openldap-software July 2009

openldap-software@openldap.org

49 participants
46 discussions

dynlist overlay and ldapsearch
by ben thielsen 03 Feb '10

03 Feb '10

hi- i'm using the dynlist overlay and am not getting back the search results i expected. i'm using 2.4.11 courtesy of debian. here is my overlay config: >ldapsearch -xWLLLD 'cn=admin,cn=config' -b 'cn=config' "(objectclass=olcdynamiclist)" dn: olcOverlay={5}dynlist,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {5}dynlist olcDLattrSet: {0}groupOfNames memberURL member olcDLattrSet: {1}mailGroup labeledURI here is the entry in question: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' -s base -b 'cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groundnoise,dc=net' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net labeledURI: ldap:///ou=domains,ou=mail,dc=groundnoise,dc=net?host?sub?(objectC lass=mailDomain) host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net searched for another way: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' host dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net host: phone.dipswitch.net host: luna.mpls.mn.us host: groundnoise.net host: thielsen.org host: sjva1991.org host: dipswitch.net host: bitrate.net however, the results from this search are missing that entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=dipswitch.net)' dn dn: host=dipswitch.net,ou=domains,ou=mail,dc=groundnoise,dc=net or another search: ldapsearch -xvWD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(host=*))' host ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: (&(objectclass=mailgroup)(host=*)) requesting: host # extended LDIF # # LDAPv3 # base <dc=groundnoise, dc=net> (default) with scope subtree # filter: (&(objectclass=mailgroup)(host=*)) # requesting: host # # search result search: 2 result: 0 Success # numResponses: 1 if i remove the labeledURI attribute and populate with static entries, things appear to work as expected: here's the entry: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(&(objectclass=mailgroup)(cn=abuse))' dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net objectClass: mailGroup objectClass: top objectClass: extensibleObject cn: abuse member: cn=postmaster,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail ,dc=groundnoise,dc=net host: foo host: bar host: com host: net host: org and a search: >ldapsearch -xWLLLD 'cn=admin,dc=groundnoise,dc=net' '(host=foo)' dn dn: cn=abuse,ou=distribution_groups,ou=all_domains,ou=domains,ou=mail,dc=groun dnoise,dc=net what am i doing wrong? thanks -ben

3 3

Re: solaris compile options
by Brett ＠Google 25 Jan '10

25 Jan '10

i am using CFLAGS="-fast -xtarget=ultraT1 -xarch=sparcvis2 -xcode=pic32 -g -xs -O" one set of solaris docs i read implied that -xarch=sparcvis2 was equivalent to -xarch=v9 (which used to trigger 64 bit), but looking at the sun studio 12 compiler options, the more specific versions of -xarch (ie. other than -xarch=v9 or v9a or v9b) may no longer imply that the 64 bit memory model should be used. so maybe i need to add a -m64 to the above ? (compiling on a Sun T2000, with a homegenous build / execute environment, so favouring speed over cpu compatibility is ok) On Thu, Mar 12, 2009 at 1:31 AM, Aaron Richton <richton(a)nbcs.rutgers.edu>wrote: > On Wed, 11 Mar 2009, Brett @Google wrote: > > /data/openldap/backups/ldap_090302.ldif: Value too large for defined data >> type >> > > man lfcompile, and/or switch to 64-bit binaries? >

2 3

Stability of autogroup overlay with OpenLDAP < 2.4.18
by Ryan Steele 01 Aug '09

01 Aug '09

Is the autogroup overlay considered stable for use with versions of OpenLDAP earlier than 2.4.18? I know it's being used on earlier versions (as 2.4.18 is not considered stable yet), but I've also seen some reports of basic search functionality getting clobbered after doing so. According to ITS#6227, that bug was fixed, but I'd like to confirm that the overlay does at least work before investing the time (however short it may be) to compile it and package it in with OpenLDAP locally for internal use. I appreciate any feedback. Regards, Ryan

3 3

LDAP Process "hangs"
by Andi Gorhan 31 Jul '09

31 Jul '09

Hello, I have a question regarding the LDAP search mechanism. I have 2 Master Server and 1 Slave Server. All Servers are in Sync. The second Master is a standby Master which is active if the first one goes down. Now I want to test a failover szenario and shut down the first Master. The second one is active now and the Slave is now in Sync with the second one. After rebooting the first Master I started LDAP and no error occured. LDAP is up and running. I tested the Server with some ldapsearches and everything works fine except the search with filters. If I do a search for example "uid=abc*" LDAP hangs and does not respond. Searching for exact DNs are working fine. What happended here? Hopefully anybody can help me. Thanks a lot. Best regards, Andi

4 3

BT IP Exchange interconnect
by Gavin Henry 31 Jul '09

31 Jul '09

Hi All, Has anyone passed the tests using OpenSIPS: http://www.btwholesale.com/pages/static/Products/Converged_Voice/IP_Exchang… Thanks. -- http://www.suretecsystems.com/services/openldap/ http://www.suretectelecom.com -- http://www.suretecsystems.com/services/openldap/ http://www.suretectelecom.com

2 1

correctly setting DB_CONFIG
by Peter Clark 31 Jul '09

31 Jul '09

Hello, I have gotten myself a bit confused. I have gone over the the FAQ-O-Matic entries on setting DB_CONFIG: http://www.openldap.org/faq/data/cache/1072.html http://www.openldap.org/faq/data/cache/1073.html http://www.openldap.org/faq/data/cache/1075.html I am working with a rather small ldap database (roughtly 3000 entries). When I look at top I see slapd grabbing 525 MB of memeory: PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 653 ldap 13 44 0 525M 27604K ucond 1 0:00 0.00% slapd Is slapd really using that or is that just reserved memory? When I db_stat my cache directory I think I am seeing that it is using 62 MB of cache (this is Delta-Sync Master, does that matter?): <snip> db_stat-4.6 -h /var/db/openldap-data -m 62MB 513KB 900B Total cache size 1 Number of caches 1 Maximum number of caches 62MB 520KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 592172 Requested pages found in the cache (99%) 1204 Requested pages not found in the cache 109 Pages created in the cache 1204 Pages read into the cache 8640 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 1313 Current total page count 1313 Current clean page count 0 Current dirty page count 8191 Number of hash buckets used for page location 594689 Total number of times hash chains searched for a page 2 The longest hash chain searched for a page 615710 Total number of hash chain entries checked for page 0 The number of hash bucket locks that required waiting (0%) 0 The maximum number of times any hash bucket lock was waited for (0%) 0 The number of region locks that required waiting (0%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 1381 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 8 Threads waited on page I/O </snip> When different indices, id2entry and dn2entry flies are all quite small (though _db.003 is 63 mb): ls -alh /var/db/openldap-data/ total 28924 drwx------ 3 ldap ldap 1.0K Jul 27 10:57 . drwxr-xr-x 10 root wheel 512B Jul 29 13:56 .. -rw-r--r-- 1 ldap ldap 1.3K Sep 16 2008 DB_CONFIG -rw------- 1 ldap ldap 24K Jul 27 10:55 __db.001 -rw------- 1 ldap ldap 560K Jul 27 10:55 __db.002 -rw------- 1 ldap ldap 63M Jul 27 10:55 __db.003 -rw------- 1 ldap ldap 3.0M Jul 27 10:55 __db.004 -rw------- 1 ldap ldap 464K Jul 27 10:55 __db.005 -rw------- 1 ldap ldap 32K Jul 27 10:55 __db.006 drwx------ 2 ldap ldap 512B Jul 27 10:57 accesslog -rw------- 1 ldap ldap 36K Jul 29 11:12 accountStatus.bdb -rw-r--r-- 1 ldap ldap 4.0K Jul 27 10:57 alock -rw------- 1 ldap ldap 956K Jul 29 11:12 cn.bdb -rw------- 1 ldap ldap 556K Jul 29 11:12 dn2id.bdb -rw------- 1 ldap ldap 84K Jul 29 11:12 entryCSN.bdb -rw------- 1 ldap ldap 72K Jul 29 11:12 entryUUID.bdb -rw------- 1 ldap ldap 36K Jul 29 11:12 gidNumber.bdb -rw------- 1 ldap ldap 544K Jul 29 11:12 givenName.bdb -rw------- 1 ldap ldap 2.5M Jul 29 11:12 id2entry.bdb -rw------- 1 ldap ldap 10M Jul 5 18:20 log.0000000004 -rw------- 1 ldap ldap 10M Jul 29 11:12 log.0000000005 -rw------- 1 ldap ldap 8.0K Jul 29 10:57 lookupKey.bdb -rw------- 1 ldap ldap 8.0K Oct 3 2008 lookupName.bdb -rw------- 1 ldap ldap 948K Jul 29 11:12 mail.bdb -rw------- 1 ldap ldap 36K Jul 29 11:12 mailForwardingAddress.bdb -rw------- 1 ldap ldap 48K Jul 29 11:12 mailQuotaSize.bdb -rw------- 1 ldap ldap 220K Jul 29 11:12 objectClass.bdb -rw------- 1 ldap ldap 596K Jul 29 11:12 sn.bdb -rw------- 1 ldap ldap 628K Jul 29 11:12 uid.bdb -rw------- 1 ldap ldap 72K Jul 29 11:12 uidNumber.bdb -rw------- 1 ldap ldap 72K Jul 29 11:12 userPassword.bdb Here is my DB_CONFIG as it stands: # cache set_cachesize 0 52428800 0 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 # Delete transaction log files as soon as contents are checkpointed and are no longer needed. set_flags DB_LOG_AUTOREMOVE I have the cache set to 50mb but I do not think I have this correct. Entry cache vs IDL cache vs BDB cache. Any help straightening this out would be appreciated. Peter

2 1

performance issue behind a a load balancer 2.3.32
by David J. Andruczyk 30 Jul '09

30 Jul '09

I work at a place with a fairly large openldap setup. (2.3.32). We have 3 large Read servers, Dell R900, 32 GB ram, 2x quadcore, hw RAID1 disks for ldap volume. The entire database takes about 13GB of physical disk space (the BDB files), and has a few million entries. DB_CONFIG is configurd to have the entire DB in memory (for speed), and slapd.conf cachesize is set to a million entries, to make as most effective use of the 32GB of ram this box has. We have them behind an F5 BigIP hardware load balancer (6400 series), and find that during peak times of the day, we get "connection deferred: binding" in our slapd.logs. (loglevel set to "none" (misnomer)), and a client request (or series of them) fails. If we use round robin DNS instead, we rarely see those errors. CPU usage is low, even during peak times, hovering at 20-50% of 1 core (the other 7 are idle) The interesting this are it seems to happen (the connection defered: binding) , only after a certian load threshold is reached (busiest time of day), and only when behind the F5's. I am suspected it might be the "conn_max_pending" or "conn_max_pending_auth" defaults (100 and 1000 respectively), as when behind the F5, all the connections will appear to come from the F5 addresses, vs RR dns where it's coming from a wde range of sources (eah of the servers. (well over 100+). We had tried experimenting with a higher number of threads previously, but that didn't seem to have a positive effect. Can any openLDAP guru's suggest some things to set/look for, i.e. (higher number of threads, higher defaults for conn_max_pending, conn_max_pending_auth). Any ideas on what a theoretical performance limit should be of a machine of this caliber? i.e. how many reqs/sec, how far will it scale, etc.. We have plans to upgrade to 2.4, but it's a "down the road item", and mgmt is demanding answers to "how far can this design scale as it is"... Thanks! -- David J. Andruczyk

9 22

slapcat and machines
by sgmayo＠mail.bloomfield.k12.mo.us 30 Jul '09

30 Jul '09

I am moving servers. I need to get the machine accounts (for samba) only from my old ldap directory. I don't want the users or anything, but only want the machines. How can I slapcat machines only? I guess that I am just wanting to get ou=Computers or something. I noticed that the manpage on both servers shows slapcat(8C), and the new server has an option '-a' that looks like it may do what I want, but the old one does not. I am still a newb on the ldap thing, so it is a bit confusing. Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

2 1

[multimaster cn=config] olcObjectIdentifier: value #0 olcObjectIdentifier: "olmLDAPAttributes" previously defined
by Thomas Chemineau 30 Jul '09

30 Jul '09

Hi, I am trying to build an OpenLDAP cluster in N-Way Multi-Master mode. I have three servers, all of them on the same network. The first provider has a configuration backend, and I want to replicate it over all nodes of my cluster. Configuration is OK, I am able to start the first provider and to play with it. I would like to run a second server, so that it replicates all of its configuration from the first provider. I do not follow exactly what it written in the online documentation, but my configuration is very similar. I create a "bootstrap" file (LDIF) with minimal information for my second node, and I slapadd it on the second node. So, I have a configuration directory, with only few files: cn=config.ldif cn=config olcDatabase={0}config.ldif olcDatabase={-1}frontend.ldif Now, I faced on a problem. I would like to start this node. It started well, but I have a lot of errors of duplicate values in OLC schema (olcObjectIdentifier, olcAttributeTypes, olcObjectClasses, olcLdapSyntaxes, etc...). See the attachment. Because of these errors, my configuration is not replicate (only the cn=schema.ldif), and my node is not operational. So, I would like to know why these errors occured ? Maybe I'm tired, but I can not find why. Any idea ? Best regards, Thomas. PS: in attachment, log and config from the second node. -- Thomas Chemineau

2 1

Enforcing Password Policy - Testing Lockout
by Subbarao Karanam 29 Jul '09

29 Jul '09

Hi, Currently I'm using Symas OPENLDAP 2.4.12.. It internally uses openLDAP 2.4.12 software I'm able to populate users in openldap database. Following is LDIF File I'm using ----- dn: dc=crmsldap,dc=company dc: crmsldap objectClass: dcObject objectClass: organization o: My company dn: ou=group,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: group dn: ou=people,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: people dn: ou=policies,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: policies dn: cn=default,ou=policies,dc=crmsldap,dc=company objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdMinLength: 2 pwdMaxFailure: 2 pwdLockout: TRUE pwdCheckQuality: 2 pwdExpireWarning: 600 pwdGraceAuthNLimit: 2 pwdInHistory: 2 pwdLockoutDuration: 0 pwdSafeModify: FALSE dn: cn=admin,ou=group,dc=crmsldap,dc=company objectClass: top objectClass: posixGroup gidNumber: 100 dn: uid=admin,ou=people,dc=crmsldap,dc=company objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: administrator sn: Administrator uid: admin userPassword: admin uidNumber: 1000 gidNumber: 100 homeDirectory: /home/admin pwdPolicySubentry:cn=default,ou=policies,dc=crmsldap,dc=company ---------- I have made all necassary changes to slapd.conf file After I give wrong password even 10 times. at the 11th time, if I give right password I'm able to login to openLDAP... Can somebody explain what is wrong in my LDIF File... Thanks Subbarao

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software July 2009