openldap-bugs

openldap-bugs@openldap.org

1 participants
21002 discussions

Re: (ITS#6590) slaptest ignores slapd.conf's dbconfig statement during conversion into cn=config
by hyc＠symas.com 21 Jul '10

21 Jul '10

daniel(a)pluta.biz wrote: > Full_Name: Daniel Pluta > Version: HEAD > OS: Lnx > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2001:4ca0:0:f000:4877:9270:3ab1:2849) > > > slaptest -f -F ignores slapd.conf (bdb/hdb convenience) dbconfig settings. > > Steps to reproduce: > > 1.) cat> slapd.conf<<EOF > include /tmp/openldap/etc/openldap/schema/core.schema > pidfile /tmp/openldap/var/run/slapd.pid > argsfile /tmp/openldap/var/run/slapd.args > database hdb > dbconfig set_cachesize 0 1048576 0 > dbconfig set_lg_bsize 2097152 > suffix "dc=my-domain,dc=com" > rootdn "cn=Manager,dc=my-domain,dc=com" > rootpw secret > directory /tmp/openldap/var/openldap-data > index objectClass eq > EOF > > 2.) convert slapd.conf into cn=config: > mkdir slapd.d&& slaptest -f slapd.conf -F slapd.d > > 3.) search slapd.d directory for "olcdbconfig" attribute values: > grep -R -i olcDbConfig slapd.d/ > > the string "olcDbConfig" cannot be found (only in schema definition)... > I'm unable to reproduce this issue; the conversion works for me: violino:~/OD/hobj/tests> ../servers/slapd/slapd -Ttest -f testrun/slapd.1.conf -F testrun/slapd.d -d -1 violino:~/OD/hobj/tests> ../servers/slapd/slapd -Tc -F testrun/slapd.d -n0 | less dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=example,dc=com olcRootPW:: c2VjcmV0 olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /home/hyc/OD/hobj/tests/testrun/db.1.a olcDbCacheSize: 1000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_lg_bsize 2097152 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 8a31068c-449d-491c-9ddf-4fb817dad065 creatorsName: cn=config createTimestamp: 20100721204954Z entryCSN: 20100721204954.041390Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100721204954Z -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6598) EXOP to return number of children of a (sub)tree
by hyc＠symas.com 21 Jul '10

21 Jul '10

masarati(a)aero.polimi.it wrote: >> quanah(a)zimbra.com wrote: >>> Full_Name: Quanah Gibson-Mount >>> Version: NA >>> OS: NA >>> URL: ftp://ftp.openldap.org/incoming/ >>> Submission from: (NULL) (75.111.45.108) >>> >>> >>> It would be extremely useful to have an extended operation that allows >>> querying >>> the number of children of a given (sub)tree, so that one can avoid >>> iterating >>> through the entire subtree to determine this number. >>> >> Might as well ask for the numSubordinates operational attribute to be >> implemented instead, this doesn't seem to merit a new exop. And for >> numSubordinates, see the -devel archives for why we chose not to implement >> it. >> >> In either case, the server still needs to iterate over all entries >> internally, >> and the result has to take ACLs and entry disclosure into account. > > An exop would allow to easily discriminate between intentional and > "catchall" requests, like "+". Moreover, it might make sense to > discriminate at least between subtree and onelevel number of subordinates; > this would require two distinct operational attributes, or a parameter in > the exop. > > I'm not endorsing either solution, I'm just pointing out possible pros and > cons. If you want to be able to distinguish results based on scope then it makes more sense to just define a Search control. Like No-op - count the entries that would be returned, instead of returning them. (And bypassing the sizelimit too, but probably not bypassing timelimit.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#6597 published: SECURITY: ldap service crash while connected AD server reboot
by openldap-its＠OpenLDAP.org 21 Jul '10

21 Jul '10

Private ITS#6597 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=6597

1 0

ITS#6593 published: SECURITY: Ldapsearch Error while using Back-NDB
by openldap-its＠OpenLDAP.org 21 Jul '10

21 Jul '10

Private ITS#6593 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=6593

1 0

ITS#6594 published: SECURITY: Ldapsearch Error while using Back-NDB
by openldap-its＠OpenLDAP.org 21 Jul '10

21 Jul '10

Private ITS#6594 is now publicly readable URL: http://www.OpenLDAP.org/its/?findid=6594

1 0

Re: (ITS#6598) EXOP to return number of children of a (sub)tree
by masarati＠aero.polimi.it 21 Jul '10

21 Jul '10

> quanah(a)zimbra.com wrote: >> Full_Name: Quanah Gibson-Mount >> Version: NA >> OS: NA >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (75.111.45.108) >> >> >> It would be extremely useful to have an extended operation that allows >> querying >> the number of children of a given (sub)tree, so that one can avoid >> iterating >> through the entire subtree to determine this number. >> > Might as well ask for the numSubordinates operational attribute to be > implemented instead, this doesn't seem to merit a new exop. And for > numSubordinates, see the -devel archives for why we chose not to implement > it. > > In either case, the server still needs to iterate over all entries > internally, > and the result has to take ACLs and entry disclosure into account. An exop would allow to easily discriminate between intentional and "catchall" requests, like "+". Moreover, it might make sense to discriminate at least between subtree and onelevel number of subordinates; this would require two distinct operational attributes, or a parameter in the exop. I'm not endorsing either solution, I'm just pointing out possible pros and cons. p.

1 0

Re: (ITS#6598) EXOP to return number of children of a (sub)tree
by hyc＠symas.com 21 Jul '10

21 Jul '10

quanah(a)zimbra.com wrote: > Full_Name: Quanah Gibson-Mount > Version: NA > OS: NA > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (75.111.45.108) > > > It would be extremely useful to have an extended operation that allows querying > the number of children of a given (sub)tree, so that one can avoid iterating > through the entire subtree to determine this number. > Might as well ask for the numSubordinates operational attribute to be implemented instead, this doesn't seem to merit a new exop. And for numSubordinates, see the -devel archives for why we chose not to implement it. In either case, the server still needs to iterate over all entries internally, and the result has to take ACLs and entry disclosure into account. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#6598) EXOP to return number of children of a (sub)tree
by quanah＠zimbra.com 21 Jul '10

21 Jul '10

Full_Name: Quanah Gibson-Mount Version: NA OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.45.108) It would be extremely useful to have an extended operation that allows querying the number of children of a given (sub)tree, so that one can avoid iterating through the entire subtree to determine this number.

1 0

(ITS#6595) Patch - Mozilla NSS - delay token auth until needed
by rmeggins＠redhat.com 20 Jul '10

20 Jul '10

Full_Name: Rich Megginson Version: 2.4.23 OS: Fedora URL: ftp://ftp.openldap.org/incoming/openldap-2.4.23-initauthtoken.patch Submission from: (NULL) (76.113.111.209) The code was doing all of the authentications to all of the tokens during the init phase. This was causing problems with NSS cert/key clients, prompting for the cert/key db password, when it isn't needed, since it is only needed to get private key information. The patch is to just remove the token authentication during init. The code already authenticates to the token when private key information is needed e.g. running in TLS/SSL server mode, or using client cert auth. This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Rich Megginson am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#6592) slapadd allows objects with objectClass doublets
by masarati＠aero.polimi.it 20 Jul '10

20 Jul '10

slapd(8) can handle those occurrences. slapadd(8) is intended to load LDIF files generated by slapcat(8), thus presumably consistent. In general, it deals with the most obvious errors. I don't think asking slapadd to perform these checks is a good idea, as it would slow it down without real benefit: if an error is caught, you would need to restart, wasting all the actual write effort. A sanity check tool for unreliable LDIF would probably be more appropriate. p.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs