On Thu, Dec 19, 2002 at 10:53:59AM +0100, Lizner Martin wrote:
> hello
>
> please do post it :).
>
> regarding the environment - we use as a production system:
>
> redhat linux 7.2
> perl 5.6.1
> openca 0.9.1 rc5 (pretty modified)
> mysql 3.23.49 as backend (it's faster)
> openssl 0.9.7 from may 2002
> apache 1.3.26 mod_ssl 2.8.10
>
> regarding the export/import via floppy - i use a tar file instead of /dev/fd0 so
>when exporting the tar iz bzipped and copied to floppy and vice versa when importing.
>
Hi,
thanks for your comment.
Well, we've tested mysql as backend already -> no remarkable speed
improvement :-(
How long does it take for you to list the Certificate-Requests?
Or do you run OpenCA on some very fast server? ;-)
Attached the ldap-backend. Some notes on its usage:
I've added a new suffix for the backend to slapd.
This suffix has to be used in the clients.
-------
database shell
suffix "cn=search, o=ACME, c=DE"
search /path/to/backend.pl
-------
You have to modify $realDN, $newDN, $opt_b and maybe $opt_h
to use it.
This is really a dirty hack, but it works fine for us with
Netscape, mozilla and M$ Outlook.
-------------- backend.pl ---------------
#!/usr/bin/perl -W
eval 'exec /usr/bin/perl -S $0 ${1+"$@"}'
if $running_under_some_shell && $running_under_some_shell;
# -*- perl -*-
#
# ldap backend which injects a searchfilter.
# Based on ldapsearch-example from perl-ldap.
#
use strict;
use Carp;
use Net::LDAP;
use URI::ldap;
use Net::LDAP::LDIF;
use vars qw($opt_n $opt_v $opt_t $opt_u $opt_A $opt_B $opt_L $opt_R $opt_d
$opt_F $opt_S $opt_f $opt_b $opt_b $opt_s $opt_a $opt_l $opt_z
$opt_D $opt_w $opt_h $opt_p $opt_3);
use Getopt::Std;
# we introduce a new suffix for this backend.
# the DNs of the search-results have to be modified
# set your actual DN, which will be replaced by $newDN
# note the questionmark around the comma. Some clients insert
# spaces, some dont ;-)
my $realDN = 'OU=My ou ?, ?O=ACME ?, ?C=DE';
my $newDN = 'cn=search,OU=My ou,O=ACME,C=DE';
# ldap-server used for search
$opt_h = 'localhost';
# base used for search
$opt_b = 'OU=Internet, OU=My ou,O=ACME,C=DE';
# Search scope
$opt_s="sub"; #FIXME probably one?
################################################
# set some expected commandline-options
$opt_F = '=' unless $opt_F;
$opt_L=1; #do LDIF
my $extfilter = "";
my $entrycount = 0;
#get the given filter
foreach(<STDIN>) {
if( m/^filter:(.*)$/) {
$extfilter = $1;
last;
}
}
my $filter = "(& (userCertificate;binary=*) " . $extfilter ." )";
#printf ("DEBUG: $filter\n");
# Enums
my %scopes = ( 'base' => 0, 'one' => 1, 'sub' => '2' );
my %derefs = ( 'never' => 0, 'search' => 1, 'find' => 2, 'always' => 3 );
# We only print attributes that we know are text
# This stuff is in lieu of a workable Schema module
my @textsyntax = grep /^\w/, (<<'EOS' =~ /(#.*|\S+)/g); # qw() with comments
# RFC 2251
modifiersName modifyTimestamp
creatorsName createTimestamp
# RFC 2256
objectClass aliasedObjectName knowledgeInformation cn sn
serialNumber c l st street o ou title description
searchGuide businessCategory postalAddress postalCode
postOfficeBox physicalDeliveryOfficeName telephoneNumber
telexNumber teletexTerminalIdentifier
facsimileTelephoneNumber x121Address
internationaliSDNNumber registeredAddress
destinationIndicator preferredDeliveryMethod
presentationAddress supportedApplicationContext member
owner roleOccupant seeAlso userPassword name givenName
initials generationQualifier x500UniqueIdentifier
dnQualifier enhancedSearchGuide protocolInformation
distinguishedName uniqueMember houseIdentifier dmdName
# RFC 1274
mail rfc822Mailbox
# RFC 2079
labeledURI
# Definitions from other schemas goes here...
collectivePostalAddress collectiveTelephoneNumber
collectiveFacsimileTelephoneNumber
supportedLDAPVersion
EOS
my %istext; # keys are canonicalised attribute names.
foreach (@textsyntax) { $istext{lc($_)} = 1; };
die "$0: unknown scope $opt_s\n" if $opt_s && !defined($scopes{$opt_s});
die "$0: unknown deref $opt_a\n" if $opt_a && !defined($derefs{$opt_a});
# We are expecting to get back referrals from the search. Each referral may
# lead to more referrals being returned, etc etc.
#
# So we handle this by looping through a list of referrals, taking the top
# one each time, but possibly adding extra ones inside the loop. We prime the
# list of referrals by making a 'referral' from the command line args.
#
# The loop body does the open, bind, search, unbind and close.
#
# The authentication offered to any particular server is not offered to any
# other server, unless the referral indicates it should. This prevents you
# revealing your password (etc) to random servers.
my $initial = URI->new("ldap:");
$initial->host($opt_h);
$initial->dn($opt_b);
$initial->port($opt_p) if $opt_p;
my %exts;
$exts{bindname} = $opt_D if $opt_D;
$exts{bindpassword} = $opt_w if $opt_w;
$initial->extensions(%exts);
my @urls = ($initial->as_string);
my $ldif = Net::LDAP::LDIF->new("-", "w" ) if $opt_L;
my $first_record = 1;
while (@urls) {
my $url = URI::ldap->new(shift @urls);
my %exts = $url->extensions;
my $ldap;
my %openargs;
my %bindargs;
my %searchargs;
$bindargs{dn} = $exts{bindname} if $exts{bindname};
$bindargs{password} = $exts{bindpassword} if $exts{bindpassword};
$openargs{port} = $url->port if $url->port;
$openargs{debug} = $opt_d if $opt_d;
dumpargs("new", $url->host, \%openargs) if ($opt_n || $opt_v);
unless ($opt_n) {
$ldap = new Net::LDAP($url->host,
%openargs) or die $@;
}
#
# Bind as the desired version, falling back if required to v2
#
$bindargs{version} = $opt_3 ? 3 : 2;
if ($bindargs{version} == 3) {
dumpargs("bind", undef, \%bindargs) if ($opt_n || $opt_v);
unless ($opt_n) {
$ldap->bind(%bindargs) or $bindargs{version} = 2;
}
}
if ($bindargs{version} == 2) {
dumpargs("bind", undef, \%bindargs) if ($opt_n || $opt_v);
unless ($opt_n) {
$ldap->bind(%bindargs) or die $@;
}
}
# Set search arguments
$searchargs{base} = $opt_b if $opt_b;
$searchargs{base} = $url->dn if $url->dn;
$searchargs{scope} = $opt_s if $opt_s;
# $searchargs{scope} = $url->_scope if defined $url->_scope;
# $searchargs{scope} = $scopes{$searchargs{scope}} if $searchargs{scope};
$searchargs{deref} = $derefs{$opt_a} if $opt_a;
#$searchargs{sizelimit} = $opt_z if $opt_z;
$searchargs{sizelimit} = 30;
#$searchargs{timelimit} = $opt_l if $opt_l;
$searchargs{timelimit} = 30;
$searchargs{attrsonly} = 1 if $opt_t; # typesOnly
$searchargs{filter} = $filter;
#$searchargs{attrs} = [ @ARGV ];
$searchargs{attrs} = ""; # return all
dumpargs("search", undef, \%searchargs) if ($opt_n || $opt_v);
# Print results
# Hm, this is harder work than the actual search!
unless ($opt_n) {
my $results = $ldap->search(%searchargs) or die $@;
my @entries = $results->entries;
#Modify DNs to match the actual search-dn
#
my $entry;
foreach $entry (@entries) {
$entrycount++;
my $tmp = $entry->dn;
if($tmp){
$tmp =~ s/${realDN}/${newDN}/si;
$entry->dn($tmp);
}
}
#printf ("DEBUG: $entrycount\n");
# LDIF output
#
if ($opt_L) {
$ldif->write(@entries);
} else {
my $entry;
foreach $entry (@entries) {
print "\n" unless $first_record;
$first_record = 0;
my ($attr, $val);
# Print in a pseudo EDB format
# Not a useful format, but it shows how to get to the
# attributes and values in an entry
print $entry->dn,"\n";
foreach $attr ($entry->attributes) {
my $is_printable = $istext{lc($attr)};
#mpf foreach $val ($entry->get($attr)) {
foreach $val ($entry->get_value($attr)) {
print "$attr$opt_F";
if ($opt_B || $is_printable) {
print "$val\n";
} else {
print "(binary value)\n";
}
} # foreach value
} # foreach attribute
} # foreach entry
} # EDB format
# Check for any referrals
my @refs = $results->referrals;
if ($opt_v && @refs) {
map { print "Referral to: $_\n" } @refs;
}
push @urls, @refs unless $opt_R;
# Check for any search continuation references
my @conts = $results->references;
if ($opt_v && @conts) {
map { print "Continue at: $_\n" } @conts;
}
push @urls, @conts unless $opt_R;
}
if ($opt_n || $opt_v) {
print "unbind()\n";
}
unless ($opt_n) {
$ldap->unbind() or die $@;
}
} # foreach URL
# at last print RESULT lines
#
print "\nRESULT\ncode: 0\n";
sub dumpargs {
my ($cmd,$s,$rh) = @_;
my @t;
push @t, "'$s'" if $s;
map {
my $value = $$rh{$_};
if (ref($value) eq 'ARRAY') {
push @t, "$_ => [" . join(", ", @$value) . "]";
} else {
push @t, "$_ => '$value'";
}
} keys(%$rh);
print "$cmd(", join(", ", @t), ")\n";
}
---------------------------------
Marco
--
Wahrheit ist die Erfindung eines L�gners.
- Heinz von Foerster -
-------------------------------------------------------
This SF.NET email is sponsored by: Geek Gift Procrastinating?
Get the perfect geek gift now! Before the Holidays pass you by.
T H I N K G E E K . C O M http://www.thinkgeek.com/sf/
_______________________________________________
Openca-Users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/openca-users
