openldap-software January 2007

openldap-software@openldap.org

98 participants
123 discussions

Re: problem with sasl
by Tony Earnshaw 18 Jan '07

18 Jan '07

Rafal wrote: >> A thought (cos it happened to me years ago): you could be mixing SASL1 >> and SASL2 libraries. You don't state OS or vendor, but if it's Linux >> make sure you've included /usr/local/lib in /etc/ld.so.conf or one of >> the files in /etc/ld.so.conf.d (if you have it) and run ldconfig. > > my system is freebsd 5.x I don't know anything about freebsd, apart from that the latest release is supposed to be 6 - I never heard of 5. > I am create file ld.so.conf with /usr/local/lib and I am run ldconfig > > and slapd along crash after run ldapsearch -I and if I loged properly > asl_interactive_bind_s: Can't contact LDAP server (-1) > > > and slapd show this: > > ==>slap_sasl2dn: converting SASL name > uid=test,cn=example.com,cn=digest-md5,cn=auth to a DN > slap_authz_regexp: converting SASL name > uid=test,cn=example.com,cn=digest-md5,cn=auth > <==slap_sasl2dn: Converted SASL name to <nothing> Well, you haven't configured OpenLDAP SASL yet in slapd.conf (if you're doing it for the first time also known as "jumping through hoops"). > slapd in free(): error: chunk is already free > Abort (core dumped) No idea. I'd continue to gamble on bad libraries. > but if I put bad password (when I login to slapd - digestmd5) - slapd > along working.......... > > my installation dir for sasl2 is /usr/local/lib/sasl2 and with postfix > is working correctly Are you using Cyrus SASL for Postfix SASL, with auxprop? And does that have an LDAP backend? (Like ours does). I don't think so, since you'd then get the same result. I honestly can't comment further, since I know nothing abour FreeBSD 5; perhaps someone here does. --Tonni -- Tony Earnshaw Email: tonni at hetnet.nl

1 0

Re: Still need ftp://ftp.OpenLDAP.org/pub/tools/* ?
by Kurt D. Zeilenga 18 Jan '07

18 Jan '07

At 02:11 AM 1/18/2007, Gavin Henry wrote: >Is it still recommended to use automake and autoconf versions from: > >ftp://ftp.OpenLDAP.org/pub/tools/ These tools are intended to be used by developers. The automake and autoconf versions provided are use in developing build system changes in older (now historic) versions of OpenLDAP Software. -- Kurt

1 0

Sync questions
by Szeti, Balazs 18 Jan '07

18 Jan '07

Hi Everyone! I've got two questions related to LDAP sync. - The consumer LDAP automaticly becomes readonly, when "syncrepl" is set in it's config. Is it possible to have a consumer (slave) LDAP, which is not readonly? - It is possible to set the attributes, which must be syncronized, but using this options will delete all other attributes of the entry (on the consumer), that I didn't wanted to syncronize. I would like to syncronize a set of attributes, but I'd like to have all the other attributes of the entry unchanged. Is it possible? I was looking for answers in the archives, but I couldn't find clear solutions. Thanks in advance, Balazs Szeti

3 2

openldap queries to w2k3 active directory fails
by javier rojas 18 Jan '07

18 Jan '07

Hello list, i have searched and read a lot for the pass days about ldap and active directory, i'm trying to get them to work, but they dont seem to be very polite to each other.... ldapsearch -v d 1 -h w2k3server -p 389 -X "admin" i get a list of stuff and the bottom of it i get: ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL (-4): no mechanism avvailable what does the -6 and the -4 stands for?, what am i missing? -- Ciao, Javier linux counter #393724 GPG Key Fingerprint = 46B76CFEDB0161089D9ECB22FEFDE7EBA8C2007E

2 1

object classes that can contain other objects
by Brandon McCombs 18 Jan '07

18 Jan '07

Hello all, Is there a published list somewhere or something in the schema that will allow me to determine all object classes that are or are not able to contain other objects? For example, inetorgpersons, printers, and ntusers are "leaf" nodes and therefore can never have anything below them (as far as I know; maybe some specialized objects like policies may be allowed to be under them). Any pointers to information? thanks Brandon

3 4

syncrepl with aliased objects
by Dieter Klünter 18 Jan '07

18 Jan '07

Hi, I'm trying to set up a backup server as syncrepl consumer and face some strange replication behaviour with aliased objects. Consumer and provider are openldap-2.4.2alpha, consumer is in refreshAndPersist mode. When creating a user object and an aliased object on the provider, only the user object is being replicated, but not the aliased object. only if if the consumer is restarted, the aliased object is being replicated. Following is a consumer log after a restart, the user object cn=Joe Smith is found, and now the aliased object cn=Smith Joe is added. How can this be solved? -Dieter .-.--.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- Jan 18 11:14:51 magenta slapd[21564]: slapd starting Jan 18 11:14:51 magenta slapd[20149]: <= bdb_equality_candidates: (entryCSN) index_param failed (18) Jan 18 11:14:51 magenta slapd[20149]: <= bdb_inequality_candidates: (entryCSN) index_param failed (18) Jan 18 11:14:51 magenta slapd[20149]: <= bdb_inequality_candidates: (entryCSN) index_param failed (18) Jan 18 11:14:51 magenta slapd[20149]: Entry cn=Joe Smith,ou=organisation 1,dc=my-domain,dc=com CSN 20070118100247Z#000000#00#000000 mat ches ctx 20070118100247Z#000000#00#000000 Jan 18 11:14:51 magenta slapd[21564]: do_syncrep2: LDAP_RES_INTERMEDIATE - SYNC_ID_SET Jan 18 11:14:51 magenta slapd[21564]: syncrepl_entry: LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jan 18 11:14:51 magenta slapd[21564]: syncrepl_entry: inserted UUID 345a79f6-3b27-102b-976c-7ffb80c3fc40 Jan 18 11:14:51 magenta slapd[21564]: <= bdb_equality_candidates: (entryUUID) index_param failed (18) Jan 18 11:14:51 magenta slapd[21564]: syncrepl_entry: be_search (0) Jan 18 11:14:51 magenta slapd[21564]: syncrepl_entry: cn=Smith Joe,ou=organisation 2,dc=my-domain,dc=com Jan 18 11:14:51 magenta slapd[21564]: syncrepl_entry: be_add (0) Jan 18 11:14:51 magenta slapd[21564]: do_syncrep2: LDAP_RES_INTERMEDIATE - REFRESH_PRESENT -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

2 1

Syncrepl refreshOnly replication failures
by Jed Donnelley 18 Jan '07

18 Jan '07

Openldap, We recently upgraded our openldap master from 2.2.30 to 2.3.30. Most of our replicas (we have some 5 production and 3 or 4 test replicas) are still 2.2.x versions of openldap. We did testing of the syncrepl refreshOnly replication across these versions before the upgrade and the replication seemed to work fine. After the upgrade to our production master we had problems with bdb lock exhaustion - as I've noticed others have run into. With the new master this problem manifested itself in the master seeming to "loop" consuming CPU while trying to support replication. However, it was still able to support direct reads and writes - unlike the 2.2.x master that just hung in that circumstance. I'm not sure such resiliency in the face of its replication failures was a good thing. Regardless, we increased the number of available bdb locks, did a bdb recovery, and the restarted master has been stable since. However, after that time we noticed that some of the replicas had parts of their directories that weren't being replicated from the master. In an effort to deal with this problem we reinitialized our replicas (zeroed out their DBs and re initialized from the master). So far so good after that point. My question to this list is, does anybody know if this re initialization will suffice? That is, do we (for example): 1. Also need to reinitialize our master (e.g. rebuild it from an ldif or from another replica). 2. Also need to upgrade the software versions for all our replicas (e.g. to 2.3.x). 3. ? Is there something else we need to do to insure that our replicas will be faithful to our new master. #1 and #2 above impose a significant costs in our environment - different organizational entities with independently administered openldap servers. #1 requires a restart of all the replicas. #2 of course has the much more significant cost of upgrading all the replicas. #3? Any thoughts appreciated. Our understanding of the progressing syncrepl implementations isn't sufficient to allow us to distinguish between the above. --Jed http://www.nersc.gov/~jed/

2 1

Still need ftp://ftp.OpenLDAP.org/pub/tools/* ?
by Gavin Henry 18 Jan '07

18 Jan '07

Hi All, Is it still recommended to use automake and autoconf versions from: ftp://ftp.OpenLDAP.org/pub/tools/ Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

problem with sasl
by sorry but email administrator always block 17 Jan '07

17 Jan '07

Why my slapd crash when I have login with SASL i am confiure line for slapd is: ./configure --with-cyrus-sasl --enable-sql --enable-hdb=no --enable-bdb=no CPPFLAGS="-I/usr/local/include -I/usr/local/unixODBC/include" LDFLAGS="-L/usr/local/lib -L/usr/local/unixODBC/lib" slapd work normal if I have loggin to it - if I write bad password - slapd normal working but if i write good login to slapd (correct login and pass) slapd is crash (always if I write correct my login and password ( ldapsearch -I ), please help me - how configure slapd with sasl....... but my slapd (last version) dont work with sasl :/ slapd -d 1: ........ >> slap_listener(ldap:///)connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 62 contents: ber_get_next ber_get_next on fd 8 failed errno=35 (Resource temporarily unavailable) do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: ==>select_backend: START ==>select_backend: dn: => send_search_entry: conn 0 dn="" ber_flush: 62 bytes to sd 8 <= send_search_entry: conn 0 exit. send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=101 err=0 ber_flush: 14 bytes to sd 8 connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 24 contents: ber_get_next ber_get_next on fd 8 failed errno=35 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (}}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech DIGEST-MD5 SASL [conn=0] Debug: DIGEST-MD5 server step 1 send_ldap_sasl: err=14 len=184 send_ldap_response: msgid=2 tag=97 err=14 ber_flush: 203 bytes to sd 8 <== slap_sasl_bind: rc=14 connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 323 contents: ber_get_next ber_get_next on fd 8 failed errno=35 (Resource temporarily unavailable) do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt (}}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_sasl_bind: dn () mech DIGEST-MD5 SASL [conn=0] Debug: DIGEST-MD5 server step 2 slap_sasl_getdn: u:id converted to uid=test,cn=example.com,cn=DIGEST-MD5,cn=auth >>> dnNormalize: <uid=test,cn=example.com,cn=DIGEST-MD5,cn=auth> <<< dnNormalize: <uid=test,cn=example.com,cn=digest-md5,cn=auth> ==>slap_sasl2dn: converting SASL name uid=test,cn=example.com,cn=digest-md5,cn=auth to a DN slap_authz_regexp: converting SASL name uid=test,cn=example.com,cn=digest-md5,cn=auth <==slap_sasl2dn: Converted SASL name to <nothing> slapd in free(): error: chunk is already free Abort (core dumped) .... slad.conf file cat slapd.conf # $OpenLDAP: pkg/ldap/servers/slapd/back-sql/rdbms_depend/mysql/slapd.conf,v 1.5.2.1 2005/01/20 18:04:03 kurt Exp $ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. access to * by * write # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 authz-police all sasl-host example.com sasl-realm example.com #require SASL authz-regexp uid=([^,]*),dc=example,dc=com uid=test,dc=example,dc=com #sasl-secprops none #authzTo: uid=[^,]*,dc=example,dc=com ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" #rootdn "cn=test,dc=example,dc=com" #rootpw secret dbname ldap dbuser ldap dbpasswd ldap123zxc subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no #access to attrs=userPassword # by * auth #access to * by * none

2 1

RE: HDB Tuning
by Mark Mcdonald 17 Jan '07

17 Jan '07

> -----Original Message----- > From: Buchan Milne [mailto:bgmilne@staff.telkomsa.net] > Sent: Thursday, January 18, 2007 12:17 AM > > Is there any reason you didn't include BDB as well ? We have a reasonably high write component in our system so we thought we'd go straight for HDB. From my fairly limited reading, I get the impression that HDB >= BDB, although I've seen nothing criticising HDB comparative to BDB. Is it something we should also consider? For what reasons? > How many entries in the database, or how large is it (du *.bdb) ? 1.3GB, 800k entries in one database. No glue or other overlays. > I think you need (more?) idlcache, configured in slapd.conf inside the > database. And, if you don't have any, you also need a cachesize configured > (in the same place). See the man page for slapd-hdb (or slapd-bdb). IIRC > the > guideline for idlcache on hdb is approx three times the cachesize (which > you > will have to decide on). Bingo! Adding the idlcachesize made a world of difference, thanks! I didn't check that man page so never realised the index caching config directive had changed. I've followed the 3x rule and it's super-speedy now. Thanks Buchan

2 1

← Newer
1
...
5
6
7
8
9
10
11
12
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software January 2007