openldap-software May 2010

openldap-software@openldap.org

32 participants
27 discussions

Using back-meta or back-relay plus slapo-rwm as a proxy to a local database
by Ryan Steele 18 May '10

18 May '10

Ok, fair warning - this is a little long-winded, but I'd rather give too much detail than not enough. Also, all examples are in slapd.conf format, since there is no documentation for cn=config, and I'm using slapd with -f and -F to make the conversion. Anyways, I'm working on implementing some rewrite rules with slapo-rwm, using back-relay (or possibly back-meta if that doesn't work out) as the backend on top of which slapo-rwm will sit, to make available some features that would be otherwise not be present with back-ldap, or in the absence of a proxy backend altogether. In its most basic form, the slapo-rwm overlay can be used without a proxy or relay backend, but the feature I'm after appears to require either the slapd-meta backend or the slapd-relay backend. For now, I've chosen to try with slapd-relay, as my research has indicated it supports the feature I'm after. For reference, this feature I desire is the 'searchResult' rewriteContext, as I'm interested in rewriting dynamic group membership DN's (i.e., the 'member' attribute, as defined in rfc2307bis) as plain uid's, so clients that only know about rfc2307 (and thus, look only for entries of the same format as memberUid and fail to perform any mappings to translate membership DN's to UID's) can make use of the dynamic groups I've created in my directory. Since my slapd-hdb database's rootDSE is dc=example,dc=com, I really couldn't find any way to get around using a virtual naming context; creating a back-meta database on the same host with the same suffix as the back-hdb database seemed ambiguous at best (in terms of how to ensure that clients would always speak to the back-meta db first), and using the suffix "dc=com" seemed inappropriate, as did creating several relay databases, one for each of the entries below the slapd-hdb database's rootDSE (e.g., ou=Users,dc=example,dc=com, ou=Groups,dc=example,dc=com, etc.). Creating several relay databases in that fashion presents other problems as well, and wouldn't do me any good for clients which query for entries using dc=example,dc=com as their search base. Given that, and the fact that I'm only looking to remap/rewrite data going to and from a single local database with a single naming context, I decided it was a better idea to create a single back-relay database with a bogus "proxy" naming context and use a suffixmassage to rewrite it, e.g.: database relay suffix "dc=example-proxy,dc=com" relay "dc=example,dc=com" overlay rwm rwm-rewriteEngine on rwm-suffixmassage "dc=example-proxy,dc=com" "dc=example,dc=com" rwm-rewriteContext searchResult rwm-rewriteRule "^uid=([^,]+?),ou=Users,dc=example,dc=com$" "$1" For reference, here is the back-meta database configuration I was going to use before I discovered that back-relay supported the searchResult rewriteContext: database meta suffix "dc=example-proxy,dc=com" overlay rwm rwm-rewriteEngine on uri "ldap://localhost/dc=example-proxy,dc=com" rwm-suffixmassage "dc=example-proxy,dc=com" "dc=example,dc=com" rwm-rewriteContext searchResult rwm-rewriteRule "^uid=([^,]+?),ou=Users,dc=example,dc=com$" "$1" In either case, I have a few questions going forward from this point: 1. Is it legal to rewrite the search result DN's as described in the example above? I'm hoping that since the data being manipulated is going from server -> client and is not being stored in the directory, the attributes I'm rewriting would not be subjected to the syntax requirements of the entry that holds them. 2. Are there any benefits or drawbacks to using a rewriteMap to accomplish this task? In my mind, it just seems like another means to the same end, at least based on the following configuration I came up with: rwm-rewriteMap ldap dn2uid "ldap://localhost/ou=Users,dc=example,dc=com?uid?sub" rwm-rewriteContext searchResult rwm-rewriteRule "^uid=([^,]+?),ou=Users,dc=example,dc=com$" "${dn2uid($1)}" 3. Is there a better way to go about doing this that I've failed to see or consider? 4. Considering the slapd-meta man page, which mentions that some of its features could potentially result in excessive overhead for some installations, are the features used in the aforementioned configuration(s) efficient enough to scale well in a very busy environment? I'm aware that's a pretty vague and loaded question with lots of variables, so I'm just looking for an educated opinion from a 10,000 foot view, assuming excellent hardware, high network capacity, and heavy - say, 5k, 10k, 15k queries per second - traffic. Performance will obviously be tested before implementing this, but it'd still be nice to have a rough idea of what to expect going in. Lastly, on a somewhat tangential note, given that there's no documentation with respect to cn=config for setting up slapo-rwm (or doing it in conjunction with a proxy backend), is there any way to discover the cn=config attributes and objectclasses for those backend and overlays that's better or more efficient than creating a standard slapd.conf configuration and converting it with slapd using -f and -F? Perhaps an official or unofficial bit of documentation floating around out there other than a few miscellaneous postings on the mailing lists and some ITS contents? On a similar note in the same vein, as far as I can tell, none of the man pages, admin guide sections, or FAQ-O-Matic entries on slapd-relay mention which rewrite contexts are available with it, and I didn't realize that slapd-relay accepted the searchResult rewrite context until I read the servers/slapd/back-relay/README file (while searching for code that might reveal slapo-rwm's cn=config attribute equivalents). Would it be objectionable to update these reference points with said information? I'd be happy to file an ITS and submit patches and/or content for updating the documentation, if Gavin is too busy, unavailable, or would like some help. Thanks for any and all advice, musings, criticisms, and opinions! -Ryan -- Ryan Steele Systems Administrator AWeber Communications

2 8

Verifying proxy cache operation
by Liam Gretton 18 May '10

18 May '10

Can anyone suggest a means of verifying that my proxy cache (using the pcache overlay) is actually returning results from the cache and not the backend LDAP server? I've got reams of debug output from slapd -d -1, but I'm unsure how to interpret it. I'm sure there are some magic strings within the output that would indicate the cache is being hit. Any pointers would be appreciated. The pcache db is bdb. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 2

do_bind: invalid dn
by Joshua Lim 17 May '10

17 May '10

Hi, I'm a newbie, downloaded a Windows compilation of OpenLDAP v2.4.18 from http://www.userbooster.de/en/download/openldap-for-windows.aspx Am having some problems trying to get a client to bind to my setup, the error is: do_bind: invalid dn Hope to receive some pointers. Thanks. : ) My slapd.conf (i basically used the default, only suffix, rootdn and rootpw is changed): ******************************** database bdb suffix "dc=click,dc=com" rootdn "cn=wael,dc=click,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data dirtyread searchstack 20 # Indices to maintain index mail pres,eq index objectclass pres index default eq,sub index sn eq,sub,subinitial index telephonenumber index cn ******************** openldap.log: ******************** OpenLDAP 2.4.18 Standalone LDAP Server (slapd)daemon_init: listen on ldap://JOSHUA:389 daemon_init: listen on ldaps://JOSHUA:636 daemon_init: 2 listeners to open... ldap_url_parse_ext(ldap://JOSHUA:389) daemon: listener initialized ldap://JOSHUA:389 ldap_url_parse_ext(ldaps://JOSHUA:636) daemon: listener initialized ldaps://JOSHUA:636 daemon_init: 6 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) ==>sql_back_initialize() <==sql_back_initialize() bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=click,dc=com> <<< dnPrettyNormal: <dc=click,dc=com>, <dc=click,dc=com> >>> dnPrettyNormal: <cn=wael,dc=click,dc=com> <<< dnPrettyNormal: <cn=wael,dc=click,dc=com>, <cn=wael,dc=click,dc=com> >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init ................ slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}nis" config_build_entry: "cn={3}inetorgperson" config_build_entry: "cn={4}openldap" config_build_entry: "cn={5}dyngroup" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=click,dc=com" bdb_db_open: warning - no DB_CONFIG file found in directory ./data: (2). Expect poor performance for suffix "dc=click,dc=com". bdb_db_open: database "dc=click,dc=com": dbenv_open(./data). bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting slap_listener_activate(2): >>> slap_listener(ldap://JOSHUA:389) connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 20 contents: op tag 0x60, time 1273085183 ber_get_next conn=0 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <wael> conn=0 op=0 do_bind: invalid dn (wael) send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=34 ber_flush2: 32 bytes to sd 2124 connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ber_get_next on fd 8 failed errno=0 (unknown WSA error) connection_close: conn=0 sd=8 ********************

4 5

ldap_str2dn() and ldap_dn2str() reentrant?
by Michael Ströder 16 May '10

16 May '10

HI! Routinely in the C module part of python-ldap all calls to libldap functions are wrapped by a thread lock. But I wonder whether that's really necessary for all of them, especially regarding ldap_str2dn() and ldap_dn2str(). Ciao, Michael.

2 2

2.4.21 and 2.4.22 exit on signal 6
by Massimo Lusetti 14 May '10

14 May '10

Hi list, I'm experiencing some problems with and LDAP box which used to run 2.4.21 and has been upgraded to 2.4.22 The box act as a pam_ldap/nsswitch login server for a bunch of boxes, let's say 20, and serve the mail server and web proxy server as a user base. The box has 2G of RAM and has an average load very low, let's say top/systat shows 0.40. The issue is that it happens from time to time every 2/4 days that the slapd daemon exits on signal 6: May 12 01:00:00 polido kernel: pid 27153 (slapd), uid 389: exited on signal 6 Then i restart the process everything looks fine and no corruption seems to happen in the DB. The box is a FreeBSD 8 Any clue is really appreciated. Thanks -- Massimo Lusetti

3 3

syncrepl_del_nonpresent and syncrepl issues.
by Jorgen Lundman 13 May '10

13 May '10

openldap-2.3.41 db-4.2.52.NC-PLUS_5_PATCHES Solaris 10 x86 Layout: ldapmaster <-syncrepl-> ldapslave01/02/03/04 <-syncrepl-> data-clusters. It has come to light that we have some sync inconsistencies. At the moment, a customer domain that shows correct entries on ldapmaster, ldapslave02, ldapslave04 (and all servers syncing from them). But has incorrect, or rather missing, entries on ldapslave01 and ldapslave03. There are no differences between these hosts (they are in fact HDD clones) and config files are pushed from git, with only RID changed. The logs on ldapslave03 for one of the broken entries (in this case, ou=DNS). I have loglevel=sync on all servers: slaplog.20100407.gz:Mar 3 12:27:12 ldapslave03.unix slapd[27355]: [ID 561622 local4.debug] syncrepl_del_nonpresent: rid 329 be_delete DNSHostName=(a),DNSZoneName=example.com,ou=dns,$DC (66) slaplog.20100407.gz:Mar 3 12:27:12 ldapslave03.unix slapd[27355]: [ID 561622 local4.debug] syncrepl_del_nonpresent: rid 329 be_delete DNSZoneName=example.com,ou=dns,$DC (66) What is "syncrepl_del_nonpresent"? Is it something I should be worried about? If I count the number of entries with said error: ldapslave02: 42 ldapslave03: 7240 Which makes me wonder if it is a global problem for us, but is exaggerated on some servers. I notice that the provisioning log for that customer's domain has about 24 "+dns" and "-dns" entries in a row. Not entirely sure why the customer was changing their DNS back and forth so much, but perhaps it is related. Can it be that a "delete/create/delete" sequence of the same DN, sent to master, but which has not yet been pushed out to all slaves, may trigger this situation? Surely all replication is in strict time sequence though. Is there anything I can do presently? Any advise is most appreciated. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

3 11

Re: Interesting delta-syncrepl failure
by Matheus Morais 12 May '10

12 May '10

I'm having the same issue here. There are some news on this subject? Thanks, Matheus Morais On Wed, May 5, 2010 at 1:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, May 05, 2010 10:31 AM -0400 Francis Swasey < > Frank.Swasey(a)uvm.edu> wrote: > > In OpenLDAP 2.3 -- this modify ldif deck failed because the "sn" >> attribute is presented twice. In OpenLDAP 2.4 -- it works, but the >> delta-syncrepl replica pukes on it with this error: >> >> syncrepl_message_to_op: rid=100 mods check (sn: value #0 provided more >> than once) >> >> If the OpenLDAP 2.4.22 server accepts it, processes it, and feeds it out >> -- shouldn't the OpenLDAP 2.4.22 delta-syncrepl consumer eat it without >> complaining? >> > > There's definitely something wrong here, yes. I suggest you file an ITS. > Either 2.4 shouldn't have taken the change, or the accesslog should have > written it in a way the replica would accept. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

pls help: performance tuning
by ST Wong (ITSC) 12 May '10

12 May '10

Hi all, I'm using openldap 2.4.21 + BerkeleyDB 4.8.26 on a machine with 4 cores. The system occassionally does accept connection and get error: May 9 03:03:31 holiday slapd[2382]: connection_input: conn=645254 deferring operation: too many executing I currently set thread in slapd.conf to 32 (default x 2). While I think shouldn't modify SLAP_MAX_WORKER_THREADS, I tried to increase no. of threads, at the cost of read performance. Besides, after increasing thread to over 32, say 100, I got warning of "threads larger than twice the default". Would like to know the recommended way to tune the system in our case. Would anyone pls help? Sorry for the newbie question. Thanks a lot. /ST Wong (st-wong(a)cuhk.edu.hk)

3 3

how to NOT use SASL
by Frank Van Damme 11 May '10

11 May '10

Hi list, Now this is something I don't understand. TSL shouldn't require the use of sasl, logically speaking, yet why am I getting this output? frvdamme@osc1:~$ ldapsearch -w dd -D 'cn=admin,dc=otec,dc=vub,dc=ac,dc=be' '(cn=admin)' -H ldap://localhost -x ldap_bind: Invalid credentials (49) frvdamme@osc1:~$ ldapsearch -w dd -D 'cn=admin,dc=otec,dc=vub,dc=ac,dc=be' '(cn=admin)' -x -H ldap://osc1 -x ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) So the only difference is how I specify the hostname and ldapsearch chooses to use sasl, even though I'm specifying -x. Why?? -- Frank Van Damme A: Because it destroys the flow of the conversation. Q: Why is it bad? A: No, it's bad. Q: Should I top post in replies to mailing lists or on Usenet?

2 2

attribute value rewrite with slapo-rwm
by Sascha Thomas Spreitzer 10 May '10

10 May '10

Hello all, due to some IBM software lackings, i need to overwrite the attribute ibm-aixAdminPolicyEntry[1] in the condition of a certain memberof group membership. The slapo-rwm man page cant help me with that, nor have I fiddled out yet, how to change attribute contents. any help? Any other ideas instead of slapo-rwm? [1] http://patrickv.info/wordpress/wp-content/uploads/2009/06/rfc2307aix.schema -- Mit freundlichen Grüßen / with kind regards, Sascha Thomas Spreitzer http://spreitzer.name/ https://fedoraproject.org/wiki/User:Sspreitzer Warum mache ich überhaupt dieses ganze OpenSource Zeugs? Lesen Sie hier, warum; http://de.windows7sins.org/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software May 2010