June 2007 - openldap-software

by Piotr Wadas

Hello, I've read something about slapd unix socket connection. I noticed about x-mod and permissions, about url-encoding, etc. However, how do I use ldapi with LDAP C SDK? To be exact, how do I use unix socket with ldap_init ? What's about bind operation? Does ldap_init supports it? I've read some posts saying that ldapi was to be used for fast and insecure connection which does not require bind operation. Anyway should I care? I mean, is it really somehow faster than tcp socket? My program does about 1-5 searches per it's operation, and there may approx. about 500 "operations" per-second (actually "operation" is http request). There's about 1-10 entries returned per one search. Would it give some real performance boost? But the posts I've read was quite old, and I coudn't find any usage examples, with or without bind. So, what's the current status and primary usage of ldapi in openldap? Regards, PIotr

16 years, 3 months

2
1
0 / 0

No search result without rootdn

by Patrick Ulmer

Hi, I have a little Problem with openldap 2.3.27 under openSUSE 10.2 and open-exchange 8.2.1. open-exchange try to search with something like that # ldapsearch -x -s one -a always -D "" -b "ou=Users,ou=OxObjects,dc=nieda,dc=de" "(&(uid=tux)(objectClass=OXUserObject))" and find nothing. /var/log/messages ACCEPT from IP=127.0.0.1:8932 (IP=0.0.0.0:389) BIND dn="" method=128 RESULT tag=97 err=0 text= SRCH base="ou=Users,ou=OxObjects,dc=nieda,dc=de" scope=1 deref=3 filter="(&(uid=tux)(objectClass=OXUserObject))" SEARCH RESULT tag=101 err=0 nentries=0 text= Now I try it with rootdn and all works fine: /var/log/messages # ldapsearch -x -W -s one -a always -D "cn=Manager,dc=nieda,dc=de" -b "ou=Users,ou=OxObjects,dc=nieda,dc=de" "(&(uid=tux)(objectClass=OXUserObject))" ACCEPT from IP=127.0.0.1:24195 (IP=0.0.0.0:389) BIND dn="cn=Manager,dc=nieda,dc=de" method=128 BIND dn="cn=Manager,dc=nieda,dc=de" mech=SIMPLE ssf=0 RESULT tag=97 err=0 text= SRCH base="ou=Users,ou=OxObjects,dc=nieda,dc=de" scope=1 deref=3 filter="(&(uid=tux)(objectClass=OXUserObject))" SEARCH RESULT tag=101 err=0 nentries=1 text= By default, everything should be readable for everyone, but why openldap give me no result for my first call? Thanks for help. Patrick

16 years, 3 months

2
3
0 / 0

regarding backsql performance

by Arunachalam Parthasarathy

Hello, Why , when we use the back-sql , the search performance reduces. Is it because , all operations to database is through odbc manager Can I get some more details regarding the above? Thanks in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

16 years, 3 months

5
9
0 / 0

ldap_start_tls_s and automatic CA certificate searching

by Roberto Aguilar

Hello, I'm trying to write a simple LDAP program that uses TLS for communication and am running into problems with the server certificate verification. Using strace I noticed that the ldapsearch command is able to find the appropriate CA certificate for the server I'm connecting to in my /etc/ssl/certs directory even if the TLS_CACERT setting in ldap.conf points to a different certificate. In my program, however, I receive error 91, which is a Connect error. Setting TLS_CACERT to the server's CA certificate allows the connection to go through, but that is not feasible as I need to connect to servers with different CAs. I tried looking through ldapsearch.c to find the secret sauce to get this to work, but was not successful. Can someone point me in the right direction. Thanks a lot! -berto.

16 years, 3 months

3
3
0 / 0

main: TLS init def ctx failed: -1

by West, Jon (NIH/NIMH) [C]

I am still attempting to implement TLS connections on my system. When using my new certificates I get this startup error and the LDAP servier will not start main: TLS init def ctx failed: -1 what exactly does this mean? Jon West

16 years, 3 months

2
3
0 / 0

Attribute Uniqueness

by Robert Klopotoski, Jr.

How do I configure slapd(8) to prevent two objects in the database from having the same value in a particular attribute? That is, how do I configure slapd(8) ensure that values of a particular attribute are unique throughout the database? The server is slapd 2.3.30, on a Debian Linux system (Etch).

16 years, 3 months

4
7
0 / 0

glued bdb databases limit ?

by Raphaël 'SurcouF' Bordet

Hi, I've a slapd instance which have more than 28 databases glued using OpenLDAP 2.3.35/BerkeleyDB 4.2.52. Most of theses databases (back_bdb) doesn't have memory cache setting greater than 1 Mb using DB_CONFIG. Greaters have 5 Mb. The slapd process consums about 1454 Mb of RAM. But with this following search, I'm getting a curious error message : $ ldapsearch -x -LLL -H ldapi:// -D 'cn=admin,dc=debianfr,dc=net' -W -b 'dc=debianfr,dc=net' -s one '(objectClass)' dn [...] dn: ou=28th,dc=debianfr,dc=net Additionnal information: internal error I don't get no more data after this error message. And in log file of slapd, I've theses lines : /----( slapd.log )---- Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 215403 local4.debug] conn=98 op=1 BIND dn="cn=manager,dc=defense,dc=gouv,dc=fr" method=128 Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 600343 local4.debug] conn=98 op=1 BIND dn="cn=manager,dc=defense,dc=gouv,dc=fr" mech=SIMPLE ssf=0 Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 618536 local4.debug] do_abandon: bad msgid 0 Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 588225 local4.debug] conn=98 op=1 RESULT tag=97 err=0 text= Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 469902 local4.debug] conn=98 op=2 SRCH base="dc=debianfr,dc=net" scope=2 deref=0 filter="(objectClass=*)" Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 744844 local4.debug] conn=98 op=2 SRCH attr=dn Jun 22 15:45:05 meta2 igc-slapd[5674]: [ID 887893 local4.debug] do_syncrep2: rid 001 LDAP_RES_SEARCH_RESULT Jun 22 15:45:27 meta2 meta-slapd[5676]: [ID 631200 local4.debug] bdb_locker_id: err Not enough space(12) \---8<---8<---8<---8<---8<--- I've already looking for an database problem but I can disable any database, when I'm adding the 29th database, this error come back ! Any ideas ? Regards, -- Raphaël 'SurcouF' Bordet

16 years, 3 months

1
0
0 / 0

dynamic schema for database sql

by Arunachalam Parthasarathy

Hello, Can I able to add new schema with database sql ? I can able to see the cn=schema, cn=config entries when I do ldapsearch But when the slapd starts, the warning states, No dynanmic config support for sql (Is that mean, I cant add new schemas?), if that's the case , what is the cn=schema, cn=config when I do a ldapsearch. Please explain me in this regard Is this due to oc / attr mapping is not in the database Thanks in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

16 years, 3 months

2
1
0 / 0

configure can't find tls

by Jon Roberts

Fedora 7 OpenSSL 0.9.8e Heimdal 0.8.1 Cyrus-SASL 2.1.22 OpenLDAP 2.3.36 My (tcsh) environment has: setenv CC gcc setenv CFLAGS "-O -g" setenv CPPFLAGS "-I/usr/local/include" setenv LDFLAGS "-L/usr/local/lib" setenv LD_LIBRARY_PATH "/usr/local/lib" When I start to build OpenLDAP, I get stopped at: ernie 70> configure --with-tls ... checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no checking OpenSSL library version (CRL checking capability)... yes configure: error: Could not locate TLS/SSL package ...even though: ernie 73> ls -l /usr/local/lib/libcrypto.a -rw-r--r-- 1 root root 2213286 2007-06-20 14:05 /usr/local/lib/libcrypto.a ernie 76> ls -l /usr/local/lib/libssl.a -rw-r--r-- 1 root root 364650 2007-06-20 14:05 /usr/local/lib/libssl.a ernie 78> ls -l /usr/local/include | grep openssl drwxr-xr-x 2 root root 4096 2007-06-20 14:05 openssl ernie 82> ls -l /usr/local/bin/openssl -rwxr-xr-x 1 root root 1749278 2007-06-20 14:05 /usr/local/bin/openssl ernie 80> ls -l /usr/local/openssl total 48 drwxr-xr-x 2 root root 4096 2007-06-20 14:05 certs drwxr-xr-x 6 root root 4096 2007-06-20 14:05 man drwxr-xr-x 2 root root 4096 2007-06-20 14:05 misc -rw-r--r-- 1 root root 9374 2007-06-20 14:05 openssl.cnf drwxr-xr-x 2 root root 4096 2007-06-20 14:05 private I built Heimdal and Cyrus-SASL without issue using the same environment and they appeared to find this OpenSSL install. What is OpenLDAP configure looking for that it isn't finding? Jon Roberts www.mentata.com

16 years, 3 months

5
11
0 / 0

sync replicate glued database

by Hans Moser

Hi! I have a glued DIT on a syncProvider: -----snip from slapd.conf------ database meta subordinate suffix proxy,ou=foo database bdb subordinate suffix humans,ou=foo database bdb subordinate suffix system,ou=foo database bdb suffix ou=foo overlay glue overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 -----snap from slapd.conf------ This should be replicated to a consumer: syncrepl rid=401 provider=ldap://provider type=refreshAndPersist retry="60 10 300 10 3600 10" searchbase="ou=humans,ou=foo" bindmethod=simple binddn="cn=human,ou=mgr,ou=foo" credentials=nothing updateref ldap://provider This does not work. Nothing is replicated. When I slapcat everthing, define one, global database und slapadd all in - so I don't have a glued DIT at the provider anymore, it works. Is the above configuration not working or did I a configuration error? Hans

16 years, 3 months

3
5
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software June 2007