openldap-software November 2008

openldap-software@openldap.org

43 participants
47 discussions

replication issue
by Dmitriy Kirhlarov 19 Nov '08

19 Nov '08

Hi, list I have a problem with replication -- numbers of objects on provider and consumer not identical. My configuration: - two servers (ldap1 & ldap2) configured in mirror mode with carp failover. It's work fine. - also, I have 9 eximx nodes with local ldap servers, configured, as consumers for replicate domain routing table from provider. eximx nodes get replica from shared ip's (i.e. connection possible to any from providers) activity ~ 1-2 changes in minute. numbers of objects ~ 120 000. numbers of read on every eximx up to 50 per second testcase: 1. I deleting db on eximx node and get fresh replica 2. waiting 24 hours 3. check numbers of objects on ldap1 and eximx node. 4. Today, on eximx, I get more objects than ldap1. Yesterday -- eximx has less objects, than ldap1. Could somebody recommend me how to debug this issue or change some parameters? Config on provider: serverID {1,2} #unique for ldap1 and ldap2 limits dn.exact="cn=root,ou=mail-routes" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database hdb suffix ou=mail-routes rootdn cn=root,ou=mail-routes rootpw XXX directory /var/db/openldap-data/mail-routes checkpoint 32 8 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 1000 syncprov-reloadhint TRUE syncrepl rid=003 provider=ldap://ldap1 type=refreshAndPersist retry="60 +" searchbase="ou=mail-routes" schemachecking=on bindmethod=simple binddn="cn=root,ou=mail-routes" credentials=XXX starttls=yes tls_reqcert=allow syncrepl rid=004 provider=ldap://ldap2 type=refreshAndPersist retry="60 +" searchbase="ou=mail-routes" schemachecking=on bindmethod=simple binddn="cn=root,ou=mail-routes" credentials=XXX starttls=yes tls_reqcert=allow mirrormode on index objectClass,dc eq index entryUUID eq Config on consumers: limits dn.exact="cn=owner,ou=mail-routes" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database hdb suffix ou=mail-routes rootdn cn=root,ou=mail-routes rootpw "" directory /opt/db/openldap/mail-routes checkpoint 32 8 syncrepl rid=0 provider=ldap://ldap searchbase="ou=mail-routes" type=refreshAndPersist bindmethod=simple binddn="cn=root,ou=mail-routes" credentials=XXX schemachecking=on retry="60 +" starttls=yes tls_reqcert=allow index objectClass,dc eq index entryUUID eq -- WBR Dmitriy

7 9

Rewrite/Map posixGroup to groupOfNames (or similar)?
by Ryan Stasel 19 Nov '08

19 Nov '08

Hello! I'm attempting to overcome a shortcoming in an OpenLDAP implementation and try to get a fully qualified membership information for Groups. Basically, a software product I'm trying to use only accepts groups that return full dn's for members, rather than just memberUid (like posixGroup). Does anyone know if this is possible? slapo-rwm looks promising, but I'm no regex wizard, so I'm not even sure how I would construct the rewrite rule. Thanks very much! -Ryan Stasel School of Journalism and Communication, University of Oregon

1 0

Rewriting entry dns
by PHILIP LEMBO 18 Nov '08

18 Nov '08

We have a Sun Directory 5.x whose DIT has entry dn's in the format "uid=xxxxxxx,ou=people,l=region,dc=example,dc=com" with "region" being the name of each of 4 continents (north america, south america, asia, europe). What I'd like to do is use the OpenLDAP meta backend to rewrite those dns so that searches against the OpenLDAP server return these dns in the format "uid=xxxxxxx,ou=people,dc=example,dc=com" The OpenLDAP server was built with --enable-overlays, as well as --enable-meta and --enable-ldap, in addition to the defaults. I've looked over the doc for slapd-meta, slapd-ldap, slapo-rwm and slapo-glue, as well as the configs in the distribution test scripts, without coming up with a working slapd.conf to accomplish this. Questions: (1) is this possible with any released version of OpenLDAP?; (2) If so, does anyone have a working example of a config that they could post here? As always, many thanks. -- Philip Lembo

2 5

Plenty of connection_read(): no connection! messages in log
by Maykel Moya 18 Nov '08

18 Nov '08

My slapd log is getting filled by 'no connection!' messages. Is that avoidable? aballi:/usr/local/sbin# tail -f /var/log/slapd.log Nov 18 14:22:59 aballi slapd[3185]: connection_read(41): no connection! Nov 18 14:23:00 aballi slapd[3185]: connection_read(55): no connection! Nov 18 14:23:15 aballi slapd[3185]: connection_read(98): no connection! Nov 18 14:23:22 aballi slapd[3185]: connection_read(48): no connection! Nov 18 14:23:24 aballi slapd[3185]: connection_read(74): no connection! Nov 18 14:23:29 aballi slapd[3185]: connection_read(41): no connection! Nov 18 14:23:32 aballi slapd[3185]: connection_read(148): no connection! Nov 18 14:23:43 aballi slapd[3185]: connection_read(44): no connection! Nov 18 14:23:45 aballi slapd[3185]: connection_read(122): no connection! Nov 18 14:23:46 aballi slapd[3185]: connection_read(145): no connection! Nov 18 14:23:52 aballi slapd[3185]: connection_read(182): no connection! Nov 18 14:24:01 aballi slapd[3185]: connection_read(24): no connection! Regards, maykel --------------------------------------- Red Telematica de Salud - Cuba CNICM - Infomed

2 1

Appropiate value for Read Waiters
by Maykel Moya 17 Nov '08

17 Nov '08

I'm having an average of 60 Read Waiters. Is that normal? slapd 2.4.11 backend hdb entries ~80k ram 3g Regards, maykel --------------------------------------- Red Telematica de Salud - Cuba CNICM - Infomed

1 0

Re: Error modifying uid or dn with ldapmodify (Naming violation (64) value of naming attribute 'uid' is not present in entry)
by Hallvard B Furuseth 17 Nov '08

17 Nov '08

darkxer0x writes: > Thank you very much. > But, I have another problem, what is the ACL to permit "seff" to > change dn? "man slapd.access" says: The modrdn operation requires write (=w) privileges on the pseudo-attribute entry of the entry whose relative DN is being modified, write (=w) privileges on the pseudo-attribute children of the old and new entry's parents, and write (=w) privileges on the attributes that are present in the new relative DN. Write (=w) privileges are also required on the attributes that are present in the old relative DN if deleteoldrdn is set to 1. Thus you'll need something like # hide passwords, but allow users to update their own access to attrs=userPassword by self =wx by * auth # allow users to add/delete/move entries directly below dc=dominio access to dn="dc=dominio" attrs=children by dn.onelevel="dc=dominio" write # allow users to write their own entries and everyone to read # everything else access to * by self write by * read > I''ve tried in slapd.conf: > access to dn.base="" by self write This tries to grant access to the single entry with DN "", which is not a user entry but a special entry that describes the LDAP server. Also it doesn't grant any access to anyone but 'self'. Maybe you meant access to * by self write by * read or something like access to dn.subtree=<some DN> by self write by * read > This doesn't work It would help if you said which error message you receive (where slapd tries to _tell_ you why it failed), but here is a guess: > I've read some howto about ldapmodrdn and all of them say: -D > "Directory Manager", Hopefully they don't, since that's not a valid DN. It would be something like -D "cn=Directory Manager,dc=dominio" assuming your slapd.conf includes something like database bdb suffix "dc=dominio" rootdn "cn=Directory Manager,dc=dominio" rootpw <some password, possibly encrypted with sbin/slappasswd> A database's rootdn is a special DN you can bind as which has full access to the database regardless of access control, and which does not need to exist in the database - which is why you can specify its password in slapd.conf instead. -- Hallvard

1 0

Error modifying uid or dn with ldapmodify (Naming violation (64) value of naming attribute 'uid' is not present in entry)
by Alberto GD 17 Nov '08

17 Nov '08

I'm trying to modify uid with ldapmodify. This is my modify.ldif: ###---modify.ldif---### dn: uid=old_user_uid,dc=dominio changetype: modify replace: uid uid: new_user_uid $ldapmodify -x -D "cn=admin,dc=dominio" -W -f modify.ldif Enter LDAP Password: modifying entry "uid=old_user_uid,dc=dominio" ldap_modify: Naming violation (64) additional info: value of naming attribute 'uid' is not present in entry When I try to modify dn: ###---modify.ldif---### dn: uid=old_user_uid,dc=dominio changetype: modify replace: dn dn: uid=new_user_uid,dc=dominio $ldapmodify -x -D "cn=admin,dc=dominio" -W -f modify.ldif Enter LDAP Password: modifying entry "uid=old_user_uid,dc=dominio" ldap_modify: Undefined attribute type (17) additional info: dn: attribute type undefined I've seen RFC2849, and the examples have dn and uid fields like: dn: cn=Gern Jensen, ou=Product Testing, dc=airius, dc=com objectclass: top objectclass: person objectclass: organizationalPerson cn: Gern Jensen cn: Gern O Jensen sn: Jensen uid: gernj Here is the output of #slapcat -a uid=old_user_uid dn: uid=old_user_uid,dc=dominio uid: old_user_uid cn: SomeOne homeDirectory: /home/old_user_uid uidNumber: SomeNumber objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: inetOrgPerson gidNumber: SomeNumber sn: Someone shadowExpire: 14245 loginShell: /bin/bash userPassword:: NWh0c0p0T3g= shadowLastChange: 14193 structuralObjectClass: inetOrgPerson entryUUID: 9a2b0c7a-488e-102d-8bce-7f1d632647aa creatorsName: cn=admin,dc=dominio createTimestamp: 20081117005833Z entryCSN: 20081117013513Z#000000#00#000000 modifiersName: cn=admin,dc=dominio modifyTimestamp: 20081117013513Z

2 1

DDS object does not expire?
by manu＠netbsd.org 15 Nov '08

15 Nov '08

Hello I am trying out slapo-dds. I haver this in slapd.conf: overlay dds dds-state TRUE dds-max-ttl 1d dds-min-ttl 10s dds-default-ttl 1h dds-interval 120s dds-tolerance 5s Then I created an entry with this: objectClass: dynamicObject I had this automatically generated. entryTtl: 3600 entryExpireTimestamp: 20081029215410Z But now this entry should be expired, and it is still in the tree. What is wrong? Did I misunderstood the documentation, shoudln't it vanish now? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

3 8

Replica (ldap slave server) certificates (SSL/TLS). Are clients certificates needed?
by Alberto GD 14 Nov '08

14 Nov '08

Hi! I've followed openldap.org's guide and ldap works great with TLS/SSL with authentication in server and clients. Now I have added a LDAP replica (ldap slave server), and I have some questions: - In the clients I had to make the certs with the server certificate (cacer.pem) of the master, because I check the server certificate, and also check the clients in the server. Now that I have a replica, I have to make others certs with the server certificate of the slave server (and how can I show two certificates to ldap.conf)?? (I followed this<http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.3>( http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.3) Or with the certificates made from server certificates its sufficient?? >Step 1 and 2: Do nothing ... the CA does not need to be created again. The plan is to use the same CA certificate to sign the client certificate.

2 3

syncprov-sessionlog
by Gavin Henry 12 Nov '08

12 Nov '08

Hi All, I'm just writing up the small overlay section on slapo-syncprov (not much to it), but the man page has confused me: syncprov-sessionlog <ops> Specify a session log for recording information about write operations made on the database. The <ops> specifies the number of operations that are recorded in the log. All write operations (except Adds) are recorded in the log. When using the session log, it is helpful to set an eq index on the entryUUID attribute in the underlying database. "All write operations (except Adds) are recorded in the log." What log are we talking about here? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

4 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software November 2008