3:55 a.m.
Hi,
I want to establish communication between two ldap servers at different
machines.
For this i have used "ref attribute of ldap" by using this attribute, i am
able to retrieve
entries of second ldap server. Means i can read or search entries of second
server from
first ldap server.
But the problem comes when i want to modify any attribute of an entry of
second server
from the first server.
Definitely i am having some access permissions related error.
Here i am attaching slapd.conf files of both ldap servers.
*First Server* *slapd.conf:*
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/gfsUserManage.schema
include /usr/local/etc/openldap/schema/gfsFileMetaData.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /usr/local/var/run/slapd.pid
argsfile /usr/local/var/run/slapd.args
# Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la
# Sample access control policy:
# Root DSE: allow anyone to write it
# Subschema (sub)entry DSE: allow anyone to write it
#Other DSEs:
allow update_anon
# Allow * write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
access to * by * write
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "dc=cdac,dc=in"
rootdn "cn=Manager,dc=cdac,dc=in"
rootpw secret
index objectClass eq
*access to * by * write*
--------------------------------------------------------------------------------------------------------------------------------
*Second server's slapd.conf:*
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/gfsUserManage.schema
include /usr/local/etc/openldap/schema/gfsFileMetaData.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
pidfile /usr/local/var/run/slapd.pid
argsfile /usr/local/var/run/slapd.args
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "dc=cdac,dc=in"
rootdn "cn=Manager,dc=cdac,dc=in"
rootpw secret
directory /usr/local/var/gfsMetaData
index objectClass eq
*access to * by * write*
-----------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------
*FIRST LADP SERVER DN*:
fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
where *test_ref* is having *ref* attribute
dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
objectClass: referral
objectClass: extensibleObject
fn: test_ref
ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in
*NOW SECOND LDAP SERVER is having DN*:
dn: fn=test1,fn=test_ref,dc=cdac,dc=in
Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry.
I have used ldap command line tool "*ldapdelete*" and executed this tool on
*first LDAP machine*.
Then the result of command is:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D
"cn=Manager,dc=cdac,dc=in"
\"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w
"secret"
ldap_delete: Referral (10)
matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
referrals:
ldap://
192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
*And slapd debug statements:*
do_bind
ber_scanf fmt ({imt) ber:
ber_scanf fmt (m}) ber:
>> dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>
<<< dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>,
<cn=manager,dc=cdac,dc=in>
do_bind: version=3 dn="cn=Manager,dc=cdac,dc=in" method=128
do_bind: v3 bind: "cn=Manager,dc=cdac,dc=in" to
"cn=Manager,dc=cdac,dc=in"
send_ldap_result: conn=2 op=0 p=3
send_ldap_response: msgid=1 tag=97 err=0
ber_flush: 14 bytes to sd 11
connection_get(11): got connid=2
connection_read(11): checking for input on id=2
ber_get_next
ber_get_next: tag 0x30 len 69 contents:
ber_get_next
do_delete
ber_scanf fmt (m) ber:
>> dnPrettyNormal:
<fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>
<<< dnPrettyNormal:
<fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>,
<fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>
bdb_dn2entry("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in")
=>
bdb_dn2id("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in")
<= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found
(-30990)
bdb_referrals: op=74
target="fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in"
matched="fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in"
ldap_url_parse_ext(ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in)
send_ldap_result: conn=2 op=1 p=3
send_ldap_response: msgid=2 tag=107 err=10
ber_flush: 160 bytes to sd 11
connection_get(11): got connid=2
connection_read(11): checking for input on id=2
ber_get_next
ber_get_next: tag 0x30 len 5 contents:
ber_get_next
do_unbind
connection_closing: readying conn=2 sd=11 for close
connection_resched: attempting closing conn=2 sd=11
connection_close: conn=2 sd=11
*
-----------------------------------------------------------------------------------------------------------------------------------------
*
Please do me a favour suggest any solution as soon as possible through which
i can update slave ldap server entries from master ldap server.
--
Rakesh Yadav
Pune.
7:07 a.m.
Rakesh Yadav wrote:
I want to establish communication between two ldap servers at
different
machines.
For this i have used "ref attribute of ldap" by using this attribute, i am
Not sure what you mean, but I presume you're using the LDAP referral
mechanism.
able to retrieve
entries of second ldap server. Means i can read or search entries of second
server from
first ldap server.
But the problem comes when i want to modify any attribute of an entry of
second server
from the first server.
Definitely i am having some access permissions related error.
Here i am attaching slapd.conf files of both ldap servers.
*First Server* *slapd.conf:*
(snip)
*access to * by * write*
^^^ not a wise policy, I hope it's just for testing. In any case you
can't have any access privilege issue with it. Granted.
--------------------------------------------------------------------------------------------------------------------------------
*Second server's slapd.conf:*
(snip)
*access to * by * write*
^^^ same as above
-----------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------
*FIRST LADP SERVER DN*:
fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
where *test_ref* is having *ref* attribute
dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
objectClass: referral
objectClass: extensibleObject
fn: test_ref
ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in
*NOW SECOND LDAP SERVER is having DN*:
dn: fn=test1,fn=test_ref,dc=cdac,dc=in
Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry.
I have used ldap command line tool "*ldapdelete*" and executed this tool on
*first LDAP machine*.
Then the result of command is:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D
"cn=Manager,dc=cdac,dc=in"
\"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w
"secret"
ldap_delete: Referral (10)
matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
referrals:
ldap://
192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
This is the expected behavior: ldapdelete provides no means to
automatically chase referrals.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Fax: +39 0382 476497
Email: ando(a)sys-net.it
-----------------------------------
1:24 a.m.
Hi,
On Sat, Feb 28, 2009 at 8:37 PM, Pierangelo Masarati <ando(a)sys-net.it>wrote:
Rakesh Yadav wrote:
I want to establish communication between two ldap servers at different
> machines.
> For this i have used "ref attribute of ldap" by using this attribute, i am
>
Not sure what you mean, but I presume you're using the LDAP
referral
mechanism.
*If the server *a.example.net* holds *dc=example,dc=net* and wished to
delegate the subtree *ou=subtree,dc=example,dc=net* to another server *
b.example.net*, the following named referral object would be added to *
a.example.net*:*
* dn: dc=subtree,dc=example,dc=net
objectClass: referral
objectClass: extensibleObject
dc: subtree
ref: ldap://b.example.net/dc=subtree,dc=example,dc=net
*
*The server uses this information to generate referrals and search
continuations to subordinate servers.*
I think now u have understood what i want to explain.
able to retrieve
> entries of second ldap server. Means i can read or search entries of
> second
> server from
> first ldap server.
>
> But the problem comes when i want to modify any attribute of an entry of
> second server
> from the first server.
>
> Definitely i am having some access permissions related error.
>
> Here i am attaching slapd.conf files of both ldap servers.
>
> *First Server* *slapd.conf:*
>
(snip)
*access to * by * write*
>
^^^ not a wise policy, I hope it's just for testing. In any case you can't
have any access privilege issue with it. Granted.
Actually this is just for testing purpose.
>
>
--------------------------------------------------------------------------------------------------------------------------------
>
> *Second server's slapd.conf:*
>
(snip)
*access to * by * write*
>
^^^ same as above
-----------------------------------------------------------------------------------------------------------------------------
>
>
-----------------------------------------------------------------------------------------------------------------------------
>
> *FIRST LADP SERVER DN*:
>
> fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
>
> where *test_ref* is having *ref* attribute
>
> dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
> objectClass: referral
> objectClass: extensibleObject
> fn: test_ref
> ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in
>
>
> *NOW SECOND LDAP SERVER is having DN*:
>
> dn: fn=test1,fn=test_ref,dc=cdac,dc=in
>
>
> Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry.
> I have used ldap command line tool "*ldapdelete*" and executed this tool
> on
> *first LDAP machine*.
>
> Then the result of command is:
>
> **[root@tapti LDIF]# ldapdelete -x -h "tapti" -D
> "cn=Manager,dc=cdac,dc=in"
> \"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w
> "secret"
> ldap_delete: Referral (10)
> matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
> referrals:
> ldap://
>
> 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
>
This is the expected behavior: ldapdelete provides no means to
automatically chase referrals.
actually i m using ldap_delete_ext_s() for deleting an entry.
*Can this ldap api be used for deleting referral entries?*
One more thing
*Can this ldap api ldap_modify_ext_s() be used for updating referral entries
?*
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Fax: +39 0382 476497
Email: ando(a)sys-net.it
-----------------------------------
--
Rakesh Yadav
C-DAC , HTDG
Pune.
Mob. 09881092496
1:32 a.m.
Rakesh Yadav wrote:
>> **[root@tapti LDIF]# ldapdelete -x -h "tapti" -D
>> "cn=Manager,dc=cdac,dc=in"
>> \"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w
>> "secret"
>> ldap_delete: Referral (10)
>> matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
>> referrals:
>> ldap://
>>
>> 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
>>
> This is the expected behavior: ldapdelete provides no means to
> automatically chase referrals.
actually i m using ldap_delete_ext_s() for deleting an entry.
*Can this ldap api be used for deleting referral entries?*
You mean: delete the referred object (chase the referral) or delete the
referral object (the reference to the real object)?
If you mean delete the referral object, the answer is: yes, but you need
to use the manageDSAit control (RFC3296).
If you mean delete the referred object by automatically chasing the
referral, the answer is: yes, but you need to register a means to rebind
to the referred host, implementing your own rebind procedure and
registering it using ldap_set_rebind_proc(3) as appropriate.
One more thing
*Can this ldap api ldap_modify_ext_s() be used for updating referral entries
?*
Same as above.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Fax: +39 0382 476497
Email: ando(a)sys-net.it
-----------------------------------
2:38 a.m.
On Tue, Mar 3, 2009 at 3:02 PM, Pierangelo Masarati <ando(a)sys-net.it> wrote:
Rakesh Yadav wrote:
**[root@tapti LDIF]# ldapdelete -x -h "tapti" -D
>>> "cn=Manager,dc=cdac,dc=in"
>>> \"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in"
-w
>>> "secret"
>>> ldap_delete: Referral (10)
>>> matched DN:
>>> fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
>>> referrals:
>>> ldap://
>>>
>>>
>>>
192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in
>>>
>>> This is the expected behavior: ldapdelete provides no means to
>> automatically chase referrals.
>>
>
>
> actually i m using ldap_delete_ext_s() for deleting an entry.
> *Can this ldap api be used for deleting referral entries?*
>
You mean: delete the referred object (chase the referral) or delete the
referral object (the reference to the real object)?
If you mean delete the referral object, the answer is: yes, but you need to
use the manageDSAit control (RFC3296).
If you mean delete the referred object by automatically chasing the
referral, the answer is: yes, but you need to register a means to rebind to
the referred host, implementing your own rebind procedure and registering it
using ldap_set_rebind_proc(3) as appropriate.
Can u sent me any example of second case means how we can register referred
host and our own rebind procedure?
One more thing
> *Can this ldap api ldap_modify_ext_s() be used for updating referral
> entries
> ?*
>
Same as above.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Fax: +39 0382 476497
Email: ando(a)sys-net.it
-----------------------------------
--
Rakesh Yadav
C-DAC , HTDG
Pune.
Mob. 09881092496
4655
days inactive
4659
days old
openldap-technical@openldap.org
4 comments
2 participants
participants (2)
-
Pierangelo Masarati -
Rakesh Yadav