openldap-software May 2007

openldap-software@openldap.org

85 participants
123 discussions

How to search from inside an overlay (newbie)
by José Marco 07 May '07

07 May '07

Hi everybody. I managed to keep developing til now but I'm desperate today... I guess this is easy stuff for people with some experience in OpenLDAP: I just need to perform a search. I am inside an overlay's response and I need to search for some entries. The question is: - How do I set the SlapReply rs? - I guess I need to create an Operation. How do I do that? - I have to call some search function. I found some searching functions taking an Operation* and a SlapReply* as parameters (like do_search and others) but I don't know which is the one I need. If you could just drop an example (I guess that it is some 5 lines). I just have to perform a search with a filter I know (and have constructed as a string). Should be something like: char *filter = "objectClass=Aclass"; // SlapReply *rs initialization // Operation *op initialization // Perform search( op, rs ) .... Maybe I'm far from the solution... I would be very pleased if you could help me with this, I'm just going mad jumping from one place in the code to another... If this message should be sent to another mailing list, just tell me and I'll resend it correctly. Thanks!

2 1

Unrecognized database type (ldap)
by Raffaele Viola 07 May '07

07 May '07

Hi all, I want to create a ldap type batabase in my ldap server as explained in the man SLAPD-LDAP(5). database ldap ( man: This backend acts as a proxy to forward incoming requests to another LDAP server.) suffix "dc=RAFFO,dc=IT" uri "ldap://151.98.181.93/dc=RAFFO,dc=IT " rootdn ""cn=Manager,dc=RAFFO,dc=IT" rootpw secret binddn "cn=Manager,dc=RAFFO,dc=IT" bindpw secret lastmod off but it doesn't work because I get this error: Unrecognized database type (ldap) Can you help me thanks Raffo

4 4

SambaXP talk
by Howard Chu 05 May '07

05 May '07

For anyone curious, the slides from my presentation at the SambaXP conference last week are now up on my web site. http://highlandsun.com/hyc/SambaXP.pdf Much of the material on malloc benchmarking was already presented at SCALE5x earlier this year. New material in these slides include benchmark results for OpenLDAP 2.3.34 vs FedoraDS 1.0.4, OpenDS 0.1-34, and ApacheDS 1.0.1 on Linux 2.6. The machine used for these tests is the same SunFire X4100 used in these tests last year http://www.symas.com/benchmark-auth.shtml Some earlier discussion of these results is also on the Connexitor blog: http://www.connexitor.com/blog/pivot/entry.php?id=130 http://www.connexitor.com/blog/pivot/entry.php?id=131 We didn't test Microsoft ActiveDirectory because we don't have a 64 bit build of it available, nor do we have a 64 bit Windows system available. I suppose we can run those tests and publish those results sometime down the road. If anybody is interested in helping to run more tests along these lines, feel free to contact me. (Judging from the information available here http://www.microsoft.com/downloads/details.aspx?FamilyID=52e7c3bd-570a-475c… I don't think there'd be any different news on that front anyway.) This round of benchmarking was quite educational. We discovered a memory leak in FedoraDS (and reported that to their maintainers, of course). Analyzing the results also shows that while FDS' entry cache is reasonably effective, they have a performance bottleneck in their frontend, most likely in connection management. I didn't profile it to get a closer look, though I'm sure a profiler would make the culprit obvious. Also FDS is too memory hungry, which causes their server to run out of memory much sooner than OpenLDAP (running on the identical machine, with identical cache memory settings, indices, workload, etc...) so their performance drops off quite sharply as database sizes increase and memory becomes constrained. (This is something different from the malloc degradation I was observing in OpenLDAP before, although FDS appears to be affected by that as well.) We also observed that Sun/Fedora's documentation and advice on performance tuning for their servers is wrong, and we can obtain better performance by ignoring their recommendations. Even though Sun, Fedora, and OpenLDAP all use BerkeleyDB, it's obvious that they don't use it as effectively as we do. Given the extremely young age of the OpenDS code base I'd say they've done a really good job thus far, even managing to beat FDS in one test. But I'd also say they've gotten as good as they can possibly get with a pure Java solution; indeed their future plans for entry caching require support outside the JVM (e.g. using a tmpfs cache). Since they're still at best 3x slower than OpenLDAP, it's unlikely they will ever achieve their stated goal of delivering high performance with a Java code base. OpenLDAP has taken a lot of flack over the years for being slow or old technology. Most of that was well-deserved up to about mid-2000, but it hasn't been true since. OpenLDAP is the fastest, most scalable, most reliable directory software in the world. That's not marketing hype; we can prove every point. AMD and Intel make a big deal about piddly 20% differences between their products. We are over 300% faster than the next closest offering. Other projects and vendors talk about how superior they are (or hope to be) but it's pretty clear that they're not in the ballpark. They're not even in the same league. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

syntax of attribute value
by Dieter Kluenter 04 May '07

04 May '07

Hi, I am testing with HEAD, when requesting with a search filter which contains an objectclass with mixed characters, that is lower and upper cases, I get fowllowing error. ldapsearch -x -LLL -H ldap://localhost:9004 -b o=avci,c=de -s sub "(objectclass=dNSZone)" Additional information: value does not conform to assertion syntax Strange enough, this occurs not with inetOrgPerson, but with all other objectclass types with NAME of mixed characters. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

Schema in Openldap 2.3.X
by Eugenia Candida Oliveira de Moura 04 May '07

04 May '07

Hi, I installed Openldap-2.3.29. Schema now is modified in runtime, I wanted to confirm a doubt with regard to schema in openldap 2.3.X. The object schema is below of cn=config, this is an object in the configuration tree and its declared attributes are attributeTypes and objectClasses, certain? For example, to add to an attribute in the schema object means to add one olcattributeType in cn=schema,cn=config. I am reasoning correctly? cn=schema,cn=config olcattributeTypes: ( 2.5.18.1 NAME 'createTimestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) Thanks.

1 0

Problem configuring OpenLDAP with Oracle
by Néstor Boscán 03 May '07

03 May '07

Hi I configured OpenLDAP with Oracle and I created the necessary metadata information. When I load the DN entries for my DN suffix (dc=tcs,dc=com,dc=ve) everything works fine and the institution and ldap_entries tables are filled. When I try to add a user I get ldap_add: No such object (32) So I check the log file and I see the following info: ==>backsql_dn2id(): dn="cn=manager,dc=tcs,dc=com,dc=ve" (no ID) id_query "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE dn_ru=?" ==>backsql_dn2id(): upperdn="EV=CD,MOC=CD,SCT=CD,REGANAM=NC" <==backsql_dn2id(): no match ==>backsql_dn2id(): dn="dc=tcs,dc=com,dc=ve" id_query "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE dn_ru=?" ==>backsql_dn2id(): upperdn="EV=CD,MOC=CD,SCT=CD" <==backsql_dn2id(): no match backsql_add("cn=manager,dc=tcs,dc=com,dc=ve"): could not lookup parent entry for new record "dc=tcs,dc=com,dc=ve" backsql_add: entry at root denied ==>backsql_dn2id(): dn="dc=com,dc=ve" (no ID) id_query "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE dn_ru=?" ==>backsql_dn2id(): upperdn="EV=CD,MOC=CD" <==backsql_dn2id(): no match ==>backsql_dn2id(): dn="dc=ve" (no ID) id_query "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE dn_ru=?" ==>backsql_dn2id(): upperdn="EV=CD" <==backsql_dn2id(): no match ==>backsql_dn2id(): dn="" (no ID) id_query "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE dn_ru=?" ==>backsql_dn2id(): upperdn="" <==backsql_dn2id(): no match The query is trying to look the DN in the dn_ru column, but my insert query is insentry_query "INSERT INTO ldap_entries (id,dn,oc_map_id,parent,keyval) VALUES (ldap_entry_ids.nextval,UPPER(?),?,?,?)" So it's never filled. I check other slapd.conf configurations and they add the following lines: id_query "SELECT id,keyval,oc_map_id FROM ldap_entries WHERE dn=UPPER(?)" But my OpenLDAP windows version 2.2.29 doesn't understand de id_query setting. Any ideas?

1 0

Globally Disable Referrals
by Brian Foddy 02 May '07

02 May '07

Is there a way to configure OpenLdap client software to globally disable referrals? Is there any side effect to doing so? I'm being bitten by an Operations Error when querying an AD server and its been traced down to the default behavior of automatically tracing down referrals in an anonymous fashion. I'd like to limit having to alter numerous other ldap aware applications that are all using ldap_search_ext_s. I could probably alter the ldap_initialize function source (or some other location) to automatically perform a ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF) but I'd rather not if I don't need to. I've tried a --disable-referrals in the configure command, but it didn't seem to affect my results. Brian

2 1

Slapd crashing again, three different reasons?
by Daniel Henninger 02 May '07

02 May '07

Hi folk, First off, let me say that per our last conversation about this, I have not yet rebuild cyrus-sasl/openldap against a different Kerberos dist. (I was going to build against 1.5.. right now I'm at 1.2.8.. we tend to steer clear of Heimdal) Anyway, on April 28th, at 12:05AM, all three of our slave servers' slapds died. All for apparently different reasons: First slave: #0 0xfed592f0 in __sigprocmask () from /usr/lib/libthread.so.1 #1 0xfed4e59c in _resetsig () from /usr/lib/libthread.so.1 #2 0xfed4dd3c in _sigon () from /usr/lib/libthread.so.1 #3 0xfed50d98 in _thrp_kill () from /usr/lib/libthread.so.1 #4 0xfedcbdc4 in raise () from /usr/lib/libc.so.1 #5 0xfedb5a5c in abort () from /usr/lib/libc.so.1 #6 0xfedb5d00 in _assert () from /usr/lib/libc.so.1 #7 0xff3188b8 in ber_sockbuf_ctrl (sb=0x18d53b38, opt=1, arg=0xd7c00e6c) at sockbuf.c:89 #8 0x0003071c in connection_get (s=111) at connection.c:312 #9 0x00032ef8 in connection_read (s=111) at connection.c:1307 #10 0x0002f84c in slapd_daemon_task (ptr=0x14d218) at daemon.c:2353 #11 0xfed5b124 in _thread_start () from /usr/lib/libthread.so.1 #12 0xfed5b124 in _thread_start () from /usr/lib/libthread.so.1 Backtrace stopped: previous frame identical to this frame (corrupt stack?) Second slave: #0 0xfee12d38 in fseek () from /usr/lib/libc.so.1 #1 0xfe343680 in krb5_ktfileint_internal_read_entry () from /local/kerberos/lib/libkrb5.so.3 #2 0xfe343ec8 in krb5_ktfileint_read_entry () from /local/kerberos/lib/libkrb5.so.3 #3 0xfe342660 in krb5_ktfile_get_entry () from /local/kerberos/lib/libkrb5.so.3 #4 0xfe35bc44 in krb5_rd_req_decrypt_tkt_part () from /local/kerberos/lib/libkrb5.so.3 #5 0xfe35bdcc in krb5_rd_req_decoded_opt () from /local/kerberos/lib/libkrb5.so.3 #6 0xfe35c594 in krb5_rd_req_decoded () from /local/kerberos/lib/ libkrb5.so.3 #7 0xfe35bb10 in krb5_rd_req () from /local/kerberos/lib/libkrb5.so.3 #8 0xfecd81ec in krb5_gss_accept_sec_context () from /local/kerberos/lib/libgssapi_krb5.so.2 #9 0xfece12c4 in gss_accept_sec_context () from /local/kerberos/lib/libgssapi_krb5.so.2 #10 0xfed02410 in gssapi_server_mech_step () from /local/lib/sasl2/libgssapiv2.so.2 #11 0xff1d95c0 in sasl_server_step () from /local/lib/libsasl2.so.2 #12 0xff1d92b4 in sasl_server_start () from /local/lib/libsasl2.so.2 #13 0x00074998 in slap_sasl_bind (op=0x516fe80, rs=0xd4c01af0) at sasl.c:1393 #14 0x0004c4d4 in fe_op_bind (op=0x516fe80, rs=0xd4c01af0) at bind.c:276 ---Type <return> to continue, or q <return> to quit--- #15 0x0004bddc in do_bind (op=0x516fe80, rs=0xd4c01af0) at bind.c:200 #16 0x00032afc in connection_operation (ctx=0x170948, arg_v=0x516fe80) at connection.c:1132 #17 0xff33cbb4 in ldap_int_thread_pool_wrapper (xpool=0x181b08) at tpool.c:478 #18 0xfed5b124 in _thread_start () from /usr/lib/libthread.so.1 #19 0xfed5b124 in _thread_start () from /usr/lib/libthread.so.1 Backtrace stopped: previous frame identical to this frame (corrupt stack?) Third slave: #0 0xfedc1fe0 in _malloc_unlocked () from /usr/lib/libc.so.1 #1 0xfedc1db0 in malloc () from /usr/lib/libc.so.1 #2 0xff039c48 in default_malloc_ex () from /local/lib/libcrypto.so. 0.9.7 #3 0xff03a638 in CRYPTO_malloc () from /local/lib/libcrypto.so.0.9.7 #4 0xff0a52bc in EVP_DigestInit_ex () from /local/lib/libcrypto.so. 0.9.7 #5 0xff04cb90 in HMAC_Init_ex () from /local/lib/libcrypto.so.0.9.7 #6 0xff18c1dc in tls1_mac () from /local/lib/libssl.so.0.9.7 #7 0xff1877a8 in ssl3_read_bytes () from /local/lib/libssl.so.0.9.7 #8 0xff185608 in ssl3_read () from /local/lib/libssl.so.0.9.7 #9 0xff18d368 in SSL_read () from /local/lib/libssl.so.0.9.7 #10 0xff35e7f4 in sb_tls_read (sbiod=0xff8b7b0, buf=0x175d0d80, len=4) at tls.c:589 #11 0xff319520 in sb_debug_read (sbiod=0xd02fe00, buf=0x175d0d80, len=4) at sockbuf.c:795 #12 0xff3431e8 in sb_sasl_read (sbiod=0xfc0cd08, buf=0xccb14b3, len=8) at cyrus.c:270 #13 0xff319520 in sb_debug_read (sbiod=0xc4f0e50, buf=0xccb14b3, len=8) at sockbuf.c:795 #14 0xff31866c in ber_int_sb_read (sb=0xe03bc80, buf=0xccb14b3, len=8) at sockbuf.c:409 #15 0xff3161e8 in ber_get_next (sb=0xe03bc80, len=0xd7c00ef4, ber=0xccb14a8) at io.c:504 #16 0x000330a8 in connection_read (s=71) at connection.c:1527 ---Type <return> to continue, or q <return> to quit--- #17 0x0002f84c in slapd_daemon_task (ptr=0x14d218) at daemon.c:2353 #18 0xfed5b124 in _thread_start () from /usr/lib/libthread.so.1 #19 0xfed5b124 in _thread_start () from /usr/lib/libthread.so.1 Backtrace stopped: previous frame identical to this frame (corrupt stack?) Now, the second one is most likely the "recompile it against a different Kerberos" issue. However, the last seems to be directly SSL related and the first ... I have no idea about the first. We have openldap built against openssl 0.9.7i. So you might be asking yourself, what occurs at 12:05am in our world? Nothing in particular as far as I can tell from the logs, which is mighty odd. Also this never happens with the master server (but then again it's not getting direct queries) The last request in the logs seems to have been a fairly simple lookup (I X'd out the uid): Apr 28 00:00:05 uni01ds.unity.ncsu.edu slapd[1058]: [ID 469902 local4.debug] con n=2189346 op=115 SRCH base="ou=accounts,dc=ncsu,dc=edu" scope=2 deref=0 filter=" (&(|(objectClass=posixAccount)(objectClass=inetOrgPerson) (objectClass=shadowAcco unt))(|(uidNumber=XXXXX)))" Apr 28 00:00:05 uni01ds.unity.ncsu.edu slapd[1058]: [ID 744844 local4.debug] con n=2189346 op=115 SRCH attr=uid cn cn homeDirectory loginShell uidNumber Looks like they really all crashed at right after midnight and were discovered and fixed 5 minutes later. Any suggestions? =( I know many of you are running this under Solaris. Anyone had any particular problems doing so? Daniel

2 3

Problem when using 'accesslog' and 'refint' overlays in combination
by Alina Dubrovska 02 May '07

02 May '07

Hello dear list, Please try respond to this post, because that's very important for out project to fix described problem! We are trying to configure access logging in my OpenLDAP server (version is 2.3.27) using slapo-accesslog overlay. In slapd.conf I have configured accesslog database according to manual: database bdb suffix "cn=accesslog" rootdn "cn=root,cn=accesslog" rootpw accesslog index reqStart eq database bdb suffix "dc=main_domain,dc=com" checkpoint 1024 5 cachesize 10000 rootdn "cn=Administrator,dc=main_domain,dc=com" overlay accesslog logdb "cn=accesslog" logops writes logold (objectclass=person) In previous version of slapd.conf there was also slapo-refint overlay enabled to support 'uniqueMember' attribute update after member entry is renamed or deleted: overlay refint refint_attributes uniqueMember After turning on access logging I inspect the following problem: I create 2 users (objectclass=person) and a group (objectclass=groupOfUniqueNames), then I add both users to that group (add users DN values to uniqueMember attribute). Next I'm trying to rename (or delete) one of the member users and... LDAP hangs up with no response. When I connect once again, then I see that action was performed (user is renamed or deleted, but old member reference is present in group attributes). However, I'm not able to modify directory (that is add some new entry, modify attribute value etc) LDAP hangs up on any attempt and only OpenLDAP restart helps. Last note is that this problem appears only when both accesslog and refint are enabled. Separately they are working as expected. Does anybody have an idea about the reason of such a problem? We tried to find some useful information in logs, but nothing is there (maybe we just looked in wrong place) Maybe it's possbile to configure access-log to use database on different LDAP server? Maybe that could help? Please help! We need to have this working together! Thanks in advance, Alina.

2 1

back-config: close database, keep suffix
by Hallvard B Furuseth 02 May '07

02 May '07

I suspect I asked this before, but I don't remember... Can I do this? Close a database, replace it with a fresh slapadded one and reopen it, _without_ clients seeing its subtree temporarily disappear. So instead of deleting the database entry, modify it so operations against it either fail with 'unavailable' or (preferably) wait for the database to become on-line again, subject to the normal time limits. -- Regards, Hallvard

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2007