Full_Name: Alex Crow
Version: 2.4.40-13.el7
OS: Centos 7.3
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (95.172.237.70)
I'm using OpenLDAP with the caching overlay as a proxy to AD, mostly for use
with Postfix and Dovecot.
I have been experiencing a strange issue whereby, when a user is moved to a
different OU in AD, the caching server initially returns only the original OU
until the cache entry expires. However, after this time, it returns both the
entry in the original OU and the entry in the new OU. This does not seem to
change even after the next expiry time has elapsed. I can only seem to clear out
the "old" result by wiping the cache's database.
Here is my slapd.conf:
### Schema includes ###########################################################
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/misc.schema
#include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/custom.schema
include /etc/openldap/schema/adstuff.schema
## Module paths ##############################################################
modulepath /usr/lib64/openldap/
moduleload back_ldap
moduleload pcache
#moduleload rwm
# Main settings ###############################################################
TLSCACertificateFile /etc/openldap/cacerts/cacertchain.pem
TLSCertificateFile /etc/openldap/cacerts/certkey.pem
TLSCertificateKeyFile /etc/openldap/cacerts/certkey.pem
TLSVerifyClient never
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
allow bind_v2
database config
rootdn "cn=admin,cn=config"
rootpw {SSHA}blahblahblah
### Database definition (Proxy to AD) #########################################
database ldap
readonly yes
protocol-version 3
rebind-as-user
uri "ldap://foo ldap://bar ..."
suffix "dc=foo,dc=bar,dc=net"
rootdn "dc=foo,dc=bar,dc=net"
timelimit 5
overlay pcache
pcache bdb 100000 1 1000 100
pcacheAttrset 0 mail x-mailHost x-mailStore unixHomeDirectory
pcacheTemplate (sn=) 0 3600 0 0 1800
pcacheTemplate (cn=) 0 3600 0 0 1800
pcacheTemplate (mail=) 0 3600 0 0 1800
pcacheTemplate (&(objectClass=)(mail=)) 0 3600 0 0 1800
pcacheTemplate (&(objectClass=)(mail=*)) 0 3600 0 0 1800
cachesize 10000
directory /var/lib/ldap
index objectClass eq
index cn,sn,uid,mail pres,eq,sub
### Logging ###################################################################
loglevel 0
Here is an example of a search returning two results from the cache:
# extended LDIF
#
# LDAPv3
# base <OU=baz,DC=foo,DC=bar,DC=net> with scope subtree
# filter: mail=test_ajc(a)integrafin.co.uk
# requesting: x-mailHost
#
# test_ajc, DMD, COPS, ...
dn: cn=test_ajc,ou=DMD,ou=COPS, ...
dc=bar,dc=net
x-mailHost: imap.bar.net
# test_ajc, SysAdmin, ITDIV, ...
dn: cn=test_ajc,ou=SysAdmin,ou=ITDIV, ...
dc=bar,dc=net
x-mailHost: imap.bar.net
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
The newer, correct entry is the lower one.
We also occasionally suffer segfaults, eg:
[8432930.512516] slapd[19550]: segfault at 108 ip 00007f4204c401de sp
00007f41c1ff94d0 error 6 in libldap_r-2.4.so.2.10.3[7f4204c18000+56000]
[8434338.469945] slapd[30666]: segfault at 108 ip 00007f102a5c41de sp
00007f1014c744d0 error 6 in libldap_r-2.4.so.2.10.3[7f102a59c000+56000]
[8951331.245103] slapd[9653]: segfault at 11d8 ip 00007f01c523d1de sp
00007f01abffd4d0 error 6 in libldap_r-2.4.so.2.10.3[7f01c5215000+56000]
[10140511.797794] slapd[10247]: segfault at 108 ip 00007fbc84de01de sp
00007fbc477fc4d0 error 6 in libldap_r-2.4.so.2.10.3[7fbc84db8000+56000]
I've not determined what, if anything specific triggers these.
Any insights much appreciated.
Alex
Although Quanah hasn't been able to trigger this yet, the regression
test in master he wrote has been consistently able to trigger for me on
my machine, so I've started to investigate.
For posterity and in case anyone is interested, I have uploaded the
testrun/ directory from a failing run (I suspect the fact of this laptop
having a slow 2-core CPU helps) with a slightly patched slapd that
records the thread ID as well since, in part, this seems like a race of
some sort.
The tgz is available at
ftp://ftp.openldap.org/incoming/its8444-regression-testrun-sync,stat.tgz
So far it looks like replica #3's threads 7f50fb7fe700 and 7f51017bb700
are both trying to apply the modification with CSN
20170605125334.856475Z#000000#001#000000 which sends it into a full
refresh.=20
--=20
Ond=C5=99ej Kuzn=C3=ADk
Senior Software Engineer
Symas Corporation http://www.symas.com
Packaged, certified, and supported LDAP solutions powered by OpenLDAP
Full_Name: Gregory Noe
Version: 2.4.44
OS: Debian 8.7
URL: ftp://ftp.openldap.org/incoming/gregory-noe-170605.tar
Submission from: (NULL) (63.142.209.94)
Slapcat is not honoring the '-g' option. The output includes entries from glued
subordinates when it shouldn't. The attached test script
(gregory-noe-170605.tar) sets up the following DIT with inetOrgPerson entries in
each OU:
dn: dc=example,dc=com
|- ou=NonSub00,dc=example,dc=com
|- ou=NonSub01,dc=example,dc=com
|- ou=NonSub02,dc=example,dc=com
glued sub: ou=Accounting,dc=example,dc=com
glued sub: ou=Administrative,dc=example,dc=com
glued sub: ou=Janitorial,dc=example,dc=com
Then the script runs 'slapcat -g -b dc=example,dc=com | grep ^dn'. The result
contains entries from all three glued subordinates.
Tested using Symas OpenLDAP 2.4.44.5
Full_Name: Quanah Gibson-Mount
Version: 2.4.43
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (47.208.148.239)
When using glued/subordinate databases, the "limits" directive needs to be set
on the parent as well as subordinate dbs to be applied if there are global
limits in place. This is currently not documented. Otherwise, the "limits"
directive settings on the subordinate databases is not honored.
Full_Name: Quanah Gibson-Mount
Version: HEAD
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (47.208.148.239)
While you can set olcMemberOfRefInt during an add operation when instantiating
slapo-memberOf with cn=config, you cannot modify the value after that point.
Attempting to change the value results in:
Running ldapmodify to change olcMemberOfRefInt value
ldapmodify failed (80)!
slapd log shows:
592ef748 <<< dnPrettyNormal:
<olcOverlay={0}memberof,olcDatabase={1}bdb,cn=config>,
<olcOverlay={0}memberof,olcDatabase={1}bdb,cn=config>
592ef748 conn=1003 op=1 modifications:
592ef748 replace: olcMemberOfRefInt
592ef748 one value, length 5
592ef748 conn=1003 op=1 MOD
dn="olcOverlay={0}memberof,olcDatabase={1}bdb,cn=config"
592ef748 conn=1003 op=1 MOD attr=olcMemberOfRefInt
592ef748 slap_queue_csn: queueing 0x7f326010add0
20170531170304.816445Z#000000#000#000000
592ef748 oc_check_required entry
(olcOverlay={0}memberof,olcDatabase={1}bdb,cn=config), objectClass
"olcMemberOf"
592ef748 oc_check_allowed type "objectClass"
592ef748 oc_check_allowed type "olcOverlay"
592ef748 oc_check_allowed type "olcMemberOfGroupOC"
592ef748 oc_check_allowed type "olcMemberOfMemberAD"
592ef748 oc_check_allowed type "olcMemberOfMemberOfAD"
592ef748 oc_check_allowed type "structuralObjectClass"
592ef748 oc_check_allowed type "entryUUID"
592ef748 oc_check_allowed type "creatorsName"
592ef748 oc_check_allowed type "createTimestamp"
592ef748 oc_check_allowed type "olcMemberOfRefInt"
592ef748 oc_check_allowed type "entryCSN"
592ef748 oc_check_allowed type "modifiersName"
592ef748 oc_check_allowed type "modifyTimestamp"
592ef748 send_ldap_result: conn=1003 op=1 p=3
592ef748 send_ldap_result: err=80 matched="" text=""
592ef748 send_ldap_response: msgid=2 tag=103 err=80
ber_flush2: 14 bytes to sd 8
592ef748 conn=1003 op=1 RESULT tag=103 err=80 qtime=0.000020 etime=0.816572
text=
592ef748 slap_graduate_commit_csn: removing 0x7f326010add0
20170531170304.816445Z#000000#000#000000
592ef748 connection_get(8)