openldap-software

openldap-software@openldap.org

2719 discussions

Re: documentation [was Re: logging]
by Gavin Henry 11 Dec '07

11 Dec '07

<quote who="Craig"> > Howard Chu wrote: >> When you're looking for a software feature, the manpages and Admin Guide >> should be your first resort. Pretty much every feature is documented. > > This morning there were some posts about "rewriting overlays". So, I > wanted to learn more about what they could do. I resisted the urge to > use Google and went directly to the OpenLDAP Admin doc: > > http://www.openldap.org/doc/admin24/ Excellent. > > First, let me say that the docs do look really complete. But, this is > good and bad. The bad part is that it is a little overwhelming. Can a > search be added to the admin docs? I wanted to know more about a > specific overlay and didn't see it in the table of contents. Hmmm, which one? Every overlay is in the TOC. > So, I > didn't know where to start... Google is the next viable option, IMO. > > The FAQ-o-matic is very nice, but I think an updated interface would > help a great deal. (Not sure if the "faq-o-matic" package allows for > easy changes to the interface. And I am NOT suggesting removing a > perfectly good piece of software for something that looks nicer, but is > less functional.) The search works very well, I've never understood why it seems to be a problem? > > Lastly, the man pages... Again, the size is a bit daunting. There are 78 > man pages with 2.3.35. (With an additional 121 symlinked files.) That's > quite a bit when you're looking for one specific thing and don't really > know where to start. There are unix tools for this; apropos: [ghenry@suretec]$ apropos rewrite CREATE RULE [create_rule] (7) - define a new rewrite rule DROP RULE [drop_rule] (7) - remove a rewrite rule TIFFRewriteDirectory [TIFFWriteDirectory] (3tiff) - write the current directory in an open TIFF file creat (3p) - create a new file or rewrite an existing one git-filter-branch (1) - Rewrite branches sepol_genbools (3) - Rewrite a binary policy with different boolean settings slapo-rwm (5) - rewrite/remap overlay to slapd See the last one above. > I want to be very clear; I am NOT knocking the docs > at all. As I started looking around more, it is a lot more clear how > things are laid out. But, when LDAP is just a tool and not a core part > of my job, it is difficult to spend 2 hours reading docs for a feature > we may not even need. I was just looking for a quick description. My > hope is that my experience gives you more insight to what, at least, one > sysadmin finds difficult. (If I am the minority, then prioritize my > thoughts appropriately.) 2 hrs? >> When a feature in the documentation isn't clear enough to you, it's fine >> to ask on the mailing list, but even better is to submit an ITS pointing >> out exactly what isn't clear. Sometimes we see problems on the list that > > So (just to be clear), you'd want me to file a bug for adding a search > box to the admin docs? I looked at the bug pages and didn't see anything > about searching the docs: > > http://www.openldap.org/its/index.cgi/Documentation Yes please. File it anywhere, we'll assign it. > > On a side note, I noticed that jitterbug is no longer being maintained. > Have you considered migrating to, say, Bugzilla? (I do realize how big > of an undertaking that is, I am *just asking*. :> ) It's work fine for the OpenLDAP project. There are plans, just not very hig priority ;-)

3 2

Re: Help Needed with mirrormode configuration in 2.4.6
by Gavin Henry 11 Dec '07

11 Dec '07

<quote who="Savithri"> > Hi, > Im using OpenLDAP 2.4.6 and trying to use the mirrormode and syncrepl. > My setup has 2 LDAP nodes, one as master and other as slave through a > VIP. > When the master goes down, the slave will become master and vice-versa. > At any point to keep both the LDAP in sync I want to use mirror mode and > syncrepl and Im using the following conf file. > > database bdb > directory $MMAIL_VAR_DIR/ldap/ipu-mail-ldap > suffix "o=mereonmail" > rootdn "cn=admin,o=mereonmail" > rootpw secret > index objectClass,entryCSN,entryUUID pres,eq > index mail,cn eq,sub > > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 100 > > syncrepl rid=1 > provider=ldap://${MMAIL_LDAP_PEER_HOSTNAME}:$MMAIL_LDAP_PORT > bindmethod=simple > binddn="cn=admin,o=mereonmail" > credentials=ipunity > filter="(objectClass=*)" > searchbase="o=mereonmail" > schemachecking=on > type=refreshAndPersist > interval=00:00:00:01 > retry="60 +" > > mirrormode on > > But with the above conf file an the both the nodes ( rid = 2 on the other The docs on the main site are out of date, I did them wrong the first time. The latest version isn't up yet for MirrorMode, but will be when 2.4.7 is out this week. Each config has to be the same, including rid, except you now need: serverID: 1 on one node and: serverID: 2 on the other. Apart from that, both configs are the same (obviously changing where they point too ;-) ). Search "man slapd.conf" for serverID Gavin.

1 0

Help Needed with mirrormode configuration in 2.4.6
by Savithri 11 Dec '07

11 Dec '07

Hi, Im using OpenLDAP 2.4.6 and trying to use the mirrormode and syncrepl. My setup has 2 LDAP nodes, one as master and other as slave through a VIP. When the master goes down, the slave will become master and vice-versa. At any point to keep both the LDAP in sync I want to use mirror mode and syncrepl and Im using the following conf file. database bdb directory $MMAIL_VAR_DIR/ldap/ipu-mail-ldap suffix "o=mereonmail" rootdn "cn=admin,o=mereonmail" rootpw secret index objectClass,entryCSN,entryUUID pres,eq index mail,cn eq,sub overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=1 provider=ldap://${MMAIL_LDAP_PEER_HOSTNAME}:$MMAIL_LDAP_PORT bindmethod=simple binddn="cn=admin,o=mereonmail" credentials=ipunity filter="(objectClass=*)" searchbase="o=mereonmail" schemachecking=on type=refreshAndPersist interval=00:00:00:01 retry="60 +" mirrormode on But with the above conf file an the both the nodes ( rid = 2 on the other node2), the replication does not seem to work. Suppose, node1 (master) has 2 add entires, these entries does not come in the slave. Also when I restart the slave, the entries in the master LDAP is deleted. Please let me know the correct conf for Mirrormode and sync repl. Also would like to know if OpenLDAP 2.4.6 supports mirrormode? IThanks in advance for your help. Savithri --------------------------------- Never miss a thing. Make Yahoo your homepage.

1 0

Re: OpenLDAP Planning
by Gavin Henry 10 Dec '07

10 Dec '07

<quote who="Daniel Gibby"> > Hi, Hi, > > We are somewhat new to OpenLDAP and are planning on how we'll use it for > our business. This thread may be more suitable for the general LDAP mailing list: http://www.umich.edu/~dirsvcs/ldap/mailinglist.html Nothing, as yet, seems directly related to OpenLDAP since you appear to be at the "understanding LDAP" stages. > > We have a few different uses we plan on, but one in particular that I > have a question about. > > We already have our email server setup to run virtual domain and aliases > with a MySQL backend. > We have a few thousand email addresses at one domain and we pretty much > won't need more meta-information related to them besides what is already > in our database. > > A spam firewall appliance sits in front of our email server. The spam > firewall supports an LDAP lookup for email addresses. > > Since we already use MySQL for the backend of our email addresses, what > would be the ways we should consider integrating OpenLDAP to support the > spam firewall appliance? Switch MySQL out for OpenLDAP. Put your virtual domains and aliases in there and then point your Spam/Firewall appliance at it. > > I'm wary of using back-sql since all I ever see when searching through > the OpenLDAP archives are somewhat old issues and lack of support. Not lack of support, mainly inproper use of back-sql or misunderstanding its intended purpose... > If I'm wrong about shying away from that, let me know. > > It seems to me that we need a very simple implementation for this part > of our business. Our schema only needs to include the email address, > that's it. > > For other areas of our business we'd want to setup something more > extensive on another server, but what would you see as options for > setting up what we be required for this appliance lookup? > > Thanks for your input! I'll post questions about our other uses or > issues of OpenLDAP in another thread. > Again, these discussion items are better suited to the general LDAP list: http://www.umich.edu/~dirsvcs/ldap/mailinglist.html Thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

3 2

Re: OpenLDAP Planning
by Gavin Henry 10 Dec '07

10 Dec '07

<quote who="Daniel Gibby"> > Let me narrow the focus of my question a bit more. This isn't a general > LDAP question. This is a question specific to OpenLDAP, since I'm > looking for people with experience in OpenLDAP and for ways they solved > the same problem I'm having with OpenLDAP and MySQL. This is better ;-) > > I understand why what you are saying is better to migrate to an LDAP > back-end. I understand why it is faster, more light-weight and elegant. As well as centralised data with standards based access, etc. etc. > Yet, the solution to move completely to LDAP and get away from a DB > back-end always ignores the fact that our business already has > everything working with MySQL. Understood. > We already have many applications setup > to use the DB. We already have what we need except for an LDAP lookup on > it. We just need advice on setting up OpenLDAP with a > super-simple-schema, and suggestions on how to best interface OpenLDAP > with MySQL for that schema. I would think that having support for this > in OpenLDAP would help the community to grow. Adoption would happen at a > much higher rate, since many businesses have a need for such a use of > OpenLDAP. That can only be mostly good news for LDAP and OpenLDAP. Hmmm, if you are merely setting up a directory server for your appliance because it can "do" LDAP lookups, then that seems the wrong way to go about it. In fact, it just seems like data duplication and management overhead to me. > So let me narrow the focus of this question more. I don't want to move > away from a MySQL database. I'm open to exporting it to LDIF or to using > back-sql, or to some other solution I don't know of that uses MySQL and > OpenLDAP. I want someone who has experience using one of those methods > to comment on resources they know of on how to get it to work, or with > gotchas they found along the way. man slapd-sql is very good and should answer most questions, using a 2.4.X release. > > If we only had the time, we'd look into X.500 server commands and LDAP > protocol and build a server that solely runs a ODBC back end and would > only support a few limited LDAP commands. It wouldn't really be a full > LDAP server, and would only support the Bind and Search commands. No > Update, TLS, etc. is needed. It would only be used for this limited > purpose. > > I do appreciate your input. I should have been more clear as to what I'm > looking for with OpenLDAP, as I could have anticipated that my first > response would have been to just move solely to an LDAP backend. There is good information at: http://www.openldap.org/doc/admin24/backends.html#SQL http://www.openldap.org/doc/admin24/intro.html#LDAP%20vs%20RDBMS > > Gavin Henry wrote: >> <quote who="Daniel Gibby"> >> >>> Hi, >>> >> >> Hi, >> >> >>> We are somewhat new to OpenLDAP and are planning on how we'll use it >>> for >>> our business. >>> >> >> This thread may be more suitable for the general LDAP mailing list: >> >> http://www.umich.edu/~dirsvcs/ldap/mailinglist.html >> >> Nothing, as yet, seems directly related to OpenLDAP since you appear to >> be >> at the "understanding LDAP" stages. >> >> >>> We have a few different uses we plan on, but one in particular that I >>> have a question about. >>> >>> We already have our email server setup to run virtual domain and >>> aliases >>> with a MySQL backend. >>> We have a few thousand email addresses at one domain and we pretty much >>> won't need more meta-information related to them besides what is >>> already >>> in our database. >>> >>> A spam firewall appliance sits in front of our email server. The spam >>> firewall supports an LDAP lookup for email addresses. >>> >>> Since we already use MySQL for the backend of our email addresses, what >>> would be the ways we should consider integrating OpenLDAP to support >>> the >>> spam firewall appliance? >>> >> >> Switch MySQL out for OpenLDAP. Put your virtual domains and aliases in >> there and then point your Spam/Firewall appliance at it. >> >> >>> I'm wary of using back-sql since all I ever see when searching through >>> the OpenLDAP archives are somewhat old issues and lack of support. >>> >> >> Not lack of support, mainly inproper use of back-sql or misunderstanding >> its intended purpose... >> >> >>> If I'm wrong about shying away from that, let me know. >>> >>> It seems to me that we need a very simple implementation for this part >>> of our business. Our schema only needs to include the email address, >>> that's it. >>> >>> For other areas of our business we'd want to setup something more >>> extensive on another server, but what would you see as options for >>> setting up what we be required for this appliance lookup? >>> >>> Thanks for your input! I'll post questions about our other uses or >>> issues of OpenLDAP in another thread. >>> >>> >> >> Again, these discussion items are better suited to the general LDAP >> list: >> >> http://www.umich.edu/~dirsvcs/ldap/mailinglist.html >> >> Thanks, >> >> Gavin. >> >> >

1 0

OpenLDAP Planning
by Daniel Gibby 10 Dec '07

10 Dec '07

Hi, We are somewhat new to OpenLDAP and are planning on how we'll use it for our business. We have a few different uses we plan on, but one in particular that I have a question about. We already have our email server setup to run virtual domain and aliases with a MySQL backend. We have a few thousand email addresses at one domain and we pretty much won't need more meta-information related to them besides what is already in our database. A spam firewall appliance sits in front of our email server. The spam firewall supports an LDAP lookup for email addresses. Since we already use MySQL for the backend of our email addresses, what would be the ways we should consider integrating OpenLDAP to support the spam firewall appliance? I'm wary of using back-sql since all I ever see when searching through the OpenLDAP archives are somewhat old issues and lack of support. If I'm wrong about shying away from that, let me know. It seems to me that we need a very simple implementation for this part of our business. Our schema only needs to include the email address, that's it. For other areas of our business we'd want to setup something more extensive on another server, but what would you see as options for setting up what we be required for this appliance lookup? Thanks for your input! I'll post questions about our other uses or issues of OpenLDAP in another thread.

1 0

rewrite searchDN based on filter
by Finn Blucher 10 Dec '07

10 Dec '07

I know this was discussed recently but there didn't seem to be a real answer so I'd like to kick if off again. I would like to be able redirect user searches to two different LDAP servers depending on UID, so: if a process searches for userA with a base of o=container, then the request is sent to ldap://10.0.0.1/ou=subA,o=container if a process searches for userB with a base of o=container, then the request is sent to ldap://10.0.0.2/ou=subB,o=container I'd appreciate any information relating to weather I should be using the ldap or meta backend to achieve this. Mostly I'm having trouble understanding the best way to rewrite the searchDN based on the contents of the searchFilter. Cheers, Finn.

2 1

ACL with group???
by Gémes Géza 09 Dec '07

09 Dec '07

Hi, Sorry if it sounds a newbie question/problem, but: Could anybody send me a working example of how can I use an ACL containing a by group part, I'we found a few examples on the net but a part of it rendered any of the by lines which followed the group one ignored, others have crashed slapd immediately on startup. (My slapd is version 2.3.38 and I stil use slapd.conf file based configuration) Thanks in advance Geza Gemes

5 8

Re: logging
by Gavin Henry 09 Dec '07

09 Dec '07

<quote who="Joseph Dickson"> > Reposting for Gavin -- doesn't seem to have gone to the list.. Thanks. <snip> I don't have the energy to repeat myself about contributing etc., so please search the archives for my thoughts on bashing our documentation. > In general, I just wanted to remind everyone that OpenLDAP's > documentation isn't great, and saying that it is doesn't really help. > Compare to the documentation of other projects (for example, Postgres), http://www.postgresql.org/about/history ;-) Umm Postgres started in 1986, a good 12 years before OpenLDAP was created, but not really an excuse. > I think we can agree that there's quite a bit of room for improvement. > I know it would be better for me to step up and begin writing rather > than rubbing salt in the wound, as it were, but sadly my free time is > already devoted to other things so the best I can do at this point is > try to remind people that there is work to be done on the documentation. Would you be so humble as to spare the time to list improvements or topics that aren't covered, or in fact the "work to be done on the documentation", as it's very hard to guess. That would be ever so kind. I know it's not finished (Admin Guide), but input (whether content or direction) from the community is always appreciated. Gavin.

2 1

Re: logging
by Gavin Henry 08 Dec '07

08 Dec '07

<quote who="Howard Chu"> > Joseph Dickson wrote: <snip> I'd like to reply to the orignal post by the author. Did it go to the list? Thanks, Gavin.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software