Recent changes to bugs

delete attribute in jamm.schema is unfortunate

Ken Yap — Tue, 15 Aug 2006 05:41:10 -0000

I've set up a master LDAP server and a replica, using
slurpd to push the changes to the replica.

When I change an account's details on the master, the
LDAP server attempts to push the change to the replica.
The change is rejected. The reason given is:

ERROR: Undefined attribute type: FALSE: attribute type
undefined
replica: ldap2.bar.com:389
time: 1155618838.3
dn: mail=fred@foo.bar.com,jvd=foo.bar.com,o=hosting,dc=
myhosting,dc=bar
changetype: modify
replace: delete
delete: FALSE

The replica schema is correct, and the replica is up to
date just before this point.

I believe the reason is that the LDIF parser sees
delete as a keyword and not an attribute following the
replace line.

Has anybody seen this problem before? I'd like some
confirmation before I go looking for other replication
solutions not sensitive to attribute names, or change
the attribute in the JAMM schema and all the code.

Translation to german

Anonymous — Wed, 15 Sep 2004 12:23:52 -0000

Hi,
I've made a german translation of the application
resources. Please upload to CVS, thanks.

Can't convert account into alias

Robin Green — Sun, 25 Jul 2004 17:35:10 -0000

I created an account called "mailman", then later
deleted it and tried to change it into an alias. It
didn't work - when I tried to delete it, the deleted
checkbox stayed checked, but the account didn't
disappear, and then when I tried to create an alias of
the same name jamm said:

" Account or Alias already exists.

An account or alias for mailman@lists.greenrd.org
already exists. "

Suggested fixes:

1. Either a deleted account should be really deleted
from the database straight away

2. alias generation should disregard deleted accounts
when checking for duplicates.

The current situation does not really make sense, IMO.

[SECURITY] Clear-text passwords world-readable??

Robin Green — Mon, 26 Apr 2004 01:01:13 -0000

In jamm.schema there is an entry as follows:

attributetype ( 1.3.6.1.4.1.12461.1.1.7 NAME
'clearPassword'
DESC 'A separate text that stores the mail
account password in clear text'
EQUALITY octetStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128})

But there is no access control for this attribute in
the HOWTO!!

Three questions:

1. Is this attribute actually used?

2. If so, why does it exist?

3. If there is a good reason, what should I put in
slapd.conf to control access appropriately?

missing info in docs?

Nathan Dial — Fri, 06 Dec 2002 22:09:36 -0000

I said before the docs are masterfully written, and I
stand by it, but in section 4.5.2 "Configuring LDAP" it
says "To use the Courier schema, you actually have a
few modifications to make, though." But it doesn't say
anything about moving files or editing slapd.conf for
using the courier schema. I think that the inention of
this sentence might be "To use the Jamm schema instead
of the courier schema" however I'm not familiar enough
with this project to know that for sure yet. (I'm
hoping that's what it is though.) In any case there is
a need for further clarification there.

The section might also better be titled "Configuring
authldap", "Configuring LDAP Authentication" or
"Configuring LDAP Authentication for Courier"

documentation code error

Nathan Dial — Fri, 06 Dec 2002 22:04:47 -0000

in the "Implementation" section of the howto, in
section 4.3.1.5 "Setting up Access Control," the sample
code gives an error when added to slapd.conf (running
openldap-2.0.23-4)

All that needs to be changed is the removal of the \'s
that are used to continue lines. Here is a
modification that works correctly:
access to
dn=".*,jvd=([^,]+),o=hosting,dc=myhosting,dc=example"
attr=userPassword
by self write
by
group/organizationalRole/roleOccupant="cn=postmaster,jvd=$1,o=hosting,dc=myhosting,dc=example"
write
by anonymous auth
by * none

access to
dn=".*jvd=([^,]+),o=hosting,dc=myhosting,dc=example"
by self write
by
group/organizationalRole/roleOccupant="cn=postmaster,jvd=$1,o=hosting,dc=myhosting,dc=example"
write
by * read

access to *
by * read