What does your OpenLDAP logs show for the query that fails?<div><br></div><div>--Daniel Fisher<br><br><div class="gmail_quote">On Mon, Aug 8, 2011 at 11:55 AM, Klaus Ethgen <span dir="ltr"><<a href="mailto:klaus.ethgen@id.uzh.ch">klaus.ethgen@id.uzh.ch</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA512<br>
<br>
Hello,<br>
<br>
I had a strange problem authorizing users via LDAP today. Maybe someone<br>
already know where the problem is located.<br>
<br>
Unfortunately there are several; sometimes very old; versions involved:<br>
Shibboleth: 2.1.5<br>
LDAP-Tools: 2.4.20<br>
OpenLDAP1: 2.3.32 (SLES 10)<br>
OpenLDAP2: 2.4.21 (Ubuntu lucid)<br>
<br>
The query is done from Shibboleth via OpenLDAP1 (and meta backend) to<br>
OpenLDAP2. When querying new users (I do not know when this start, so<br>
please do not ask) I get no query result back when searching with<br>
shibboleth. But if I do the same query with ldapsearch (and the same<br>
flags used by shibboleth) from the same host I successful get the<br>
requested account. So LDAP is not broken.<br>
<br>
After several searching I switched to direct using OpenLDAP2 and<br>
everything worked.<br>
<br>
This sounds to me that this is somewhat as a compatibility problem<br>
between some of my components. The problem is that I do not know which<br>
components did trigger the problem.<br>
<br>
Is there any special a java LDAP query do that is not done by ldapsearch<br>
or vis versa? Or do anybody have some sort of test tool to test the<br>
problem the same way as shibboleth do but without all the stuff around?<br>
<br>
Feel free to ask. But please do not send double mails; I am subscribed<br>
to this list.<br>
<br>
Regards<br>
Klaus<br>
- --<br>
Klaus Ethgen<br>
pub 2048R/D1A4EDE5 2000-02-26 Klaus Ethgen <<a href="mailto:klaus.ethgen@id.uzh.ch">klaus.ethgen@id.uzh.ch</a>><br>
Fingerprint: D7 67 71 C4 99 A6 D4 FE EA 40 30 57 3C 88 26 2B<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
<br>
iQGcBAEBCgAGBQJOQAbTAAoJEK8RO3RE9oVxyREL/1LctEcp63CiqNTVOyRmcXE5<br>
kc0gyzerF9aXTClfSqGO3clprMS7LQUIuEFHoyAsECFAs0zmzALeO8BH0Dd3tH9M<br>
AIvaMjh28CODz61qozKBBvHzFtzm6eXGtwrLWjoTH6BSst9+Xf2TsqiuOPLWEVLA<br>
qtde8F+msC2R0qBfT3ORCzbfYyyopeYm0Bgmdim/LysKHZl7la25eiDjtS8wWwTR<br>
T+bfv5YWRIJiCE3Bwm7D3jC7XTHW846+agk+F7XSLOXs2XgDhb9JA2tfn8EVstqn<br>
1OOq3yIwSEG7TYhYfldjVtBUCD+1j+jDK0ctAiiK90MbbWXfI89Q1AXvsoRm/ANz<br>
pAHC0LjbGYYVBvoobZCLewk7QgrFmPEXlHyTjPhgjY0cXF47QsTouzZ1UM42n7YU<br>
5wgJUN5saWhgOJSZObBueE2jRGfriGQs2gPgIR/4lMST3MXjITMEKuG4t/Xk6Gwp<br>
zycnObupRIV8C3YOkxZXt5HKldfgi3GrW6tL1tm0fQ==<br>
=sMY+<br>
-----END PGP SIGNATURE-----<br>
<font color="#888888">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></blockquote></div><br></div>