openldap-software March 2008

openldap-software@openldap.org

65 participants
66 discussions

Help with server hang
by Marantz, Roy 13 Mar '08

13 Mar '08

I'm running OpenLDAP 2.4.8 with Berkeley DB 2.4.6 on Solaris-10 compiled with Sun's compiler. If I start and stop slapd in short succession it will hang after the 2nd or 3rd time. Following are the syslog message, a pstack (backtrace), and sanitized copy of slapd.conf. Any help in debugging this would be appreciated. Thanks. Roy Mar 11 16:00:33 master.nyc.deshaw.com slapd[3991]: [ID 702911 local4.debug] @(#) $OpenLDAP: slapd 2.4.8 (Mar 10 2008 13:35:31) $ Mar 11 16:00:33 master.nyc.deshaw.com mselby@desab005.nyc.deshaw.com:/var/tmp/build/openldap-2.4.8/servers/sla pd Mar 11 16:00:33 master.nyc.deshaw.com slapd[3991]: [ID 991073 local4.error] nss_order: ldap: not a member of group: staff Mar 11 16:00:33 master.nyc.deshaw.com slapd[3991]: [ID 610730 local4.debug] pkcs11_softtoken: Cannot create keystore. Mar 11 16:00:33 master.nyc.deshaw.com slapd[3995]: [ID 100111 local4.debug] slapd starting Mar 11 16:00:39 master.nyc.deshaw.com slapd[3995]: [ID 543694 local4.debug] daemon: shutdown requested and initiated. Mar 11 16:00:39 master.nyc.deshaw.com slapd[3995]: [ID 542995 local4.debug] slapd shutdown: waiting for 0 threads to terminate 13476: /usr/local/openldap/libexec/slapd -u ldap -g ldap ----------------- lwp# 1 / thread# 1 -------------------- fe001117 lwp_wait (2, 80476f8) fdffd326 _thrp_join (2, 0, 0, 1) + 5a fdffd4a5 pthread_join (2, 0, 80871e0, 0) + 2b 08088b02 slapd_daemon () + 7a ----------------- lwp# 2 / thread# 2 -------------------- fe00040b lwp_park (0, 0, 0) fdffac7a cond_wait_queue (83114ac, 8311494, 0, 0) + 68 fdffb146 _cond_wait (83114ac, 8311494) + 66 fdffb188 cond_wait (83114ac, 8311494) + 21 fdffb1c1 pthread_cond_wait (83114ac, 8311494, a7, 821603c) + 1b 08196c6c ldap_pvt_thread_pool_destroy (fe000542, 0, 83114cc, fdee8ec0, fdc70000, 0) + e4 083114c8 ???????? () include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/desco.schema include /etc/openldap/schema/sendmail.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args password-hash {CRYPT} modulepath /usr/local/openldap/libexec/openldap moduleload syncprov.la moduleload rwm.la loglevel 256 sizelimit 512000 TLSCertificateFile /etc/openldap/ssl/server.crt TLSCertificateKeyFile /etc/openldap/ssl/server.key TLSCACertificateFile /etc/openldap/ssl/ca.crt TLSVerifyClient never access to * by dn="cn=ldapadm,dc=nyc,dc=example,dc=com" write by dn="cn=syncrepl,dc=nyc,dc=example,dc=com" write by * read database bdb suffix "dc=nyc,dc=example,dc=com" rootdn "cn=root,dc=nyc,dc=example,dc=com" rootpw secrete directory /var/openldap/nyc.example.com/data cachesize 15000 checkpoint 512 720 index objectClass eq index entryCSN eq index entryUUID eq index ou eq index uid eq index cn eq,sub index sn eq,sub index uidNumber eq index gidNumber eq index userPassword eq index memberUid eq index ipHostNumber eq index ipNetworkNumber eq index ipProtocolNumber eq index ipServiceProtocol eq index oncRpcNumber eq index macAddress eq index ipServicePort eq index automountKey eq index amdKey eq index desmailKey eq index desmiscKey eq index sendmailMTAAliasGrouping eq index sendmailMTAMapName eq index sendmailMTAKey eq serverID 1 database relay suffix "ou=sendmail,dc=example,dc=mail" overlay rwm suffixmassage "ou=sendmail,dc=nyc,dc=example,dc=com" database monitor database monitor

2 2

null_callbacks after initial sync
by Nick Geron 12 Mar '08

12 Mar '08

I'm working with a test mirror mode setup on 2.4.7 with db 4.5.20 and seeing issues with SyncRepl. Specifically, do_syncrepl fails with an initial error 0x10 and subsequent 0x14, though at least one modification is propagated. To put another way: *Systems using same ldif to populate and running nearly identical slapd.conf files (serverID is the only variance). 1) start server 1 2) start server 2 3) add host attribute to posixAccount entry on s-1 4) attribute seen on s-2 but results in the following log 5) no other updates successful until server process restarted. Mar 4 10:46:14 slapd[22999]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 4 10:46:14 slapd[22999]: do_syncrep2: cookie=rid=001,sid=002,csn=20080304164630.523962Z#000000#001#000000 Mar 4 10:46:19 slapd[22999]: conn=0 fd=25 ACCEPT from IP=172.30.24.5:53140 (IP=0.0.0.0:389) Mar 4 10:46:19 slapd[22999]: conn=0 op=0 BIND dn="uid=syncrepl,ou=ldap,dc=example,dc=com" method=128 Mar 4 10:46:19 slapd[22999]: conn=0 op=0 BIND dn="uid=syncrepl,ou=ldap,dc=example,dc=com" mech=SIMPLE ssf=0 Mar 4 10:46:19 slapd[22999]: conn=0 op=0 RESULT tag=97 err=0 text= Mar 4 10:46:19 slapd[22999]: conn=0 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(reqResult=0)" Mar 4 10:46:19 slapd[22999]: conn=0 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Mar 4 10:46:45 slapd[22999]: conn=1 fd=26 ACCEPT from IP=172.16.71.134:65251 (IP=0.0.0.0:389) Mar 4 10:46:45 slapd[22999]: conn=1 op=0 BIND dn="cn=manager,dc=example,dc=com" method=128 Mar 4 10:46:45 slapd[22999]: conn=1 op=0 BIND dn="cn=manager,dc=example,dc=com" mech=SIMPLE ssf=0 Mar 4 10:46:45 slapd[22999]: conn=1 op=0 RESULT tag=97 err=0 text= Mar 4 10:46:45 slapd[22999]: conn=1 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(objectClass=*)" Mar 4 10:46:45 slapd[22999]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=2 text= Mar 4 10:46:45 slapd[22999]: conn=1 op=2 UNBIND Mar 4 10:46:45 slapd[22999]: conn=1 fd=26 closed Mar 4 10:46:45 slapd[22999]: conn=2 fd=26 ACCEPT from IP=192.168.15.32:45137 (IP=0.0.0.0:389) Mar 4 10:46:45 slapd[22999]: conn=2 fd=26 closed (connection lost) Mar 4 10:47:07 slapd[22999]: do_syncrep2: cookie=rid=001,sid=002,csn=20080304164728.385080Z#000000#001#000000 Mar 4 10:47:07 slapd[22999]: syncrepl_message_to_op: rid=001 be_modify uid=tguy,ou=employees,ou=people,dc=example,dc=com (0) Mar 4 10:47:07 slapd[22999]: null_callback : error code 0x10 Mar 4 10:47:07 slapd[22999]: syncrepl_updateCookie: rid=001 be_modify failed (16) Mar 4 10:47:07 slapd[22999]: do_syncrepl: rid=001 retrying Mar 4 10:47:17 slapd[22999]: null_callback : error code 0x14 Mar 4 10:47:17 slapd[22999]: syncrepl_message_to_op: rid=001 be_modify uid=tguy,ou=employees,ou=people,dc=example,dc=com (20) **** LAST 3 LINES REPEATED THEREAFTER **** A little more verbose output on the consumer side shows some problem modifying the underlying DB, but I can't see an obvious where to go from here. Mar 4 10:57:10 slapd[23057]: =>do_syncrepl rid=001 Mar 4 10:57:10 slapd[23057]: =>do_syncrep2 rid=001 Mar 4 10:57:10 slapd[23057]: >>> dnPrettyNormal: <uid=tguy,ou=employees,ou=people,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: <<< dnPrettyNormal: <uid=tguy,ou=employees,ou=people,dc=example,dc=com>, <uid=tguy,ou=employees,ou=people,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: >>> dnPretty: <cn=Manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: <<< dnPretty: <cn=Manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: >>> dnNormalize: <cn=Manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: <<< dnNormalize: <cn=manager,dc=example,dc=com> Mar 4 10:57:10 slapd[23057]: => bdb_entry_get: ndn: "uid=tguy,ou=employees,ou=people,dc=example,dc=com" Mar 4 10:57:10 slapd[23057]: => bdb_entry_get: oc: "(null)", at: "(null)" Mar 4 10:57:10 slapd[23057]: bdb_dn2entry("uid=tguy,ou=employees,ou=people,dc=example,dc=com") Mar 4 10:57:10 slapd[23057]: => bdb_entry_get: found entry: "uid=tguy,ou=employees,ou=people,dc=example,dc=com" Mar 4 10:57:10 slapd[23057]: bdb_entry_get: rc=0 Mar 4 10:57:10 slapd[23057]: hdb_modify: uid=tguy,ou=employees,ou=people,dc=example,dc=com Mar 4 10:57:10 slapd[23057]: bdb_dn2entry("uid=tguy,ou=employees,ou=people,dc=example,dc=com") Mar 4 10:57:10 slapd[23057]: bdb_modify_internal: 0x00000a2b: uid=tguy,ou=employees,ou=people,dc=example,dc=com Mar 4 10:57:10 slapd[23057]: <= acl_access_allowed: granted to database root Mar 4 10:57:10 slapd[23057]: bdb_modify_internal: delete host Mar 4 10:57:10 slapd[23057]: bdb_modify_internal: 16 modify/delete: host: no such value Mar 4 10:57:10 slapd[23057]: hdb_modify: modify failed (16) Mar 4 10:57:10 slapd[23057]: send_ldap_result: conn=-1 op=0 p=0 Mar 4 10:57:10 slapd[23057]: send_ldap_result: err=16 matched="" text="modify/delete: host: no such value" Mar 4 10:57:10 slapd[23057]: null_callback : error code 0x10 Mar 4 10:57:10 slapd[23057]: syncrepl_message_to_op: rid=001 be_modify uid=tguy,ou=employees,ou=people,dc=example,dc=com (16) Again, if multiple, successful writes are made to the 'primary' server in the mirror, only the first makes it to the 'secondary.' If the second server is restarted, it retrieves all new edits as expected. Can someone elaborate on what bdb_modify_internal is trying to tell me? Please let me know if more information is required. Thanks. Slapd.conf # Global Settings ################# include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/sendmail.schema include /etc/openldap/schema/solaris.schema include /etc/openldap/schema/example.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args sizelimit unlimited # Loglevel ########## loglevel any moduleload /usr/local/libexec/openldap/back_hdb.la moduleload /usr/local/libexec/openldap/accesslog.la # TLS/SSL ######### TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/openldap/certs/ldap.example.com.crt TLSCertificateKeyFile /etc/openldap/certs/ldap.example.com.key TLSCACertificateFile /etc/openldap/certs/ca.crt TLSVerifyClient never # Access log ############ database bdb suffix cn=accesslog directory /var/lib/openldap-data/accesslog rootdn cn=Manager,cn=accesslog rootpw secret index default eq index reqStart,objectClass,entryCSN,reqResult eq cachesize 3000 idlcachesize 9000 overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Primary DB Configuration ########################## database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/openldap-data/example.com cachesize 3000 idlcachesize 9000 # Primary DB Indexes #################### index objectClass,entryUUID,entryCSN eq index cn,sn,uid eq,sub,pres,approx index sendmailMTAMapName eq,pres index sendmailMTAMapValue eq index sendmailMTAKey eq,sub,pres index sendmailMTAAliasValue eq,pres index sendmailMTAClassName eq index sendmailMTAClassValue eq index exampleUserModifiable eq # Primary DB SyncRepl ##################### syncrepl rid=1 provider=ldap://ldap.example.com type=refreshAndPersist searchbase="dc=example,dc=com" bindmethod=simple binddn="uid=syncrepl,ou=ldap,dc=example,dc=com" credentials="syncpw" retry="10 +" schemachecking=off logbase="cn=accesslog" syncdata=accesslog logfilter="(reqResult=0)" mirrormode on serverID 2 # Primary DB Sync Provider ########################## overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 # Primary DB accesslog ###################### overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 # ACLs for Primary DB ##################### access to attrs=userPassword by anonymous auth by self write by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read by * none access to dn.subtree="ou=employees,ou=people,dc=example,dc=com" by anonymous auth by self write by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read by * none access to dn.subtree="ou=group,dc=example,dc=com" by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read access to dn.subtree="ou=ldap,dc=example,dc=com" by anonymous auth by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read access to dn="ou=sendmail,dc=example,dc=com" by ssf=112 dn.base="uid=sendmail,ou=ldap,dc=example,dc=com" read by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read access to dn.subtree="dc=example,dc=com" by dn="uid=syncrepl,ou=ldap,dc=example,dc=com" read by dn="uid=pam,ou=ldap,dc=example,dc=com" read by dn.regex="uid=[^,]+,ou=employees,ou=people,dc=example,dc=com" read access to dn.base="" by * read

4 14

bdb_locker_id: err Cannot allocate memory(12)
by Raphaël Ouazana-Sustowski 11 Mar '08

11 Mar '08

Hi, I have a problem with an OpenLDAP server version 2.3.30. It is configured with many databases (more than 100), and when I try a search I get this error message: bdb_locker_id: err Cannot allocate memory(12) I tried to play with different parameters of DB_CONFIG (locks, cache_size, etc.) and slapd.conf (threads in particular) but without any result. Looking at the code I found that the function ldap_pvt_thread_pool_setkey (where it seems the error is from) doesn't allocate memory, but uses a fixed size table ctx of length MAXKEYS. Do you think I need to increase the MAXKEYS value, or that the problem is from somewhere else? Thanks in advance for your help, Raphaël Ouazana.

2 1

Re: Timeouts and TTL's
by Hans Moser 11 Mar '08

11 Mar '08

Hi! Matthew Stier schrieb: > I am using OpenLDAP (2.3.38) as a proxy server, to provide a single > point of lookup, for the many e-mail systems used within the company I > work for. > > The only problem I am now encountering, is 'slapd' randomly hanging, and > I suspect that could be caused by bad interactions between the proxy and > ldap servers. yes, I experienced the same a while ago. > The most plausible solution would be to implement timeout's, but that is > where I come into a brink wall, trying to understand when each of the > multitude of timeout and ttl setting should be used. conn-ttl 90 idle-timeout 1m30s solved my problems. YMMV man slapd-meta Hans

1 0

config evolution with openldap 2.3 and beyond?
by openldap 10 Mar '08

10 Mar '08

Hi listers, [cvs@myhost ~]$ rpm -q openldap-servers openldap-servers-2.3.39-1.fc8 [cvs@myhost ~]$ As far as i have understood, the openldap config is moving towards beeing fully LDAP integrated, i.e. you will change the config using ldapmodify, you will add to the config using ldapadd, you will view the config using ldapsearch. That created me a problem: i had to add a schema. what i did: i created a new olcInclude object into cn=config. This object, however, was not stable, it got lost at the next slapd restart. When i consulted this discussion list, i was informed that adding a new olcInclude object is not the correct way to add a new schema. But i was not informed on how the intention is to do it. I imagine that another way would be to convert the schema from the schema file manually/directly into olcAtttributeTypes, olcObjectClasses, olcObjectIdentifier and insert them into the cn=schema,cn=config. This, however, would be a very error prone action. Also, the handling of the access rights in the future is far from clear. When i consulted the openldap docu, i found put me in front of a fait-accompli: that is how it is, help yourself. could someone shed some light on the evolution process from file-based config into LDAP-based config? thanks in advance. suomi

2 1

replication problem
by Julien Garnier 10 Mar '08

10 Mar '08

Hi, I was looking for a solution to monitor syncrepl between two server and find that I need to compare contextCSN on the two server. The problem is that entryCSN doesn't exist on my slave server : On the master (don't know openldap ver): # ldapsearch -x -h master -b "ou=people,dc=compagnie,dc=com" -s base ContextCSN give me : # extended LDIF # # LDAPv3 # base <ou=people,dc=compagnie,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ContextCSN # # People, compagnie.com dn: ou=people,dc=compagnie,dc=com contextCSN: 20080305145635Z#000000#00#000000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 On the slave (openldap 2.4.8): # ldapsearch -x -h slave -b "ou=people,dc=compagnie,dc=com" -s base ContextCSN give me : # extended LDIF # # LDAPv3 # base <ou=people,dc=compagnie,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ContextCSN # # search result search: 2 result: 0 Success # numResponses: 1 At startup on the slave, I have this log : bdb_modify: ou=People,dc=compagnie,dc=com bdb_dn2entry("ou=People,dc=compagnie,dc=com") bdb_modify_internal: 0x00000001: ou=People,dc=compagnie,dc=com <= acl_access_allowed: granted to database root bdb_modify_internal: delete contextCSN bdb_modify_internal: 16 modify/delete: contextCSN: no such value bdb_modify: modify failed (16) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=16 matched="" text="modify/delete: contextCSN: no such value" null_callback : error code 0x10 syncrepl_updateCookie: rid=013 be_modify failed (16) ldap_msgfree ldap_result ld 0x832ca48 msgid 2 wait4msg ld 0x832ca48 msgid 2 (timeout 0 usec) wait4msg continue ld 0x832ca48 msgid 2 all 0 ** ld 0x832ca48 Connections: * host: master port: 389 (default) refcnt: 2 status: Connected last used: Wed Mar 5 14:53:45 2008 I don't understand what append ... Thanks for your help Julien

5 12

Timeouts and TTL's
by Matthew Stier 10 Mar '08

10 Mar '08

I am using OpenLDAP (2.3.38) as a proxy server, to provide a single point of lookup, for the many e-mail systems used within the company I work for. The only problem I am now encountering, is 'slapd' randomly hanging, and I suspect that could be caused by bad interactions between the proxy and ldap servers. The most plausible solution would be to implement timeout's, but that is where I come into a brink wall, trying to understand when each of the multitude of timeout and ttl setting should be used.

1 0

index_param failed on ipHostNumber
by Robert Fitzpatrick 10 Mar '08

10 Mar '08

I setup a new lookup in our Postfix just like the one we have used for transports for some time, but now using ipHostNumber to allow relay. After setting up, I started receiving... Mar 7 09:43:04 esmtp slapd[22766]: <= bdb_equality_candidates: (ipHostNumber) index_param failed (18) So, I added ipHostNumber to my list of indexes already established for other Postfix lookups... # Following indexes for postfix virtual lookups index associatedDomain,mail,mailLocalAddress,ipHostNumber eq The errors go away, but now my lookup does returns nothing. And as soon as I remove the index and try lookup again, it returns the result fine, but slow of course and with the error above. However, even with it removed, I still see the index in my file system... esmtp# ls -lah /home/openldap/ipHostNumber.bdb -rw------- 1 ldap ldap 8.0K Mar 7 08:32 /home/openldap/ipHostNumber.bdb Can someone offer some guidance on what I should try next? Thanks in advance. -- Robert

2 1

syncrepl with filter question
by Ralph Rößner 10 Mar '08

10 Mar '08

Hello list, I have noticed (as of 2.4.7) an interaction of searchAndPersist syncrepl, search filters, and access rules that looks weird to me. Before I call it a bug (and submit to ITS) I'd like to ask whether I'm not just missing the point and everything is working as intended. So here is the situation: We replicate just part of the provider data by annotating the objects to replicate with an extra replication info attribute. Access to that attribute is restricted. Now when an object is change, we observe this: If the change is made by a user who has read access to the replication info attribute then the change is replicated. Otherwise it is not. It appears that the replication filter is evaluated using the access rights of the user making the modification, not those of the replication user. If someone can tell me that this is not a problem because ... whatever reason then I'm interested to know. Otherwise I'll pack up configs, logs, etc. and file a bug report. Sincerely, Ralph Rößner -- Ralph Rößner CAPCom AG < http://www.capcom.de > Rundeturmstr. 10, 64283 Darmstadt, Germany Phone +49 6151 155 900, Fax +49 6151 155 909 Vorstand: Luc Neumann (Vorsitzender) Vorsitzender des Aufsichtsrats: Prof. Dr.-Ing. José L. Encarnação Sitz der Gesellschaft: Darmstadt, Registergericht: Darmstadt HRB 8090

4 5

program segfaults on ldap_get_values/ldap_get_values_len
by Brian Hechinger 09 Mar '08

09 Mar '08

I'm trying to access LDAP from a C program (the first time I've used the OpenLDAP API) and so far I've only met with moderate success. I can bind without issue, but I need to retrieve the values held by a specific multi valued attribute, and that's where I'm having issues. I was using ldap_get_values() and all the other deprecated functions, but have recently converted my code to only use what's available in 2.4.x Sadly, that didn't fix the problem, it still happens. This line: attr_values = ldap_get_values_len(ldap_conn, entry, attr); Segfaults with SIGABRT and prints this to stderr: Assertion failed: (LBER_VALID( ber )), function ber_scanf, file decode.c, line 779. This is OpenLDAP 2.4.8 on FreeBSD 7.0-RELEASE (as built out of PORTS). Where do I start looking to try and get this resolved? Thanks!! -brian -- "Perl can be fast and elegant as much as J2EE can be fast and elegant. In the hands of a skilled artisan, it can and does happen; it's just that most of the shit out there is built by people who'd be better suited to making sure that my burger is cooked thoroughly." -- Jonathan Patschke

5 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2008