openldap-software December 2007

openldap-software@openldap.org

75 participants
90 discussions

very slow queries sometimes with alias deref always and scope sub
by COMBES Julien - CETE Lyon/DI/ET/PAMELA 21 Dec '07

21 Dec '07

Hello, I have a strange problem on all of my openldap servers (master and slaves). In general, requests with alias always dereferenced and scope sub on an attribute indexed are working correctly and answers come in a few milliseconds. But sometimes , during some hours, on all my openldap servers, the same queries are taking a few seconds to be returned (between 10 to 45s). During this time all queries with alias never dereferenced are working correctly. For the openldap master, which is only used to write entries and for slurpd replication, the load average is between 0.2 and 0.5 during the problem. For others servers that have more requests, the load average is growing up. I don't find the reasons which cause the problem. All is coming back to normal performance after the night. I use debian etch openldap package wich provide openldap 2.3.30. My directory has around 150000 entries. I use bdb database. I have somes tuning on DB_CONFIG that I could give, if you think that it could have an interest. For exemple : -> During problem : - with alias deref *never* $ time ldapsearch -x -LLL -H ldap://master.my.domain -b "dc=my,dc=domain" -s sub -a never uid=jean.talus.i <ldap answer> real 0m0.007s user 0m0.004s sys 0m0.000s - with alias deref *always* $ time ldapsearch -x -LLL -H ldap://master.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i <ldap answer> real 0m47.225s user 0m0.004s sys 0m0.000s $ time ldapsearch -x -LLL -H ldap://slave1.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i Time limit exceeded (3) real 0m16.148s user 0m0.000s sys 0m0.004s and so on on all my openldap slaves servers. -> after the night, when it's working correctly again : $ time ldapsearch -x -LLL -H ldap://master.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i <ldap answer> real 0m0.016s user 0m0.000s sys 0m0.004s $ time ldapsearch -x -LLL -H ldap://slave1.my.domain -b "dc=my,dc=domain" -s sub -a always uid=jean.talus.i <ldap answer> real 0m0.020s user 0m0.000s sys 0m0.004s I don't find anything that help me on internet. Do you know how can I correct this or what can it be the cause ? Is there some docs that could help me to tune my openldap servers to correct this ? Regards, Julien

3 3

Problems when following referrals with ldapsearch
by Antonio Alonso 21 Dec '07

21 Dec '07

Hi ! I have configured an slapd/back-meta (slapd_1) which redirects all LDAP messages to an slapd/back-bdb instance (slapd_2). This last slapd instance manages also some other referrals to other slapd/back-bdb instance (slapd_3) I have configured back-meta to follow the referrals. When sending an LDAPsearch to slapd_1 with a base that I have configured as a referral in slapd_2 (the acual data is stored in slapd_3) I see the "Referral (10)" result code in slapd_1 (I am tracing it) but the back-meta is NOT following that referral. I tried directly sending the LDAPsearch to slapd_2 using through the ldapsearch commnand (setting the ldap.conf option REFERRAL parameter to "yes") but I see exactely the same (the "10" resul code, the right "ref" parameter -pointing to the right entry in slapd_3) but the command is NOT following the referral. I tested it with the java LDAPBrowser tool (setting the "follow referrals" option) and it works properly (so now I am sure it is not a problem in the data stored in the backends involved). Do you know what I am missing? I do not know if I forgot some "configuration" option when compiling/creating the openldap libclient library (when installing openLDAP 2.4) as it is used in both ldapsearch and back-meta (so I am starting to think the problem is in that "common" component) ... NOTE: I have tried with referrals followng the "ldap://127.0.0.1: ...." and "ldap://localhost:..." patterns (as all slapd instances are running in the same machine) but I got the same error .... Thanks in advance Best regards / Antonio > Antonio Alonso Alarcón CUDB System Engineer > Ericsson España, S.A. Phone: +34 91339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) 28033 Madrid, Spain Fax: +34 91339 1636 E-mail: Antonio.Alonso(a)ericsson.com

1 0

ldap.conf between /etc/openldap or /etc/openldap2.3?
by R.B. 21 Dec '07

21 Dec '07

Hi; I've finally completed my server setup and now I'm focusing on the client configurations (with TLS). I'm using the Buchan RPMs (openldap 2.3.39) for RHEL4 and it creates an /etc/openldap2.3 directory. I also have the base openldap (2.2.x) rpms installed (originally) and it creates the base /etc/openldap directory. After doing an strace, I see that /etc/openldap/ldap.conf is used.... but I want use /etc/openldap2.3/ldap.conf file, how do I switch my ldap client to look here? Thanks, Rafael

5 5

Re: Overlay chain formatting
by Chris Sellers 20 Dec '07

20 Dec '07

I agree. The man pages offer content that is not in the admin guide and are generally well written. Use the man pages if the admin guide leaves you wondering ----- Original Message ----- From: openldap-software-bounces+chris.sellers=nitle.org(a)OpenLDAP.org <openldap-software-bounces+chris.sellers=nitle.org(a)OpenLDAP.org> To: Justin Lambert <jlambert(a)ften.com> Cc: openldap-software(a)openldap.org <openldap-software(a)openldap.org> Sent: Thu Dec 20 19:10:55 2007 Subject: Re: Overlay chain formatting Justin Lambert wrote: > I have spent the last week off and on trying to figure out why my chain > overlay was not working correctly. I tried all combinations of it that I > could find and finally found out that the parser of the slapd.conf file > is picky about spacing. I was trying to make my config file look nice by > indenting the options under "overlay chain" only to find after many > frustrating hours that you cannot do that! I didn't find anywhere that > that was explicitly documented (even though all of the examples were not > formatted that way). Apparently you haven't read the slapd.conf(5) manpage: If a line begins with white space, it is considered a continuation of the previous line. No physical line should be over 2000 bytes long. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

slapcat messages in 2.4
by Michael Ströder 20 Dec '07

20 Dec '07

HI! Can anybody shed some light on what these messages actually mean: back-bdb/back-hdb monitor: "olmBDBAttributes" previously defined "1.3.6.1.4.1.4203.666.1.55.0.1.1" back-bdb/back-hdb monitor: "olmBDBObjectClasses" previously defined "1.3.6.1.4.1.4203.666.3.16.0.1.1" Ciao, Michael.

3 4

Test047 fails if "rwm" not configured
by Dave Horsfall 19 Dec '07

19 Dec '07

Just been playing with 2.4.7, and test047 was failing. It seems that it assumes that "rwm" is present; should I file an ITS? -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

2 2

Client timeout dumps core
by Dave Horsfall 19 Dec '07

19 Dec '07

2.4.7 on FreeBSD 4.10-STABLE On setting the general client timeout with LDAP_OPT_TIMEOUT and performing a search on a simulated hung server ("nc -l 389"), I get a coredump: assertion "r != NULL" failed: file "error.c", line 272 GDB: (gdb) bt #0 0x28136748 in kill () from /usr/lib/libc.so.4 #1 0x2817803e in abort () from /usr/lib/libc.so.4 #2 0x28154033 in __assert () from /usr/lib/libc.so.4 #3 0x280bf519 in ldap_parse_result (ld=0x8050000, r=0x0, errcodep=0xbfbfdb2c, matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0) at error.c:272 #4 0x280bf455 in ldap_result2error (ld=0x8050000, r=0x0, freeit=0) at error.c:222 #5 0x280c016d in ldap_search_s (ld=0x8050000, base=0x0, scope=2, filter=0xbfbff450 "(uid=daveh)", attrs=0xbfbfdbd8, attrsonly=0, res=0xbfbfdbe0) at search.c:392 #6 0x8049e9b in main (argc=0, argv=0xbfbff8b8) at lget.c:662 Known problem? Should I file an ITS? -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

2 4

Re: OpenLDAP 2.4.7 available
by Howard Chu 19 Dec '07

19 Dec '07

OpenLDAP Project wrote: > OpenLDAP 2.4.7 is now available for download as detailed on our > download page: > http://www.openldap.org/software/download/ > > and should soon be available on all official mirrors: > ftp://ftp.openldap.org/pub/OpenLDAP/MIRRORS > > This is a maintenance release and is made available for general use. > Users of OpenLDAP Software are encouraged to upgrade. > > Significant contributors to this release include: > Howard Chu (Symas Corp) > Quanah Gibson-Mount (Yahoo! Inc) > Ralf Haferkamp (SUSE Linux) > Gavin Henry (Suretec Systems) > Pierangelo Masarati (Sys-Net) > > OpenLDAP 2.4.7 Release (2007/12/14) > Added slapd ordered indexing of integer attributes (ITS#5239) Note that the above caused an incompatible format change in the back-bdb/hdb index databases. If you've used any presence indexing or equality indexing of integer attributes, you'll need to run slapindex to get the new format. slapindex -q -t should do the trick. Obviously there've been a lot of other changes. There are still one or two new features in CVS that will show up in the next 2.4 release. But in the meantime, this release is generally more usable than 2.3. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 5

RE: ldapsearch in openldap problem
by Srilakshmanan, Kumuthiny 19 Dec '07

19 Dec '07

Try this, ldapsearch -h <servername> -p <PortNumber> -x -D cn=Manager,dc=nits,dc=ac,dc=in -W -b dc=nits,dc=ac,dc=in '(uid=jmaan*)' -----Original Message----- From: openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au(a)OpenLDAP.or g [mailto:openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au@Ope nLDAP.org] On Behalf Of Jyotishmaan Ray Sent: Thursday, 20 December 2007 3:31 AM To: openldap-software(a)openldap.org Subject: ldapsearch in openldap problem Plz see below the output of ldapsearch using -x and -D options:- Please find enclosed the slapd.conf and /etc/ldap.conf files herewith in text format. Please let me know why i am getting these errors. Had been trying since a few months for successful authentication. studied gssapi,sasl, etc types of authentication mechanisms. It seems no ways other than this list for deep insights into ldapsearch and then sucessful authentication!! 1) [root@authdns openldap]# ldapsearch -D 'dc=nits,dc=ac,dc=in' '(uid=jmaan*)' SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database [root@authdns openldap]# 2) When ldapsearch is used with -x -b the output is shown as below:- [root@authdns openldap]# ldapsearch -x -b 'dc=nits,dc=ac,dc=in' '(uid=jmaan*)' # extended LDIF # # LDAPv3 # base <dc=nits,dc=ac,dc=in> with scope subtree # filter: (uid=jmaan*) # requesting: ALL # # jmaan, non-teach, compcen, <http://nits.ac.in/> nits.ac.in dn: uid=jmaan,stornt=non-teach,bn=compcen,dc=nits,dc=ac,dc=in uid: jmaan cn: jmaan objectClass: account objectClass: posixAccount loginShell: /bin/bash uidNumber: 623 gidNumber: 623 homeDirectory: /home/jmaan # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 In the below output, i have tried using the "Manager"'s password as well as "uid"'s password to lon on to the server, but in both the cases, the authentication could not be successful:- [root@authdns ~]# ldapsearch -b 'dc=nits,dc=ac,dc=in' '(uid=jmaan*)' SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database [root@authdns ~]# The output of ldapwhoami command is as shown below with -x and -D options:- [root@authdns openldap]# ldapwhoami -D "cn=Manager,dc=nits,dc=ac,dc=in " -W Enter LDAP Password: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database [root@authdns openldap]# ldapwhoami -x -D "cn=Manager,dc=nits,dc=ac,dc=in " -W Enter LDAP Password: dn:cn=Manager,dc=nits,dc=ac,dc=in Result: Success (0) [root@authdns openldap]# [root@authdns openldap]# ldapwhoami -x "cn=Manager,dc=nits,dc=ac,dc=in " anonymous Result: Success (0) [root@authdns openldap]# Is it necessary to create a userid and a password in the sasldb using saslpasswd2 :- Though i created a saslpasswd2 for the user "jmaan" for performing the ldapsearch, without using -x, it is yet not successful. Please give me hints why it is as such unsuccessful and shown above, without std output from the console. One more thind my ldap server is on Linux fedora o.s. Thanking you in anticipation, Jyotishmaan With Thanks and Regards, Jyotishmaan Ray Moderator Of Paradise Groups http://yahoogroups.com/group/Spirituality-Paradise <http://yahoogroups.com/group/Spirituality-Paradise> Are You Spiritually Aware !!! Are You Enjoying Yourself !!! See What All You Had Been Missing !!!! Please Join Immediately By Sending A Blank Mail @ Spirituality-Paradise-subscribe(a)yahoogroups.com <mailto:Spirituality-Paradise-subscribe@yahoogroups.com> _____ Looking for last minute shopping deals? Find <http://us.rd.yahoo.com/evt=51734/*http://tools.search.yahoo.com/newsearch/c ategory.php?category=shopping> them fast with Yahoo! Search. Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

1 0

Re: [Fwd: Can't compile OpenLDAP with Berkekey DB: File format not recognized]
by Gavin Henry 19 Dec '07

19 Dec '07

<quote who="Howard Chu"> >> ---------------------------- Original Message >> ---------------------------- >> Subject: Can't compile OpenLDAP with Berkekey DB: File format not >> recognized >> From: ben(a)fallinganvils.com >> Date: Wed, November 28, 2007 10:41 pm >> To: openldap-bugs(a)openldap.org >> -------------------------------------------------------------------------- >> >> This is my first openldap install. > > Pay attention to details. > >> This is what I do : >> >> 1) Install Berkeley DB 4.6.21 in /home/ben/opt/bdb >> >> $ cd db-4.6.21/build_unix >> $ ../dist/configure --prefix=/home/ben/opt/bdb >> $ make && make install >> $ export LD_RUN_PATH=/home/ben/opt/bdb/lib >> $ export CPPFLAGS='-I /home/ben/opt/bdb/include' >> $ export LDFLAGS='-L /home/ben/opt/bdb/lib' > > There must not be any spaces between "-L" or "-I" and the path. > Nice catch.

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software December 2007