openldap-software

openldap-software@openldap.org

2719 discussions

Re: Timeouts and TTL's
by Hans Moser 11 Mar '08

11 Mar '08

Hi! Matthew Stier schrieb: > I am using OpenLDAP (2.3.38) as a proxy server, to provide a single > point of lookup, for the many e-mail systems used within the company I > work for. > > The only problem I am now encountering, is 'slapd' randomly hanging, and > I suspect that could be caused by bad interactions between the proxy and > ldap servers. yes, I experienced the same a while ago. > The most plausible solution would be to implement timeout's, but that is > where I come into a brink wall, trying to understand when each of the > multitude of timeout and ttl setting should be used. conn-ttl 90 idle-timeout 1m30s solved my problems. YMMV man slapd-meta Hans

1 0

config evolution with openldap 2.3 and beyond?
by openldap 10 Mar '08

10 Mar '08

Hi listers, [cvs@myhost ~]$ rpm -q openldap-servers openldap-servers-2.3.39-1.fc8 [cvs@myhost ~]$ As far as i have understood, the openldap config is moving towards beeing fully LDAP integrated, i.e. you will change the config using ldapmodify, you will add to the config using ldapadd, you will view the config using ldapsearch. That created me a problem: i had to add a schema. what i did: i created a new olcInclude object into cn=config. This object, however, was not stable, it got lost at the next slapd restart. When i consulted this discussion list, i was informed that adding a new olcInclude object is not the correct way to add a new schema. But i was not informed on how the intention is to do it. I imagine that another way would be to convert the schema from the schema file manually/directly into olcAtttributeTypes, olcObjectClasses, olcObjectIdentifier and insert them into the cn=schema,cn=config. This, however, would be a very error prone action. Also, the handling of the access rights in the future is far from clear. When i consulted the openldap docu, i found put me in front of a fait-accompli: that is how it is, help yourself. could someone shed some light on the evolution process from file-based config into LDAP-based config? thanks in advance. suomi

2 1

replication problem
by Julien Garnier 10 Mar '08

10 Mar '08

Hi, I was looking for a solution to monitor syncrepl between two server and find that I need to compare contextCSN on the two server. The problem is that entryCSN doesn't exist on my slave server : On the master (don't know openldap ver): # ldapsearch -x -h master -b "ou=people,dc=compagnie,dc=com" -s base ContextCSN give me : # extended LDIF # # LDAPv3 # base <ou=people,dc=compagnie,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ContextCSN # # People, compagnie.com dn: ou=people,dc=compagnie,dc=com contextCSN: 20080305145635Z#000000#00#000000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 On the slave (openldap 2.4.8): # ldapsearch -x -h slave -b "ou=people,dc=compagnie,dc=com" -s base ContextCSN give me : # extended LDIF # # LDAPv3 # base <ou=people,dc=compagnie,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ContextCSN # # search result search: 2 result: 0 Success # numResponses: 1 At startup on the slave, I have this log : bdb_modify: ou=People,dc=compagnie,dc=com bdb_dn2entry("ou=People,dc=compagnie,dc=com") bdb_modify_internal: 0x00000001: ou=People,dc=compagnie,dc=com <= acl_access_allowed: granted to database root bdb_modify_internal: delete contextCSN bdb_modify_internal: 16 modify/delete: contextCSN: no such value bdb_modify: modify failed (16) send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=16 matched="" text="modify/delete: contextCSN: no such value" null_callback : error code 0x10 syncrepl_updateCookie: rid=013 be_modify failed (16) ldap_msgfree ldap_result ld 0x832ca48 msgid 2 wait4msg ld 0x832ca48 msgid 2 (timeout 0 usec) wait4msg continue ld 0x832ca48 msgid 2 all 0 ** ld 0x832ca48 Connections: * host: master port: 389 (default) refcnt: 2 status: Connected last used: Wed Mar 5 14:53:45 2008 I don't understand what append ... Thanks for your help Julien

5 12

Timeouts and TTL's
by Matthew Stier 10 Mar '08

10 Mar '08

I am using OpenLDAP (2.3.38) as a proxy server, to provide a single point of lookup, for the many e-mail systems used within the company I work for. The only problem I am now encountering, is 'slapd' randomly hanging, and I suspect that could be caused by bad interactions between the proxy and ldap servers. The most plausible solution would be to implement timeout's, but that is where I come into a brink wall, trying to understand when each of the multitude of timeout and ttl setting should be used.

1 0

index_param failed on ipHostNumber
by Robert Fitzpatrick 10 Mar '08

10 Mar '08

I setup a new lookup in our Postfix just like the one we have used for transports for some time, but now using ipHostNumber to allow relay. After setting up, I started receiving... Mar 7 09:43:04 esmtp slapd[22766]: <= bdb_equality_candidates: (ipHostNumber) index_param failed (18) So, I added ipHostNumber to my list of indexes already established for other Postfix lookups... # Following indexes for postfix virtual lookups index associatedDomain,mail,mailLocalAddress,ipHostNumber eq The errors go away, but now my lookup does returns nothing. And as soon as I remove the index and try lookup again, it returns the result fine, but slow of course and with the error above. However, even with it removed, I still see the index in my file system... esmtp# ls -lah /home/openldap/ipHostNumber.bdb -rw------- 1 ldap ldap 8.0K Mar 7 08:32 /home/openldap/ipHostNumber.bdb Can someone offer some guidance on what I should try next? Thanks in advance. -- Robert

2 1

syncrepl with filter question
by Ralph Rößner 10 Mar '08

10 Mar '08

Hello list, I have noticed (as of 2.4.7) an interaction of searchAndPersist syncrepl, search filters, and access rules that looks weird to me. Before I call it a bug (and submit to ITS) I'd like to ask whether I'm not just missing the point and everything is working as intended. So here is the situation: We replicate just part of the provider data by annotating the objects to replicate with an extra replication info attribute. Access to that attribute is restricted. Now when an object is change, we observe this: If the change is made by a user who has read access to the replication info attribute then the change is replicated. Otherwise it is not. It appears that the replication filter is evaluated using the access rights of the user making the modification, not those of the replication user. If someone can tell me that this is not a problem because ... whatever reason then I'm interested to know. Otherwise I'll pack up configs, logs, etc. and file a bug report. Sincerely, Ralph Rößner -- Ralph Rößner CAPCom AG < http://www.capcom.de > Rundeturmstr. 10, 64283 Darmstadt, Germany Phone +49 6151 155 900, Fax +49 6151 155 909 Vorstand: Luc Neumann (Vorsitzender) Vorsitzender des Aufsichtsrats: Prof. Dr.-Ing. José L. Encarnação Sitz der Gesellschaft: Darmstadt, Registergericht: Darmstadt HRB 8090

4 5

program segfaults on ldap_get_values/ldap_get_values_len
by Brian Hechinger 09 Mar '08

09 Mar '08

I'm trying to access LDAP from a C program (the first time I've used the OpenLDAP API) and so far I've only met with moderate success. I can bind without issue, but I need to retrieve the values held by a specific multi valued attribute, and that's where I'm having issues. I was using ldap_get_values() and all the other deprecated functions, but have recently converted my code to only use what's available in 2.4.x Sadly, that didn't fix the problem, it still happens. This line: attr_values = ldap_get_values_len(ldap_conn, entry, attr); Segfaults with SIGABRT and prints this to stderr: Assertion failed: (LBER_VALID( ber )), function ber_scanf, file decode.c, line 779. This is OpenLDAP 2.4.8 on FreeBSD 7.0-RELEASE (as built out of PORTS). Where do I start looking to try and get this resolved? Thanks!! -brian -- "Perl can be fast and elegant as much as J2EE can be fast and elegant. In the hands of a skilled artisan, it can and does happen; it's just that most of the shit out there is built by people who'd be better suited to making sure that my burger is cooked thoroughly." -- Jonathan Patschke

5 7

openldap 2.4.8 and autogroup contrib
by Guy Deleeuw 08 Mar '08

08 Mar '08

Hello, I just compile the openldap 2.4.8 version and I try the overlay autogroup from the contrib On my own schema I create 2 attributes description : attributeType ( 1.3.6.1.4.1.13175.1.62 NAME 'ezMemberURL' SUP memberURL ) attributeType ( 1.3.6.1.4.1.13175.1.63 NAME 'ezMember' SUP member ) And a new objectClass : objectClass ( 1.3.6.1.4.1.13175.2.13 NAME 'ezDynGroup' SUP top MUST ( ou ) MAY ( ezMemberURL $ description $ ezMember ) ) In slapd.conf : overlay autogroup autogroup-attrset ezDynGroup ezMemberURL ezMember overlay dynlist dynlist-attrset groupOfURLs memberURL First question : the ezMember is required on the class definition ? I cannot return the ezMember : root@nova:~# ldapsearch -x -LLL -b "ou=dynLists,o=Eurofer,c=be" -s sub "(&(&(objectClass=ezDynGroup)))" dn: ou=ezDynList1,ou=dynLists,o=Eurofer,c=be objectClass: top objectClass: ezDynGroup ou: ezDynList1 ezMemberURL: ldap:///br=Internal,o=Eurofer,c=be??sub?(&(uid=*)) description: testgroup Could you help me or give me a link to more informations ? Thanks in advance Guy

1 2

Getting LDAP and SASL (digest-md5) to play nice
by Rick Stevens 07 Mar '08

07 Mar '08

I'm sure I'm not the only person having this issue, but I absolutely cannot seem to get SASL and LDAP to work. I want SASL to authenticate using the passwords in LDAP, but in the classic chicken-and-egg scenario, you can't talk to LDAP without having SASL working first. I have the authz-regexp stuff set up and the ldapwhoami seems to show me as being converted from the "uid=username,cn=digest-md5,cn=auth" thing to "uid=username,ou=people,dc=mydomain,dc=com", but ONLY if I've put a user and password into the saslpasswd2 database. If I don't do that, I get invalid SASL credentials on the ldapwhoami. I'm sure this is really farking simple, but I've googled the kapok out this thing and gotten nowhere. ---------------------------------------------------------------------- - Rick Stevens, Unix Geek rps2(a)socal.rr.com - - - - Reality: A crutch for those who can't handle science fiction - ----------------------------------------------------------------------

6 17

How is the intention to change config?
by openldap 07 Mar '08

07 Mar '08

Hi LDAPers [cvs@myhost ~]$ rpm -q openldap-servers openldap-servers-2.3.39-1.fc8 [cvs@myhost ~]$ As far as i have understood, the openldap config is moving towards beeing fully LDAP integrated, i.e. you will change the config using ldapmodify, you will add to the config using ldapadd, you will view the config using ldapsearch. That created me a problem: i had to add a schema. what i did: i created a new olcInclude object into cn=config. This object, however, was not stable, it got lost at the next slapd restart. When i consulted this discussion list, i was informed that adding a new olcInclude object is not the correct way to add a new schema. But i was not informed on how the intention is to do it. I imagine that another way would be to convert the schema from the schema file manually/directly into olcAtttributeTypes, olcObjectClasses, olcObjectIdentifier and insert them into the cn=schema,cn=config. This, however, would be a very error prone action. Also, the handling of the access rights in the future is far from clear. When i consulted the openldap docu, i found put me in front of a fait-accompli: that is how it is, help yourself. could someone shed some light on the evolution process from file-based config into LDAP-based config? thanks in advance. suomi

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software