openldap-devel

openldap-devel@openldap.org

1443 discussions

Re: commit: ldap/servers/slapd/overlays syncprov.c
by Howard Chu 14 May '07

14 May '07

hyc(a)OpenLDAP.org wrote: > Update of /repo/OpenLDAP/pkg/ldap/servers/slapd/overlays > > Modified Files: > syncprov.c 1.186 -> 1.187 > > Log Message: > ITS#4961 disable schema checking on contextCSN update That may have been premature, need to see why the glue entry has no objectclass attribute. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: commit: ldap/libraries/libldap tls.c gnutls.c
by Ralf Haferkamp 14 May '07

14 May '07

On Sunday 13 May 2007 00:15, hyc(a)openldap.org wrote: > Update of /repo/OpenLDAP/pkg/ldap/libraries/libldap > > Modified Files: > tls.c 1.147 -> 1.148 > Removed Files: > gnutls.c 1.3 -> NONE > > Log Message: > Merged GNUtls support into main tls.c This broke building with openssl. Seems to be caused by the explicit #define HAVE_GNUTLS 1 #undef HAVE_OPENSSL in there. I've removed those lines again. -- Ralf

2 1

Bind DN SSF
by Hallvard B Furuseth 13 May '07

13 May '07

A loose thought - haven't really thought it through, and don't know exactly how SSFs are used today either: I'm wondering if we need one or two "Bind DN SSF"s which describe how reliable a Bind DN is - how secure the server-side authentication system is, as well as the Bind method and connection security at the time of the Bind. Then one can set access controls, 'security' directive, and a new 'rootdn-ssf' directive which requires a certain quality of the rootdn/pw. Possibly rootdn-ssf should be nonzero by default, or nonzero by default for cn=config. The ultimate example of an insecure Bind DN is probably database config rootdn cn=foo,cn=nil # config's rootdn is very powerful database null suffix cn=nil bind on # accept any password for any DN which hopefully doesn't happen outside tests. (That's why this occurred to me, I'd like to support cd tests/ && ./run -b null. Not when one could accidentally write a test like this, though.) There are other reasons the quality of the authentication or password store might differ - different authentication methods, a sloppily-written back-perl instance, whatever. So as a source of the Bind DN SSF one would configure SSFs to subsystems used for authentication - databases, SASL, etc. -- Regards, Hallvard

1 0

Re: commit: ldap/servers/slapd schema_init.c
by Howard Chu 12 May '07

12 May '07

hyc(a)OpenLDAP.org wrote: > Update of /repo/OpenLDAP/pkg/ldap/servers/slapd > > Modified Files: > schema_init.c 1.395 -> 1.396 > > Log Message: > Use liblber for certificate Validation, Normalization These functions are no longer dependent on HAVE_TLS. I've only tested with X509v3 certificates, it probably needs a shakedown with X509v1 and X509v2 certs. Along with the other changes to integrate GNUtls support, I've changed the ldap_X509dn2bv function to expect a DER format berval for input. We no longer use OpenSSL-specific X509_NAME structures anywhere. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

back-monitor and "" rooted DBs
by Quanah Gibson-Mount 09 May '07

09 May '07

I have a database rooted at "", and would like to use the monitor backend as well. I found that if I put "database monitor" before the 'database ""' definition, it will load just fine. However, if it is defined afterwards, it fails to load, since "" overloads it context. I understand that that is correct from a technical standpoint, but IIRC, there have been issues in the past having "database monitor" come before other database definitions. I thought it would be worthwhile to allow "database monitor" to be instantiated after a 'database ""' definition. Thoughts? --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

tpool.c without a pool
by Hallvard B Furuseth 02 May '07

02 May '07

Has anyone got a variant of tpool.c which has the current interface but creates a new thread per operation instead of using a pool? (I'm trying to track down a memory corruption issue which disappears with --disable-threads, and I'm hoping the load of complaints from 'valgrind-2.2.0 --tool=helgrind' is due to the thread pool rather than genuine bugs or code which Helgrind can't deal with.) -- Regards, Hallvard

1 0

Default threads value in OpenLDAP
by Quanah Gibson-Mount 23 Apr '07

23 Apr '07

After extensive benchmarking by both Howard & I, it seems the default value for the threads setting in OpenLDAP (16) is excessive for most hardware. Unless someone has plenty of CPUs (at least 4+, not counting fake HT CPUs), slapd performance is significantly improved by running at 8 threads. Recent tests done by Howard indicated that dropping the number of threads to 4 on my 2 CPU boxes further improved read performance, but I haven't had the time to do the corresponding write performance tests to see how they were impacted. In any case, the "8" value is definitely better for both read & write performance for 1 & 2 CPU servers (and possibly 4, I just haven't had one to experiment on). The only time I've found a need to increase the number of threads was when I was benchmarking the Sun T2000, which had 32 cores. Given all of this, I'd like to propose that we change SLAP_MAX_WORKER_THREADS in slap.h from 16 to 8 for OpenLDAP 2.4. Thoughts? --Quanah -- Quanah Gibson-Mount Senior Systems Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

5 12

access ... by certificate=...
by Hallvard B Furuseth 22 Apr '07

22 Apr '07

Sorry if I asked about this before and forgot it... Could we add an 'access ... by' variant for the client's TLS certificate, _without_ Bind:SASL/EXTERNAL? (To the cert's DN, I expect, but I don't know much about certificates. Maybe there are other things to look at as well.) That could be used to authenticate a service (an LDAP client) rather than the user it Binds as, when the service asks the user for password and Binds with his DN and password. The simple way to do that is to grant access to the service's IP address, but that's not always feasible, and gets hard to maintain. -- Regards, Hallvard

2 3

IRC meeting to discuss Google Funding Proposal?
by Gavin Henry 11 Apr '07

11 Apr '07

Hi All, To speed things along as e-mail can take a wee while, why don't we try and get ourselves together for an irc session? We can go over the details of the proposal etc. then. Time/Date? Thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Funding proposal for OpenLDAP Build Farm
by Gavin Henry 11 Apr '07

11 Apr '07

Dear All, I've mentioned this in passing to Howard and he was going to have a wee chat with the Samba guys at SambaXP about theirs: http://build.samba.org So I popped into #samba-technical and asked about setting the above up. Few guys asked what for, and Jeremy Allison (http://samba.org/~jra/ and Google, in case you didn't know ;-) ) asked me to ping him a serious funding proposal: <snip irc> <wanon> did someone ask for money.... ? <ghenry> wanon: got some? ;-) <wanon> This is OpenLDAP right ? <ghenry> yup <wanon> put a proposal togther. A *serious* one, and mail it to me. <ghenry> wanon: Will do <ghenry> wanon: Tips? <ghenry> wanon: Should I google for your address? ;-) <ghenry> heh <wanon> Ask for a concrete amount, and give explicit reasons why you want it. <ghenry> Business plan? Or one pager? <wanon> One pager to start. <ghenry> Ok. Google funding, correct? <ghenry> excuse me if I should know, sorry <wanon> yep <ghenry> would you be kind enough to msg me your e-mail? <wanon> just google for it. <ghenry> heh, ok <wanon> or use my samba.org address * abartlet remembers the days when we didn't know who wanon was :-) <ghenry> So, funding proposal for OpenLDAP Build Farm. Thanks wanon <ghenry> going to post to openldap-devel then go from there with rest of team. thanks again all (abartlet wanon) <wanon> ok, works for me ! So, can we put a serious one together and get a build farm! Thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

4 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel