openldap-devel

openldap-devel@openldap.org

1416 discussions

logging "reqEntryUUID" in accesslog?
by Michael Ströder 29 Mar '10

29 Mar '10

HI! In web2ldap when displaying a single entry I have a button which directly forms a filter for searching the audit log (accesslog DB) for the entry based on the attribute 'reqDN'. This is handy but does not work anymore when entries were renamed. So how about logging the value of entryUUID of an entry affected by a write operation in a separate attribute 'reqEntryUUID'? Ciao, Michael.

2 2

pcache logging
by masarati＠aero.polimi.it 26 Mar '10

26 Mar '10

I'd like to enhance pcache logging by adding the conn= op= prefix. Objections? p.

2 1

liblutil/ultils.c: lutil_localtime() <g-differential> timestamp format bug?
by Daniel 20 Mar '10

20 Mar '10

Hi, there seems to be a small problem in "lutil_localtime()" regarding the creation of <g-differential> timestamp formated bervals: The returned length "ret" (of type: size_t) of a timestamp value in <g-differential> format contains the terminating "\0" which leads to base64 encoded presentation... For demonstration I've attached a minimal (and probably very dirty) patch which fixed this issue for me, but I'm quite unsure whether: - it's really a bug or I'm doing something completely wrong - my patch represents a clean solution. Therefore I've not opened an ITS. First of all I would appreciate your valuable feedback, whether lutil_localtime() creates <g-differential> timestamps like intended? Thanks a lot! Best regards Daniel Index: libraries/liblutil/utils.c =================================================================== RCS file: /repo/OpenLDAP/pkg/ldap/libraries/liblutil/utils.c,v retrieving revision 1.70 diff -u -r1.70 utils.c --- libraries/liblutil/utils.c 20 Nov 2009 19:43:50 -0000 1.70 +++ libraries/liblutil/utils.c 20 Mar 2010 17:15:12 -0000 @@ -147,7 +147,7 @@ snprintf( p, smax - 15, "%02ld%02ld", delta / 3600, ( delta % 3600 ) / 60 ); - return ret + 5; + return ret + 4; } int lutil_tm2time( struct lutil_tm *tm, struct lutil_timet *tt )

1 0

Altering the behavior of pcache to improve cache hit/miss ratio
by Ryan Steele 10 Mar '10

10 Mar '10

Hey folks, I've been playing with pcache for about a week (in combination with back-ldap), testing various things and trying to create a configuration that helps preserve system stability if access to the LDAP server disappears. Many things seem to work well, but I noticed that quite a good number of Unix commands, like "id", request a user's full entry (i.e., no filter string). In its current implementation, this will always fail to hit the cache, because (as the man page states) you cannot specify an empty list of attributes. This means that even if you have all the information required to return what was requested in the local cache, you will never be able to leverage that information. Given that, I wanted to ask if it could be considered to change the design of the overlay a bit, such that if an empty attribute list is specified, pcache will return every attribute *in the cache* for that entry, instead of blindly assuming it doesn't have the information to accomplish the task. I understand the shortcomings this could introduce, most notably if one did not want to cache every attribute for a particular entry and still wanted to be able to omit the filter string and get the entry's full attribute list, but I think the benefits would make it worthwhile. I say that for a few reasons: if you're using pcache and are interested in truly optimizing performance or keeping a system that is LDAP-dependent from having major issues if the network disappears, it would make sense to cache every attribute for entries used in common system tasks (e.g., using utilities like "id"). I believe this could also significantly improve the hit/miss ratios, especially if you take a look at how many of these common system utilities make queries without specifying any kind of filter. I would think that this could be accomplished by adding a case for the empty filter string, such that it would take a unison of each set of attributes corresponding to the cached entry for that particular LDAP filter, and returning the result. If the same attribute is present in more than one cache entry matching the specified LDAP filter, the most recent would be favored and returned, thereby preventing pcache from having choose between several query-string-dependent entries for that entry, if more than one are present. I'm interested to hear what you guys think of this. Even if my implementation ideas aren't 100% spot-on, I would think that the wiser minds could adapt the general idea in to something more artful, provided they agree with the idea in principle. Thanks! -Ryan

2 2

Re: commit: openldap-guide/admin backends.sdf overlays.sdf
by Gavin Henry 06 Mar '10

06 Mar '10

----- hyc(a)OpenLDAP.org wrote: > Update of /repo/OpenLDAP/pkg/openldap-guide/admin > > Modified Files: > backends.sdf 1.17 -> 1.18 > overlays.sdf 1.47 -> 1.48 > > Log Message: > ITS#6486 - avoid explicit moduleload in examples > > > CVS Web URLs: > > http://www.openldap.org/devel/cvsweb.cgi/admin/?cvsroot=OpenLDAP-guide > > http://www.openldap.org/devel/cvsweb.cgi/admin/backends.sdf?cvsroot=OpenLDA… > > http://www.openldap.org/devel/cvsweb.cgi/admin/overlays.sdf?cvsroot=OpenLDA… > Thanks! -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

back-config delete support (syncprov overlay)
by Ralf Haferkamp 02 Mar '10

02 Mar '10

Hi, while taking up some loose ends on my work on delete support for back- config (enabled with -DSLAP_CONFIG_DELETE) I wondered how we should deal with the deletion of the syncprov overlay when there are active refreshAndPersist sessions. What errorcode should we sent when closing such a connection? To me LDAP_UNAVAILABLE sound like the best choice. LDAP_UNWILLING_TO_PERFORM might also be ok. -- Ralf

4 9

SASL OTP and syncrepl
by manu＠netbsd.org 21 Feb '10

21 Feb '10

Hello After exchanging a few private messages with Pierangelo Masarati, I just posted ITD#6475: > When binding using SASL OTP to a replica, the bind works, but the > cmusaslsecretOTP attribute is modified on the replica and fail to be > propagated to the master. On the next modification, the master will > overwrite the replica's updated cmusaslsecretOTP value. > > Here is a script that exhibit the behaviour: > ftp://ftp.openldap.org/incoming/ldapotp.tgz > That require SASL enabled OpenLDAP, with the OTP plugin installed. The > PATH in run.sh must probably be adjusted. The problem is in sasl_auxprop_store(), who bypass the replication process. The easier fix to me seems to send a referal to the master on any SASL OTP bind, Any other idea? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

6 8

syncprov mmr propagation
by Howard Chu 02 Feb '10

02 Feb '10

Currently we still send too many updates in a fully connected mesh. The provider currently knows not to resend an update to the originating server, and also not to resend an update to the server that just relayed the update to it. We should also filter out updates that we know another server is likely to receive from an alternate path. E.g. in a 4-way mesh: 1 - 2 |\ /| | X | |/ \| 3 - 4 When server 1 receives an update from a client, it will propagate it to each of 2, 3, and 4. These servers will also attempt to propagate it to each other: 2 to 3,4; 3 to 2,4; and 4 to 2,3. If these further updates are not quite simultaneous, it is possible that one or two redundant updates will be pruned out given the existing code. But that's just based on luck and variations in server and network load. Once any node has received any updates from a given sid, it should be able to remember which neighbors have sent it identical updates, and filter them out from further propagation attempts. Of course, this may turn out to be a bad idea; if one of the nodes loses one connection, it might stop receiving updates altogether even though other servers could forward to it. I guess we can't protect against this case without at least some redundant messages still being generated. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Providing LDIF support at the LDAP level
by Rich Megginson 29 Jan '10

29 Jan '10

This patch provides low level LDIF support in libldif and high level support in libldap. http://rmeggins.fedorapeople.org/newldif.patch http://rmeggins.fedorapeople.org/ldifutil.c The libldap support is in the form of LDAP_F( int ) ldap_parse_ldif_record LDAP_P(( char *rbuf, int linenum, LDIFRecord *lr, const char *errstr, unsigned int flags, void *ctx )); Where rbuf and linenum come from ldif_read_record; lr is new (see below); errstr is the string prefix to print for error/debug messages (usually the program name e.g. "ldapmodify"), flags are one of these: #define LDIF_DEFAULT_ADD 0x01 /* if changetype missing, assume LDAP_ADD */ #define LDIF_ENTRIES_ONLY 0x02 /* ignore changetypes other than add */ #define LDIF_NO_CONTROLS 0x04 /* ignore control specifications */ and ctx is the memory context (for ber_*alloc_x) LDIFRecord returns all of the data from the LDIF record, regardless of what type of operation it is. The lr_op field is used to determine the type of operation, and the other fields return the operation specific data. There is also a section of several data fields used by the internal implementation (lifted almost verbatim from ldapmodify.c). This is cleaned up properly by ldap_ldif_record_done() If the LDIF record in rbuf contains no actual record (e.g. the version: field, comments only, etc.) then the return value of ldap_parse_ldif_record() will be 0, but the lr_op field will also be 0.

2 4

Source Code Visualization with Gource. | michaeldehaan.net
by Gavin Henry 20 Jan '10

20 Jan '10

Something we should do when we are on git! http://michaeldehaan.net/2010/01/15/source-code-visualization-with-gource/ -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 9

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel