openldap-software

openldap-software@openldap.org

2719 discussions

Re: Write changed immediately to disk
by Buchan Milne 21 Feb '08

21 Feb '08

On Thursday 21 February 2008 17:20:41 ml(a)bortal.de wrote: > Hello List, > > i was busy the last few days so i could not investigate in this thread. > > My System: > - Ubuntu Dapper 6.06 > - OpenLdap 2.2.26 > - Database: dbd > > Problem: > --------- > I need to restart slapd each time after i make a change. If i do not > restart slapd and reset my server the changes are not beeing saved. > > Example: > ----------- > - Add Samba user to Database > - I Wait 5mins > - Execute "sync" > - reset the box > - The Added user disapears or is not there anymore. > > > It would be no problem is slapd or my OS need like 10 or 20 secs to write > to disk. But after 5 mins i would expect the changed to be saved! This can be solved with a checkpoint statement, and running db_checkpoint -h /path/to/database as the user that runs slapd from cron (2.3 and onwards do checkpoints automatically according to the configuration). However, you should also ensure that db_recover is called before slapd is started. > If i run the example with restarting slapd before the reset then my > database looks fine! Most likely during shutdown, slapd hasn't exited by the time the shutdown script kills all processes. > Any idea how i could fix this? Any workarounds or tips? > There are no OpenLdap Backports for Dapper and i really need to stay with > Dapper. Honestly, bite the bullet and upgrade. You're wasting your time working around issues that are now taken care of for you, and then you're still on a release not supported by the developers. Regards, Buchan

1 0

when to checkpoint?
by Thomas Ledbetter 21 Feb '08

21 Feb '08

So.. Ive been reading up hardcore on Berkeley database administration regarding how to do archival and recovery, and its pretty cool stuff. Yet I have the following questions: Database archival will be done on one of our master servers, so its not necessary to keep alot of old transaction logfiles on the replicas, but in order to clean out them out, a periodic checkpoint is necessary. Initially, I was thinking that we should do this once per day, off hours, but would it make more sense to do this more frequently over the course of the day to keep the checkpoint process less expensive per iteration? What kinds of metrics should be used to determine how frequently this should be done? Second, would there be that great of a performance gain when disabling transaction logging altogether? If I have two master servers keeping, say, a week's worth of transaction logs, a sound archival process, and a backup LDIF, would it make sense to just disable transaction logging altogether across the replicas? Third, I now understand how to do archival and recovery using the Berkeley tools, but is there a 'best practice' document out there anywhere from someone who utilizes this method that I could take a look at to make sure Im not missing anything?

3 2

Restoring with SLAPADD
by Dave Horsfall 21 Feb '08

21 Feb '08

OpenLDAP 2.3.40 and 2.4.7. Testing disaster recovery, such as a bulk update gone wrong, so need to restore from last night's "slapcat" dump (we hardly ever write to the directory, so it's no big deal losing a morning's work). Delete an entry. Oops, I need it back. Stop the master (and slave), "rm *.bdb __*", "slapadd -nX < slap.out", start the master and slave, check the slave, and the deleted entry has reappeared. Is this guaranteed behaviour i.e. the slave will always resynchronise in this case, or was I just lucky? If it makes a difference, we use SyncRepl in "refreshAndPersist" mode. -- Dave Horsfall DTM VK2KFU Ph: +61 2 9552-5509 (direct) +61 2 9552-5500 (switch) Corinthian Eng'ng P/L, Ste 54 Jones Bay Whf, 26-32 Pirrama Rd, Pyrmont 2009, AU

3 4

BDB upgrade from 2.3 to 2.4
by Marcin Giedz 21 Feb '08

21 Feb '08

Hi, I'm preparing for an upgrade to 2.4 release but I've been looking for some documents related to: if it's needed to "dump" and "restore" the whole LDAP database (BDB actually) when changing openldap from 2.3 do 2.4? or perhaps it is irrelevant whether I use 2.3/2.4 BDB remains the same? Regards, Marcin

5 5

account locking strategy
by Guillaume Rousse 21 Feb '08

21 Feb '08

Hello list. I have to handle account locking on our directory, so as to keep accounts from people not working here anymore. On Buchan's suggestion, I used ppolicy sofar, with pwdAccountLockedTime attribute set to 000001010000Z to lock unused account. This is really handy to handle unix account and web applications account at once. However, they are also some drawbacks: - this is an operational account, thus a bit difficult to retrieve/edit (additional search options needed) - its locking value seems to be quite cryptic (but I maybe missed the semantic description somewhere) - it seems to be a binary field only (locked/unlocked), by opposition to shadowMax which allows to set an expiration date in advance. Even a purely cosmetic contract expiration date would be helpful here, but i didn't found anything similar in standard schemas - it doesn't handle easily use case where you just need to extract valid account list (such as scan-to-emails features from copiers), excepted by filtering on this attribute value, which isn't always possible (broken copiers firmware, for instance) Last issue could be workarounded by filtering on ldap side using dynamic group I think. So, does anyone have suggestion on how to handle this better ? -- Guillaume Rousse Moyens Informatiques - INRIA Futurs Tel: 01 69 35 69 62

4 4

translucent overlay to add local entries if they don't exist remotely?
by Andrew Cobaugh 21 Feb '08

21 Feb '08

Question regarding the translucent overlay. Say I wanted to create some entries locally that don't have corresponding remote entries. For example, if the base suffix is dc=foo,dc=bar, and the remote ldap server has, let's call them user entries at uid=myuser,dc=foo,dc=bar, and I wanted to locally create ou=group,dc=foo,dc=bar and put my own group entries in that, is this possible with translucent? Or maybe with a combination of overlays? Ok, I know I can create local-only entries, but any search requests for them fail. Is this what ITS#5283 is supposed to accomplish, without going through the hassle of trying to build HEAD? -- Andy Cobaugh phalenor(a)gmail.com

4 4

Help with 2.4 ACLs
by Duncan Brannen 21 Feb '08

21 Feb '08

An upgrade from 2.3.38 to 2.4.7 seems to have caused my acls to stop working in that anonymous users can no longer search the tree to find their entry to authenticate. With an acl of access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to dn.subtree="ou=People,dc=st-andrews,dc=ac,dc=uk" by * read access to * by users read by anonymous auth All anonymous searches get insufficient access returned Logging of ACls shows => slap_access_allowed: search access denied by auth(=xd) Any thoughts on what extra I need for this to work in 2.4? Cheers, Duncan

3 5

ldap_result error
by Fabio Ubaldi 21 Feb '08

21 Feb '08

Hi all, I have one process that needs to communicate with two different LDAP servers. For this reason, the process creates two threads (each thread manages the connection with one server). For tests, the process launch several "search" requests for the two threads at a fixed rate (about 100 searches/s). Each thread polls the server responses using the API "ldap_result" in asynchronous mod using LDAP_RES_ANY and LDAP_MSG_ONE macros. In this scenario, the "ldap_result" system call of one thread return with error (-1) and the error is "Can't contact the LDAP server". I tried to launch one single thread and it works fine (the maximum measured rate is 800 searches/s). Also I launch the two threads alternating the search requestes (so that only one of them is running) and it works fine. It seems that the error happens only if the two process runs simultaneously. Thinking of a race condition error, I lead the same tests using the libldap_r library to build the process but the error still remains. Have anyone encountered a similar error? The used openldap version is 2.3.27 both for LDAP servers ("slapd") and the libraries. Thanks in advance for the reply.

2 2

back-config schema in subschema
by Dieter Kluenter 20 Feb '08

20 Feb '08

Hi, I just discovered that with REl_ENG_2.4 objectclasses and attribute types of back-config schema are not included in cn=subschema any more. Is this intentional or is this a bug? Problem is I cannot configure or modify back-config with a tool which reads subschema for available objectclasses and attribute types anymore. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

2 1

Re: [phpldapadmin-users] grant access on a attribute specific value
by Pierangelo Masarati 20 Feb '08

20 Feb '08

Fabrice Eudes wrote: > Pierangelo Masarati a écrit : >> [please do not cross-post] > sorry. I mean: keep postings on the same list they started (and they belong to). Do not assume I subscribed to any list you did. >> Did you re-index after changing the index configuration in >> slapd.conf(5)? See slapindex(8) for details. > yes. > > I change a bit the "set" clause using "(employeeType=foo)" instead of > "(groupesTravail=1200)" and I have the same behavior: > >> index employeeType eq > makes the set clause fails (even after reindexing). > > without the index, access are ok. > > more idea(s) ? Indexing cannot alter the response of the system. So your indexing is not correct for some reason. I suggest you first work this issue out by running searches without any ACL. Then go back to ACL design. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software