openldap-software

openldap-software@openldap.org

2719 discussions

ldapmodify error
by Naufal Sheikh 27 Mar '08

27 Mar '08

Hey list, I have openlldap running on one box with replog enabled. I am trying to propagate the generated replog on the production and when using the ldapmodify command I get the following: ldap_modify: Constraint violation (19) additional info: entryCSN: no user modification allowed test server is exact mirror of the production in every sense apart from the platforms they are running on which I believe showuld not be the issue. They have same configuration and everything. Any pointer will be appreciated . Thanks! NZ

3 6

Real alternatives to BDB?
by Marten Lehmann 27 Mar '08

27 Mar '08

Hello, we are currently running openldap 2.2.13 with a bdb-4.2.52 backend as it comes with RHEL4. We have about 50.000 cn's each having about 5-10 attributes with a length of no longer than 100 characters. So our dataset is not very big. We have a lot of concurrent reads since or ldap provides the data for incoming and pop3/imap servers. But we have only about 100 changes/adds a day, not more. Yesterday we had the second bdb problem in our 1 year ldap setup. The problem is, that we cannot really detect the crash, since ldap queries just hang, but neither they timeout nor openldap is crashing. We just notice the mailserver issues and have to track it down to openldap and bdb. As with last time, we had to shutdown openldap and recover bdb. Fortunately we have been able to recover the data-directory both times using dv_recover. But in fact, we want to have a backend, that doesn't crash twice a year. And as our setup is growing and we want to start with replication, we want a backend to whom we can trust. I read through the backend documentation of openldap and berkeley db is praised as very fast and efficient. Amazing, that berkeleydb is not called stable anywhere in the documentation. And from my experience, bdb is not stable. Whenever you here about bdb, you here about it because a database went corrupt. bdb is just a key/value database that seems to work fine as long it is read-only. Different projects, e.g. subversion, have turned away from bdb and use a different backend. Often they use SQLite. Since SQLite handles complete table layouts, it would also be possible to create one table with two columns (key and value as in bdb). SQLite shall also be transactional. But why is openldap sticking on bdb? Does bdb have any other important features the SQLite doesn't have? Benchmark issues? Replication? I have to admit, that I'm not using the latest releases of bdb. But I'm using and watching bdb for years and I hardly believe, that it has become stable in the latest release. Regards Marten

9 9

Replication appears to vanish, sometimes.
by Jorgen Lundman 26 Mar '08

26 Mar '08

Hello list, SunOS ldapmaster01.unix 5.10 Generic_118844-26 i86pc i386 i86pc openldap-2.3.19 db-4.2.52.NC-sol10-intel-local ./configure LDFLAGS=-L/usr/local/lib --enable-crypt Generally, Openldap is working well, and replication is working. I get no .rej files, and the replog file itself is frequently drained. But, ldapmaster and ldapslave frequently get out of sync. I thought it was initially just on the modrdn operations, but we have had "simpler" operations vanish. I realise this isn't much to go on, but perhaps I can get suggestions which may lead to more clues. The important looking sections in slapd.conf: loglevel none database bdb suffix "dc=company,dc=jp" rootdn "cn=admin,dc=company,dc=jp" access to attr=userPassword by self write by anonymous auth by * none access to * by self write by dn="cn=admin,dc=company,dc=jp" write by * read password-hash {CRYPT} checkpoint 128 15 directory /usr/local/var/openldap-data index objectClass eq index uid eq index uidNumber eq index mail eq index mailAlternateAddress pres,eq index deliveryMode eq index accountStatus eq index gecos eq index radiusGroupName eq index o pres,eq replogfile /usr/local/var/openldap-slurp/replica/slurpd.replog replica host=172.20.12.23:389 binddn="cn=admin,dc=company,dc=jp" bindmethod=simple credentials="<secret>" ldapslave slapd.conf is identical (it really is scp'ed) but with the last two lines removed (replogfile, replica). # /usr/local/bin/ldapsearch -h ldapmaster01 -D cn=admin,dc=company,dc =jp -x -w secret -b ou=mail,dc=company,dc=jp mail=test01(a)cs-sd01.com # extended LDIF # # LDAPv3 # base <ou=mail,dc=company,dc=jp> with scope subtree # filter: mail=test01(a)cs-sd01.com # requesting: ALL # # test01, cs-sd01.com, mail, company.jp dn: uid=test01,o=cs-sd01.com,ou=mail,dc=company,dc=jp objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: qmailUser objectClass: amavisAccount uid: test01 cn: test01 [snip] # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 # /usr/local/bin/ldapsearch -h ldapslave01 -D cn=admin,dc=company,dc=jp -x -w <secret> -b ou=mail,dc=company,dc=jp mail=test01(a)cs-sd01.com # extended LDIF # # LDAPv3 # base <ou=mail,dc=secret,dc=jp> with scope subtree # filter: mail=test01(a)cs-sd01.com # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 The various slapdlogs appear to contain little of interest, but perhaps "loglevel none" is the wrong setting? ldapmaster usually gives lines like: Mar 25 09:51:23 ldapmaster01.unix slapd[1319]: [ID 458966 local4.debug] do_search: invalid dn (uid=a.user, o=, ou=mail, dc=company, dc=jp) Mar 25 09:51:25 ldapmaster01.unix slapd[1319]: [ID 458966 local4.debug] do_search: invalid dn (uid=user4447, o=, ou=mail, dc=company, dc=jp) Mar 25 09:51:29 ldapmaster01.unix slapd[1319]: [ID 458966 local4.debug] do_search: invalid dn (uid=6201535, o=, ou=mail, dc=company, dc=jp) Which is just users entering their usernames wrong. ldapslave01 has no real log entries: Mar 24 22:42:41 ldapslave01.unix slapd[25495]: [ID 854361 local4.debug] bdb_db_open: unclean shutdown detected; attempting recovery. Mar 24 22:42:41 ldapslave01.unix slapd[25495]: [ID 100111 local4.debug] slapd starting When things are out of sync, I stop ldapslave01, stop provisioning (the only thing writing to ldap), then rsync everything from ldapmaster, and start it again. We are considering running without ldapslave until it can be resolved, it will just a bit slower. As I said, it is not all replication that fails, just some. There was a period where ldapslave was experiencing "too many files open error", but we increased file descriptors since then (6 weeks ago). I do also have a DBCONFIG file. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

4 7

memberof overlay 2.4.08
by LALOT Dominique 25 Mar '08

25 Mar '08

Hello, I'm testing memberof overlay and I'd like to get it working properly for a database migration My tests showed me that's it's working when adding members in groups, but for an initial loading, it does not work. I tested slapadd -q or slapadd without success. Could you tell us, or write something in the documentation to explain, the right way for an initial loading. Should we write some script, or is there an easier way? When we will be in production, I imagine that sometimes, we can get out of sync between members and memberof. What can we do in such case. Thanks Dominique

2 1

Compilation 2.3.39 on SunOS 5.8.
by vincent.blondel＠ing.be 25 Mar '08

25 Mar '08

Hello, I am trying to compile OpenLDAP 2.3.39 on my sun box. Below details on my compilation environment : SunOS 5.8 Generic_117350-49 sun4u sparc SUNW,Sun-Fire-V210 gcc : 3.4.6 binutils : 2.17 make 3.80 autoconf : 2.59 OpenSSL 0.9.8d I try to get OpenLDAP compiled only for client usage ( binaries, libraries ), statically including GCC object files and OpenSSL libraries because these are not present on any of our Sun servers. Below, you can find script I developped to compile this version. As you can see I disabled all what concern slapd, slurpd, Berkeley DB and I enabled SSL libraries. This is the way I usely compile my packages on SunOS platform (SQUID, ISC Bind, ...) PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin LD_LIBRARY_PATH=/usr/local/lib PKG=openldap-2.3.39 PREFIX=/usr/local export PATH PKG PREFIX LD_LIBRARY_PATH /usr/bin/env \ CC="/usr/local/bin/cc" \ CXX="/usr/local/bin/c++" \ CFLAGS="-O2 -pipe" \ LDFLAGS="-L/usr/local/ssl/lib/libssl.a -L/usr/local/ssl/lib/libcrypto.a -L/usr/local/ssl/lib -L/usr/local/lib -R/usr/local/lib" \ CPPFLAGS="-I/usr/local/ssl/include -I/usr/local/include" \ AUTOCONF="/usr/local/bin/autoconf" \ AUTOHEADER="/usr/local/bin/autoheader" \ AUTOIFNAMES="/usr/local/bin/ifnames" \ AUTOM4TE="/usr/local/bin/autom4te" \ AUTORECONF="/usr/local/bin/autoreconf" \ AUTOSCAN="/usr/local/bin/autoscan" \ AUTOUPDATE="/usr/local/bin/autoupdate" \ SHELL=/bin/sh \ CONFIG_SHELL=/bin/sh \ ./configure \ --prefix=/usr/local \ --sysconfdir=/etc \ --enable-crypt \ --enable-dynamic \ --with-tls \ --with-threads=posix \ --without-cyrus-sasl \ --disable-debug \ --disable-slapd \ --disable-slurpd \ --disable-monitor \ --disable-bdb \ --disable-hdb \ --disable-relay \ --disable-glue \ --disable-syncprov make depend make make install Now I get problems with it because binaries always give me 'Killed' message. # /usr/local/bin/ldapsearch Killed Concerning libraries, these ones seem to compile but not statically including ssl libraries and/or libgcc, the other ones are okay and can be linked dynamically. # ldd /usr/local/lib/libldap.so warning: ldd: /usr/local/lib/libldap.so: is not executable libssl.so.0.9.8 => (file not found) libcrypto.so.0.9.8 => (file not found) libgcc_s.so.1 => /usr/local/lib/libgcc_s.so.1 liblber-2.3.so.0 => /usr/local/openldap/lib/liblber-2.3.so.0 libresolv.so.2 => /lib/libresolv.so.2 libgen.so.1 => /lib/libgen.so.1 libnsl.so.1 => /lib/libnsl.so.1 libsocket.so.1 => /lib/libsocket.so.1 libc.so.1 => /lib/libc.so.1 libdl.so.1 => /lib/libdl.so.1 libmp.so.2 => /lib/libmp.so.2 /usr/platform/SUNW,Sun-Blade-100/lib/libc_psr.so.1 After many times, I tried to link binaries with SunOS built-in linker '/usr/ccs/bin/ld' but always get the same problem. If you want have a look compilation with /usr/local/bin/ld, click on this link http://ks31203.kimsufi.com/openldap-2.3.39-local_ld.log If you want have a look at compilation with /usr/ccs/bin/ld (LD="/usr/ccs/bin/ld"), click on this link http://ks31203.kimsufi.com/openldap-2.3.39-ccs_ld.log So, finally, maybe my problem is something really stupid but I do not find the solution to get my binaries valid with requested libraries statically compiled. Help is really appreciated in this case. Vincent. ----------------------------------------------------------------- ATTENTION: The information in this electronic mail message is private and confidential, and only intended for the addressee. Should you receive this message by mistake, you are hereby notified that any disclosure, reproduction, distribution or use of this message is strictly prohibited. Please inform the sender by reply transmission and delete the message without copying or opening it. Messages and attachments are scanned for all viruses known. If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. Always scan attachments before opening them. -----------------------------------------------------------------

5 6

Selecting TLS Cipher problem
by Pat Riehecky 25 Mar '08

25 Mar '08

I am trying to limit the cipher list for TLS negotiations, but I don't seem to be able to do this..... ... output from -d -1.... 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) TLS: could not set cipher list !ALL:HIGH:+SSLv3:+TLSv1:MEDIUM:+SSLv2:! aNULL:!NULL:+SHA:+MD5. main: TLS init def ctx failed: -1 slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. </-d -1 snip> Here is all of my TLS data from my slapd.conf # SSL TLSCertificateFile /etc/ldap/certificate.pem TLSCertificateKeyFile /etc/ldap/private.key TLSCipherSuite !ALL:HIGH:+SSLv3:+TLSv1:MEDIUM:+SSLv2:!aNULL:!NULL:+SHA: +MD5 </slapd.conf snip> OpenLDAP 2.4.7-5 on Debian x86 installed from apt What did I do wrong? I would swear the cipher list is good, but.... Pat

4 6

valsort not sorting?
by Pat Riehecky 21 Mar '08

21 Mar '08

I have the valsort overlay in place database hdb suffix "dc=mytest,dc=com" overlay valsort valsort-attr uid ou=People,dc=mytest,dc=com weighted alpha-ascend but when I do an ldapsearch results are not sorted by uid # ldapsearch -x -b "ou=People,dc=mytest,dc=com" uid dn: uid=btest,ou=People,dc=mytest,dc=com uid: btest dn: uid=mytest,ou=People,dc=mytest,dc=com uid: mytest dn: uid=atest,ou=People,dc=atest,dc=com uid: atest What did I do wrong? Pat

2 1

order of rewrite context processing
by Ron Peterson 21 Mar '08

21 Mar '08

I'm trying to select a backend (ldap proxy) according to the the content of a search filter. I've configured something like this prior to any backend definitions: rwm-rewriteContext bindDN rwm-rewriteRule ".*" "${&&bindprefix("")}$0" ":" rwm-rewriteRule "cn=([shaum])_(.+)" "${&&bindprefix($1)}cn=$2" ":" rwm-rewriteContext searchFilter rwm-rewriteRule ".*" "${&&filterprefix("")}$0" ":" rwm-rewriteRule "(.*)cn=([shaum])_(.+)" "${&&filterprefix($2)}$1cn=$3" ":" # Using this expression below breaks things. I'm guessing the searchDN # context gets processed before searchFilter, so ${**filterprefix} is # undefined. # "${**bindprefix}${**filterprefix}<>${&prefix($1)}" rwm-rewriteContext searchDN rwm-rewriteRule "(.*)o=fc" "${**bindprefix}<>${&prefix($1)}" <=== replace w/ above ":I" rwm-rewriteRule "s{1,2}<>$" "${*prefix}o=backa" ":@I" rwm-rewriteRule "h{1,2}<>$" "${*prefix}o=backb" ":@I" etc... Does searchDN get processed before searchFilter? Is there a way around that? Is there a better way to do this? The basic concept seems to work fine w/ bindDN, but not searchFilter. I'm using OpenLDAP 2.4.8 TIA. -- Ron Peterson Network & Systems Manager Mount Holyoke College

2 6

Getting pwdCheckModule: check_password module ppErrStr --> "the client"
by Eric Berggren 21 Mar '08

21 Mar '08

What's the client-side trick in getting the ppErrStr string from the check_password() function (from pwdCheckModule) actually back to the client when using EXOP_MODIFY_PASSWD ? Seems to require use of a ppolicy control, which appears to be effectively a noop in 2.3.38 (before noticing the mention in the release notes) yet completely broken in 2.3.41 resulting in: ../../../libraries/libldap/controls.c:437: ldap_create_control: Assertion `ber != ((void *)0)' failed. this is using ldap_create_passwordpolicy_control() as such: LDAPControl **ctrls = NULL; .... ldap_create_passwordpolicy_control( ld, &ctrls ); (yes, this is from client/tools/ldappasswd.c). Checking the library code, indeed, ppolicy.c:ldap_create_passwordpolicy_control() passes NULL in as *ber into controls.c:ldap_create_control() in v .41 , hitting the assert( ber != NULL ). More reading seems to suggest this whole mechanism is deprecated and will likely go away. So getting back.. i would like to report the "human-readable textual explanation of the [check_password] error" back to the client (per slapo-ppolicy(5)). Or is this not really implemented in v2.3 ? thanks, -eric

1 0

Testsuite lacks TLS tests?
by Peter O'Gorman 20 Mar '08

20 Mar '08

Hi, Does 'make test' test TLS functionality? It does not seem to. What would a thorough TLS functionality test entail? Peter

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software