openldap-bugs

openldap-bugs@openldap.org

1 participants
20964 discussions

(ITS#5788) Search does not work with nested naming contexts
by emmanuel.duru＠atosorigin.com 03 Nov '08

03 Nov '08

Full_Name: Emmanuel Duru Version: 2.4.11 OS: Windows URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (80.78.0.137) I want to run a directory server with a "c=fr" suffix, and a replicated subtree: "ou=test,o=myorg,c=fr". To do this, I define two bdb databases, the first one with a "ou=test,o=myorg,c=fr" suffix, the second one with a "c=fr" suffix. But when I perform a search, the entries from the first base are not returned. For example, search with base "o=myorg,c=fr" and scope one level returns "ou=test2,o=myorg,c=fr" but not "ou=test,o=myorg,c=fr" whereas search with base "ou=test,o=myorg,c=fr" returns the entry. If this is a configuration problem, please tell me what is wrong. Here follows my slapd.conf file: include schema/core.schema include schema/cosine.schema include schema/inetorgperson.schema pidfile slapd.pid argsfile slapd.args access to * attrs=userPassword by self write by anonymous auth by * none access to * by self write by users read by anonymous read by * none database bdb suffix "ou=test,o=myorg,c=fr" rootdn "cn=manager,c=fr" updatedn "cn=replicator,ou=test,o=myorg,c=fr" cachesize 20000 checkpoint 10000 10 directory db1 index objectClass,entryCSN,entryUUID eq index cn,sn eq,sub database bdb suffix "c=fr" rootdn "cn=manager,c=fr" rootpw {SSHA}IcRbIFvDVZ9j6g8hWK9bbgo7xhSrMMTf cachesize 20000 checkpoint 10000 10 directory db2 index objectClass,entryCSN,entryUUID eq index cn,sn eq,sub

1 0

Re: (ITS#5756) 2.4 slapo-pcache only caches first lookup for certain templates
by toby＠inf.ed.ac.uk 03 Nov '08

03 Nov '08

Hi there, is there any further debugging I could usefully carry out for this issue, or does it need someone who understands the code a bit better? Cheers Toby -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

Re: (ITS#5745) slapcat doesn't return correct error status for bdb fatal error
by Guillaume.Rousse＠inria.fr 03 Nov '08

03 Nov '08

Howard Chu a écrit : > Guillaume.Rousse(a)inria.fr wrote: >> Full_Name: Guillaume Rousse >> Version: 2.4.12 >> OS: >> URL: >> Submission from: (NULL) (193.55.250.67) >> >> >> [root@etoile ~]# slapcat -b dc=msr-inria,dc=inria,dc=fr >> ... >> bdb(dc=msr-inria,dc=inria,dc=fr): pthread lock failed: Invalid argument >> bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: Invalid argument >> bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: DB_RUNRECOVERY: Fatal error, run >> database recovery >> bdb(dc=msr-inria,dc=inria,dc=fr): PANIC: fatal region error detected; run >> recovery >> bdb_db_close: database "dc=msr-inria,dc=inria,dc=fr": close failed: >> DB_RUNRECOVERY: Fatal error, run database recovery (-30975) >> [root@etoile ~]# echo $? >> 0 >> >> It makes a bit difficult to know if slapcat-based backup were successful. > > How did you create this situation? I can't test a fix without some way > to break the DB in the first place, and generally the DB doesn't fail... I just upgraded to 2.4.12, as described at http://www.openldap.org/lists/openldap-software/200810/msg00087.html. -- Guillaume Rousse Service des Moyens Informatiques INRIA Saclay - Ile de France Tel: 01 69 35 69 62

1 0

Re: (ITS#5640) slapd scans too many objects at startup
by hyc＠symas.com 02 Nov '08

02 Nov '08

Ali Pouya wrote: > Howard Chu a écrit : >> The startup scan is only performed inside the syncprov overlay. If >> server C is only a consumer, then it does not need the syncprov overlay. >> > Yes, you are right for the point 1). Thank you. > > But I'm also bothered with the point 2) reproduced below : > > .... > 2) If I do only one write operation on B, then I get two contextCSN values, > which is normal. > > But il this case slapd on B scans, at each startup, all objecs written on A > after the write operation on B. > The log and the effect are similar to those explained above. I see. This has been fixed for back-bdb/hdb in HEAD. If the database was shut down cleanly before, there will be no scan on the next startup. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5786) too many arguments to function slap_get_commit_csn
by hyc＠symas.com 02 Nov '08

02 Nov '08

michael(a)stroeder.com wrote: > Full_Name: Michael Ströder > Version: HEAD > OS: openSUSE Linux 11.0 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (84.163.100.88) > > > HEAD synced, invoked configure after make distclean > > cd overlays; make -w static > make[3]: Entering directory > `/usr/src/michael/openldap/HEAD/openldap/servers/slapd/overlays' > gcc -g -O4 -I../../../include -I../../../include -I.. -I./.. > -I/usr/include -I/usr/include -I/usr/include -I/usr/include -DDEVEL -c -o > syncprov.o syncprov.c > syncprov.c: In function syncprov_op_response: > syncprov.c:1612: error: too many arguments to function slap_get_commit_csn > syncprov.c:1621: error: too many arguments to function slap_get_commit_csn > make[3]: *** [syncprov.o] Error 1 > make[3]: Leaving directory > `/usr/src/michael/openldap/HEAD/openldap/servers/slapd/overlays' > make[2]: *** [liboverlays.a] Error 2 > make[2]: Leaving directory > `/usr/src/michael/openldap/HEAD/openldap/servers/slapd' > make[1]: *** [all-common] Error 1 > make[1]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/servers' > make: *** [all-common] Error 1 Incomplete commit. Fixed now. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5787) Implement support for "Codice Fiscale" syntax
by ando＠sys-net.it 02 Nov '08

02 Nov '08

Further info is available here: <http://www.openldap.org/faq/data/cache/1471.html> p.

1 0

(ITS#5787) Implement support for "Codice Fiscale" syntax
by ando＠sys-net.it 02 Nov '08

02 Nov '08

Full_Name: Pierangelo Masarati Version: HEAD OS: irrelevant URL: ftp://ftp.openldap.org/incoming/cf.tar.gz Submission from: (NULL) (81.72.89.40) Submitted by: ando This module registers the "Codice Fiscale" syntax, derived from directoryString, and makes it compatible with the caseExactMatch matchingRule. It also defines a "codiceFiscale" attribute and the "codiceFiscaleBase" and "codiceFiscaleObject" objectClasses. I believe this software and these schema items will probably be mainly useful to Italian users and developers of OpenLDAP software. This software has been developed by myself, based on publicly available information. It is released under the OpenLDAP license for use with OpenLDAP software. p.

1 0

Re: (ITS#5785) dontUseCopy in slapd requires criticality to be TRUE
by ando＠sys-net.it 02 Nov '08

02 Nov '08

See also <http://www.openldap.org/lists/openldap-devel/200811/msg00000.html> and specifically <http://www.openldap.org/lists/openldap-devel/200811/msg00006.html> dontUseCopy needs to be fixed, but specific "disallow" flags could be added to alter per-RFC4511 behavior. p.

1 0

(ITS#5786) too many arguments to function slap_get_commit_csn
by michael＠stroeder.com 02 Nov '08

02 Nov '08

Full_Name: Michael Ströder Version: HEAD OS: openSUSE Linux 11.0 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.100.88) HEAD synced, invoked configure after make distclean cd overlays; make -w static make[3]: Entering directory `/usr/src/michael/openldap/HEAD/openldap/servers/slapd/overlays' gcc -g -O4 -I../../../include -I../../../include -I.. -I./.. -I/usr/include -I/usr/include -I/usr/include -I/usr/include -DDEVEL -c -o syncprov.o syncprov.c syncprov.c: In function syncprov_op_response: syncprov.c:1612: error: too many arguments to function slap_get_commit_csn syncprov.c:1621: error: too many arguments to function slap_get_commit_csn make[3]: *** [syncprov.o] Error 1 make[3]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/servers/slapd/overlays' make[2]: *** [liboverlays.a] Error 2 make[2]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/servers/slapd' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/usr/src/michael/openldap/HEAD/openldap/servers' make: *** [all-common] Error 1

1 0

Re: (ITS#5785) dontUseCopy in slapd requires criticality to be TRUE
by ando＠sys-net.it 02 Nov '08

02 Nov '08

michael(a)stroeder.com wrote: > ando(a)sys-net.it wrote: >> The "dontUseCopy" control requires criticality to be TRUE. While this is the >> desirable value, > > Why is this a desirable value? The answer Kurt gave on ldap-ext mailing > list just mentioned direct mapping to X.511 dontUseCopy option. Because. If you need to avoid using copy, then you strongly need it. If it's just a wish, then don't use it, assuming the DSA you contact will do no more than what it can to provide you valid data. You would otherwise be misuing the control. >> a DUA could use the control with the criticality set to FALSE. Yes, perfectly legitimate (from a DSA's point of view, as per RFC4511) but contrary to the control's specification (and, IMHO, to common sense). > As I stated on ldap-ext mailing list in this case I'd simply accept a > best effort on the DSA side. IMHO you already get the best effort by not using the control. > So sending "dontUseCopy" control with > criticality FALSE would mean: If the DSA supports this control it should > *process* it according to what's specified in > draft-zeilenga-ldap-dontusecopy. Otherwise ignore it. No. The spec looks broken to me, because it contradicts RFC4511 (from the DSA's point of view). The DUA must use TRUE to comply with dontUseCopy. If it doesn't, then the DSA can do its best to honor it, but nothing more. If the DSA finds out it can chain a request, but this would cost resources, it could return a referral, or simply ignore the control. All of these behaviors would comply with criticality to FALSE. > The main problem is that a DUA cannot determine in advance whether a DSA > supports a certain control for a certain backend. It turned out in > practice that looking a supportedControl in rootDSE does not have any > meaning at all. You got a clear answer: the only ultimate way to know is to try. If you use FALSE, you'll never know. > IMO yet another control does not solve this. It does: you add dontUseCopy with criticality set to TRUE; you add the whatFailed control; if dontUseCopy fails, you'd know for sure. Then you don't need to use it any more, as using it with FALSE would make no sense. >> For full conformance with RFC4511, if the control is syntactically well-formed >> and criticality is set to FALSE, slapd MUST accept it if recognized, or MUST >> ignore it if not recognized, but CANNOT question the fact that the value of >> criticality is violating the control's specification. > > I'm not sure whether this statement can be made generally. I'd wish so > and I'd rephrase "accept it" to "process it". With "accept" I mean: "recognize it"; with "process" I'd mean "apply it to the operation". If you set criticality to FALSE and the DSA does not recognize it, the DSA will just ignore it. If the DSA recognizes it, it is at the DSA's discretion to either apply it or not, based on what the DSA considers best (including interoperability with the specific operation, with other extensions, with resource consumption and any other consideration about the opportunity to process it). I'm pretty sure you agree that elaving so much discretion to the DSA about something related to data integrity does not differ too much from not using the control at all. p.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs