openldap-software

openldap-software@openldap.org

2719 discussions

replication. keepalive searching...
by Dmitriy Kirhlarov 09 Feb '07

09 Feb '07

Hi, list. I'm using openldap 2.3.33 on provider and consumer server on FreeBSD 6.x. Provider have real IP address. Consumer installed in local network with 172.16.x.x address behind Cisco Pix firewall with NAT. I'm using syncrepl replication (type=refreshAndPersist retry="500 +") and all work fine. But, time-to-time, after reconfiguration, we are reloading translation table on PIX. As result, all installed tcp connections silently drops. Consumer detect this situation after more them 1h (TCP timeout?). Is it possible decrease this time period? WBR -- Dmitriy Kirhlarov OILspace, 26 Leninskaya sloboda, bld. 2, 2nd floor, 115280 Moscow, Russia P:+7 495 105 7247 ext.208 F:+7 495 105 7246 E:DmitriyKirhlarov@oilspace.com Building Successful Supply Chains - One Solution At A Time. www.oilspace.com

4 6

Searching for entryUUIDs broken?
by Peter Mogensen 09 Feb '07

09 Feb '07

Hi, I'm experiencing something weird. I'm using slapd 2.3.32 on Ubuntu Dapper. First I add a couple of objects. Then I look them up by entryUUID: ldapsearch -h localhost -x -W -D 'cn=admin,dc=abook,dc=example,dc=com' -b 'uid=user1,o=NA,dc=abook,dc=example,dc=com' 'entryuuid=ef881802-496c-102b-9655-97b172d5724c' entryUUID The after a slapd restart I try the same, but now only some of the entries will show up as a result. That is, - when I first do: ldapsearch -h localhost -x -W -D 'cn=admin,dc=abook,dc=example,dc=com' -b 'uid=user1,o=NA,dc=abook,dc=example,dc=com' 'entryuuid=*' entryUUID ... then they all show up, but if I pick out one of the results and do the above search for a single entryUUID, then some work and some doesn't. (admin is the rootdn, so it shouldn't be a matter of ACLs) Is there a bug, or am I doing something wrong? regards, Peter

2 2

Changing rootdn password while it's in the db (not in slapd.conf)?
by m h 09 Feb '07

09 Feb '07

Hello- Thanks to the help of Michael and others I was able to migrate my root dn user from slapd.conf to the database. (BTW should I file a bug for bad documentation on example from 7.1 from [1]?) Here's how I did it (for the curious and benefit of future users/searchers):: Add rootdn user to ldif (/tmp/entries.ldif):: # Organization for Example Corporation dn: dc=example,dc=com objectClass: dcObject objectClass: organization dc: example o: Example Corporation description: The Example Corporation # Organizational Role for Directory Manager dn: cn=Manager,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: Manager description: Directory Manager userPassword: secret load it:: ldapadd -x -D "cn=Manager,dc=example,dc=com" -w secret -f /tmp/entries.ldif stop ldap comment out "rootdn" and "rootpw" from slapd.conf start ldap test user from db:: ldapwhoami -x -D "cn=Manager,dc=example,dc=com" -w secret Yeah! It works! So, now back to my original issue. Updating the rootdn password. When I try the following it fails:: ldappasswd -x -v -S -w secret -D cn=Manager,dc=example,dc=com cn=Manager,dc=example,dc=com New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Result: Insufficient access (50) I also have another user that I added and tried to update his password and got the same error:: ldappasswd -x -v -S -w secret -D cn=Manager,dc=example,dc=com cn=s2searchuser,ou=InternalPerson,cn=Manager,dc=example,dc=com New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Result: Insufficient access (50) If I stop ldap, put rootdn/rootpw back in slapd, start ldap and re-run the above and it works:: $ ldappasswd -x -v -S -w secret -D cn=Manager,dc=example,dc=com cn=s2searchuser,ou=InternalPerson,cn=Manager,dc=example,dc=com New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Result: Success (0) I'm sure I'm missing something that is probably obvious to the seasoned veterans, but frustrating to a newbie like me. If anyone can point me further in the right direction that'd be great. thanks much -matt 1 - http://www.openldap.org/doc/admin22/dbtools.html

4 5

RE: Schema Replication
by Mark Mcdonald 08 Feb '07

08 Feb '07

> READ THE ADMIN GUIDE. That'll learn me for skipping over the first paragraph :) Thanks Howard, everything's looking peachy now!

1 0

Maximum size of the primary thread pool
by Rajarshi Chaudhuri 08 Feb '07

08 Feb '07

Hi, Maximum size of the primary thread pool - the default is 16. Is it recommended to increase this value to higher ones like 32/64 etc. Is there any loose relation between the RAM and OS and the thread pool size that I need to consider. Simply, is there any guideline on this thread pool size and it's implications? Rajarshi Chaudhuri Genesys Telecommunications Lab, Inc rajarshi(a)genesyslab.com <mailto:rajarshi@genesyslab.com>

3 4

Can openldap locate "horizon data" on different servers ?
by Zhang William 08 Feb '07

08 Feb '07

for example, there are 1000 entries like this: sub=1,dc=root sub=..., dc=root sub=1000, dc=root i wanna sub=1..500 located on server1 and sub=501...1000 on server2 (no referal). can openldap do that ? i have tried backend meta but it seems cant work. thanks in advance -- Regards. William

3 2

RE: Invalid DN
by Ian Moroney 08 Feb '07

08 Feb '07

ldapadd -x -h localhost -D "cn=mailadmin,dc=global-drum,dc=com" -W -f /srv/ox/share/init_ldap.ldif works! why don't they tell you in the tutorial to have double quotes :P Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work ________________________________ From: David Damon [mailto:ddamon@Baxglobal.com] Sent: 07 February 2007 19:00 To: Ian Moroney Cc: openldap-software(a)openldap.org Subject: Re: Invalid DN Ian, Try ldapadd -x -h localhost -D "cn=mailadmin,dc=global-drum,dc=com" -W -f /srv/ox/share/init_ldap.ldif and see if this works. Notice the DN after the -D is in double quotes. Also, if you have the HOSTS (which is depreciated) or URI (which is the new way of defining providers) defined in your /etc/openldap/ldap.conf file you do not need to define the -h localhost in the ldapadd or ldapsearch commands. Regards, David Damon Senior Systems Integration Analyst "Ian Moroney" <ian.moroney(a)techdivision.co.uk> Sent by: openldap-software-bounces+ddamon=baxglobal.com(a)openldap.org 02/07/2007 07:09 AM To <openldap-software(a)openldap.org> cc Subject Invalid DN Hi again all! Just another brick wall i've ran into... I am running the following command: ldapadd -x -h localhost -D cn=mailadmin,dc=global-drum,dc=com -W -f /srv/ox/share/init_ldap.ldif I then get: ldap_bind: Invalid DN syntax (34) additional info: invalid DN This error happens if i have UID=mailadmin,dc=global-drum,dc=com, cn=root.... cn=mailadmin or whatever. if necessary, i can post the contents of the init_ldap.ldif and my slapd.conf files. ldapsearch -h localhost -D "UID=mailadmin,dc=global-drum,dc=com" -x -W (after password enter) comes back with: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 and when i look at slapd -d -1, it is showing the following, amongst other things: ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 ber_get_next: tag 0x39 len 5 contents: ber_dump: buf=0x80268b80 ptr=0x80268b80 end=0x80268b85 len=5 0000: 02 01 03 42 00 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable ber_get_next on fd 16 failed errno=11 (Resource temporarily unavailable) The database is supposed to be empty, so maybe it should be reporting what it is reporting above. Thoughts? Thanks and Kind Regards, Ian Moroney Field Engineer T: 020 8891 3010 M: 07791 965924 F: 020 8288 2591 www.techdivision.co.uk <http://www.techdivision.co.uk/> TechDivision - Making IT Work

2 1

Salted passwords, further clarification please
by m h 08 Feb '07

08 Feb '07

Hi all. I'm trying to write a script to change the rootpw value in slapd.conf. Before allowing the user to change the password, I'm asking that they first verify the existing password. My question has to do with the random salt. How do I verify the existing password? Going through slappasswd doesn't appear to work, since it uses a random salt each time. ie: r52 ~ # slappasswd -s foo {SSHA}OBe71ShE85Wd8PINTJzunxazszPWpon1 r52 ~ # slappasswd -s foo {SSHA}OCK0lxJa+pfFqDfE39N3EZ8529IZIMhd It doesn't appear from the man page for slappasswd that you can specify the salt. Furthermore, how does the server know what the salt is? (I read through the FAQ on the website and it says the salt is added to the password before encryption). A little confused. Anything enlightening would be wonderful! Thanks much. matt

3 4

Schema Replication
by Mark Mcdonald 08 Feb '07

08 Feb '07

Hi list, I was wondering if there is any way to perform automatic schema delivery to an LDAP network. Basically we’ve started a project where the stakeholders wish to synchronise a new database with LDAP, and the plan is to do it in small steps as the need for each part of the database arises. This is mainly because the users can't define what they want in advance and the size of the database is too big to do in one hit. The schema is going to be defined bit by bit, and deployment of the schema across the country is a fairly big task (~30 slaves) requiring serious outages so what I’m after is a way to change the schema on-the-fly and have it replicate across the network, can OpenLDAP do this? Is this a reasonable request? Any better ideas? If not, what would the scale of this kind of task be? I’ve not touched OpenLDAP code before and I haven’t written any serious C for a few years but if it’s not a huge task I’d like to be able to contribute. Comments welcome. Thanks Mark McDonald iiNet Limited

2 1

OpenLDAP at SCALE
by Howard Chu 07 Feb '07

07 Feb '07

Just a brief note - I'll be giving a talk at the Southern California Linux Expo this weekend http://www.socallinuxexpo.com/scale5x/ The talk will cover some of what's new in OpenLDAP 2.4, present some more benchmark results, and some other related topics. (Yes, OpenLDAP 2.3 *was* the fastest LDAP server we've ever tested. 2.4 is even faster...) Come by and say Hi if you're in the area... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software