openldap-devel

openldap-devel@openldap.org

1 participants
1421 discussions

ITS8100: What to do about a fresh accesslog DB when in delta-sync MMR node
by Quanah Gibson-Mount 11 May '15

11 May '15

There's a general issue with using delta-sync MMR that needs some resolution (It's causing some considerable pain for customers): It is possible to put the entire system into endless fallbacks until a new and/or reloaded node gets a write operation. The general problem is that when an existing master queries the new/reloaded master's accesslog DB, zero entries are returned. This then triggers the fallback. This happens up util such a time as the new/reloaded master gets a direct write op. I've worked around it in general by immediately doing a no-op on the primary db (ldapmodify/replace an attribute value with its own value), but it would be nice to be able to bring new MMR nodes online or be able to reload MMR nodes for if they get out of sync, etc, without causing this sync fallback issue. There is no clear solution at the moment on what to do about zero results from the accesslog in the delta-sync MMR scenario. Proposals welcome. ;) --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 1

RE24 testing call #4 (2.4.41), LMDB RE0.9 testing call #4 (0.9.15)
by Quanah Gibson-Mount 01 May '15

01 May '15

OpenLDAP 2.4.41 Engineering Fixed ldapsearch to explicitly flush its buffer (ITS#8118) Fixed libldap async connections (ITS#8090) Fixed libldap double free of request during abandon (ITS#7967) Fixed libldap error string for LDAP_X_CONNECTING (ITS#8093) Fixed libldap segfault in ldap_sync_initialize (ITS#8001) Fixed libldap ldif-wrap off by one error (ITS#8003) Fixed libldap handling of TLS in async mode (ITS#8022) Fixed libldap null pointer dereference (ITS#8028) Fixed libldap mutex handling with LDAP_OPT_SESSION_REFCNT (ITS#8050) Fixed slapd slapadd onetime leak with -w (ITS#8014) Fixed slapd sasl auxprop crash with invalid config (ITS#8092) Fixed slapd syncrepl delta-mmr issue with overlays and slapd.conf (ITS#7976) Fixed slapd syncrepl mutex for cookie state (ITS#7968) Fixed slapd syncrepl memory leaks (ITS#8035) Fixed slapd syncrepl to free presentlist at end of refresh mode (ITS#8038) Fixed slapd syncrepl to streamline presentlist (ITS#8042) Fixed slapd syncrepl concurrency when CHECK_CSN is enabled (ITS#8120) Fixed slapd rootdn checks for hidden backends (ITS#8108) Fixed slapd segfault when using matched values control (ITS#8046) Fixed slapd-mdb minor case typo (ITS#8049) Fixed slapd-mdb one-level search (ITS#7975) Fixed slapd-mdb heap corruption (ITS#7965) Fixed slapd-mdb crash after deleting in-use schema (ITS#7995) Fixed slapd-mdb minor code cleanup (ITS#8011) Fixed slapd-mdb to return errors when using incorrect env flags (ITS#8016) Fixed slapd-mdb to correctly update search candidates (ITS#8036, ITS#7904) Fixed slapd-mdb when there were more than 65535 aliases in scope (ITS#8103) Fixed slapd-meta TLS initialization with ldaps URIs (ITS#8022) Fixed slapd-perl conversion to cn=config (ITS#8105) Fixed slapo-collect segfault (ITS#7797) Fixed slapo-constraint with 0 count constraint (ITS#7780,ITS#7781) Fixed slapo-deref with empty attribute list (ITS#8027) Fixed slapo-memberof to correctly reject invalid members (ITS#8107) Fixed slapo-sock result parser for CONTINUE (ITS#8048) Fixed slapo-syncprov synprov_matchops usage of test_filter (ITS#8013) Fixed slapo-syncprov segfault on disconnect/abandon (ITS#5452,ITS#8012) Fixed slapo-syncprov memory leak (ITS#8039) Fixed slapo-syncprov segfault on disconnect/abandon (ITS#8043) Fixed slapo-syncprov deadlock when autogroup is in use (ITS#8063) Fixed slapo-syncprov potential loss of changes when under load (ITS#8081) Fixed slapo-unique enforcement of uniqueness with manageDSAit control (ITS#8057) Build Environment Fixed libdb detection with gcc 5.x (ITS#8056) Enhanced contrib modules build paths (ITS#7782) Fixed contrib/autogroup internal operation identity (ITS#8006) Fixed contrib/autogroup to skip internal ops with accesslog (ITS#8065) Fixed contrib/passwd/sha2 compiler warning (ITS#8000) Fixed contrib/noopsrch compiler warning (ITS#7998) Fixed contrib/dupent compiler warnings (ITS#7997) Test suite: Added vrFilter test (ITS#8046) Contrib Added pbkdf2 sha256 and sha512 schemes (ITS#7977) Fixed autogroup modification callback responses (ITS#6970) Fixed nssov compare with usergroup (ITS#8079) Fixed nssov password change behavior (ITS#8080) Fixed nssov updated to 0.9.4 (ITS#8097) Documentation Added ldap_get_option(3) LDAP_FEATURE_INFO_VERSION information (ITS#8032) Added ldap_get_option(3) LDAP_OPT_API_INFO_VERSION information (ITS#8032) Fixed slapd-config(5), slapd.conf(5) tls_cipher_suite option (ITS#8099) Fixed slapd-meta(5), slapd-ldap(5) tls_cipher_suite option (ITS#8099) LMDB 0.9.15 Release Engineering Fix txn init (ITS#7961,#7987) Fix MDB_PREV_DUP (ITS#7955,#7671) Fix compact of empty env (ITS#7956) Fix mdb_rebalance collapsing root (ITS#8062) Fix mdb_load with large values (ITS#8066) Fix to retry writes on EINTR (ITS#8106) Fix mdb_cursor_del on empty DB (ITS#8109) Fix MDB_INTEGERDUP key compare (ITS#8117) Added workaround for fdatasync bug in ext3fs Build Don't use -fPIC for static lib Update .gitignore (ITS#7952,#7953) Cleanup for "make test" (ITS#7841) Misc. Android/Windows cleanup Documentation Fix MDB_APPEND doc Clarify mdb_dbi_open doc Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 3

MDB_INTEGERDUP in back-mdb's indexer for attr-tables.
by Леонид Юрьев 01 May '15

01 May '15

Hi, Howard. I would like to refine my question. Currently I develop a mdb_chk tool for deep check LMDB-files, like a fsck tool. It is needed for us, but let this stay aside for now. On some step I plan to check the size of each key in each DBI with MDB_INTEGERKEY and/or MDB_INTEGERDUP flags. Initially I assumed - if one of these flags is set, the the length of all keys must be sizeof(int) or sizeof(long). As will be used the corresponding comparison functions (mdb_cmp_int, mdb_cmp_long) , which can handle only keys of such sizes. But this approach has failed. A dbi-tables created for attr by mdb_attr_dbs_open() have MDB_DUPSORT|MDB_DUPFIXED|MDB_INTEGERDUP flags and may contain records with a 5-byte keys. For instance as the 'entryCSN'. Later you have written that MDB_INTEGERDUP is required. Now I do not understand how it all works: - MDB_INTEGERDUP is set for attr tables. - indexer could create a 5-byte keys. - mdb-backend set custom comparison function only for MDB_DN2ID table. - under debugger I see that md_dcmp is pointed to the default. - assert for key-size in default comparators was not failed while "make test". - all test are passed without MDB_INTEGERDUP. - but you told MDB_INTEGERDUP is necessary So, - how and when MDB_INTEGERDUP will have an impact? - in which cases keys in the table definitely should be sizeof(int) or sizeof(long)? Thank in advance, Leonid.

2 4

Propose to MDB_PICKUP for mdb_dpi_open()
by Леонид Юрьев 30 Apr '15

30 Apr '15

Hi, Howard. I would like to introduce the MDB_PICKUP flag for mdb_dpi_open(). Please see https://github.com/ReOpen/ReOpenLDAP/commit/04f92c952e42ff4c843135c42fdb9aa… At least, this is required for mdb_chk tool, when a DBI should be opened with flags that stored inside LMDB, which while a DBI was created. It is particularly important for DBI_MAIN. Leonid.

2 4

Re: (ITS#8117) Bugs related to key-size in lmdb and backend
by Леонид Юрьев 30 Apr '15

30 Apr '15

Hi, Howard. As you told before, I will write to openldap-devel. So, please take look to MDB_INTEGERDUP in mdb_attr_dbs_open(). I cutout ones and all tests are passing. For my mdb_chk tool this is also solves a problem with checking INTEGER-keys. With MDB_INTEGERDUP removal a logic become spotless: keys must be sizeof(int) or sizeof(size_t) only if MDB_INTEGERDUP or MDB_INTEGERKEY is in a dbi-flags. Would you agree to remove MDB_INTEGERDUP from the mdb_attr_dbs_open()? Leonid. 2015-04-30 4:12 GMT+03:00 Howard Chu <hyc(a)symas.com>: > Leonid Yuriev wrote: > >> OK, but then - what is the purpose of MDB_INTEGERDUP in >> mdb_attr_dbs_open()? >> >> flags = MDB_DUPSORT|MDB_DUPFIXED|MDB_INTEGERDUP; >> if ( !(slapMode & SLAP_TOOL_READONLY) ) >> flags |= MDB_CREATE; >> >> Think it is not necessary, is it? >> > > You really think so? Have you thought about what the actual *values* are > in an index, instead of just the keys? > > Anyway, this ITS is resolved. Thank you for reporting the bug. If you want > to ask further questions about how the indexer works take it to > openldap-devel. > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

2 2

New Committer
by Howard Chu 29 Apr '15

29 Apr '15

The Project is pleased to announce that Ryan Tandy has joined the OpenLDAP Engineering Team. Ryan's recent contributions have been very helpful, in addition to his participation in the community and his coordinating with the Debian project. Welcome, Ryan! -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

New Committer
by project＠openldap.org 29 Apr '15

29 Apr '15

We are pleased to announce that Ryan Tandy has joined the OpenLDAP Engineering Team. Ryan's recent contributions have been very helpful, particularly his work as a liaison to the Debian project. Welcome, Ryan! -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: [WIP] WiredTiger Backend
by HAMANO Tsukasa 27 Apr '15

27 Apr '15

Hi, Howard Thanks for your responce! On 月, 27 4月 2015 at 12:46:12 JST, Howard Chu wrote: > > Interesting, thanks for the contribution. Looks like there is no > manpage though, do you have one? > I will write it soon :p > > Some note: > > * slapadd, slapcat, slapindex will works. > > * LDAP BIND, ADD, DELETE, SEARCH will works. > > How well does it work, good enough to run benchmarks now? > I have just tested on virtual machine, back-wt LDAP ADD(with single thread) is 20-30x times faster than back-bdb. I'm looking forward to benchmarking with many thread. I'll publish benchmarks just when I get high spec machine. > > * WiredTiger is not support multiprocess access yet. > > It mean that we can't to do slatcat while running slapd. > > It will be supported in the future. > > You should use alock in the meantime then, to prevent multiprocess access. > WiredTiger is planning to implement RPC for multiprocess access. http://source.wiredtiger.com/2.5.3/group__wt.html#ga9e6adae3fc6964ef837a627… I think it will communicate with unix domain socket. I'm planning to use the feature to avoid multi process locking. Thank you. -- Open Source Solution Technology Corporation HAMANO Tsukasa <hamano(a)osstech.co.jp> fingerprint = 2285 2111 6D34 3816 3C2E A5B9 16BE D101 6069 BE55

1 0

LMDB and gitorious
by Timur Kristóf 22 Apr '15

22 Apr '15

Hi, As you might've heard, Gitorious is shutting down on 15th May. Maybe we start should look for a new home for the projects at https://gitorious.org/mdb - do you guys have a plan for this? Cheers, Timur

2 1

ppolicy: pardon password history
by hercherf＠hrz.uni-marburg.de 21 Apr '15

21 Apr '15

Hi list, I have made a tiny modification to the ppolicy-module. The aim is to go easy on people who forgot their password, or forgot to deploy their recently changed password to all devices (think of laptops, smartphones, etc.). Whenever a login fails due to a invalid password, the ppolicy-module will count this as a failure. After a configurable number of password failures in a given time, ppolicy will take action and - for example - lock the acount. I have tried to tweak this behaviour: When the password is found in the password history, the ppolicy-module will not count this as a password failure. If anyone is interested in this, please find the attached patch which also includes a working example configuration/testcase. Best regards, Florian -- Florian Hercher | Hochschulrechenzentrum | Philipps-Universität Marburg Hans-Meerwein-Str. 6, 35032 Marburg | fon +49-(0)6421-28-21036

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel