openldap-software August 2007

openldap-software@openldap.org

77 participants
93 discussions

FW: running DB on different machine than slapd
by Kelly, Terence P 24 Aug '07

24 Aug '07

> -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > Sent: Friday, August 24, 2007 1:04 AM > To: Kelly, Terence P > Cc: openldap-software(a)openldap.org > Subject: Re: running DB on different machine > than slapd > > Kelly, Terence P wrote: > > > For a variety of reasons I would like to run > > the back-end database beneath slapd on a > > different machine than slapd. > > > > This appears to be difficult using the > > Berkeley DB. > > Makes no sense at all, given that BerkeleyDB is > an *embedded* database. I.e., it doesn't run in > a separate process, it is designed to run in the > same process as the application that uses it. Yes, I know. I was hoping it would be easier if I used some other database. > > Can anyone offer suggestions on how to run > > slapd and the database --- any database --- > > on separate machines? > > Why? I think if you provide more details about > your motivation it would be easier to suggest > usable alternatives. I'm a researcher and one of my interests is in the trade-offs between performance and other properties (e.g., fault isolation/security) that various software architectures offer. Furthermore I want to include OpenLDAP in an apples-to-apples comparison involving other applications with multi-tier architectures in which the various tiers run on separate physical machines. Therefore I'm interested in any way of running the underlying database on a different physical machine then the slapd application, even if the performance overhead is substantial. Does that make sense? Thanks in advance for any suggestions you can offer.

2 1

Fwd: Maximum size of the database.
by Sumith Narayanan 24 Aug '07

24 Aug '07

Hello , Any suggessions ? Thanks, Sumith. ---------- Forwarded message ---------- From: Quanah Gibson-Mount <quanah(a)zimbra.com> Date: Aug 24, 2007 12:51 PM Subject: Re: Maximum size of the database. To: Sumith Narayanan <sumith.narayanan(a)gmail.com> --On Friday, August 24, 2007 12:02 PM -0700 Sumith Narayanan <sumith.narayanan(a)gmail.com> wrote: > Hi Quanah, > > I am running $OpenLDAP: slapd 2.3.27 and I have restarted slapd after > making this change. I am running Berkeley DB (Version: 4.4.20). > > Is there some other configuration that I should make. I am running on > MacOSX 10.4 Ah, I dunno on MAC OS X 10.4... I've only every played with this under Linux, and with BDB 4.2.52+patches. I wonder if there's a bug. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

syncrepl - out of sync scenario
by Arunachalam Parthasarathy 24 Aug '07

24 Aug '07

Hello all, I am using openldap 2.3.36 and using syncrepl feature. I had configured a server as a master and another server as a slave. I am using refreshOnly mode in slave. When I start the slave, I am getting all the entries from the master under the particular DN , in slave. Now I stop the slave, make it normal server add some entries. Again , I made it as slave, and try to sync with the master (as 3rd line above) Now the entries which I had added, when it was normal server, is not getting deleted when I sync, the second time (the above line) I mean now the slave and master are out of sync Please say me, is this way is correct and why the slave is not deleting the entries , which are not in master (I mean, extra entries, which I added , when it was in normal server) Thanks a lot in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

2 1

Strange error during TLS handshake
by Fabian Steiner 24 Aug '07

24 Aug '07

Heute 17:09:11 Hello! For some time now we are using OpenLDAP in order to provide a stable network-wide authentication service. Of course, we also enabled TLS-Support so that any connection is encrypted. However, we encounter some problems which are definitely subject of SSL as they also occur when we try to test our setup using "openssl s_client" and "openssl s_server". Most of the time TLS/SSL works perfect, but it may happen that we get the following error when we restart slapd: $ ldapsearch -x -ZZ -d1 [...] TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=lsh-marquartstein.de, issuer: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=lsh-marquartstein.de TLS certificate verification: depth: 0, err: 0, subject: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=uranos.lsh-marquartstein.de, issuer: /C=DE/ST=Bavaria/L=Marquartstein/O=Staatliches Landschulheim Marquartstein/CN=lsh-marquartstein.de TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure [...] If this is the case we can't get it to work anymore and the whole server has to be switched off in order to make it work again. What might cause this problem? OS is Ubuntu Linux 6.06.1 Dapper Server-Edition. Looking forward to your answer! Thanks, Fabian P.S. We are using self-signed certificates of our own CA.

2 2

running DB on different machine than slapd
by Kelly, Terence P 24 Aug '07

24 Aug '07

For a variety of reasons I would like to run the back-end database beneath slapd on a different machine than slapd. This appears to be difficult using the Berkeley DB. Can anyone offer suggestions on how to run slapd and the database --- any database --- on separate machines? Thanks in advance for any advice you can offer.

4 3

Re: successful ldapsearch -- need to turn it into a working slapd configuration for an LDAP proxy
by Quanah Gibson-Mount 23 Aug '07

23 Aug '07

----- "Jason R. DePriest" <jrdepriest(a)gmail.com> wrote: > > Originally, it was database meta only and didn't work. Adding in the > backend bdb is just one of the things I have tried to change in the > config. Without it, the errors look the same. I just double-checked > to make sure. Keep replies to the list please. I didn't necessarily expect it to change the result, but it was definitely a misconfiguration, and best to remove it. ;) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

successful ldapsearch -- need to turn it into a working slapd configuration for an LDAP proxy
by DePriest, Jason R. 23 Aug '07

23 Aug '07

I can run ldapsearch from my OpenLDAP server and successfully query a remote LDAP server. My command-line looks like this (broken into lines for readability): ldapsearch -u -v -x -D 'cn=LDAP-proxy,ou=Service Accounts,dc=subdomain,dc=domain,dc=com' -w '<password>' -H 'ldap://server.subdomain.domain.com' -b 'ou=Department,dc=subdomain,dc=domain,dc=com' -s one -P 3 '(&(objectCategory=person)(objectClass=user)(cn=DeP*))' + It returns: # extended LDIF # # LDAPv3 # base <ou=Data Security,dc=subdomain,dc=domain,dc=com> with scope subtree # filter: (&(objectCategory=person)(objectClass=user)(cn=DeP*)) # requesting: + # # DePriest\2C Jason R., Department, subdomain.domain.com dn: CN=DePriest\, Jason R.,OU=Department,DC=subdomain,DC=domain,DC=com ufn: DePriest\2C Jason R., Department, subdomain.domain.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Hey, look! It found me! I have tried using the ldap backend, but I'm leaning toward using the meta backend now. I cannot seem to figure out how to take the successful ldapsearch and turn it into a configuration that will proxy requests to the remote server. I have what I think looks good, but I get an error while trying to do a query and it crashes with this: slapd: symbol lookup error: /usr/lib/ldap/back_meta-2.3.so.0: undefined symbol: ldap_back_proxy_authz_ctrl I am running OpenLDAP 2.3.35 on a 2.6.21 kernel Debian GNU/Linux system. I hate to post the entire gigantic debug log or the entire config when I don't really know what parts are important to you. Let me know if you need more information. Thanks! -Jason -- NOTICE: This email is being sent in clear-text across the public Internet. Therefore, any attempts to include unenforceable legalese restrictions are ridiculous and pointless. If you can read this, consider yourself authorized (whether I like it or not).

2 5

ldap_bind: Can't contact LDAP server (-1)
by Villem Alari 23 Aug '07

23 Aug '07

When I write ldapdelete I get answer like that from my terminal: ldap_bind: Can't contact LDAP server (-1) What should I do to connect to LDAP server? Villem Alari e-post: villem(a)ekool.ee mobiil: +37253939163

4 5

'simpleSecurityObject' requires attribute 'userPassword'
by Villem Alari 22 Aug '07

22 Aug '07

Entry (cn=admin,dc=example,dc=com): object class 'simpleSecurityObject' requires attribute 'userPassword' slapadd: dn="cn=admin,dc=example,dc=com" (line=12): (65) object class 'simpleSecurityObject' requires attribute 'userPassword' Why does it say that 'simpleSecurityObject' requires attribute 'userPassword'. What password it means? I have done everything exactly as it is said here till the point where it says add the new content sudo slapadd -l init.ldif. After doing that this 'userPassword' appeared. Regards, Villem Alari

2 2

Delta-syncrepl issues when missing schema
by Scott Sanders 22 Aug '07

22 Aug '07

Hello OpenLDAP fans, I have a situation which came to my attention inadvertantly after creating a new replication slave for my directory. The directory holds a number of posix user accounts, and some of these entries with the posixAccount object class also have a sambaSamAccount object class. I use delta-syncrepl for my slaves, because of how quickly I can set them up at new locations. However, after creating this slave and setting up auth through PAM on a linux machine to use the new slave I found I was unable to log in, but other users could. After checking the contents of ou=people on the slave, it seems no entries referencing any samba attributes or samba object classes were replicated. As it turns out, I had forgotten to include samba.schema in my slave slapd.conf . Now, I set out to fix this on my own. Restarting the server after adding the schema definition did not populate the samba entries on the slave. I was instructed to try modifying one of the missing entries by the wonderful users in #ldap, in hopes it would trigger syncrepl to send the missing entry to the slave. This also had no effect. After 30 minutes of frusteration I simply wiped out the openldap-data directory on the slave and restarted LDAP. This did work. However, it recreated the whole database on the slave, which could have taken a long time if my directory was larger. In the future I would like to know how to repair replication issues in a less blunt manner. Any suggestions or comments would be appreciated. Thanks, Scott Sanders

3 3

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software August 2007