openldap-software July 2007

openldap-software@openldap.org

108 participants
124 discussions

using slapo-pcache with an empty attr list
by Toby Blake 05 Jun '08

05 Jun '08

Hi all, I'm doing a bit of playing with slapo-pcache and have it working fairly well (particularly once I realised that an individual attr can live in only one proxyattrset). However, there's one bit that I can't get working - is there any way to define a template that will match a search which doesn't provide an attr list? i.e. I can see quite a few searches (presumably from amd) of the following form (spacing and formatting changed by me to make it more readable): Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SRCH base="dc=inf,dc=ed,dc=ac,dc=uk" scope=2 deref=0 filter="(&(objectClass=amdmap)(amdmapName=home)(amdmapKey=root))" Jul 23 14:54:16 host1 slapd[26671]: query template of incoming query = (&(objectClass=)(amdmapName=)(amdmapKey=)) Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT ANSWERABLE Jul 23 14:54:16 host1 slapd[26671]: QUERY NOT CACHEABLE Jul 23 14:54:16 host1 slapd[26671]: conn=49 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Note that there's no 'SRCH attr=' line. I've tried proxyattrset of the following forms... proxyattrset 1 * proxyattrset 1 (both of which crash slapd) And also proxyattrset 1 <full list of attrs returned when none specified> .... but this didn't work either. Thanks in advance for any advice, Cheers Toby Blake School of Informatics University of Edinburgh

3 8

OpenLDAP 2.4
by Howard Chu 08 Nov '07

08 Nov '07

The Admin Guide still has not been updated with all of the relevant changes, so here are some notes on new features in the 2.4 release... I believe all of the manpages are up to date, so you can get specifics from them. More complete cn=config functionality: There is a new slapd-config(5) manpage for the cn=config backend. the original design called for auto-renaming of config entries when you insert or delete entries with ordered names, but that was not implemented in 2.3. It is now in 2.4. This means, e.g., if you have olcDatabase={1}bdb,cn=config olcSuffix: dc=example,dc=com and you want to add a new subordinate, now you can: ldapadd olcDatabase={1}bdb,cn=config olcSuffix: dc=foo,dc=example,dc=com this will insert a new BDB database in slot 1 and bump all following databases down one, so the original BDB database will now be named olcDatabase={2}bdb,cn=config olcSuffix: dc=example,dc=com In 2.3 you were only able to add new schema elements, not delete or modify existing elements. In 2.4 you can modify schema at will. (Except for the hardcoded system schema, of course.) More sophisticated syncrepl configurations: the original implementation of syncrepl in OpenLDAP 2.2 was intended to support multiple consumers within the same database, but that feature never worked and was removed from OpenLDAP 2.3. I.e., you could only configure a single consumer in any database. In 2.4 you can configure multiple consumers in a single database. The configuration possibilities here are quite complex and numerous. You can configure consumers over arbitrary subtrees of a database (disjoint or overlapping). Any portion of the database may in turn be provided to other consumers using the syncprov overlay. The syncprov overlay works with any number of consumers over a single database or over arbitrarily many glued databases. As a consequence of the work to support multiple consumer contexts, the syncrepl system now supports full N-way multimaster replication with entry-level conflict resolution. There are some important constraints, of course: In order to maintain consistent results across all servers, you must maintain tightly synchronized clocks across all participating servers (e.g., you must use NTP on all servers). The entryCSNs used for replication now record timestamps with microsecond resolution, instead of just seconds. The delta-syncrepl code has not been updated to support multimaster usage yet, that will come later in the 2.4 cycle. On a related note, syncrepl was explicitly disabled on cn=config in 2.3. It is now fully supported in 2.4; you can use syncrepl to replicate an entire server configuration from one server to arbitrarily many other servers. It's possible to clone an entire running slapd using just a small (less than 10 lines) seed configuration, or you can just replicate the schema subtrees, etc. Tests 049 and 050 in the test suite provide working examples of these capabilities. In 2.3 you could configure syncrepl as a full push-mode replicator by using it in conjunction with a back-ldap pointed at the target server. But because the back-ldap database needs to have a suffix corresponding to the target's suffix, you could only configure one instance per slapd. In 2.4 you can define a database to be "hidden" which means that its suffix is ignored when checking for name collisions, and the database will never be used to answer requests received by the frontend. Using this hidden database feature allows you to configure multiple databases with the same suffix, allowing you to set up multiple back-ldap instances for pushing replication of a single database to multiple targets. There may be other uses for hidden databases as well (e.g., using a syncrepl consumer to maintain a *local* mirror of a database on a separate filesystem). More extensive TLS configuration control: In 2.3, the TLS configuration in slapd was only used by the slapd listeners. For outbound connections used by e.g. back-ldap or syncrepl their TLS parameters came from the system's ldap.conf file. In 2.4 all of these sessions inherit their settings from the main slapd configuration but settings can be individually overridden on a per-config-item basis. This is particularly helpful if you use certificate-based authentication and need to use a different client certificate for different destinations. Various performance enhancements: Too many to list. Some notable changes - ldapadd used to be a couple of orders of magnitude slower than "slapadd -q". It's now at worst only about half the speed of slapadd -q. A few weeks ago I did some comparisons of all the 2.x OpenLDAP releases; the results are in the slides from my SCALE presentation and you can find a copy here: http://www.highlandsun.com/hyc/scale2007.pdf That compared 2.0.27, 2.1.30, 2.2.30, 2.3.33, and HEAD (as of a couple weeks ago). Toward the latter end of the "Cached Search Performance" chart it gets hard to see the difference because the runtimes are so small, but the new code is about 25% faster than 2.3, which was about 20% faster than 2.2, which was about 100% faster than 2.1, which was about 100% faster than 2.0, in that particular search scenario. That test basically searched a 1.3GB DB of 380836 entries (all in the slapd entry cache) in under 1 second. i.e., on a 2.4GHz CPU with DDR400 ECC/Registered RAM we can search over 500 thousand entries per second. The search was on an unindexed attribute using a filter that would not match any entry, forcing slapd to examine every entry in the DB, testing the filter for a match. Essentially the slapd entry cache in back-bdb/back-hdb is so efficient the search processing time is almost invisible; the runtime is limited only by the memory bandwidth of the machine. (The search data rate corresponds to about 3.5GB/sec; the memory bandwidth on the machine is only about 4GB/sec due to ECC and register latency.) I think it goes without saying that no other Directory Server in the world is this fast or this efficient. Couple that with the scalability, manageability, flexibility, and just the sheer know-how behind this software, and nothing else is even remotely comparable. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

7 12

RE: ldapsearch on local attributes with slapo-translucent
by Srilakshmanan, Kumuthiny 11 Oct '07

11 Oct '07

Are you missing a bracket? "(&(object Class=AsteriskSIPUser)(AstAccountName=600))" -----Original Message----- From: openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au(a)OpenLDAP.or g [mailto:openldap-software-bounces+kumuthiny.srilakshmanan=auspost.com.au@Ope nLDAP.org] On Behalf Of Gavin Henry Sent: Friday, 20 July 2007 7:26 AM To: openldap-software(a)openldap.org Subject: ldapsearch on local attributes with slapo-translucent Dear All, I'm doing some work with Asterisk and translucent, trying to overlay some attributes to an existing remote account, locally. These attributes have been added by entries in the local database before being presented to me via ldapsearch, whilst searching for attributes present in the remote directory: objectClass: AsteriskExtension objectClass: AsteriskSIPUser AstAccountName: 600 AstAccountType: friend AstAccountSecret: 600 AstAccountQualify: yes AstAccountPort: 5060 AstAccountNAT: never AstAccountMailbox: 600@device AstAccountHost: dynamic AstAccountDTMFMode: rfc2833 AstAccountContext: from-internal AstAccountCanReinvite: no AstAccountCallerID: Gavin <502> Should I expect to be able to search for the above attributes and get a result? Currently I am not. A filter like: "(&(objectClass=AsteriskSIPUser)(AstAccountName=600)" returns: ldapsearch: ldap_search_ext: Bad search filter (-7) So I guess that answers my question. If slapo-translucent did return results for searches against the local attributes, would this be defeating the purpose/design of the overlay? Thanks, Gavin. Australia Post is committed to providing our customers with excellent service. If we can assist you in any way please telephone 13 13 18 or visit our website. The information contained in this e-mail communication may be proprietary, confidential or legally professionally privileged. It is intended exclusively for the individual or entity to which it is addressed. You should only read, disclose, re-transmit, copy, distribute, act in reliance on or commercialise the information if you are authorised to do so. Australia Post does not represent, warrant or guarantee the integrity of this e-mail communication has been maintained nor that the communication is free of errors, virus or interference. If you are not the addressee or intended recipient please notify us by replying direct to the sender and then destroy any electronic or paper copy of this message. Any views expressed in this e-mail communication are taken to be those of the individual sender, except where the sender specifically attributes those views to Australia Post and is authorised to do so.

4 4

slapo-unique. several unique_base with different unique_attributes sets
by Dmitriy Kirhlarov 02 Oct '07

02 Oct '07

Hi, list I have container in my tree 'ou=cyrus,ou=mail,o=domain' and I need check 'uniqueMember' attribute -- user can be membered only in one group. Also, for 'ou=web,ou=groups,o=domain' with same types of objects, as 'ou=cyrus,ou=mail,o=domain' user can be membered in several groups, but I need uniques check for 'gidNumber' inside 'ou=groups,o=domain'. I need something: unique_base ou=users,o=domain uidNumber mail mailLocalAddress unique_base ou=groups,o=domain gidNumber unique_base ou=cyrus,ou=mail,o=domain uniqueMember I'm using openldap 2.3.35 Is it possible with this version or, may be, with 2.4.x? WBR. Dmitriy

3 4

Re: OpenLDAP: Referrals
by r d 01 Aug '07

01 Aug '07

can someone suggest something on following ----- Original Message ---- From: r d <rad390(a)yahoo.com> To: openldap-software(a)openldap.org Sent: Friday, July 27, 2007 3:49:05 PM Subject: OpenLDAP: Referrals -help Hello, I'm newbe to openldap. Want to get some helpful hand on setting up referral. I've two slapd instances running. The directory tree on machine 1 is dc=example,dc=com,ou=TestUser and directory tree on machine B has dc=example,dc=com,ou=TestUser and dc=example,dc=com,ou=LdapUser Now from machine A I'm trying to refer records in machine B using following command.and I get following output. my slapd.config on machine-A has following line referral ldap://machin-B:389/ C:\Program Files\OpenLDAP>ldapsearch.exe -x -H ldap://machin-A -D "cn=Mana ger,dc=example,dc=com" -b "dc=example,dc=com,ou=LdapUser" "cn="LdapUser1 foo" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=example,dc=com,ou=LdapUser> with scope sub # filter: sn=LU1foo # requesting: ALL # # search result search: 2 result: 10 Referral ref: ldap://machine-B:389/dc=example,dc=com,ou=LdapUser??sub # numResponses: 1 ========================== What I was expecting in output was search should return the record exists in machine B. But it didn't. Am I expecting right thing ? Is there anyhitng I need to configured, add entry in proper format or somehitng ? Please suggest ========================== Notice that sample entry exists on machine-B. ldapsearch -x -b 'dc=example,dc=com' '(&(objectclass=*)(cn=LdapUser1 foo))' # LdapUser1 foo, LdapUser, example.com dn: cn=LdapUser1 foo,ou=LdapUser,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: uidObject cn: LdapUser1 foo uid: LU1foo sn: LU1foo displayName: LdapUser1 foo userPassword:: VGVzdExkYXA= mail: LU1foo(a)mun.com ======================================================== Thanks in advance for looking into this, Need a vacation? Get great deals to amazing places on Yahoo! Travel. ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

3 2

Possible to create "link" between trees in openldap 2.3
by Ski Kacoroski 01 Aug '07

01 Aug '07

Hi, I am not sure what the correct terminology is, but as part of a major re-work of our OpenLDAP directory we are moving from: ou=people, dc=nsd, dc=org to ou=people, ou=accounts, dc=nsd, dc=org. In the new server I would like to create a "link" from ou=people, dc=nsd, dc=org -> ou=people, ou=accounts, dc=nsd, dc=org. because I have 2500 email clients that have as a search base ou=people, dc=nsd, dc=org and my user community is not able to update their email clients to point to the new search base. Is it there a way to create a "link" and if so how. Thanks for your help. cheers, ski -- "When we try to pick out anything by itself, we find it connected to the entire universe" John Muir Chris "Ski" Kacoroski, ski(a)nsd.org, 206-501-9803

2 2

Upgrade from OpenLDAP 2.1.30 -> 2.3.37
by Leon de Rooij 31 Jul '07

31 Jul '07

Hi all, After a period of testing I upgraded our LDAP servers from 2.1.30 to 2.3.37. Many things were done, changed replication from slurpd to syncrepl, changed backend from ldbm to hdb, even changed the structure of the tree a bit, almost everything works great :) Except some searches are slower ! I have around 160K dn's with around 3.2M attrs in a server with 4G memory with a tree looking like this (simplified): o=sp | ou=users | namespace=domain.com | uid=username Now, when I do this search: # time ldapsearch -b "o=sp" "mail=user(a)domain.com" dn dn: uid=user,namespace=domain.com,ou=users,o=sp real 0m0.005s user 0m0.000s sys 0m0.000s But when I do this search: # time ldapsearch -b "ou=users,o=sp" "mail=user(a)domain.com" dn dn: uid=user,namespace=domain.com,ou=users,o=sp real 0m0.190s user 0m0.000s sys 0m0.000s (even after a couple of searches, the numbers stay the same) That's 50 times slower ! Right now all machines using LDAP are doing fine, but I'd like the searches with a different base than o=sp to be the same speed (I expected them to be even quicker because there's less to search, or am I wrong ?) (BTW, on our old LDAP, searches within o=sp were equally quick as searches in a different basedn, around 0.009 s real) I have indexed o, ou and namespace with pres and eq (and mail with pres, eq and sub), so I don't see a problem there. I still have to look a bit more into DB_CONFIG tuning, but still, is it normal behaviour of OpenLDAP 2.3.37 with hdb backend that searches in a subtree are slower than in the base of the tree ? Just before sending this mail I also tried searching like this: # time ldapsearch -b "namespace=domain.com,ou=users,o=sp" "mail=user(a)domain.com" dn dn: uid=user,namespace=domain.com,ou=users,o=sp real 0m0.015s user 0m0.000s sys 0m0.000s So that's in between both previous searches.. strange.. thanks & regards, Leon de Rooij leon(a)scarlet-internet.nl

5 8

noSuchObject at LDAP
by Hasan Tolga Bazan 30 Jul '07

30 Jul '07

Hello, If there is a LDAP tree consisting of "student names" and the searched name does not exist in the tree,"noSuchObject(32)" result code is returned. Is it possible to configure LDAP to get a default value like "name: Peter" instead of getting "noSuchObject" ? Thanks BR/Tolga _________________________________________________________________ With Windows Live Hotmail, you can personalize your inbox with your favorite color. www.windowslive-hotmail.com/learnmore/personalize.html?locale=en-us&ocid=TX…

2 1

Slapd doesn't start after update
by ツ Leandro Sales 27 Jul '07

27 Jul '07

Hi, I upgrade openldap from 2.2.28-r7 to 2.3.35-rc1 and no the slapd doesn't start. What may be the problem? I tried to downgrade back to 2.2.28-r7 and when I start the daemon I got: /usr/lib64/openldap/slapd: error while loading shared libraries: liblber-2.3.so.0: cannot open shared object file: No such file or directory Any clue? Thank you. []s Leandro.

2 3

OpenLDAP: Referrals -help
by r d 27 Jul '07

27 Jul '07

Hello, I'm newbe to openldap. Want to get some helpful hand on setting up referral. I've two slapd instances running. The directory tree on machine 1 is dc=example,dc=com,ou=TestUser and directory tree on machine B has dc=example,dc=com,ou=TestUser and dc=example,dc=com,ou=LdapUser Now from machine A I'm trying to refer records in machine B using following command.and I get following output. my slapd.config on machine-A has following line referral ldap://machin-B:389/ C:\Program Files\OpenLDAP>ldapsearch.exe -x -H ldap://machin-A -D "cn=Mana ger,dc=example,dc=com" -b "dc=example,dc=com,ou=LdapUser" "cn="LdapUser1 foo" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=example,dc=com,ou=LdapUser> with scope sub # filter: sn=LU1foo # requesting: ALL # # search result search: 2 result: 10 Referral ref: ldap://machine-B:389/dc=example,dc=com,ou=LdapUser??sub # numResponses: 1 ========================== What I was expecting in output was search should return the record exists in machine B. But it didn't. Am I expecting right thing ? Is there anyhitng I need to configured, add entry in proper format or somehitng ? Please suggest ========================== Notice that sample entry exists on machine-B. ldapsearch -x -b 'dc=example,dc=com' '(&(objectclass=*)(cn=LdapUser1 foo))' # LdapUser1 foo, LdapUser, example.com dn: cn=LdapUser1 foo,ou=LdapUser,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: uidObject cn: LdapUser1 foo uid: LU1foo sn: LU1foo displayName: LdapUser1 foo userPassword:: VGVzdExkYXA= mail: LU1foo(a)mun.com ======================================================== Thanks in advance for looking into this, ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software July 2007