eGroupware Samba 4 LDAP error

Zombie_Ryushu1 2014-05-10 11:50:30 UTC #1

re-adding it to Samba 4’s LDAP service is creating object Class
violations as Samba 4 won’t let the attributes of objectSid and
ObjectGUID be removed, creating an object Class violation for ‘top’.
eGroupware’s modification behaviour needs to be altered such that it
only adds or removes the needed Object Class and not the whole entry
upon modification. This bug creates lock-ups and can make the
application stop responding on a php level. eGroupware can interact with
Samba 4, and Authenticate against Samba 4 without any issue. But
management of LDAP accounts needs to be more finely tuned. In addition,
eGroupware will delete the LDAP entry attempting to be modified.

Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
� 3 signs your SCM is hindering your productivity
� Requirements for releasing software faster
� Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Ralf_Becker_Stylite 2014-05-10 13:56:45 UTC #2

Hi,

re-adding it to Samba 4’s LDAP service is creating object Class
violations as Samba 4 won’t let the attributes of objectSid and
ObjectGUID be removed, creating an object Class violation for ‘top’.
eGroupware’s modification behaviour needs to be altered such that it
only adds or removes the needed Object Class and not the whole entry
upon modification. This bug creates lock-ups and can make the
application stop responding on a php level. eGroupware can interact with
Samba 4, and Authenticate against Samba 4 without any issue. But
management of LDAP accounts needs to be more finely tuned. In addition,
eGroupware will delete the LDAP entry attempting to be modified.
I believe this behavior has been fixed in Trunk and EPL-11.1 when AD
support was added.

With which version have you been testing and are you using AD support or
LDAP directly?

Ralf

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

Zombie_Ryushu1 2014-05-11 01:37:37 UTC #3

The latest Community edition of eGroupware 1.8. (SVN Checkout.) It’s
treating it like a normal LDAP server. I don’t use the “AD Support mode”

There are three inconsistancies:

OpenLDAP uses uid= while Samba 4 AD uses CN=. You can create
duplicate CN=username and uid=username, and this will work around the
problem, but it also creates Normalization errors in Samba 4.
homeDirectory serves different Purposes in OpenLDAP rather than in
Samba 4. In Samba 4, homeDirectory is the Windows path to the user’s
Home Directory (UNC) such as \server\user while the Unix Home Directory
is unixHome Directory. Oddly enough, this is the only conflicting
attribute between Samba 4 and OpenLDAP. As before, you can create
duplicate CN=username and uid=username, and this will work around the
problem, but it also creates Normalization errors in Samba 4. Such a
Duplicate entry will have an objectGUID, but not an objectSid.
objectSid, and objectGUID can’t be modified, if it is, Samba 4
Returns a "Server Unwillinng to preform error.

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Zombie_Ryushu1 2014-05-11 06:21:46 UTC #4

Clarification. eGroupware 1.8.007

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Ralf_Becker_Stylite 2014-05-11 07:28:20 UTC #5

Hi,

if you want to use Samba4 you should go right way to 14.1 beta.

It has full support for Active Directory.

Ralf

The latest Community edition of eGroupware 1.8. (SVN Checkout.) It’s
treating it like a normal LDAP server. I don’t use the “AD Support mode”

There are three inconsistancies:

OpenLDAP uses uid= while Samba 4 AD uses CN=. You can create
duplicate CN=username and uid=username, and this will work around the
problem, but it also creates Normalization errors in Samba 4.

homeDirectory serves different Purposes in OpenLDAP rather than in
Samba 4. In Samba 4, homeDirectory is the Windows path to the user’s
Home Directory (UNC) such as \server\user while the Unix Home Directory
is unixHome Directory. Oddly enough, this is the only conflicting
attribute between Samba 4 and OpenLDAP. As before, you can create
duplicate CN=username and uid=username, and this will work around the
problem, but it also creates Normalization errors in Samba 4. Such a
Duplicate entry will have an objectGUID, but not an objectSid.

objectSid, and objectGUID can’t be modified, if it is, Samba 4
Returns a "Server Unwillinng to preform error.

Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
� 3 signs your SCM is hindering your productivity
� Requirements for releasing software faster
� Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany