openldap-software

openldap-software@openldap.org

2719 discussions

unable to get syncrepl to work
by Adam Williams 18 Apr '08

18 Apr '08

I have a master ldap server named roark, and a slave ldap server named archives3 and both are running openldap 2.3.39. In roark's /etc/openldap/slapd.conf I added: index entryUUID,entryCSN eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 lastmod on and in archives3's slapd.conf I added: cachesize 100000 idlcachesize 300000 checkpoint 1024 5 syncrepl rid=1 provider=ldap://roark.mdah.state.ms.us:389 type=refreshandPersist retry="60 +" searchbase="dc=mdah,dc=state,dc=ms,dc=us" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn= "cn=Manager,dc=mdah,dc=state,dc=ms,dc=us" credentials={SSHA}xxxxxxxxxxxxxxx and then loaded a slapcat yesterday into archives3's ldap with slapadd, and started ldap on archives3. Now I just added a user on roark's openldap with ldapadd, and it added the user fine, i can log in as them, and the timestamp on /var/lib/ldap files is current, however, on archives3, the timestamp on the files is still from yesterday. why hasn't archives3's ldap updated itself with the new user that was added? [root@roark ldap]# date Fri Apr 18 11:39:03 CDT 2008 [root@roark ldap]# ls -ltr total 5660 drwxr-xr-x 2 root root 4096 2008-02-22 11:55 rpmorig -rw------- 1 ldap ldap 8192 2008-04-13 21:51 sambaDomainName.bdb -rw------- 1 ldap ldap 8192 2008-04-13 22:14 memberUid.bdb -rw-r----- 1 root root 769 2008-04-14 11:08 DB_CONFIG -rw------- 1 ldap ldap 49152 2008-04-16 12:11 displayName.bdb -rw------- 1 ldap ldap 102400 2008-04-17 00:00 sambaSID.bdb -rw------- 1 ldap ldap 24576 2008-04-17 11:32 __db.006 -rw------- 1 ldap ldap 557056 2008-04-17 11:32 __db.005 -rw------- 1 ldap ldap 98304 2008-04-17 11:32 __db.004 -rw------- 1 ldap ldap 270336 2008-04-17 11:32 __db.003 -rw------- 1 ldap ldap 368640 2008-04-17 11:32 __db.002 -rw------- 1 ldap ldap 24576 2008-04-17 11:32 __db.001 -rw------- 1 ldap ldap 10485760 2008-04-18 11:28 log.0000000001 -rw------- 1 ldap ldap 8192 2008-04-18 11:30 uidNumber.bdb -rw------- 1 ldap ldap 53248 2008-04-18 11:30 uid.bdb -rw------- 1 ldap ldap 53248 2008-04-18 11:30 sn.bdb -rw------- 1 ldap ldap 36864 2008-04-18 11:30 objectClass.bdb -rw------- 1 ldap ldap 8192 2008-04-18 11:30 gidNumber.bdb -rw------- 1 ldap ldap 8192 2008-04-18 11:30 entryUUID.bdb -rw------- 1 ldap ldap 8192 2008-04-18 11:30 entryCSN.bdb -rw------- 1 ldap ldap 57344 2008-04-18 11:30 dn2id.bdb -rw------- 1 ldap ldap 77824 2008-04-18 11:30 cn.bdb -rw------- 1 ldap ldap 311296 2008-04-18 11:31 id2entry.bdb -rw-r--r-- 1 ldap ldap 4096 2008-04-18 11:32 alock [root@archives3 ldap]# date Fri Apr 18 11:39:32 CDT 2008 [root@archives3 ldap]# ls -ltr total 4232 -rw------- 1 ldap ldap 24576 2008-04-17 11:45 __db.006 -rw------- 1 ldap ldap 557056 2008-04-17 11:45 __db.005 -rw------- 1 ldap ldap 98304 2008-04-17 11:45 __db.004 -rw------- 1 ldap ldap 270336 2008-04-17 11:45 __db.003 -rw------- 1 ldap ldap 368640 2008-04-17 11:45 __db.002 -rw------- 1 ldap ldap 24576 2008-04-17 11:45 __db.001 -rw------- 1 ldap ldap 8192 2008-04-17 12:25 uidNumber.bdb -rw------- 1 ldap ldap 57344 2008-04-17 12:25 uid.bdb -rw------- 1 ldap ldap 53248 2008-04-17 12:25 sn.bdb -rw------- 1 ldap ldap 110592 2008-04-17 12:25 sambaSID.bdb -rw------- 1 ldap ldap 8192 2008-04-17 12:25 sambaDomainName.bdb -rw------- 1 ldap ldap 36864 2008-04-17 12:25 objectClass.bdb -rw------- 1 ldap ldap 8192 2008-04-17 12:25 memberUid.bdb -rw------- 1 ldap ldap 262144 2008-04-17 12:25 id2entry.bdb -rw------- 1 ldap ldap 8192 2008-04-17 12:25 gidNumber.bdb -rw------- 1 ldap ldap 49152 2008-04-17 12:25 dn2id.bdb -rw------- 1 ldap ldap 49152 2008-04-17 12:25 displayName.bdb -rw------- 1 ldap ldap 69632 2008-04-17 12:25 cn.bdb -rw------- 1 ldap ldap 10485760 2008-04-17 12:32 log.0000000001 -rw-r--r-- 1 ldap ldap 4096 2008-04-17 12:33 alock

2 2

Where can I get the detailed meaning of OpenLDAP's Error Code?
by jjj＠sjtu.org 18 Apr '08

18 Apr '08

Hello all, Now I am running OpenLdap and get one error code from syslog. But I have no any references about the detailed meaning of OpenLdap's error code. Where can I get the detailed meaning of OpenLDAP's Error Code? Thank you in advance. JJ

2 1

slapd crashes due to empty user password
by Simon Gao 18 Apr '08

18 Apr '08

Hi, I am seeing slapd crashing repeatedly when assigning empty password to a user account. The version is 2.3.39. Is this a known problem? Or another question is how do we disable a user account with OpenLDAP? Simon

3 2

BDB error
by Sumith Narayanan 18 Apr '08

18 Apr '08

Hi All, I installed OpenLDAP 2.3.39 & BDB 4.4.20 backend. Loaded data with slapadd. After that when I restart , I get the below error. Any pointers to help fix this would be great. Apr 17 09:44:43 dsx1 slapd[10206]: bdb_db_open: unclean shutdown detected; attempting recovery. Apr 17 09:44:44 dsx1 slapd[10206]: bdb(o=root dn): Log file corrupt at LSN: [10][10485679]\nApr 17 09:44:44 dsx1 slapd[10206]: bdb(o=root dn): PANIC: Invalid argument\nApr 17 09:45:04 dsx1 slapd[10206]: bdb(o=root dn): unable to join the environment\nApr 17 09:45:04 dsx1 slapd[10206]: bdb_db_open: Database cannot be recovered, err -30974. Restore from backup!\nApr 17 09:45:04 dsx1 slapd[10206]: bdb(o=root dn): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem\nApr 17 09:45:04 dsx1 slapd[10206]: bdb(o=root dn): txn_checkpoint interface requires an environment configured for the transaction subsystem\nApr 17 09:45:04 dsx1 slapd[10206]: bdb_db_close: txn_checkpoint failed: Invalid argument (22)\nApr 17 09:45:04 dsx1 slapd[10206]: backend_startup_one: bi_db_open failed! (-30974)\nApr 17 09:45:04 dsx1 slapd[10206]: bdb_db_close: alock_close failed\nApr 17 09:45:04 dsx1 slapd[10206]: slapd stopped.\n Thanks, Sumith.

3 2

syncrepl with accesslog database
by John Morrissey 17 Apr '08

17 Apr '08

I'm trying to replicate (with syncrepl) the bdb database generated by the accesslog overlay. This is with 2.3.41 on both provider and consumer. slapd complains: do_syncrep2: rid 002 got empty syncUUID do_syncrepl: rid 002 retrying (29 retries left) Sure enough, the entry for my accesslog database's suffix doesn't have an entryUUID: dn: cn=log objectClass: auditContainer cn: log structuralObjectClass: auditContainer contextCSN: 20080313163024Z#000000#00#000000 lastmod is not explicitly enabled for this database, but slapd.conf(5) says the default is on. I'm reasonably sure I didn't specify 'lastmod off' for that database at the time it would have been created. Given that my consumers are using delta-syncrepl (hence the accesslog), is there any reason I can't/shouldn't replicate the accesslog itself, too? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 6

PPolicy Questions
by Todd Merrill 17 Apr '08

17 Apr '08

Hello, I hope this is the place to send such questions. I'm having problems getting started with ppolicy. I am trying to specify a specific ppolicy entry for users without using the slapd.conf default policy. Our OpenLDAP deployment environment in Red Hat uses version 2.3.33. >From what I have read (elsewhere since the manual is missing the ppolicy config info), I must first add a new policy of objectclass 'pwdPolicy" in the policy list. I have done that without problem. I must then indicate for the users that use that policy, the DN of the new policy in the field 'pwdPolicySubentry'. My problem at this point is that I see no objectclass that contains this field. In reading the ppolicy.schema file I see that the type 'pwdPolicySubentry' is described there, but commented out. The odd thing though, is that even though it is commented out, I can see the type in my LDAP browser when I look for a list of types, and I see no description of it in the other .schema files. I did read on someone's site that the user entry should be an objectclass of 'pwdPolicy' and then the 'pwdPolicySubentry' field can be entered, but in the ppolicy.schema document, 'pwdPolicySubentry' is not described in the list of fields for objectclass 'pwdPolicy'. Do I have to edit the ppolicy.schema to get the overlay to work this way? I'm new to LDAP so perhaps I'm not understanding something basic. Any help or suggestions would be very helpful. -Todd Merrill

3 2

Problem loading LDIF data in openldap 2.4.8
by benoitde＠sympatico.ca 16 Apr '08

16 Apr '08

Hi, I tried to load a slapcat dump from OpenLDAP 2.3.27 into OpenLDAP 2.4.8, and had problems with java entries. I narrowed down the problem with this simple test case: LDIF: dn: cn=REQUEST,dc=example,dc=com javaClassName: com.ibm.mq.jms.MQQueue objectClass: javaContainer objectClass: javaObject objectClass: javaNamingReference javaFactory: com.ibm.mq.jms.MQQueueFactory cn: REQUEST javaReferenceAddress: #0#VER#6 javaReferenceAddress: #1#EXP#-2 javaReferenceAddress: #2#PRI#-2 javaReferenceAddress: #3#PER#-2 javaReferenceAddress: #4#CCS#1208 javaReferenceAddress: #5#TC#1 javaReferenceAddress: #6#ENC#273 javaReferenceAddress: #7#FIQ#1 javaReferenceAddress: #8#QU#REQUEST javaReferenceAddress: #9#QMGR#QM Load of this LDIF in OpenLDAP 2.3.27: ldapadd -D"cn=Manager,dc=example,dc=com" -W -x -f /tmp/bug.ldif Enter LDAP Password: adding new entry "cn=REQUEST,dc=example,dc=com" Works, but in OpenLDAP 2.4.8: ldapadd -h sdco1cdba -p 1389 -D"cn=Manager,dc=example,dc=com" -W -x -f /tmp/bug.ldif Enter LDAP Password: adding new entry "cn=REQUEST,dc=example,dc=com" ldap_add: Object class violation (65) additional info: instanstantiation of abstract objectClass 'javaObject' not allowed And the entry is not loaded. I tried to define the entry with the JMSAdmin tool that comes with IBM MQ, but could not load it either in 2.4.8, it worked against 2.3.27. A wireshark dump showed that the tool received the same error as ldapadd. I performed a "diff" on the java.schema of 2.4.8 and 2.3.27, but the schemas are identical. Is there any way that I could circumvent this problem? Thanks!

2 2

fast slapcat and slow slapadd
by Piotr Wadas 16 Apr '08

16 Apr '08

Hello, Using openldap 2.3.38 on 2.6.24 with bdb/hdb backend. I got about 12-13 000 entries in my directory. Slapcat takes seconds, while slapadd takes 15 minutes or more. Is there any way to speed it up, which I've missed? to slapadd I do: /etc/init.d/slapd stop && cd /var/lib/ldap && ls |grep -v DB_CONFIG|xargs rm && cat slapcat-output-file|slapadd currently the best way to minimize downtime I found is to replace "directory" line in slapd.conf, then do slapadd "into" new physical location, and then just stop slapd, change dirname, change directory line back, and start again. I'm afraid it's actually not slapd issue, but just some file-reading/adding -related thing. Is it some better workaround for this with newer release? I'd be happy to jump to 2.4.7 series, but it still seems a little bit unstable, segfaults sometimes with some searches. Regards, PW

4 3

A question about pwdMinAge
by Ryan Steele 15 Apr '08

15 Apr '08

Hey List, I wanted to test the scenario where a user had forgotten his password, and needed to have it reset. I wanted to give this user the ability change this temporary password if they wanted. To do this, I: 1. Executed ldappasswd, binding as the rootdn, to change the user's password 2. Used ldapvi to reset the sambaPwdCanChange and sambaPwdLastSet attributes 3. Logged in to the domain as the user 4. Hit Ctrl+Alt+Delete and selected "Change Password" However, because my ppolicy pwdMinAge hadn't expired yet, the user was unable to change the password. So, it seems necessary to be able to change that value for the user so he/she can change their password. I couldn't find an attribute called pwdMinAge, but I'm assuming that's because it just looks at pwdChangedTime. I 'assume' because I couldn't find explicit documentation stating this, though the man page definition for pwdChangedTime says "[pwdChangedTime] is used by the password expiration policy to determine whether the password is too old to be allowed to be used for user authentication." Is this why I see a NT_STATUS_WRONG_PASSWORD returned from LDAP when a user tries to change a password that is being protected by pwdMinAge? And, is executing an ldapmodify the proper thing to do in this situation to change the pwdChangedTime and allow the user to change his/her password? E.g.: ldapmodify -D "cn=admin,dc=example,dc=com" -W dn: uid=someuser,ou=Users,dc=example,dc=com changetype: modify replace: pwdChangedTime pwdChangedTime: 1207690188Z Thanks as always, Ryan

4 6

BDB error while starting openldap.
by Sumith Narayanan 15 Apr '08

15 Apr '08

Hi, I am getting the below error while starting openLDAP. bdb_db_open: alock package is unstable backend_startup_one: bi_db_open failed! (-1) slapd shutdown: initiated ====> bdb_cache_release_all ====> bdb_cache_release_all ====> bdb_cache_release_all slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. However, if I am using sudo access, I get no error and could successfully start the server and search the DB. Could anyone please help let me know what the cause for this error is ? I am using Berkeley DB 4.4.20 OpenLDAP version : 2.3.39 Thanks, Sumith.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software