The Suretec Blog - OpenLDAP

OpenLDAP 2.4.12 Released

nospam@example.com (Gavin Henry) — Tue, 14 Oct 2008 07:04:00 +0100

OpenLDAP 2.4.12 Release (2008/10/12)
Fixed libldap ldap_utf8_strchar arguments (ITS#5720)
Fixed libldap TLS_CRLFILE (ITS#5677)
Fixed liblutil executables on Windows (ITS#5604)
Fixed liblutil microsecond overflows on Windows (ITS#5668)
Fixed librewrite memory handling (ITS#5691)
Fixed slapd aci performance (ITS#5636)
Fixed slapd aci's with sets (ITS#5627)
Fixed slapd attribute leak (ITS#5683)
Fixed slapd config backend with index greater than sibs (ITS#5684)
Fixed slapd custom attribute inheritance (ITS#5642)
Fixed slapd dynacl mask handling (ITS#5637)
Fixed slapd firstComponentMatch normalization (ITS#5634)
Added slapd caseIgnoreListMatch (ITS#5608)
Fixed slapd connection events enabled twice (ITS#5725)
Fixed slapd memory handling (ITS#5691)
Fixed slapd objectClass canonicalization (ITS#5681)
Fixed slapd objectClass termination (ITS#5682)
Fixed slapd overlay control registration (ITS#5649)
Fixed slapd runqueue checking (ITS#5726)
Fixed slapd spurious text output (ITS#5688)
Fixed slapd socket closing on Windows (ITS#5606)
Fixed slapd sortvals comparison (ITS#5578)
Added slapd substitute syntax support (ITS#5663)
Fixed slapd syncrepl contextCSN detection (ITS#5675)
Fixed slapd syncrepl error logging (ITS#5618)
Fixed slapd syncrepl runqueue interval (ITS#5719)
Fixed slapd-bdb entry return if attr not present (ITS#5650)
Fixed slapd-bdb olcDbMode syntax (ITS#5713)
Fixed slapd-bdb/hdb release search entries earlier (ITS#5728,ITS#5730)
Fixed slapd-bdb/hdb subtree search with empty suffix (ITS#5729)
Fixed slapd-dnssrv memory handling (ITS#5691)
Fixed slapd-ldap^[?],slapd-meta invalid filter behavior (ITS#5614)
Fixed slapd-meta memory handling (ITS#5691)
Fixed slapd-meta objectClass filtering (ITS#5647)
Fixed slapd-meta quarantine behavior (ITS#5592)
Added slapd-ndb experimental backend
Fixed slapd-relay initialization (ITS#5643)
Fixed slapd-sql freeing of connection (ITS#5607)
Fixed slapd-sql fault on NULL fields (ITS#5653)
Fixed slapo-accesslog entryCSN generation on purge (ITS#5694)
Fixed slapo-constraint string termination (ITS#5609)
Fixed slapo-dynlist expansion with mapped attributes (ITS#5717)
Fixed slapo-memberof internal operations DN (ITS#5622)
Fixed slapo-pcache attrset crash (ITS#5665)
Fixed slapo-pcache caching with invalid schema (ITS#5680)
Fixed slapo-ppolicy control return on password modify exop (ITS#5711)
Fixed slapo-rwm callback cleanup (ITS#5601,ITS#5687)
Fixed slapo-rwm attr mapping and merging (ITS#5624)
Fixed slapo-rwm objectClass filtering (ITS#5647)
Fixed slapo-translucent back-config support (ITS#5689)
Fixed slapo-translucent filter usage on merged entries (ITS#5679)
Fixed slapo-unique filter validation (ITS#5581)
Fixed slapo-unique suffix testing (ITS#5641)
Build Environment
Fixed ODBC library detection (ITS#5602)
Added BDB 4.7 support (ITS#5523)
Added slapo-collect overlay with enhancements(ITS#5659)
Documentation
Added slapd-ldap(5), slapd-meta(5) noundeffilter (ITS#5614)
Fixed slapd-ldap(5), slapd-meta(5), slapo-pcache(5) schema requirements (ITS#5680)
Added slapo-collect(5) man page (ITS#5706)
Added slapo-pcache(5) proxycheckcacheability option (ITS#5680)
Added slapo-retcode(5) retcode.conf location (ITS#5633)
admin24 dontusecopy control update (ITS#5718)
admin24 guide updates (ITS#5616)
admin24 octetString fix (ITS#5670)

"When you can do something useful, you should"

nospam@example.com (Gavin Henry) — Sat, 11 Oct 2008 21:25:21 +0100

Another great example of how the Open Source community works and how others should follow.

Gavin.

Asterisk 1.6.0 is the first official release of Asterisk 1.6

nospam@example.com (Gavin Henry) — Fri, 03 Oct 2008 10:01:39 +0100

The first official release is out, and you can see lots of new features . Unfortunately there are still a few Realtime LDAP^[?] driver bugs, but it's getting there.

It's well worth having a play with Asterisk 1.6.0 though.

Gavin.

OpenLDAP for Fortune 20 Enterprises

nospam@example.com (Suretec) — Mon, 29 Sep 2008 23:29:53 +0100

HP decided to partner with Symas on OpenLDAP. We engineered as well as funded major contributions to OpenLDAP. On several occasions, we had the opportunity to put the facilitator model to the test. Would Symas be able to respond to urgent support calls? Would they be able to turn around quick patches to fix bugs? Would they be able to get those patches accepted by the OpenLDAP project? Would the OpenLDAP project embrace the overall work of HP and Symas, even though it meant significant change to the underlying codebase? The answer to each of these questions was a resounding yes, and our expectations for working in this model were fully validated.

Learn how to do this for your Enterprise.

For Enterprise grade OpenLDAP Support and consultancy, contact Suretec or Symas.

Suretec partners Symas release a MySQL Cluster back-end for OpenLDAP

nospam@example.com (Suretec) — Fri, 19 Sep 2008 12:29:49 +0100

MySQL and Symas have worked together for much of 2008 to produce a back-ndb, a back-end module for OpenLDAP that uses MySQL Cluster’s networked clustered database technology for OpenLDAP. Initially, we were concerned about how this would turn out but the advantages of the clustering technology made it worth a try. It turned out much better than expected!

MySQL (Sun) has contributed the source of this back-end to the OpenLDAP project and it is available in source from the project now. We expect it to be included in the next OpenLDAP 2.4 Release (imminent). MySQL will be offering binary distributions for selected platforms by the end of September.

GNU/Linux and Microsoft Active Directory

nospam@example.com (Gavin Henry) — Fri, 29 Aug 2008 23:44:40 +0100

There's an interesting interview video with Gerald Carter of Samba and Likewise Software talking about Likewise Open:

Likewise Open is an open source, community project sponsored by Likewise Software to integrate Linux, Unix, and Mac in Microsoft Active Directory and authenticate users with their domain credentials. Likewise Open is licensed under the open source licensing so you can download it for free. Or, if you would like to become involved with the project, join one of the community mailing lists and discuss Likewise Open with other users and developers.

Suretec use Likewise Open for some of its cusomters and it's very good if you need to go down that route....

Zimbra do listen

nospam@example.com (Suretec) — Thu, 21 Aug 2008 08:35:00 +0100

Suretec have now been using Zimbra OSS^[?] Edition for 2 weeks now and have hooked in Funambol OSS Edition using the Zimbra Funambol Connector. Mighty impressive and saves a lot of time and has a great business benefits.

It also uses OpenLDAP! Time to test the Asterisk Zimlet (which will need development work for the UK).

Have a feature request for Zimbra or bug report? Well, they do listen.

Down with OpenLDAP 2.3! OpenLDAP 2.4 is king!

nospam@example.com (Gavin Henry) — Fri, 15 Aug 2008 08:08:07 +0100

OpenLDAP 2.4.11 has now been official marked as "stable"

Note:

The term "release", as used on the download web page (http://www.openldap.org/software/download/) refers to the lastest version of the OpenLDAP Software available for "general use".

The term "stable" refers to the last "general use" release that has demonstrated itself as being reliable in real world environments.

Each new version which is published is referred to as the "release" version until a subsequent version is published. Likewise, "stable" always refers to the release which is considered the most reliable.

Until today, an OpenLDAP 2.3 version was always marked as stable. For more information see the major changes and releases notes.

Gavin.

OpenLDAP for OpenSolaris

nospam@example.com (Gavin Henry) — Thu, 07 Aug 2008 20:30:38 +0100

In reality the OpenLDAP distribution is moving forward, while the Mozilla distribution has stagnated.

I wonder what other LDAP^[?] projects are in the same state as the Mozilla one?

Almost all other known Linux FOSS based utilities using LDAP,
use OpenLDAP libraries by default. The current maintainers
of the Mozilla LDAP code base are currently expressing no
interest in continuing to enhance Mozilla libldap beyond
existing minimal maintenance efforts. In reality the OpenLDAP
distribution is moving forward, while the Mozilla distribution
has stagnated.

Today, Solaris/OpenSolaris is the only major distribution that
does not deliver the OpenLDAP libldap C APIs. This project
corrects this issue.

Full e-mail post is here.

Hardware and Operating System Best Practices for OpenLDAP

nospam@example.com (Suretec) — Wed, 30 Jul 2008 08:53:55 +0100

Just a quick one to say our partners Symas have written a very nice peice about how to pick your base hardware and operating system for use with OpenLDAP in your Enterprise:

The key to this first factor is that OpenLDAP is the most efficient, most stable, and most suitable LDAP^[?] Directory Service technology for Enterprise production use. Installing it as a new service or an upgrade to an older technology will be the most cost-effective step assuming the capacity is available. In general, replacing an older Directory Technology will reduce the processor load by two to five times. It will also improve the stability of the server(s) making simplification of configurations tuned to frequent server outages possible. Symas OpenLDAP is available under inexpensive annual support subscriptions with no consideration for the number of CPUs in the server or the number of objects/entries in the Directory, too. So, our preference of platform, in general, is put OpenLDAP (Symas OpenLDAP) on what you’ve got!

Read the full article

Asterisk RealTime LDAP Driver Guide

nospam@example.com (Gavin Henry) — Fri, 25 Jul 2008 20:25:18 +0100

W. Michael Petullo has published a very detailed article for Red Hat Magazine about using the Asterisk RealTime LDAP^[?] Driver and Fedora Directory Server.

It's well written and a good read, but just so you know, OpenLDAP can easily be used and should have been the first choice as I'm sure our partners in crime Symas would point out too

But hey, it's a Red Hat Magazine so you can't blame them really...

Voice over Internet Protocol (VoIP) has emerged as a popular technology for modern voice communications. Many organizations have replaced their analog or proprietary digital telephone systems with VoIP-based solutions. This allows the consolidation of telephone services into an existing IP infrastructure. In addition, using IP to host voice services lets the organization leverage existing expertise–while retaining all of the network’s management advantages. Though not without its disadvantages, VoIP provides a compelling option to those looking for a telephone solution.

This article will present a simple VoIP solution using Asterisk, an open source private branch exchange (PBX) product. It will show you how to install Asterisk, configure it using its LDAP backend, and connect to it using the Ekiga software VoIP client and a Cisco 7900 Series VoIP telephone to make calls.

The first comment about the article is right though:

In general experienced users from the Asterisk community advise against purchasing Cisco phones for business deployment with Asterisk and recommend Polycom, Aastra or Snom instead. Cisco phones are very expensive, difficult to setup, technical documentation is not easily accessible for the end-user, their SIP firmware has some nasty surprises and as far as I know that cheap SmartNet contract is still quite difficult to get.

The LDIF Schema and normal LDAP schema are available in non-FDS format and are contributed to the Asterisk Project by Suretec and maintained by Suretec.

Thanks,

Gavin.

Replacing Slurpd using OpenLDAP 2.4

nospam@example.com (Gavin Henry) — Thu, 10 Jul 2008 20:15:26 +0100

I updated the replication section of the OpenLDAP Admin guide last night to the final version discussing Push Based Replication, i.e. what slurpd does in OpenLDAP 2.3 (dropped for various reasons, but since the docs won't be available properly until 2.4.11 is out I'm posting it here.

Read on for more....
Basically with OpenLDAP 2.4 you have two choices:

1. A Master directory, which as you know can have multiple database definitions, therefore a LDAP^[?] Proxy included:

Your slapd.conf or cn=config can list your normal LDAP database and also a back-ldap^[?] database which sucks in data via Syncrepl pointing to the main URI and pushes changes out via the back-ldap uri, hence "Push-based".

2. If you don't have access to the master directory or you aren't setting up a new deployment, you can create a standalone LDAP Proxy that does the same as above:

So, for method 1.:

CODE:

####################################################################### # Standard OpenLDAP Master/Provider ####################################################################### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/slapd.acl modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args loglevel sync stats database hdb suffix "dc=suretecsystems,dc=com" directory /usr/local/var/openldap-data checkpoint 1024 5 cachesize 10000 idlcachesize 10000 index objectClass eq # rest of indexes index default sub rootdn "cn=admin,dc=suretecsystems,dc=com" rootpw testing # syncprov specific indexing index entryCSN eq index entryUUID eq # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database monitor database config rootpw testing ############################################################################## # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap ############################################################################## database ldap # ignore conflicts with other databases, as we need to push out to same suffix hidden on suffix "dc=suretecsystems,dc=com" rootdn "cn=slapd-ldap" uri ldap://localhost:9012/ lastmod on # We don't need any access to this DSA restrict all acl-bind bindmethod=simple binddn="cn=replicator,dc=suretecsystems,dc=com" credentials=testing syncrepl rid=001 provider=ldap://localhost:9011/ binddn="cn=replicator,dc=suretecsystems,dc=com" bindmethod=simple credentials=testing searchbase="dc=suretecsystems,dc=com" type=refreshAndPersist retry="5 5 300 5" overlay syncprov

Corresponding Slave config:

CODE:

####################################################################### # Standard OpenLDAP Slave without Syncrepl ####################################################################### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/slapd.acl modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args loglevel sync stats database hdb suffix "dc=suretecsystems,dc=com" directory /usr/local/var/openldap-slave/data checkpoint 1024 5 cachesize 10000 idlcachesize 10000 index objectClass eq # rest of indexes index default sub rootdn "cn=admin,dc=suretecsystems,dc=com" rootpw testing # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited updatedn "cn=replicator,dc=suretecsystems,dc=com" # Refer updates to the master updateref ldap://localhost:9011 database monitor database config rootpw testing

Possible ACLs:

CODE:

# Give the replica DN unlimited read access. This ACL may need to be # merged with other ACL statements. access to by dn.base="cn=replicator,dc=suretecsystems,dc=com" write by break access to dn.base="" by read access to dn.base="cn=Subschema" by read access to dn.subtree="cn=Monitor" by dn.exact="uid=admin,dc=suretecsystems,dc=com" write by users read by none access to by self write by * read

Method 2:

CODE:

####################################################################### # Standard OpenLDAP Master/Provider ####################################################################### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/slapd.acl modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args loglevel sync stats ############################################################################## # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap ############################################################################## database ldap # ignore conflicts with other databases, as we need to push out to same suffix hidden on suffix "dc=suretecsystems,dc=com" rootdn "cn=slapd-ldap" uri ldap://localhost:9012/ lastmod on # We don't need any access to this DSA restrict all acl-bind bindmethod=simple binddn="cn=replicator,dc=suretecsystems,dc=com" credentials=testing syncrepl rid=001 provider=ldap://localhost:9011/ binddn="cn=replicator,dc=suretecsystems,dc=com" bindmethod=simple credentials=testing searchbase="dc=suretecsystems,dc=com" type=refreshAndPersist retry="5 5 300 5" overlay syncprov

And point the above to the same kind of slave using the already listed config.

Anyway, more explaination will be in the Admin Guide when 2.4.11 comes out.

Thanks,

Gavin.

Suretec Systems.

LDAP, Mark Spencer and Asterisk

nospam@example.com (Suretec) — Thu, 26 Jun 2008 20:13:37 +0100

In Interview With Asterisk Founder, Mark Spencer:

3) What improvements would you personally like to see in any upcoming releases? Perhaps Active Directory or LDAP^[?] integration?

LDAP, Clustering Events, and Video are three areas I'm especially interested in in terms of the core of the software. I'm also interested in ways to make Asterisk even more approachable for new developers of either core functionality or new systems utilizing Asterisk.

Suretec agree and are trying to help.

[...]I think a low-cost Asterisk unified communications solution is a perfect opportunity for Digium. Thus, perhaps something called Asterisk UC Edition might be a good name. Your thoughts on this idea?

[....]we want the core of Asterisk to remain Open Source and as such encourage the development of Open Source technologies wherever possible. I believe it would be foolish to attempt to make Asterisk's innovation only available as a proprietary product when clearly it is its Open Source foundation that made it so successful and continues to do so[...]

Excellent to hear!

[...]Mark didn't take my idea of offering a "premium" UC (closed) version of Asterisk, that I felt would give Digium a potentially strong revenue source, I found it very fascinating that Mark continues to hold the "open source" mantra flag high. This only re-confirms Mark's (& Digium's) strong commitment to keeping Asterisk 100% open source that Mark stressed to me[...]

Of course, as it should.

I have to commend Digium for sticking to their 100% open source guns, but honestly, I don't think anyone would begrudge them if they copied the SugarCRM/MySQL/Movable Type model where they offered an open source version and a premium (closed) version. Ok, maybe some open source zealots would.

Suretec would, as would everyone else. Keep it 100% Open Source.

Solutions for creating a Samba4 OpenLDAP backend

nospam@example.com (Gavin Henry) — Thu, 12 Jun 2008 15:16:43 +0100

Things are looking better for the future of Samba and OpenLDAP working together:

If we get this much done, then I think Samba4 and OpenLDAP can continue
the forward march. I look forward to having Samba4 'powered by
OpenLDAP', because without it (or a Fedora DS backend, with whom I'm
having a similar discussion) Samba4 does not have a replicated
deployment modal.

Vote OpenLDAP for the 2008 Community Choice Awards!

nospam@example.com (Gavin Henry) — Tue, 10 Jun 2008 16:11:55 +0100

To vote for the OpenLDAP Project click the following:

The Suretec Blog - OpenLDAP

OpenLDAP 2.4.12 Released

"When you *can* do something useful, you *should*"

Asterisk 1.6.0 is the first official release of Asterisk 1.6

OpenLDAP for Fortune 20 Enterprises

Suretec partners Symas release a MySQL Cluster back-end for OpenLDAP

GNU/Linux and Microsoft Active Directory

Zimbra do listen

Down with OpenLDAP 2.3! OpenLDAP 2.4 is king!

OpenLDAP for OpenSolaris

Hardware and Operating System Best Practices for OpenLDAP

Asterisk RealTime LDAP Driver Guide

Replacing Slurpd using OpenLDAP 2.4

LDAP, Mark Spencer and Asterisk

Solutions for creating a Samba4 OpenLDAP backend

Vote OpenLDAP for the 2008 Community Choice Awards!

"When you can do something useful, you should"