openldap-devel

openldap-devel@openldap.org

1443 discussions

OpenLDAP Faq-O-Matic: Misleading comment in "Which version of BerkeleyDB should I use?"
by Michael Ströder 17 Apr '08

17 Apr '08

HI! I think this text in http://www.openldap.org/faq/data/cache/44.html needs some correction since recent BDB 4.6 cannot be used with OpenLDAP 2.3: "[..] Versions 4.4, 4.5, and 4.6 are known to work with OpenLDAP 2.3 and newer." I don't know how to edit existing text in the FAQ-O-MATIC. Ciao, Michael.

3 3

Re: RE2.4
by Raphaël Ouazana-Sustowski 16 Apr '08

16 Apr '08

Hi, Le Mar 15 avril 2008 09:25, Gavin Henry a écrit : >> Please test RE2.4 and let me know how things go. > > All passed on i386, Fedora 8 here. Any news on the build machine rebuild > Kurt? > >>>>> Starting test050-syncrepl-multimaster ... running defines.sh Initializing server configurations... Starting producer slapd on TCP/IP port 9011... Using ldapsearch to check that producer slapd is running... Inserting syncprov overlay on producer... Starting consumer slapd on TCP/IP port 9012... Using ldapsearch to check that consumer slapd is running... Configuring syncrepl on consumer... Starting consumer2 slapd on TCP/IP port 9013... Using ldapsearch to check that consumer2 slapd is running... Configuring syncrepl on consumer2... Adding schema and databases on producer... Using ldapadd to populate producer... Waiting 20 seconds for syncrepl to receive changes... Using ldapadd to populate consumer... Waiting 20 seconds for syncrepl to receive changes... Using ldapsearch to check that syncrepl received database changes... Waiting 5 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ldapsearch failed (32)! >>>>> ./scripts/test050-syncrepl-multimaster failed (exit 32) make[2]: *** [hdb-yes] Erreur 32 make[2]: quittant le répertoire « /tmp/openldap/tests » make[1]: *** [test] Erreur 2 make[1]: quittant le répertoire « /tmp/openldap/tests » make: *** [test] Erreur 2 Regards, Raphaël Ouazana.

3 4

Any plans for 2.4.9?
by Michael Ströder 16 Apr '08

16 Apr '08

HI! Are there any plans when to release 2.4.9? I vaguely remember some interesting fixes and noticed that some things were already back-ported to RE24. Ciao, Michael.

5 14

RE2.4
by Quanah Gibson-Mount 15 Apr '08

15 Apr '08

I've sync'd up RE24 with everything I'm aware of except for: Update of /repo/OpenLDAP/pkg/ldap/servers/slapd/back-bdb Modified Files: referral.c 1.49 -> 1.50 Log Message: ITS#5339: fix referral rewrite, remove pointless default_referral code as I was not sure from the comments if this was really ready for release. Please test RE2.4 and let me know how things go. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

8 8

non-unix help needed: valid filename characters?
by Hallvard B Furuseth 14 Apr '08

14 Apr '08

Which characters one can safely use in filenames on at least the platforms OpenLDAP is ported to: Unix, Windows (cygwin), IBM zOS and MacOS X according to ANNOUNCEMENT? In particular Windows, since that's the most common non-Unix platform. I only know Unix filenames. Googling around I've found a plethora of conflicting info. It's for a naming scheme for back-ldif filenames that will let back-ldif work as a general backend, and hopefully won't conflict with its current names for the config database. ITS#5408. Currently back-ldif takes the RDN and escapes the directory separator as "\hex", which doesn't work on Windows where \ is a directory separator. Some other notes: - Don't need really general filenames. OpenLDAP does in any case assume Unix/Windows/URL-style pathnames: root to the left, leaf to the right, a single directory separator character. - Hopefully the characters "=-{}" can be used, since database config uses those characters. E.g. olcDatabase={-1}frontend,cn=config. ",+" would be nice too, as separators in and between RDNs. - Need some escape character. Howard suggested % as in URL-escaping. First that sounded nice, but on second thought such a filename is not a valid file:// URL component for that file - the '%' must be URL-escaped again to access the file as an URL. Not sure if that's a good argument either way. Full URL-escaping also escapes {} which is unfortunate (see point 1). - For real paranoia, might escape uppercase characters in case-sensitive attribute types too. I won't bother unless someone disagrees, both case-sensitive DNs and the use of back-ldif as a general database are fairly rare. -- Hallvard

2 9

Re: commit: ldap/doc/man/man5 slapd-meta.5
by Pierangelo Masarati 14 Apr '08

14 Apr '08

ando(a)OpenLDAP.org wrote: > Log Message: > make pseudoroot-bind-defer TRUE by default (part of ITS#5440 fix) This is a change in a side-feature of back-meta, something that should not hurt in most cases, but definitely a change in the default behavior, established since back-meta was released. What's the best way to notify it? p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

3 4

slapo-dynlist improvement
by manu＠netbsd.org 12 Apr '08

12 Apr '08

Hello I'd like to use the slapo-dynlist overlay, to generate an automatically updated list of attributes onan object. My problem is that I want the attribute name to be different than the original: I have dn: cn=list,o=home objectClass: groupOfURLs cn: list memberURL: ldap:///o=home?foo?sub?(objectClass=fooClass) In slapd.conf: overlay dynlist dynlist-attrset groupOfURLs memberURL A search on cn=list,o=home gives me: dn: cn=list,o=home objectClass: groupOfURLs cn: list foo: value1 foo: value2 foo; value3 ... But I would like it to be displayed that way: dn: cn=list,o=home objectClass: groupOfURLs cn: list bar: value1 bar: value2 bar; value3 ... It seems this is not possible with current software (please correct me if I'm wrong). I propose a contribution to slapo-dynlist, to include attribute name remapping capability. In the config file, this qould be configured by extending the member-ad parameter: overlay dynlist dynlist-attrset groupOfURLs memberURL foo:bar Of course, for backward compatibility, dynlist-attrset groupOfURLs memberURL foo would still be equivalent to dynlist-attrset groupOfURLs memberURL foo:dn Opinions? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 5

OpenLDAP Overlay API
by micky 11 Apr '08

11 Apr '08

Hello, exists a OpenLDAP API Documentation to develop a Overlay (like smbk5pwd)? We just started to explore the source-code (smbk5pwd.c), but we noticed that the struct's and function syntax aren't easy to unterstand - We need a description. Like the smbk5pwd module, we want to develop a analog module for Asterisk. -- Greets Michael

3 2

Proxied attribute descriptions initialization
by Jonathan Clarke 11 Apr '08

11 Apr '08

The feature introduced in 2.3 [1] to map undefined attributes from proxies as "proxied" attribute descriptions enables searches with filters using attributes that have no local definition. For example, given slapd with a back-ldap pointing to an Active Directory (AD) server, this features makes searches with a filter of "(samAccountName=login)" work with no extra configuration, and without explicitly adding samAccountName to local schema. However, such searches will be passed on to the AD server only if a previous search result contained the attributes in question (samAccountName) and was not based on a filter containing the attribute. Otherwise, the filter is considered invalid and replaced with "(?=undefined)" in the logs, and passed to the AD server as "(!(objectclass=*))". This means that the same search, on the same data, can return different results at different times, depending on whether or not a previous search had succeeded and returned given attribute (samAccountName). Currently, we have worked around this problem by either: - running a bogus ldapsearch just after starting slapd, that returns this attribute - adding the attribute description to a local schema What is the general opinion on working around this issue? Might there be a way to implement something that ensures this happens automatically? I'm thinking of delegating filter checking to proxied servers for ldap backends, or automatically fetching schemas from them... Any experience, ideas? Thanks in advance. Best regards, Jonathan [1]http://www.openldap.org/its/index.cgi/Software%20Enhancements?id=3959 -- Jonathan Clarke Open Source Software Assurance (OSSA) - Groupe LINAGORA 27 rue de Berri, 75008 Paris Tél: 01 58 18 68 28, fax: 01 58 18 68 29 http://www.linagora.com - http://www.08000linux.com

2 1

Socket-level timeouts?
by Chris Adams 11 Apr '08

11 Apr '08

We've noticed hard failures on both our Linux and Mac workstations when an LDAP server fails in a way which causes it to stop responding but leave a connection open (e.g. lock contention, disk failure). This usually ends up requiring the system to be rebooted because a key system process will probably have made a call which is waiting on a read() which might take days to fail. I've created a patch simply calls setsockopt() to set SO_SNDTIMEO| SO_RCVTIMEO when LDAP_OPT_NETWORK_TIMEOUT has been set. This appears to produce the desired result on Linux (both with pam_ldap and the ldap utilities) and OS X (within the DirectoryService plugin). Is there a drawback to this approach which I've missed? It appears that the issue has come up in the past but there's no solution that I can see (certainly nothing else uses socket-level timeouts). I'd like to find a solution for this as it's by far the biggest source of Linux downtime in our environment. Thanks, Chris

4 7

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel