openldap-software March 2010

openldap-software@openldap.org

55 participants
43 discussions

syncrepl failure over time
by Aaron Bennett 15 Mar '10

15 Mar '10

Hi, openldap-2.3.43 db4-4.3.29 CentOS 5.3 We're observing that syncrepl with refreshandpersist is failing at some point after an ldap restart. I've written a script to try to figure out exactly when, but it's sometime within 24 hours. A slapd restart on the consumer always picks up any pending changes. Here's our configuration: syncrepl provider: database bdb overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=clarku,dc=edu" #readonly on overlay syncprov suffix "dc=clarku,dc=edu" rootdn "cn=Manager,ou=Services,dc=clarku,dc=edu" rootpw --snip-- directory /var/lib/ldap checkpoint 5120 60 cachesize 50000 idlcachesize 150000 dbconfig set_cachesize 0 524288000 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_flags DB_LOG_AUTOREMOVE sizelimit 30 conn_max_pending 400 concurrency 25 threads 25 limits dn="cn=Replicator,ou=Services,dc=clarku,dc=edu" size=none syncrepl consumer: database bdb overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=clarku,dc=edu" #readonly on suffix "dc=clarku,dc=edu" rootdn "cn=Manager,ou=Services,dc=clarku,dc=edu" rootpw --snip-- directory /var/lib/ldap checkpoint 5120 60 cachesize 50000 idlcachesize 150000 dbconfig set_cachesize 0 524288000 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_flags DB_LOG_AUTOREMOVE syncrepl rid=001 provider=ldap://nyx.clarku.edu type=refreshandpersist searchbase="dc=clarku,dc=edu" scope=sub retry= 30 10 120 + bindmethod=simple binddn="cn=Replicator,ou=Services,dc=clarku,dc=edu" credentials=--snip-- best, Aaron Bennett Clark University ITS

4 4

Authentication Issue
by Richard Golding 12 Mar '10

12 Mar '10

I am trying to setup a server and running into an issue whereby I cannot authenticate using the rootdn. (I am new to OPENLDAP so apologies in advance if this is a basic question) The problem is I get "Invalid Credentials" returned Here is an excerpt from my Slapd.conf file database bdb suffix "dc=my-domain,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret rootpw {crypt}ijFYNcSNctBYg And here is the OpenLDAP command I run: [root@localhost rgolding]# ldapadd -D cn=Manager,dc=my-domain,dc=com -w secret -f /tmp/newentry ldap_bind: Invalid credentials (49) [root@localhost rgolding]# And here is the LDAP entry I am trying to add: [root@localhost rgolding]# more /tmp/newentry dn: cn=Barbara Jensen,dc=my-domain,dc=com ObjectClass: person cn: Barbara Jensen cn: Babs Jensen sn: Jensen title: the world's most famous mythical manager mail: bjensen(a)example.com uid: bjensen Thanks in advance Richard

3 2

glue objects
by Dieter Kluenter 09 Mar '10

09 Mar '10

Hi, when adding a subtree object, it is occasionally not properly created, instead only a glue object is created: ,----[ created glue object ] | dn: o=xxxxx,dc=abook,dc=example,dc=com | entryUUID: a3a1368a-a12f-102e-941f-adf8df1281f9 | creatorsName: dc=abook,dc=example,dc=com | createTimestamp: 20100129143758Z | entryCSN: 20100129143758.447642Z#000000#001#000000 | modifiersName: dc=abook,dc=example,dc=com | modifyTimestamp: 20100129143758Z | objectClass: top | objectClass: glue | structuralObjectClass: glue | entryDN: oxxxx,dc=abook,dc=example,dc=com | subschemaSubentry: cn=Subschema | hasSubordinates: TRUE `---- Part of the script to create this object with proper objectclasses and attributes can be found here: http://pastebin.de/4465 Any idea why an object with objectclass glue is created? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

2 2

ldap_search_ext_s and non-const attrs parameter
by Haszlakiewicz, Eric 08 Mar '10

08 Mar '10

I am using ldap_search_ext_s with an attrs parameter that looks something like this: const char* attrs[] = { "cn", "statusCode", NULL }; Previously, I did not have the const qualifier on there, but I increased the warning level of my compiler, and it was (correctly) complaining that I was treating string constants as non-constant. Unfortunately, the ldap_search_ext_s function is declared *without* the const qualifier: LDAP_F( int ) ldap_search_ext_s LDAP_P(( LDAP *ld, LDAP_CONST char *base, int scope, LDAP_CONST char *filter, char **attrs, <------ here int attrsonly, LDAPControl **serverctrls, LDAPControl **clientctrls, struct timeval *timeout, int sizelimit, LDAPMessage **res )); Does this mean that I really do need to pass in mutable buffers, or is the API incorrect? If it needs to be mutable, under what conditions will those be changed, and do I need to re-initialize the values after every call? I notice that other ldap libraries (e.g. IBM's Tivoli Directory Server) *do* use const for that parameter. eric

1 0

poor performance of db-4.8.26?
by Dieter Kluenter 08 Mar '10

08 Mar '10

Hi, I'm just testing performance of db-4.5.20 vs. db-4.8.26 and found that db-4.8.26 much slower than db-4.5.20. BerkeleyDB: 4.5.20 real 0m4.973s user 0m2.043s sys 0m0.784s BerkeleyDB: 4.8.26 real 0m7.461s user 0m2.517s sys 0m0.995s The OS is openSuSE-11.1, I just built openldap-2.4.21 twice, using the same slapd.conf to setup two servers and slapadded some 30,000 dummy entries, the search was done on a subtree with 10,000 dummy entries. The script can be found here: http://pastebin.de/4428 In fact I tested filesystem performance as well, creating partions with ext3, ext4 and btrfs, but fould that these filesystems had almost no influence on performance, at least not with such a small database. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

3 4

Question about /etc/openldap/ldap.conf
by Rogov Stepan 07 Mar '10

07 Mar '10

Hi there! I have openldap 2.4.21. I configured it with ssl(ldaps) and "TLSVerifyClient demand". On the client side file /etc/openldap/ldap.conf contains the following: TLS_CACERT /etc/ssl/servercert.ca.crt TLS_CERT /etc/openldap/client.crt TLS_KEY /etc/openldap/client.key But samba and ldap-standard tools (eg ldapsearch) don't connect to ldap-server: TLS trace: SSL3 alert read: fatal: handshake failure TLS trace: SSL_connect: failed in SSLv3 read finished A TLS: can't connect: error: 14094410: SSL routines: SSL3_READ_BYTES: sslv3 alert handshake failure. ldap_err2string ldap_sasl_bind (SIMPLE): Can't contact LDAP server (-1) If you save the content of /etc/openldap/ldap.conf in ~ /.ldaprc or use variables $LDAP<uppercase option name>, then everything works fine. I assume that options TLS_CERT and TLS_KEY aren't read from /etc/openldap/ldap.conf. Correspondingly the server can not verify client certificates. But the manual says: "Thus the following files and variables are read, in order: variable $LDAPNOINIT, and if that is not set: system file /etc/openldap/ldap.conf, user files $HOME/ldaprc, $HOME/.ldaprc, ./ldaprc, system file $LDAPCONF, user files $HOME/$LDAPRC, $HOME/.$LDAPRC, ./$LDAPRC, variables $LDAP<uppercase option name>. Settings late in the list override earlier ones." Could you explain me what wrong is?

3 2

need help with syncrepl on 2.3.39
by L.B. 05 Mar '10

05 Mar '10

Hi; I've finally decided to make the move to syncrepl after much delay and procrastination. I've read the guide and also reviewed several howto's on the topic... It still isn't running correctly for me because it doesn't replicate a few new users I've added to the provider. Also I'm seeing the following issue over and over (every time it tries a sync on my 10m interval): ######### Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: do_syncrep2: rid 001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_del_nonpresent: rid 001 be_delete uid=airftp,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com (0) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 be_search (0) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 uid=airftp,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: syncrepl_entry: rid 001 be_add (0) Mar 5 20:25:19 admin-agis01 slapd2.3[6147]: do_syncrep2: rid 001 LDAP_RES_SEARCH_RESULT ######### My setup is RHEL4 with Buchan's RPMs (openldap2.3-servers-2.3.39-3.rhel4, etc.). I have a fairly simple setup, one provider and one consumer. Here is my provider config: ###################### include /usr/share/openldap2.3/schema/core.schema include /usr/share/openldap2.3/schema/cosine.schema include /usr/share/openldap2.3/schema/inetorgperson.schema include /usr/share/openldap2.3/schema/nis.schema include /usr/share/openldap2.3/schema/misc.schema include /usr/share/openldap2.3/schema/corba.schema include /usr/share/openldap2.3/schema/openldap.schema include /usr/share/openldap2.3/schema/ppolicy.schema include /usr/share/openldap2.3/schema/ldapns.schema access to * by dn.exact="cn=Replicator,dc=swa,dc=com" read by self read by * none break limits group="cn=Replicator,dc=swa,dc=com" size=unlimited time=unlimited access to * by dn.exact="uid=agis-ldap,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com" read by self read by * none break access to attrs=userPassword by self write by * auth pidfile /cluster/agis-ldap/ldap-master/var/run/slapd.pid argsfile /cluster/agis-ldap/ldap-master/var/run/slapd.args modulepath /usr/lib/openldap2.3 moduleload ppolicy.la moduleload syncprov.la TLSCertificateFile /cluster/agis-ldap/ldap-master/etc/cacerts/ldap.pem TLSCertificateKeyFile /cluster/agis-ldap/ldap-master/etc/cacerts/ldap.pem TLSCACertificateFile /cluster/agis-ldap/ldap-master/etc/cacerts/ldap.pem loglevel 256 database bdb suffix "dc=swa,dc=com" rootdn "cn=Manager,dc=swa,dc=com" rootpw {SSHA}YADYADAYADA directory /cluster/agis-ldap/ldap-master/var/lib/ldap overlay ppolicy ppolicy_default "cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com" ppolicy_use_lockout overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 serverid 001 cachesize 100000 idlcachesize 100000 checkpoint 256 5 index objectClass eq index ou,cn,mail,givenname eq,subinitial index uidNumber,gidNumber,memberUid,loginShell eq index uid eq,subinitial index uniqueMember pres index entryCSN,entryUUID eq ###################### Here is my consumer config: ###################### include /usr/share/openldap2.3/schema/core.schema include /usr/share/openldap2.3/schema/cosine.schema include /usr/share/openldap2.3/schema/inetorgperson.schema include /usr/share/openldap2.3/schema/nis.schema include /usr/share/openldap2.3/schema/misc.schema include /usr/share/openldap2.3/schema/corba.schema include /usr/share/openldap2.3/schema/openldap.schema include /usr/share/openldap2.3/schema/ppolicy.schema include /usr/share/openldap2.3/schema/ldapns.schema access to * by dn.exact="uid=agis-ldap,ou=SystemUsers,ou=SystemAccounts,dc=swa,dc=com" read by self read by * none break access to attrs=userPassword by self write by * auth pidfile /cluster/agis-ldap/ldap-slave/var/run/slapd.pid argsfile /cluster/agis-ldap/ldap-slave/var/run/slapd.args modulepath /usr/lib/openldap2.3 moduleload ppolicy.la moduleload syncprov.la TLSCertificateFile /cluster/agis-ldap/ldap-slave/etc/cacerts/ldap.pem TLSCertificateKeyFile /cluster/agis-ldap/ldap-slave/etc/cacerts/ldap.pem TLSCACertificateFile /cluster/agis-ldap/ldap-slave/etc/cacerts/ldap.pem loglevel sync database bdb suffix "dc=swa,dc=com" rootdn "cn=Manager,dc=swa,dc=com" rootpw {SSHA}YADYADAYADA directory /cluster/agis-ldap/ldap-slave/var/lib/ldap overlay ppolicy ppolicy_default "cn=swaPasswordPolicy,ou=Policies,dc=swa,dc=com" ppolicy_use_lockout cachesize 100000 idlcachesize 100000 checkpoint 256 5 index objectClass eq index ou,cn,mail,givenname eq,subinitial index uidNumber,gidNumber,memberUid,loginShell eq index uid eq,subinitial index uniqueMember pres index entryCSN,entryUUID eq syncrepl rid=001 provider=ldap://ldap-agis01.mascorp.com type=refreshOnly interval=00:00:10:00 retry="60 10 300 +" searchbase="dc=swa,dc=com" filter="(objectClass=*)" binddn="cn=Replicator,dc=swa,dc=com" bindmethod=simple credentials=yadayadayada schemachecking=off updateref ldap://ldap-agis01.mascorp.com/ ###################### Any help would be much appreciated! Thanks!! Rafael

1 0

operations_error on simple bind with ruby ffi
by Thilko Richter 05 Mar '10

05 Mar '10

Hello, I am developing an ldap binding with ruby ffi. Currently I try to implement a simple bind to an local open ldap server. Unfortunately I always get an 'operations error'(1) on a ldap_simple_bind. I played around with different credentials and ldap_open and ldap_init as well, but I can´t change the error on bind. My app does a 'ldap_open' and then a 'ldap_simple_bind'. In contrast to that a 'ldap_open' and 'ldap_search' works fine. Since I am a newbie with c ldap api I would appreciate some hints where I could search for debug msgs and other stuff. /var/log/syslog says nothing... Thx in advance, Thilko

1 0

Mirrormode Docs
by Dieter Kluenter 03 Mar '10

03 Mar '10

Hi, to my understanding the admin guide on mirrormode is misleading. http://www.openldap.org/doc/admin24/replication.html#MirrorMode According to this documentation both nodes have to be put into mirror mode, as far as I understand the concept of mirror mode, and is described in slapd.conf(5), there is one node accepting write operations, that is 'mirrormode on' statement, the other node acts as synrepl consumer and a hot standby only, with 'mirrormode off'. Could someone please correct me, if I'm wrong. -Dieter -- Dieter Klünter | Systemberatung sip: +49.180.1555.7770535 http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 3

Less aggressive syncrepl ?
by Jorgen Lundman 03 Mar '10

03 Mar '10

Hello list, openldap-2.3.41 db-4.2.52.NC-PLUS_5_PATCHES SunOS ldapmaster01.unix 5.10 Generic_127128-11 i86pc i386 i86pc We currently have 1 master, and about 25 clients hanging off it, using syncrepl. Today we restarted the master for the first time in quite some time. This was to add an index we had forgotten. It was only added to the master. Initially, the master replies very fast to test-ldapsearch. But it appears that all 25 clients connect within the first 30seconds or so, and start the syncing process. This appears to take about 30 minutes of communicating back and forth. (As observed with snoop/tcpdump). Simple commandline ldapsearch connect, but never replies. I haven't even started the software that talks to ldapmaster, so it is essentially doing nothing. (Just checking everything is in sync, there should be no changes). This seems rather aggressive. I assume my syncrepl is set far too eagerly. Normally, syncrepl works beautifully, and updates are very fast across the board. But having hour long no-response from the master after a restart is undesirable. Can someone suggest better values for our syncrepl? Master has: lastmod on checkpoint 128 15 cachesize 10000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Slaves has: (RID is based on IP's last octet + 256) lastmod on checkpoint 128 15 cachesize 10000 syncrepl rid=279 provider=ldap://172.20.12.113 type=refreshAndPersist interval=00:00:00:30 searchbase="dc=company,dc=com" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off updatedn="cn=admin,dc=company,dc=com" bindmethod=simple binddn="cn=admin,dc=company,dc=com" credentials="OurSecret" retry="60 10 300 +" # wait 60s then retry connect 10 times, then wait 300s forever updateref ldap://172.20.12.113 -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software March 2010