--On Wednesday, March 25, 2009 11:52 AM +0000 sudeshchandimal(a)gmail.com
wrote:
> Full_Name: sudesh chandimal
> Version: openldap-2.4.15
> OS: fedora
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (124.43.51.7)
>
>
> lap_add: Invalid DN syntax (34)
> additional info: invalid DN
>
> this is the error i'm getting after runing this ldif file..
>
># Base object for Request Balance
> dn: dview=ECS1_request_bal, dc=my-domain, dc=com
> dview: ECS1_request_bal
> objectClass: top
> objectClass: dview
> userPassword: balance
Send usage questions to openldap-software(a)openldap.org, not the ITS system.
The ITS system is for reporting bugs in the software.
--Quanah
--
Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
Full_Name: Samuel Tran
Version: 2.3.43
OS: CentOS 5.x
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (216.73.248.203)
If I lock an account on a consumer 'pwdMaxFailure' consecutive failed bind
attempts, two password changes on the provider is required to unlock the account
on the consumer.
The first password change updates 'userPassword', 'pwdChangedTime' and removes
'pwdFailureTime'. The second updates 'userPassword', 'pwdChangedTime' and
removes 'pwdAccountLockedTime'.
The replication mode is delta-syncrepl.
Here is the configuration file on the provider:
#-------------------------------------------------
# Accesslog DB definition (slapo-accesslog)
#-------------------------------------------------
database hdb
suffix "cn=accesslog"
rootdn "cn=root,cn=accesslog"
rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
directory /var/lib/ldap/accesslog
index default eq
index entryUUID,entryCSN,objectClass,reqEnd,reqResult,reqStart
limits dn.exact="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com"
time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
overlay syncprov
syncprov-nopresent TRUE
syncprov-reloadhint TRUE
#-------------------------------------------------
# Primary example.com database definition
#-------------------------------------------------
database hdb
suffix "dc=example,dc=com"
rootdn "cn=Manager,dc=example,dc=com"
rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxx
directory /var/lib/ldap/example.com
[snip]
index objectClass,uidNumber,gidNumber,memberUid,employeeNumber eq,pres
index employeeType,accountActive,ftpActive,mailActive,vacationActive,ou,mailRoutingAddress
eq
index cn,mail,surname,givenname eq,pres,subinitial
index displayName,gecos,telephoneNumber sub,subany
index uid,aliasUid eq,sub,subany
index entryUUID,entryCSN eq
limits dn.exact="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com"
time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
overlay syncprov
syncprov-checkpoint 100 30
syncprov-sessionlog 100
overlay accesslog
logdb cn=accesslog
logops writes
logsuccess TRUE
logpurge 28+00:00 01+00:00
overlay ppolicy
ppolicy_use_lockout
Here is the configuration file on the consumer:
#-------------------------------------------------
# Primary example.com database definition
#-------------------------------------------------
database hdb
suffix "dc=example,dc=com"
rootdn "cn=Manager,dc=example,dc=com"
rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
directory /var/lib/ldap/example.com
[snip]
index objectClass,uidNumber,gidNumber,memberUid,employeeNumber eq,pres
index employeeType,accountActive,ftpActive,mailActive,vacationActive,ou,mailRoutingAddress,mailAlternateAddress,mailAliasActive,allowedService
eq
index cn,mail,surname,givenname eq,pres,subinitial
index displayName,gecos,telephoneNumber sub,subany
index uid,aliasUid eq,sub,subany
index entryUUID eq
#############################################################
# Syncrepl - Consumer configuration
#############################################################
syncrepl rid=002
provider=ldaps://info-ldap-001.example.com:636
bindmethod=simple
binddn="cn=syncrepl,ou=Accounts,ou=Apps,dc=example,dc=com"
credentials=xxxxxxxx
type=refreshAndPersist
retry="5 +"
searchbase="dc=example,dc=com"
logbase="cn=accesslog"
logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"
schemachecking=on
syncdata=accesslog
overlay ppolicy
ppolicy_use_lockout
The problem is similar to the one reported in ITS #5398 for OL 2.4.8.
I saw Howard's reply stating that he was not able to reproduce the problem in
the current OL 2.4.x code. I was wondering if someone was able to reproduce the
problem using OL 2.3.43.
Thanks.
Luca Scamoni wrote:
> Howard Chu ha scritto:
>> HEAD has been changed to silently ignore these cases, please test.
>>
>> (I guess we could log something at LDAP_DEBUG_CONFIG level but that
>> seems unnecessary at the moment.)
>>
> thanks,
> now it doesn't segfaults anymore but something like:
> modulepath /usr/local/openldap/sbin
> moduleload syncprov.la
> moduleload back_hdb.la
> moduleload syncprov.la
>
> becomes:
> dn: cn=module{0},cn=config
> objectClass: olcModuleList
> cn: module{0}
> olcModulePath: /usr/local/openldap/sbin
> olcModuleLoad: {0}syncprov.la
> olcModuleLoad: {1}back_hdb.la
> olcModuleLoad: {2}syncprov.la
>
> any chance this can cause problems?
It's a bit redundant. Perhaps we should fail it instead.
> about logging I vote for it
>
>
> Ing. Luca Scamoni
> Responsabile Ricerca e Sviluppo
>
> SysNet s.r.l.
> via Dossi, 8 - 27100 Pavia - ITALIA
> http://www.sys-net.it
> -----------------------------------
> Office: +39 0382 573859 (137)
> Mobile: +39 347 1014425
> Fax: +39 0382 476497
> Email: luca.scamoni(a)sys-net.it
> -----------------------------------
>
>
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
Howard Chu ha scritto:
> HEAD has been changed to silently ignore these cases, please test.
>
> (I guess we could log something at LDAP_DEBUG_CONFIG level but that
> seems unnecessary at the moment.)
>
thanks,
now it doesn't segfaults anymore but something like:
modulepath /usr/local/openldap/sbin
moduleload syncprov.la
moduleload back_hdb.la
moduleload syncprov.la
becomes:
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/local/openldap/sbin
olcModuleLoad: {0}syncprov.la
olcModuleLoad: {1}back_hdb.la
olcModuleLoad: {2}syncprov.la
any chance this can cause problems?
about logging I vote for it
Ing. Luca Scamoni
Responsabile Ricerca e Sviluppo
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 0382 573859 (137)
Mobile: +39 347 1014425
Fax: +39 0382 476497
Email: luca.scamoni(a)sys-net.it
-----------------------------------