openldap-software March 2010

openldap-software@openldap.org

55 participants
43 discussions

Need help syncing with syncrepl 2.3
by L.B. 21 May '10

21 May '10

Hi; I've finally decided to make the move to syncrepl after much delay and procrastination. I've read the guide and also reviewed several howto's on the topic... It still isn't running correctly for me because it doesn't replicate a few new users I've added to the provider. Also I'm seeing the following issue over and over (every time it tries a sync on my 10m interval): ######### Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: do_syncrep2: rid 001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_del_nonpresent: rid 001 be_delete uid=airftp,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com (0) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 be_search (0) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 uid=airftp,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 be_add (0) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: do_syncrep2: rid 001 LDAP_RES_SEARCH_RESULT ######### My setup is RHEL4 with Buchan's RPMs (openldap2.3-servers-2.3.39-3.rhel4, etc.). I have a fairly simple setup, one provider and one consumer. Here is my provider config: ###################### include /usr/share/openldap2.3/schema/core.schema include /usr/share/openldap2.3/schema/cosine.schema include /usr/share/openldap2.3/schema/inetorgperson.schema include /usr/share/openldap2.3/schema/nis.schema include /usr/share/openldap2.3/schema/misc.schema include /usr/share/openldap2.3/schema/corba.schema include /usr/share/openldap2.3/schema/openldap.schema include /usr/share/openldap2.3/schema/ppolicy.schema include /usr/share/openldap2.3/schema/ldapns.schema access to * by dn.exact="cn=Replicator,dc=swa,dc=com" read by self read by * none break limits group="cn=Replicator,dc=swa,dc=com" size=unlimited time=unlimited access to * by dn.exact="uid=agis-ldap,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com" read by self read by * none break access to attrs=userPassword by self write by * auth pidfile /cluster/agis-ldap/ldap-master/var/run/slapd.pid argsfile /cluster/agis-ldap/ldap-master/var/run/slapd.args modulepath /usr/lib/openldap2.3 moduleload ppolicy.la moduleload syncprov.la TLSCertificateFile /cluster/agis-ldap/ldap-master/etc/cacerts/ldap.pem TLSCertificateKeyFile /cluster/agis-ldap/ldap-master/etc/cacerts/ldap.pem TLSCACertificateFile /cluster/agis-ldap/ldap-master/etc/cacerts/ldap.pem loglevel 256 database bdb suffix "dc=swa,dc=com" rootdn "cn=Manager,dc=swa,dc=com" rootpw {SSHA}YADYADAYADA directory /cluster/agis-ldap/ldap-master/var/lib/ldap overlay ppolicy ppolicy_default "cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com" ppolicy_use_lockout overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 serverid 001 cachesize 100000 idlcachesize 100000 checkpoint 256 5 index objectClass eq index ou,cn,mail,givenname eq,subinitial index uidNumber,gidNumber,memberUid,loginShell eq index uid eq,subinitial index uniqueMember pres index entryCSN,entryUUID eq ###################### Here is my consumer config: ###################### include /usr/share/openldap2.3/schema/core.schema include /usr/share/openldap2.3/schema/cosine.schema include /usr/share/openldap2.3/schema/inetorgperson.schema include /usr/share/openldap2.3/schema/nis.schema include /usr/share/openldap2.3/schema/misc.schema include /usr/share/openldap2.3/schema/corba.schema include /usr/share/openldap2.3/schema/openldap.schema include /usr/share/openldap2.3/schema/ppolicy.schema include /usr/share/openldap2.3/schema/ldapns.schema access to * by dn.exact="uid=agis-ldap,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com" read by self read by * none break access to attrs=userPassword by self write by * auth pidfile /cluster/agis-ldap/ldap-slave/var/run/slapd.pid argsfile /cluster/agis-ldap/ldap-slave/var/run/slapd.args modulepath /usr/lib/openldap2.3 moduleload ppolicy.la moduleload syncprov.la TLSCertificateFile /cluster/agis-ldap/ldap-slave/etc/cacerts/ldap.pem TLSCertificateKeyFile /cluster/agis-ldap/ldap-slave/etc/cacerts/ldap.pem TLSCACertificateFile /cluster/agis-ldap/ldap-slave/etc/cacerts/ldap.pem loglevel sync database bdb suffix "dc=swa,dc=com" rootdn "cn=Manager,dc=swa,dc=com" rootpw {SSHA}YADYADAYADA directory /cluster/agis-ldap/ldap-slave/var/lib/ldap overlay ppolicy ppolicy_default "cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com" ppolicy_use_lockout cachesize 100000 idlcachesize 100000 checkpoint 256 5 index objectClass eq index ou,cn,mail,givenname eq,subinitial index uidNumber,gidNumber,memberUid,loginShell eq index uid eq,subinitial index uniqueMember pres index entryCSN,entryUUID eq syncrepl rid=001 provider=ldap://ldap-agis01.mascorp.com type=refreshOnly interval=00:00:10:00 retry="60 10 300 +" searchbase="dc=swa,dc=com" filter="(objectClass=*)" binddn="cn=Replicator,dc=swa,dc=com" bindmethod=simple credentials=yadayadayada schemachecking=off updateref ldap://ldap-agis01.mascorp.com/ ###################### Any help would be much appreciated! Thanks!! Rafael

3 2

Slave connecting to maser always stay connected?
by Mathew Rowley 14 Apr '10

14 Apr '10

I have a setup with 2 masters (nway multimaster) and 4 slaves each having syncrepl set up to connect to the 2 masters. The question I have, with the following configuration (on the slaves) should they always be connected to the masters? Netstat is showing that the connections are intermittent: type=refreshAndPersist retry="60 +" Netstat on the masters shows that the connections from the slaves will vary sometimes 0, sometimes 4 seems to be somewhat random. We are trying to determine if there is something wrong in our network. Thanks for the help. MAT

3 6

built in objectClasses and atrributes
by Itay Moav 01 Apr '10

01 Apr '10

Greetings, Where can I see the list of built in objectClasses and attributes the OpenLDAP ships with? Thanks IM

4 5

Re: slow slave performance
by Quanah Gibson-Mount 01 Apr '10

01 Apr '10

--On Monday, March 29, 2010 11:41 AM -0700 Jefferson Davis <jdavis(a)standard.k12.ca.us> wrote: > > not quite the answer I was hoping for... > > However, I will look for more updated repo's - this 2.2 is the latest > and greatest for rhel/centos 4.8... > > While i'm not averse to compiling source, it's generally simpler to > maintain via package mgt than patching/compiling, etc... > > and wholesale upgrade of server os is not an option I want to look at > right now. > > In the meantime... nothing I can do w/2.2? You can try basic tuning (via DB_CONFIG for Berkeley DB) and the cachesize. But some of the options for tuning available in later releases are not valid for 2.2. For running a production LDAP service, I near always recommend building and maintaining it yourself. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

5 5

Syncrepl loosing synchronization
by Massimo Lusetti 01 Apr '10

01 Apr '10

Hi all, I have 6 servers which all synchronize with syncrepl mechanism from a single master. Of that six server one is the master and 2 are local connected servers, every server is a 2.4, plus there are 3 remote connected servers which are all 2.3 With local connected i mean LAN (maybe different DMZ) while remote connected i mean WAN (with data over the relative-slow link). It happens frequently that the remote servers loose synchronization with the master (no more updates to data) when/if the link goes down. Or even when the link is slower the usual. The local connected servers are all with refreshAndPersist while the remotes one are refreshOnly. Every replica has a retry of "60 +" so it tries indefinitely and the refreshOnly ones has an interval of 45 Did you have any clues while is should loose synchronization and the only possible solution is to rebuild the whoile DIT on the replicas? Cheers -- Massimo

2 1

architecture and DIT change strategy
by Guillaume Rousse 01 Apr '10

01 Apr '10

Hello. I'm trying to find the best way to conduct a consequent change in our data model and servers topology, with the fewer service disturbing. Before the reorganisation, we were a single entity, splitted on three different sites. As a consequence, we had a single database for all our users and groups: dc=new,dc=foo,dc=tld |-users | |-site1 | |-site2 | |-site3 |-groups |-site1 |-site2 |-site3 The master server is hosted on one site, and we have slave servers on three sites After the reorganisation, we are three different entities, and I'd like to break the tree in the three different databases, each site hosting a server acting as the master for its own base, a slave for the two others: dc=site1,dc=foo,dc=tld |-users |-groups dc=site2,dc=foo,dc=tld |-users |-groups dc=site3,dc=foo,dc=tld |-users |-groups The change also involves dropping the last part of the original suffix, which is no longer relevant. I'm currently investigating the usage slapo-rwm to provide virtual views of the current database according to the new structure, so as to progressively migrate applications configuration first, then write an automated conversion tool, and finally convert the virtual bases to new ones. But maybe they are better strategies ? -- BOFH excuse #193: Did you pay the new Support Fee?

2 1

Re: built in objectClasses and atrributes
by Michael Ströder 01 Apr '10

01 Apr '10

Please stay on the mailing list. Itay Moav wrote: > yes - only the hard coded ones (as I figured where to find and read the > schema files that comes with the installation :-) ) Do not include schema files and start slapd with all the overlays you need. Then look at the subschema subentry. Ciao, Michael.

1 0

Re: slow slave performance
by Michael Ströder 31 Mar '10

31 Mar '10

Jefferson Davis wrote: > > I know I need to remove the rpm packages before I install the new stuff. Not necessarily. You could leave all the RPM-based stuff depending on libldap and compile the server software to a completely separate prefix. Ciao, Michael.

3 5

Re: Replication problems.
by Steve Button 31 Mar '10

31 Mar '10

On 26 March 2010 17:41, Steve Button <steve(a)pointers-uk.net> wrote: > On 26 March 2010 14:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > >> --On Friday, March 26, 2010 8:39 AM +0000 Steve Button < >> steve(a)pointers-uk.net> wrote: >> >> I'm checking this by comparing the date stamp in the contextCSN. Have >>> Any suggestions? >>> >> Which release? >> >> --Quanah >> >> The release is 2.3 > >> >> I have just found the problem (well a colleague has actually - thanks Sam). My original config had :- type refreshOnly interval 00:00:05:00 and it needed to be :- type=refreshOnly interval=00:00:05:00 Fixed these and replication is working fine using 2.3. At least so far anyway. I'm using the version which comes with RedHat 5.3 which shows as 2.3.43-3 Steve -- http://ournaturalway.co.uk

1 0

Re: kerberized OpenLDAP
by Guillaume Rousse 30 Mar '10

30 Mar '10

Le 29/03/2010 10:26, Wolf-Agathon Schaly a écrit : > If I leave the LDAP server listening on the TCP address of localhost (127.0.0.1) declips is cool. > If I change the entry in /etc/openldap/ldap.conf from > URI=ldap://127.0.0.1/ > to > URI=ldap://10.1.1.1/ > I'm facing the same issue (gss_accept_sec_context) as on levante. > > > Is there somebody out there who can lead me to a solution. It seems like a name canonicalisation error for me, as you have a multihomed setup, and result varies with the IP adress you're using. You have to ensure the principal used in LDAP server keytab (its SPN) matches both the ones used by client when they ask a service ticket (DNS hostname for the IP adress used in their /etc/openldap/ldap.conf files), and the one used by the server itself (by default, the one returned by gethostname(), otherwise, the one specified with sasl_hostname directive in its configuration file). You may also check in the KDC logs what are the principal requested by clients. -- BOFH excuse #11: magnetic interference from money/credit cards

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2010