openldap-software February 2007

openldap-software@openldap.org

94 participants
112 discussions

Schema Replication
by Mark Mcdonald 08 Feb '07

08 Feb '07

Hi list, I was wondering if there is any way to perform automatic schema delivery to an LDAP network. Basically we’ve started a project where the stakeholders wish to synchronise a new database with LDAP, and the plan is to do it in small steps as the need for each part of the database arises. This is mainly because the users can't define what they want in advance and the size of the database is too big to do in one hit. The schema is going to be defined bit by bit, and deployment of the schema across the country is a fairly big task (~30 slaves) requiring serious outages so what I’m after is a way to change the schema on-the-fly and have it replicate across the network, can OpenLDAP do this? Is this a reasonable request? Any better ideas? If not, what would the scale of this kind of task be? I’ve not touched OpenLDAP code before and I haven’t written any serious C for a few years but if it’s not a huge task I’d like to be able to contribute. Comments welcome. Thanks Mark McDonald iiNet Limited

2 1

OpenLDAP at SCALE
by Howard Chu 07 Feb '07

07 Feb '07

Just a brief note - I'll be giving a talk at the Southern California Linux Expo this weekend http://www.socallinuxexpo.com/scale5x/ The talk will cover some of what's new in OpenLDAP 2.4, present some more benchmark results, and some other related topics. (Yes, OpenLDAP 2.3 *was* the fastest LDAP server we've ever tested. 2.4 is even faster...) Come by and say Hi if you're in the area... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: OpenLDAP Backup Questions
by Howard Chu 07 Feb '07

07 Feb '07

Please keep replies on the list. Discussions that start on the public mailing list should stay on the list so that everyone can see their resolution. Rajarshi Chaudhuri wrote: > Thanks Howard. > > One question - if slapcat is backing up the data - and meanwhile some > writes are happening to ldap data (as slapd is running) - then what > would happen to the backup ldif file - it will get all the data until > some cut-off point - or even the current updates will also go into it? slapcat reads the database sequentially. If an entry that has already been dumped gets updated, then that update obviously won't appear in the dump. If an entry is updated before slapcat reaches it, then the updated entry will appear in the dump. > Can there be any inconsistency if there are two many writes going on > during the backup time? What kind of inconsistency? Writes to the DB are atomic, so it's impossible for slapcat to see an entry in an in-between state, no matter how many writes are occurring. The only possible inconsistency is as noted above - changes made to entries that were already read out won't be seen until the next time you do a backup. > > Regds, > Rajarshi Chaudhuri > Genesys Telecommunications Lab, Inc > rajarshi(a)genesyslab.com > > -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > Sent: Wednesday, February 07, 2007 3:42 PM > To: Rajarshi Chaudhuri > Cc: openldap-software(a)openldap.org > Subject: Re: OpenLDAP Backup Questions > > Rajarshi Chaudhuri wrote: >> Hi, >> >> >> I'm planning to make a daily backup of my openldap(2.3.19 used with > bdb >> backend). There are couple of questions that I have - >> >> 1. If I take a backup using slapcat while slapd is running - is there > a >> possibility of some data loss or other inconsistency? > > No. > >> 2. Is there some other effective backup mechanism / backup tool >> recommended other >> than slapcat. > > No. >> 3. If I can programmatically assure that no writes happen during my > backup >> phase - then does it matter whether slapd is running or not? > > No. >> 4. I'm going to do this in both Windows and Solaris environment - so > any >> suggestions like I should use something specific based on the OS? > > No. >> I would highly appreciate if my questions are effectively answered. >> >> >> >> Rajarshi Chaudhuri >> Genesys Telecommunications Lab, Inc >> rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com> -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

RE: OpenLDAP Backup Questions
by Quanah Gibson-Mount 07 Feb '07

07 Feb '07

--On Wednesday, February 07, 2007 3:50 PM -0800 Rajarshi Chaudhuri <rajarshi(a)genesyslab.com> wrote: > Hi Quanah - > > Sorry for re-posting. As you mentioned - Please keep replies on the list. > <<< You should address your questions to openldap-software(a)openldap.org > when > they have to do with using OpenLDAP. >>> > > So - I thought I need to post it there too for archival purpose. > > So - as per your suggestion I should be OK taking hot backups using > slapcat keeping slapd running. You also suggested to upgrade the version > - I see the new version is 2.3.33 - is it the recommended one or some > prior one should be better? See the page on <http://www.openldap.org> about the difference between "stable" and "current". You may also want to read over the change log of what was fixed between releases, which is distributed with each release, and also available from the website. > Further questions for you (forgive me - I'm new to this openldap stuff). > Is there a way to instruct slapd to do a recovery first each time it is > re-started? Also - is the graceful/gentle shutdown of slapd reliable? > Can you point me a location where there are good sample scripts > demonstrating these things - like backup/recovery etc. OpenLDAP 2.3 already performs recovery on startup, if it is necessary. There has been no evidence that graceful/gentle shutdown of slapd is unreliable. I personally turned it off because if you have persistent connections that never close, slapd will never shutdown. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

OpenLDAP Backup Questions
by Rajarshi Chaudhuri 07 Feb '07

07 Feb '07

Hi, I'm planning to make a daily backup of my openldap(2.3.19 used with bdb backend). There are couple of questions that I have - 1. If I take a backup using slapcat while slapd is running - is there a possibility of some data loss or other inconsistency? 2. Is there some other effective backup mechanism / backup tool recommended other than slapcat. 3. If I can programmatically assure that no writes happen during my backup phase - then does it matter whether slapd is running or not? 4. I'm going to do this in both Windows and Solaris environment - so any suggestions like I should use something specific based on the OS? I would highly appreciate if my questions are effectively answered. Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com>

3 2

Invalid DN
by Ian Moroney 07 Feb '07

07 Feb '07

Hi again all! Just another brick wall i've ran into... I am running the following command: ldapadd -x -h localhost -D cn=mailadmin,dc=global-drum,dc=com -W -f /srv/ox/share/init_ldap.ldif I then get: ldap_bind: Invalid DN syntax (34) additional info: invalid DN This error happens if i have UID=mailadmin,dc=global-drum,dc=com, cn=root.... cn=mailadmin or whatever. if necessary, i can post the contents of the init_ldap.ldif and my slapd.conf files. ldapsearch -h localhost -D "UID=mailadmin,dc=global-drum,dc=com" -x -W (after password enter) comes back with: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 and when i look at slapd -d -1, it is showing the following, amongst other things: ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 ber_get_next: tag 0x39 len 5 contents: ber_dump: buf=0x80268b80 ptr=0x80268b80 end=0x80268b85 len=5 0000: 02 01 03 42 00 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable ber_get_next on fd 16 failed errno=11 (Resource temporarily unavailable) The database is supposed to be empty, so maybe it should be reporting what it is reporting above. Thoughts? Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work

3 2

slapd segfault when using pcache
by Fabio Pedretti 07 Feb '07

07 Feb '07

Hi, I am trying to use slapd as a proxycache LDAP daemon for another LDAP server. (I was following the manual here: http://www.openldap.org/doc/admin23/proxycache.html but this refers to proxycache, which I think it is now replaced by pcache? Should the manual be updated?) This is my slapd.conf: include /usr/local/etc/openldap/schema/core.schema pidfile /var/ldap/slapd.pid argsfile /var/ldap/slapd.args database ldap suffix "o=example,c=COM" rootdn "uid=root,o=example,c=COM" uri "ldap://ldap1.example.com ldap://ldap2.example.com" overlay pcache proxycache ldbm 10000 1 1000 3600 directory /var/ldap/openldap-data cachesize 100 index objectClass eq index uid eq index uidNumber eq index gidNumber eq When I run slapd with -d 1 I get this: ... slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=include{0}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}ldap" config_build_entry: "olcOverlay={0}pcache" backend_startup_one: starting "o=example,c=COM" ldap_back_db_open: URI=ldap://ldap1.example.com ldap://ldap2.example.com backend_startup_one: starting "o=example,c=COM" ldbm_back_db_open: unclean shutdown detected; database may be inconsistent! slapd starting ../rc.d/rc.slapd: line 15: 22613 Segmentation fault $SLAPD -u $USER -h "$LDAPSOCKET" -d 1 If I add this to slapd.conf: proxyattrset 0 pager slapd no longer crashes, but does not start. I get this now: ... bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December 3, 2003) >>> dnPrettyNormal: <o=example,c=COM> <<< dnPrettyNormal: <o=example,c=COM>, <o=example,c=com> >>> dnPrettyNormal: <uid=root,o=example,c=COM> <<< dnPrettyNormal: <uid=root,o=example,c=COM>, <uid=root,o=example,c=com> ldap_url_parse_ext(ldap://ldap2.example.com) ldap_url_parse_ext(ldap://ldap1.example.com) slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Any ideas on what's wrong? Thanks in advance, Fabio

3 6

Re: syncrepl issues
by Wes Rogers 07 Feb '07

07 Feb '07

> Given that no problems show up in 2.3.27, and looking at the diffs between > 2.3.27 and 2.3.32, the only substantive difference is in syncprov_checkpoint > handling, due to ITS#4720. Looking over that patch, it's possible the chosen > fix was bad. > > Try turning off syncprov-checkpoint in your provider. If that makes a > difference, then the ITS#4720 patch is broken. So far, that hasn't made a difference. The two problem consumers still do the same thing. These particular consumers are in a different network, and are heavily firewalled. I brought up a test consumer on the same network as the provider, and it stays in sync 100%. So, I'll need to poke the network to see what I can find. Thank you both for the help so far. Wes

1 0

RE: logging
by Ian Moroney 07 Feb '07

07 Feb '07

Thanks for all the replies guys, looked at the output of slapd -d -1 and it showed that there was an invalid ACCESS statement in my slapd.conf Removed it, and it starts ok now. BTW, I don't appear to have any syslog.conf on the system, but syslog-ng is installed, so I put the LOCAL4.* statement into my syslog-ng.conf.in file, so hopefully that should work now. Thanks for all your replies! Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk TechDivision - Making IT Work -----Original Message----- From: openldap-software-bounces+ian.moroney=techdivision.co.uk(a)OpenLDAP.org [mailto:openldap-software-bounces+ian.moroney=techdivision.co.uk@OpenLDA P.org] On Behalf Of Gavin Henry Sent: 06 February 2007 22:51 To: Ian Moroney Cc: openldap-software(a)openldap.org Subject: Re: logging <quote who="Ian Moroney"> > Hi guys. How can i set up logging for openldap so i can find out why > the damn thing won't start? :P i've got the good old ldap_bind: can't > contact LDAP server (-1) problem... and i'd like to look at a log file > to see what is causing the problem I know how to set the loglevel to > 256 in the configuration file, but no idea what file to look at for > the output. > Help! :D > Add to your syslog.conf: LOCAL4.* -/var/log/openldap.log etc. and restart slapd and syslog See: http://www.openldap.org/faq/data/cache/80.html -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

ldapsearch error for SASL (DIGEST-MD5)
by Radhakrishnan Balasubramanian 06 Feb '07

06 Feb '07

Hi, When I do ldapsearch for digest-md5 from the linux computer to my Openldap server, I am getting the output like below: [tester@bf1r-oLinux-1 tester]$ ldapsearch -H ldap://192.168.0.18 -U pokemon -w pokemon123 SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: More results to return Is there anyway to get the proper output for ldapsearch using digest-md5 ? I do not have this issue when I do ldapsearch on the localhost. Please help. Thanks, Radhakrishnan ____________________________________________________________________________________ Looking for earth-friendly autos? Browse Top Cars by "Green Rating" at Yahoo! Autos' Green Center. http://autos.yahoo.com/green_center/

1 0

← Newer
1
...
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software February 2007