openldap-software

openldap-software@openldap.org

2719 discussions

regarding backsql performance
by Arunachalam Parthasarathy 23 Jun '07

23 Jun '07

Hello, Why , when we use the back-sql , the search performance reduces. Is it because , all operations to database is through odbc manager Can I get some more details regarding the above? Thanks in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

5 9

ldap_start_tls_s and automatic CA certificate searching
by Roberto Aguilar 23 Jun '07

23 Jun '07

Hello, I'm trying to write a simple LDAP program that uses TLS for communication and am running into problems with the server certificate verification. Using strace I noticed that the ldapsearch command is able to find the appropriate CA certificate for the server I'm connecting to in my /etc/ssl/certs directory even if the TLS_CACERT setting in ldap.conf points to a different certificate. In my program, however, I receive error 91, which is a Connect error. Setting TLS_CACERT to the server's CA certificate allows the connection to go through, but that is not feasible as I need to connect to servers with different CAs. I tried looking through ldapsearch.c to find the secret sauce to get this to work, but was not successful. Can someone point me in the right direction. Thanks a lot! -berto.

3 3

main: TLS init def ctx failed: -1
by West, Jon (NIH/NIMH) [C] 22 Jun '07

22 Jun '07

I am still attempting to implement TLS connections on my system. When using my new certificates I get this startup error and the LDAP servier will not start main: TLS init def ctx failed: -1 what exactly does this mean? Jon West

2 3

Attribute Uniqueness
by Robert Klopotoski, Jr. 22 Jun '07

22 Jun '07

How do I configure slapd(8) to prevent two objects in the database from having the same value in a particular attribute? That is, how do I configure slapd(8) ensure that values of a particular attribute are unique throughout the database? The server is slapd 2.3.30, on a Debian Linux system (Etch).

4 7

glued bdb databases limit ?
by Raphaël 'SurcouF' Bordet 22 Jun '07

22 Jun '07

Hi, I've a slapd instance which have more than 28 databases glued using OpenLDAP 2.3.35/BerkeleyDB 4.2.52. Most of theses databases (back_bdb) doesn't have memory cache setting greater than 1 Mb using DB_CONFIG. Greaters have 5 Mb. The slapd process consums about 1454 Mb of RAM. But with this following search, I'm getting a curious error message : $ ldapsearch -x -LLL -H ldapi:// -D 'cn=admin,dc=debianfr,dc=net' -W -b 'dc=debianfr,dc=net' -s one '(objectClass)' dn [...] dn: ou=28th,dc=debianfr,dc=net Additionnal information: internal error I don't get no more data after this error message. And in log file of slapd, I've theses lines : /----( slapd.log )---- Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 215403 local4.debug] conn=98 op=1 BIND dn="cn=manager,dc=defense,dc=gouv,dc=fr" method=128 Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 600343 local4.debug] conn=98 op=1 BIND dn="cn=manager,dc=defense,dc=gouv,dc=fr" mech=SIMPLE ssf=0 Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 618536 local4.debug] do_abandon: bad msgid 0 Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 588225 local4.debug] conn=98 op=1 RESULT tag=97 err=0 text= Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 469902 local4.debug] conn=98 op=2 SRCH base="dc=debianfr,dc=net" scope=2 deref=0 filter="(objectClass=*)" Jun 22 15:45:01 meta2 meta-slapd[5676]: [ID 744844 local4.debug] conn=98 op=2 SRCH attr=dn Jun 22 15:45:05 meta2 igc-slapd[5674]: [ID 887893 local4.debug] do_syncrep2: rid 001 LDAP_RES_SEARCH_RESULT Jun 22 15:45:27 meta2 meta-slapd[5676]: [ID 631200 local4.debug] bdb_locker_id: err Not enough space(12) \---8<---8<---8<---8<---8<--- I've already looking for an database problem but I can disable any database, when I'm adding the 29th database, this error come back ! Any ideas ? Regards, -- Raphaël 'SurcouF' Bordet

1 0

dynamic schema for database sql
by Arunachalam Parthasarathy 22 Jun '07

22 Jun '07

Hello, Can I able to add new schema with database sql ? I can able to see the cn=schema, cn=config entries when I do ldapsearch But when the slapd starts, the warning states, No dynanmic config support for sql (Is that mean, I cant add new schemas?), if that's the case , what is the cn=schema, cn=config when I do a ldapsearch. Please explain me in this regard Is this due to oc / attr mapping is not in the database Thanks in advance, Arunachalam. **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

2 1

configure can't find tls
by Jon Roberts 22 Jun '07

22 Jun '07

Fedora 7 OpenSSL 0.9.8e Heimdal 0.8.1 Cyrus-SASL 2.1.22 OpenLDAP 2.3.36 My (tcsh) environment has: setenv CC gcc setenv CFLAGS "-O -g" setenv CPPFLAGS "-I/usr/local/include" setenv LDFLAGS "-L/usr/local/lib" setenv LD_LIBRARY_PATH "/usr/local/lib" When I start to build OpenLDAP, I get stopped at: ernie 70> configure --with-tls ... checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no checking OpenSSL library version (CRL checking capability)... yes configure: error: Could not locate TLS/SSL package ...even though: ernie 73> ls -l /usr/local/lib/libcrypto.a -rw-r--r-- 1 root root 2213286 2007-06-20 14:05 /usr/local/lib/libcrypto.a ernie 76> ls -l /usr/local/lib/libssl.a -rw-r--r-- 1 root root 364650 2007-06-20 14:05 /usr/local/lib/libssl.a ernie 78> ls -l /usr/local/include | grep openssl drwxr-xr-x 2 root root 4096 2007-06-20 14:05 openssl ernie 82> ls -l /usr/local/bin/openssl -rwxr-xr-x 1 root root 1749278 2007-06-20 14:05 /usr/local/bin/openssl ernie 80> ls -l /usr/local/openssl total 48 drwxr-xr-x 2 root root 4096 2007-06-20 14:05 certs drwxr-xr-x 6 root root 4096 2007-06-20 14:05 man drwxr-xr-x 2 root root 4096 2007-06-20 14:05 misc -rw-r--r-- 1 root root 9374 2007-06-20 14:05 openssl.cnf drwxr-xr-x 2 root root 4096 2007-06-20 14:05 private I built Heimdal and Cyrus-SASL without issue using the same environment and they appeared to find this OpenSSL install. What is OpenLDAP configure looking for that it isn't finding? Jon Roberts www.mentata.com

5 11

sync replicate glued database
by Hans Moser 21 Jun '07

21 Jun '07

Hi! I have a glued DIT on a syncProvider: -----snip from slapd.conf------ database meta subordinate suffix proxy,ou=foo database bdb subordinate suffix humans,ou=foo database bdb subordinate suffix system,ou=foo database bdb suffix ou=foo overlay glue overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 -----snap from slapd.conf------ This should be replicated to a consumer: syncrepl rid=401 provider=ldap://provider type=refreshAndPersist retry="60 10 300 10 3600 10" searchbase="ou=humans,ou=foo" bindmethod=simple binddn="cn=human,ou=mgr,ou=foo" credentials=nothing updateref ldap://provider This does not work. Nothing is replicated. When I slapcat everthing, define one, global database und slapadd all in - so I don't have a glued DIT at the provider anymore, it works. Is the above configuration not working or did I a configuration error? Hans

3 5

32 bit to 64 bit migration performance problems
by erin crego 21 Jun '07

21 Jun '07

I am moving our ldap instances to new servers; the old servers are 32 bit, the new ones are 64 bit. I have compiled the same versions of bdb (4.2.52) and openldap (2.2.26) with the same flags on the new servers. After running DirectoryMark tests, I have found the operations per second has gone down 33% - from 299 on the old servers to 192 on the new ones. I have tried adding what I think are the 64 bit flags to the compilation of bdb and openldap. LDFLAGS='-m64' and CFLAGS='-m64' This has resulted in the operations/second going down further to 52. Are there different compilation flags I should use for 64 bit systems? Or, is the performance change of -33% to be expected when moving from 32 bit to 64 bit? --------------------------------- Need a vacation? Get great deals to amazing places on Yahoo! Travel.

2 1

Re: Apparent character loss in Windows implementation
by matthew sporleder 20 Jun '07

20 Jun '07

You could try running slapd -Ta to run it in slapadd mode if it's not in your install base anywhere. If ldapsearch doesn't suffer from the character loss problem, then I suspect it's an incompatibility with your ldap browser's ber-encoding libraries, or just some other kind of weirdo problem. More debugging would be necessary. Good luck! On 6/18/07, Jack Emmerichs <beamrider1(a)hotmail.com> wrote: > ldapsearch (from the new build) can retrieve the base DN described in the > slapd.conf file, so that looks okay. The next thing I need to do is to > rebuild the database from an exported ldif file (which I have) and build a > current database for the new openLDAP version. Unfortunately, I can't find > the slapadd utility in the new build. > > Question: do I need to enable any flags or options to have the build > generate an up-to-date version of slapadd? Sorry for such a really basic > question, but I expected it to just show up as part of the build like > ldapsearch did. > > > >From: "matthew sporleder" <msporleder(a)gmail.com> > >To: "Jack Emmerichs" <beamrider1(a)hotmail.com> > >CC: openldap-software(a)openldap.org > >Subject: Re: Apparent character loss in Windows implementation > >Date: Mon, 18 Jun 2007 09:29:43 -0400 > > > >On 6/15/07, Jack Emmerichs <beamrider1(a)hotmail.com> wrote: > >>We have just succeeded in creating a Windows (Windows XP Professional SP2) > >>implementation of the current stable version (2.3.32) by building all the > >>source code (back end, openSSL, OpenLDAP, etc.) within the MinGw Windows > >>build environment in order to enable the ppolicy options. We are using > >>the > >>standard BDB back-end. Oddly enough, it seems to have worked, and I can > >>execute the slapd.exe file, which seems to run normally. > >> > >>I know Windows is a non-standard environment, but as I understand it, the > >>underlyling OpenLDAP code is suppose to work correctly. Whether we have > >>achieved that or not remains to be seen. > >> > >>The test database we are using has a standard test Manager account in a > >>database structure defined as dn="cn=Manager,dc=my-domain,dc=com". In > >>trying to attach a browser to the LDAP, I seem to be getting a connection > >>to > >>the database, but something seems to be stripping the initinal character > >>from the db structure definition leaving the decoded "dc" component as: > >>"c=my-domain,dc=com". > >> > >>Here is the trace of the attempted connection to the LDAP: > >> > >>slapd starting > >> >>>slap_listener(ldap:///) > >>connection_get(420): got connid=0 > >>connection_read(420): checking for input on id=0 > >>ber_get_next > >>ber_get_next: tag 0x30 len 49 contents: > >>ber_get_next > >>do_bind > >>ber_scanf fmt ({imt) ber: > >>ber_scanf fmt (m}) ber: > >> >>>dnPrettyNormal: <cn=Manager, dc=my-domain,dc=com> > >><<< dnPrettyNormal: <cn=Manager,dc=my-domain,dc=com>, > >><cn=manager,dc=my-domain,d > >>c=com> > >>do_bind: version=3 dn="cn=Manager,dc=my-domain,dc=com" method=128 > >>do_bind: v3 bind: "cn=Manager,dc=my-domain,dc=com" to > >>"cn=Manager,dc=my-domain,d > >>c=com" > >>send_ldap_result: conn=0 op=0 p=3 > >>send_ldap_response: msgid=1 tag=97 err=0 > >>ber_flush: 14 bytes to sd 420 > >>connection_get(420): got connid=0 > >>connection_read(420): checking for input on id=0 > >>ber_get_next > >>ber_get_next: tag 0x30 len 69 contents: > >>ber_get_next > >>do_search > >>ber_scanf fmt ({miiiib) ber: > >> >>>dnPrettyNormal: <dc=my-domain,dc=com> > >><<< dnPrettyNormal: <dc=my-domain,dc=com>, <dc=my-domain,dc=com> > >>ber_scanf fmt (m) ber: > >>ber_scanf fmt ({M}}) ber: > >>=> bdb_search > >>bdb_dn2entry("dc=my-domain,dc=com") > >>=> bdb_dn2id("dc=my-domain,dc=com") > >><= bdb_dn2id: got id=0x01000000 > >>entry_decode: "c=my-domain,dc=com" > >><= entry_decode: str2ad(orsName): AttributeDescription contains > >>inappropriate ch > >>aracters > >><= entry_decode: slap_str2undef_ad(orsName): AttributeDescription contains > >>inapp > >>ropriate characters > >>send_ldap_result: conn=0 op=1 p=3 > >>send_ldap_response: msgid=2 tag=101 err=80 > >>ber_flush: 28 bytes to sd 420 > >> > >>The problem is about seven lines up from the end of the trace. It has the > >>flavor of trying to insert a newline into the full dn=... text and having > >>Unix insert a single expected character while Windows inserts two > >>characters, thereby overlaying the first character of the following text. > >> > >>Does anybody know of any gotchas in a Windows environment related to this > >>problem, or any other information about it? The build options we used > >>were: > >> > >>OPENLDAPCONF="--disable-static --enable-shared --enable-dynamic > >>--enable-lmpasswd --enable-bdb --disable-ldap --disable-ldbm > >>--disable-meta > >>--disable-monitor --disable-null --disable-sql --enable-ppolicy" > >> > >>Any suggestions, including a known impossibility of getting this to work, > >>would be appreciated. > > > > > >Have you tried your search with the 'ldapsearch' command that comes with > >slapd? > > _________________________________________________________________ > Get a preview of Live Earth, the hottest event this summer - only on MSN > http://liveearth.msn.com?source=msntaglineliveearthhm > >

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software