatically chase referrals.
actually i m using ldap_delete_ext_s() for deleting an entry. *Can this ldap api be used for deleting referral entries?*
You mean: delete the referred object (chase the referral) or delete the referral object (the reference to the real object)?
If you mean delete the referral object, the answer is: yes, but you need to use the manageDSAit control (RFC3296).
If you mean delete the referred object by automatically chasing the referral, the answer is: yes, but you need to register a means to rebind to the referred host, implementing your own rebind procedure and registering it using ldap_set_rebind_proc(3) as appropriate.
Can u sent me any example of second case means how we can register referred host and our own rebind procedure?
One more thing
*Can this ldap api ldap_modify_ext_s() be used for updating referral entries ?*
Same as above.
p.
Ing. Pierangelo Masarati OpenLDAP Core Team
SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it
Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it
openldap-technical@openldap.org
-
Pierangelo Masarati -
Rakesh Yadav