<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<pre class="message" style="font-family: monospace; padding-top: 8px; margin-top: 0px; border-top-width: 0px; color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 19.2px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px;">>> At the moment, I think this behaviour is intentional and by design.
>>
>>> First, I would note that this only happens when you haven't performed
>>> the minimal TLS configuration yet:
It's not by design. If it is, someone needs the Kay Sievers treatment.
1) As I told you a few weeks ago, OpenLDAP build is broke.
2) GnuTLS sucks the royal spoon.
3) "Upstream" stops at Debian.
4) There are even broken password settings (in another bug report, called "a minor bug" )...
LAST BUT NOT LEAST, COMPOUNDING THE PROBLEMS -- there are even mismatches between various packages:
1) NSSWITCH.
2) PAM
3) OpenLDAP.
libnss_ldap.secret
ldap.secret
pam_ldap.secret.
NUTS.
That's why I build my own OpenLDAP... and I have flawless programs and scripts to do it. However, every version of Debian seems to break my code.
Sievers Situation.
I build my own, now. But, Now I've even got to redo LIBNSS AND PAM, TOO!!! Before long, I'll have my own distro????
Ridiculous. As I also said before, testing is imperative. I'll withhold my "Torvald's response."
</pre>
<br>
On Mon, 14 Dec 2015 15:05:22 +0100 Obspm
<a class="moz-txt-link-rfc2396E" href="mailto:albert.shih@obspm.fr"><albert.shih@obspm.fr></a> wrote:<br>
> Package: slapd<br>
> Version: 2.4.40+dfsg-1+deb8u1<br>
> Severity: important<br>
> <br>
> <br>
> Hi everyone.<br>
> <br>
> >From a fresh install (the server is a virtual machine with
VirtualBox), after basic configuration of slapd, without any
configuration other than those make by apt-get, with no special data
I can add this piece of ldif<br>
> <br>
> dn: cn=config<br>
> changeType: modify<br>
> add: olcTLSVerifyClient<br>
> olcTLSVerifyClient: never<br>
> -<br>
> <br>
> I always got a <br>
> <br>
> root@debian:~# ldapmodify -Y EXTERNAL -H ldapi:/// -f toto.ldif
<br>
> SASL/EXTERNAL authentication started<br>
> SASL username:
gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth<br>
> SASL SSF: 0<br>
> modifying entry "cn=config"<br>
> ldap_modify: Server is unwilling to perform (53)<br>
> <br>
> and the debug file containt (with LogLevel:1)<br>
> <br>
> Dec 14 15:04:12 debian slapd[3597]: slap_listener_activate(11):<br>
> Dec 14 15:04:12 debian slapd[3597]: >>>
slap_listener(ldapi:///)<br>
> Dec 14 15:04:12 debian slapd[3597]: connection_get(13): got
connid=1031<br>
> Dec 14 15:04:12 debian slapd[3597]: connection_read(13):
checking for input on id=1031<br>
> Dec 14 15:04:12 debian slapd[3597]: op tag 0x60, time
1450101852<br>
> Dec 14 15:04:12 debian slapd[3597]: conn=1031 op=0 do_bind<br>
> Dec 14 15:04:12 debian slapd[3597]: >>>
dnPrettyNormal: <><br>
> Dec 14 15:04:12 debian slapd[3597]: <<<
dnPrettyNormal: <>, <><br>
> Dec 14 15:04:12 debian slapd[3597]: do_bind: dn () SASL mech
EXTERNAL<br>
> Dec 14 15:04:12 debian slapd[3597]: ==>slap_sasl2dn:
converting SASL name
gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth to a DN<br>
> Dec 14 15:04:12 debian slapd[3597]: <==slap_sasl2dn:
Converted SASL name to <nothing><br>
> Dec 14 15:04:12 debian slapd[3597]: SASL Authorize [conn=1031]:
proxy authorization allowed authzDN=""<br>
> Dec 14 15:04:12 debian slapd[3597]: send_ldap_sasl: err=0
len=-1<br>
> Dec 14 15:04:12 debian slapd[3597]: do_bind: SASL/EXTERNAL
bind: dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
sasl_ssf=0<br>
> Dec 14 15:04:12 debian slapd[3597]: send_ldap_response: msgid=1
tag=97 err=0<br>
> Dec 14 15:04:12 debian slapd[3597]: <== slap_sasl_bind: rc=0<br>
> Dec 14 15:04:12 debian slapd[3597]: connection_get(13): got
connid=1031<br>
> Dec 14 15:04:12 debian slapd[3597]: connection_read(13):
checking for input on id=1031<br>
> Dec 14 15:04:12 debian slapd[3597]: op tag 0x66, time
1450101852<br>
> Dec 14 15:04:12 debian slapd[3597]: conn=1031 op=1 do_modify<br>
> Dec 14 15:04:12 debian slapd[3597]: >>>
dnPrettyNormal: <cn=config><br>
> Dec 14 15:04:12 debian slapd[3597]: <<<
dnPrettyNormal: <cn=config>, <cn=config><br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_required entry
(cn=config), objectClass "olcGlobal"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"objectClass"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type "cn"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"olcArgsFile"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"olcPidFile"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"olcToolThreads"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"structuralObjectClass"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"entryUUID"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"creatorsName"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"createTimestamp"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"olcConnMaxPending"<br>
> Dec 14 15:04:12 debian slapd[3597]: oc_check_allowed type
"olcLogLevel"<br>
<br>
</body>
</html>