Hi everyone, i have a problem when I want to update CA Certificates into LDAP (users cert's update properly)
 
 
      Checking for a special DN where to store CA-certificates ...
        There is no special DN specified.
      Adding valid CA-certificates to the LDAP server ...
        Certificate 0 FAILED (error -1: LDAP-add failed: objectClass: matching rule failed)
 

And the ldap debug error

send_ldap_result: conn=0 op=5 p=3
send_ldap_response: msgid=6 tag=105 err=-1
ber_flush: 47 bytes to sd 12
  0000:  30 2d 02 01 06 69 28 0a  01 ff 04 00 04 21 6f 62   0-...i(......!ob
  0010:  6a 65 63 74 43 6c 61 73  73 3a 20 6d 61 74 63 68   jectClass: match
  0020:  69 6e 67 20 72 75 6c 65  20 66 61 69 6c 65 64      ing rule failed
ldap_write: want=47, written=47
  0000:  30 2d 02 01 06 69 28 0a  01 ff 04 00 04 21 6f 62   0-...i(......!ob
  0010:  6a 65 63 74 43 6c 61 73  73 3a 20 6d 61 74 63 68   jectClass: match
  0020:  69 6e 67 20 72 75 6c 65  20 66 61 69 6c 65 64      ing rule failed
connection_get(12): got connid=0
connection_read(12): checking for input on id=0
ber_get_next
ldap_read: want=8, got=0

ber_get_next on fd 12 failed errno=0 (Success)
connection_read(12): input error=-2 id=0, closing.
connection_closing: readying conn=0 sd=12 for close
connection_close: deferring conn=0 sd=12
connection_resched: attempting closing conn=0 sd=12
connection_close: conn=0 sd=12

 

My sladp.conf

# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.23.2.8 2003/05/24 23:19:14 kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#

schemacheck off

include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/openca.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral      
ldap://root.openldap.org

pidfile         /usr/local/var/slapd.pid
argsfile        /usr/local/var/slapd.args

# Load dynamic backend modules:
# modulepath    /usr/local/libexec/openldap
# moduleload    back_bdb.la
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy is:
#       Allow read by all
#
# rootdn can always write!

#######################################################################
# ldbm database definitions
#######################################################################

 

database        bdb
suffix          "o=prueba,c=ar"
rootdn          "cn=adminca,o=prueba,c=ar"
##rootdn                "cn=Manager,dc=my-domain,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
##rootpw                secret
rootpw          openca
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /usr/local/var/openldap-data2
# Indices to maintain
index   objectClass     eq

 

 

 

 

----- Original Message -----
Sent: Wednesday, August 04, 2004 10:01 AM
Subject: Re: [Openca-Users] Problems using OpenCA with MySQL

Hello Oliver, thanks a lot,

Here I'm sending you a copy of a new error_log file,
the first entries are after trying to start one
interface using no password for mysql since DBI.conf,
the next lines are the result of starting an openca
Interface using a password.

It seems like a missing package, but I don't now which
one :-(

This is my apache error_log file:

[Wed Aug 04 07:56:01 2004] [notice] Digest: generating
secret for digest authentication ...
[Wed Aug 04 07:56:01 2004] [notice] Digest: done
[Wed Aug 04 07:56:01 2004] [notice] LDAP: Built with
OpenLDAP LDAP SDK
[Wed Aug 04 07:56:01 2004] [notice] LDAP: SSL support
unavailable
[Wed Aug 04 07:56:02 2004] [notice] Apache/2.0.47
(Fedora) configured -- resuming normal operations
[Wed Aug 04 07:56:16 2004] [error] [client 127.0.0.1]
Error Trapped: Cannot initialize OpenCA::DBI class!
The database returns errorcode 0. (Success (error
10070: Missing database parameters (type, name, user
or passphrase). Does the passphrase be empty? (error
11111: Do not commit if the database or the module
itself fails.))) at
/usr/local/OpenCA/lib/servers/ca/functions/misc-utils.lib
line 22., referer: http://localhost/ca/
[Wed Aug 04 07:56:16 2004] [error] [client 127.0.0.1]
Compilation failed in require at
/var/www/cgi-bin/ca/ca line 191., referer:
http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
Premature end of script headers: ca, referer:
http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
install_driver(mysql) failed: Can't locate
DBD/mysql.pm in @INC (@INC contains:
/usr/lib/perl5/5.8.1/i386-linux-thread-multi
/usr/lib/perl5/5.8.1
/usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.1
/usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.8.1/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.1
/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.0
/usr/lib/perl5/vendor_perl
/usr/lib/perl5/5.8.1/i386-linux-thread-multi
/usr/lib/perl5/5.8.1 .) at (eval 53) line 3., referer:
http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
Perhaps the DBD::mysql perl module hasn't been fully
installed,, referer: http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
or perhaps the capitalisation of 'mysql' isn't right.,
referer: http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
Available drivers: ExampleP, Pg, Proxy., referer:
http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
at /usr/lib/perl5/site_perl/5.8.1/OpenCA/DBI.pm line
841, referer: http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
 (in cleanup) Can't call method "disconnect" on an
undefined value at
/usr/lib/perl5/site_perl/5.8.1/OpenCA/DBI.pm line
3358., referer: http://localhost/ca/
[Wed Aug 04 07:56:50 2004] [error] [client 127.0.0.1]
Compilation failed in require at
/var/www/cgi-bin/ca/ca line 191., referer:
http://localhost/ca/

My perl modules installed on my Fedora Core 1 are:

perl-Parse-Yapp-1.05-30
perl-libxml-perl-0.07-28
perl-5.8.1-92
perl-Filter-1.29-8
mod_perl-1.99_09-10
perl-DateManip-5.40-30
perl-HTML-Parser-3.26-18
perl-URI-1.21-7
perl-XML-Parser-2.31-16
perl-XML-Dumper-0.4-25
perl-libxml-enno-1.02-29
perl-DBD-MySQL-2.9003-4
perl-DBD-Pg-1.22-1
perl-HTML-Tagset-3.03-28
perl-libwww-perl-5.65-6
perl-XML-Encoding-1.01-23
perl-DBI-1.37-1

Mysql packages installed:

mysql-3.23.58-4
mysql-server-3.23.58-4

Thanks a lot,
Johnny

 --- Oliver Welter <[EMAIL PROTECTED]> escribi�:
> Hi Johnny,
>
> as you get a "real" DB error when leaving out the
> password and get no
> such error when you specify it, I think you dont
> have a db problem...
> What is in your apache error log ??
>
> Oliver
>
> --
> Diese Nachricht wurde digital unterschrieben
> oliwel's public key: http://www.oliwel.de/oliwel.crt
> Basiszertifikat: http://www.ldv.ei.tum.de/page72
>

> ATTACHMENT part 2 application/x-pkcs7-signature
name=smime.p7s
 



______________________________________________
Renovamos el Correo Yahoo!: �100 MB GRATIS!
Nuevos servicios, m�s seguridad
http://correo.yahoo.es


-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Openca-Users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/openca-users

Reply via email to