openldap-software

openldap-software@openldap.org

2719 discussions

SASL OTP and syncrepl
by manu＠netbsd.org 08 Dec '09

08 Dec '09

Hello When using SASL OTP, the one time password sequence number is stored in a cmusaslsecretOTP attribute. On every successful authentication, it should be decreased. That works fine until used with a syncrepl setup: authenticating to a replica may cause its local cmusaslsecretOTP, but this change will be overriden by the value from the master. As a result, I see sometime the sequence number decreasing just after a succeeded authentication, but that does not last very long. Soon or later, the older value is restored. How is it supposed to work? As far as I understand, there needs to be some code for the replica to send the update to the master. Is the code missing, or do I have a configuration problem that prevent it from working? Or do I hit a bug? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

5 7

back-sock and Proxy Authz or SASL Authz-Name
by Michael Ströder 05 Dec '09

05 Dec '09

HI! We a currently testing a custom OpenLDAP setup where specific modify requests are handled via back-sock (redirected via slapo-rwm) by a handler implemented in Python. These modify requests are checked and then passed to the real database backend (back-hdb) on behalf of the user bound to slapd. This works by looking at the line (binddn: ) passed to the handler by back-sock. But now there's requirement for proxy authorization. The web application binds via SASL bind DIGEST-MD5 and explicitly sets the authzid in the SASL bind request which is mapped via authz-regexp to an authz-DN. This setup seems to work (tested with commandline-tool ldapwhoami -X authzid) but the authz-DN is not passed to the back-sock handler. binddn: still contains the bind-DN of the web application. Is this feasible at all? If not which parts of back-sock would have to be patched to make that work? Ciao, Michael.

2 1

adding x-hidden denied
by Dieter Kluenter 04 Dec '09

04 Dec '09

Hi, I am trying to add x-hidden to the olcAttributeOptions attribute type but I always get error 80, :~> ldapadd -D cn=config -w xxx -H ldap://localhost dn: cn=config changetype: modify add: olcAttributeOptions olcAttributeOptions: x-hidden modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcAttributeOptions> handler exited with 1 :~> ldapadd -D cn=config -w xxx -H ldap://localhost dn: cn=config changetype: modify replace: olcAttributeOptions olcAttributeOptions: x-hidden lang- modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) Any idea how to add this attribute value? Or is x-hidden not supported? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

1 0

how to set an optimal cachesize into openldap
by fida aljounaidi 02 Dec '09

02 Dec '09

Hello My openldap server is always crashed with segmentation fault exit. exemple slapd[6814]: segfault at 8 rip 4af0f2 rsp 451c0530 error 4 I want to tune this server by putting a better cachesize. The size of the openldap database into system is 125 MB The siize of id2entry file is about 22M The size of db2intery file is 6,7M I read on the Administration openldap guide that i can execute db_stat -m to look on the cachesize used by slapd. This size is increasing every hour. In the morning it was on about 240 M on the evening, it increase until 400 M What does it mean and how to deal with that Thanks

1 0

Re: Syncrepl: 3 simple questions
by samk＠twinix.com 02 Dec '09

02 Dec '09

See Thread at: http://www.techienuggets.com/Detail?tx=106135 Posted on behalf of a User Hi,everybody Actually, in 2.4.11 I have ?critical Extension? response with ldap_sync_init API. However with same the source code, it is functional in 2. 3.27 and 2.4.18 . all the waiters are configured in the same way. Have you solved this trouble? Thanks a lot Jack In Response To: Hi! What I would like to understand: 1. How do I query a master for the cookie? 2. How do I query a slave for the coolie? 3. How do I query the master in a human readable format for all changes based on a cookie which I present? My apologies if these questions should have been answered by reading the documentation; I did not find it there, unfortunately. I am sure someone who is a bit more into this can just reply with three simple ldadpsearch statemenets. Regards, Torsten

1 0

openldap 2.4.16 crash
by fida aljounaidi 01 Dec '09

01 Dec '09

Hi Slapd process crash every day. We have activeted debug level at 256. this lets us see this log before the crash conn=2 op=1 SRCH base="dc=domain,dc=com" scope=2 deref=2 filter="(&(memberUid=000678)" slapd[13011]: conn=2 op=1 SRCH attr=cn slapd[13011]: conn=2 op=1 SRCH attr=cn slapd[13011]: conn=2 op=1 SRCH attr=cn slapd[13011]: conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=30 text= slapd[13011]: conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=30 text= slapd[13011]: conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=30 text= slapd[13011]: conn=2 fd=16 closed (connection lost) slapd[13011]: conn=2 fd=16 closed (connection lost) slapd[13011]: conn=2 fd=16 closed (connection lost) We put th idletimeout to 60 s to close properly idle connexions. But this does not provide any change. does anybody have an idea about that ? how to fix that ? Thanks a lot

1 0

Lost of synchronisation in N-way syncro
by fida aljounaidi 30 Nov '09

30 Nov '09

Hi We configure 3 openldap servers to be replicated by the N-Way Multi-Master replication method. after some hours, the servers lost there replication. sometimes , we even lose some data from servers. ntp is well configured, all the servers are set to the same time. What can be th problem? Thanks

1 0

Strange behaviour after installation of openldap
by fida aljounaidi 30 Nov '09

30 Nov '09

Hi I found a strange syntax under the compiled slpad daemon. In fact, when i look to this file i found this line inserted "(#) $OpenLDAP: slapd 2.4.16 $ root@llocalhos:/tmp/openldap-2.4.16/servers/slapd " into it. /tmp/openldap-2.4.16 was the path of sources from where i 've installed the software. this directory does not exist any more. I think that this may cause troubles when running slapd. is it right ? Why this line was inserted into compiled software.?? how can i deal whith that ? thanks a lot Fida

1 0

contextCSN with empty suffix
by Christian Kratzer 27 Nov '09

27 Nov '09

Hi, we have a customer who runs an openldap installation with an empty suffix as in suffix "" which is a potential problem when migrating to syncrepl as they do not have an entry to store the contextCSN. In our lab using openldap 2.4.19 we succeeded in inserting an entry with an empty dn as follows: dn: objectClass: organization o: root This entry received the contextCSN entries and everything looks good from what I can see: dn: objectClass: organization o: root structuralObjectClass: organization entryUUID: 6bd316a2-6f10-102e-904e-c754373eef36 creatorsName: cn=Manager createTimestamp: 20091126194832Z entryCSN: 20091126194832.284443Z#000000#000#000000 modifiersName: cn=Manager modifyTimestamp: 20091126194832Z contextCSN: 20091126194832.864794Z#000000#000#000000 I have no idea how ugly this hack is and am concerned this might break with a future release when either searching for contextCSN below the suffix is perhaps supported again or entries with an empty dn break. I am about to advise the customer to move to a directory with an nonempty suffix matching their root entry but would like to hear nevertheless what you think of above. Greetings Christian Kratzer CK Software GmbH -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Schwarzwaldstr. 31 Phone: +49 7452 889 135 D-71131 Jettingen Fax: +49 7452 889 136 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

3 3

tcmalloc
by Brett ＠Google 24 Nov '09

24 Nov '09

Hello, I was wondering of anybody has used much of tcmalloc (from google performance tools) and has any opinion they care to share with regards to performance of berkeleydb/openldap toolset ? Seems about the same with as without for a simple slapadd, but i'd expect that wins would be more around a highly loaded server, not the initial load process? (investigations continue however, server loading is next) Cheers Brett

6 7

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software