openldap-software

openldap-software@openldap.org

2719 discussions

RE: HDB Tuning
by Mark Mcdonald 17 Jan '07

17 Jan '07

> -----Original Message----- > From: Buchan Milne [mailto:bgmilne@staff.telkomsa.net] > Sent: Thursday, January 18, 2007 12:17 AM > > Is there any reason you didn't include BDB as well ? We have a reasonably high write component in our system so we thought we'd go straight for HDB. From my fairly limited reading, I get the impression that HDB >= BDB, although I've seen nothing criticising HDB comparative to BDB. Is it something we should also consider? For what reasons? > How many entries in the database, or how large is it (du *.bdb) ? 1.3GB, 800k entries in one database. No glue or other overlays. > I think you need (more?) idlcache, configured in slapd.conf inside the > database. And, if you don't have any, you also need a cachesize configured > (in the same place). See the man page for slapd-hdb (or slapd-bdb). IIRC > the > guideline for idlcache on hdb is approx three times the cachesize (which > you > will have to decide on). Bingo! Adding the idlcachesize made a world of difference, thanks! I didn't check that man page so never realised the index caching config directive had changed. I've followed the 3x rule and it's super-speedy now. Thanks Buchan

2 1

Re: openldap queries to w2k3 active directory fails
by Kurt D. Zeilenga 17 Jan '07

17 Jan '07

At 10:04 AM 1/17/2007, javier rojas wrote: >ldapsearch -v d 1 -h w2k3server -p 389 -X "admin" Did you really want to do a SASL authentication? If not, see ldapsearch(1) for information about how to disable use of SASL (the default). Otherwise, I suggest you, at least initially, use the -Y option to specify the desired SASL mechanism. >i get a list of stuff and the bottom of it i get: > >ldap_sasl_interactive_bind_s: Unknown authentication method (-6) > additional info: SASL (-4): no mechanism avvailable This error is discussed here in the FAQ at: http://www.openldap.org/faq/index.cgi?file=771 >what does the -6 and the -4 stands for?, what am i missing? ldapsearch(1) doesn't have -4 and -6 flags, so they stand for argument error I guess. See ldapsearch(1). Regards, Kurt

1 0

HDB Tuning
by Mark Mcdonald 17 Jan '07

17 Jan '07

Hi list, We’ve been doing some performance testing comparing LDBM to HDB to present the business case for an upgrade but currently getting some surprising results. A thousand searches (run consecutively) on LDBM is taking around 70 seconds to complete, whereas the same data is taking 1.2-1.3s per search with HDB. I’ve done some basic fiddling with the DB_CONFIG file and have not appeared to change the results at all. I’ve adjusted the cache size (in DB_CONFIG) to 50 meg, 500 meg, 768 meg and 1gig and I’ve played with different txn log methods (in memory, autoremove, regular logging). I am running db_recover afterwards. The machine specs are identical (Dual P3 1266MHz, 1.25GB RAM) but I’ve also replicated it on a Dual 3GHz Xeon w/2GB RAM. The OpenLDAP versions didn’t seem to matter (currently running on 2.3.32, also tried 2.3.30 & 2.2.26). The OS has been either Debian or Ubuntu linux. Running Berkeley DB 4.2.52. With trace & args logging enabled (-d5) the pause is on the first line of this output: => hdb_dn2idl("BASE_DN") <-- this line => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30990) <= bdb_equality_candidates: id=0, first=0, last=0 => bdb_equality_candidates (uid) => key_read bdb_idl_fetch_key: [78cb9f8c] <= bdb_index_read 1 candidates <= bdb_equality_candidates: id=1, first=666704, last=666704 bdb_search_candidates: id=1 first=666704 last=666704 entry_decode: "" <= entry_decode() => send_search_entry: conn 0 dn="cn=291232744,BASE_DN" ber_flush: 810 bytes to sd 12 <= send_search_entry: conn 0 exit. The other line that has me worried is the 5th line (bdb_index_read: failed (-30990)), I've run slapindex to restore indices but this didn't help or remove the error message. Can anyone shed any light as to where this lag might be coming from? Can I provide any more info to help? Thanks Mark McDonald

2 1

Problems configure access-lists
by Andreas Dahlen 15 Jan '07

15 Jan '07

Hi! I'm running OpenLDAP 2.3.19. Our LDAP-structure is as below; ou=admin,dc=example.dc=com cn=admlocal (objectclass=person) cn=admmaster (objectclass=simpleSecurityObject, organizationalRole) ou=deps,dc=example.dc=com dep=dep1 (objectclass=locDep) cn=admin (objectclass=locAdmin) locId=ID11 (objectclass=locData) locId=ID12 (objectclass=locData) locUsr=USR11 (objectclass=locUser) . . . dep=dep2 (objectclass=locDep) cn=admuser (objectclass=locAdmin) locId=ID21 (objectclass=locData) locId=ID22 (objectclass=locData) locUsr=USR21 (objectclass=locUser) Objectclasses locDep, locAdmin, locData and locUser are locally defined classes. Everything works fine right now, but when I looked in sklapd.conf I saw a major configuration error; The access-lists states; access to attrs=userPassword by dn="cn=admmaster,ou=admin,dc=example,dc=com" write by anonymous auth by self write by * none access to * by dn="cn=admlocal,ou=admin,dc=example,dc=com" write by dn="cn=admmaster,ou=admin,dc=example,dc=com" write by * write I wants to tighthen this security but I can't figure out how I should configure my access-lists. * cn=admmaster,ou=admin,dc=example.dc=com Should have full access to everything * cn=admlocal,ou=admin,dc=example.dc=com Should have full access to everything, except userPassword * cn=<username>,dep=<dep>,ou=deps,dc=example.dc=com Should have full access to everything below its dep, i.e. - cn=admin,dep=dep1,ou=deps,dc=example.dc=com should have full access to everything below dep=deop1,ou=deps,dc=example.dc=com and read on dep=deop1,ou=deps,dc=example.dc=com. - cn=admuser,dep=dep2,ou=deps,dc=example.dc=com should have full access to everything below dep=dep2,ou=deps,dc=example.dc=com and read on dep=dep2,ou=deps,dc=example.dc=com. The name of (class) locAdmin can be different in different deps. I hope that I've managed to describe what I wants to achive. /Andreas ---------------------------------------------------------------- This message was sent using IMP (http://www.horde.org). Running on PHP 5.1.2, Apache 2.0.55, Ubuntu Dapper.

1 0

Syncrepl: why would this happen?
by Lesley Walker 15 Jan '07

15 Jan '07

Running 2.3.32 with the patch for added sync logging, I got this message: Jan 15 18:51:14 wwsv04 slapd[7879]: Entry uid=example,ou=example,dc=example,dc=co,dc=nz CSN 20070115055002Z#000000#00#000000 greater than snapshot 20070115051233Z#000001#00#000000 This particular record gets an update every hour at *:51, but the message has only appeared once so far, and this version has been running since Friday. It seems perfectly reasonable that the CSN with the later timestamp is greater than the earlier one, so why is it telling me this? This is on the provider, which in turn gets its updates from the master server via slurpd. (a temporary measure until we can upgrade the master server) -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

2 2

Syncrepl questions
by Lesley Walker 14 Jan '07

14 Jan '07

If I've understood the documentation correctly, syncrepl utilises a synchronisation cookie which is passed from provider to consumer every so often, and this cookie is based on something called contextCSN which I do not yet understand (but I don't think that matters right now). Which loglevel keyword (if any) will allow me to see this synchronisation cookie being passed? Which other loglevels are useful for debugging replication issues? (Apart from sync, of course, which I'm already using.) Background: I'm trying to debug an issue in which, sometimes, a record that is deleted on the provider does not get deleted on some of the consumers. Version: 2.3.31 Patch: the consumers that exihibit this behaviour are running a version that has been patched for ITS4790, but there are a handful patched consumers that are okay. Some consumers are still running the unpatched version, and all of them are okay (other than the ITS4790 bug). Backend: bdb (4.2) at both ends Provider config: overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 Consumer config: syncrepl rid=123 provider=ldap://wwsv04.opus.co.nz type=refreshAndPersist searchbase="dc=example,dc=co,dc=nz" scope=sub schemachecking=off bindmethod=simple binddn="cn=root,dc=example,dc=co,dc=nz" credentials=secret retry=5,5,30,5,60,5,300,+ -- Lesley Walker Linux Systems Administrator Opus International Consultants Ltd Email lesley.walker(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

3 7

TR : Collective Attributes support
by Mignon, Laurent 13 Jan '07

13 Jan '07

Objet : Collective Attributes support Hy, I'm very interested by the collective attribute support in openldap. When I'm looking in your source code, It appears that this feature is still under development. But when I check the CVS log on files related to this feature, I don't find recent changes. Can you say me if this feature is usable or still too experimental. Do you have planned a release with this feature available? In short, what's the status of the RFC 3671 support in openldap? Thanks in advance Laurent Mignon

2 1

Re: Deny bind for subtree not working?
by Pierangelo Masarati 13 Jan '07

13 Jan '07

Please ask software use questions on the openldap-software mailing list. As per your question about access control in slapd-ldap(5), the answer is in (guess what?) slapd-ldap(5), in the section entitled (guess what?) "ACCESS CONTROL". As per your question about other means to deny bind for a subtree, the answer is in slapd.conf(5), about the config statement "restrict". p. Daniel Hasler wrote: > Hi > > I try to deni BIND for all entries in a subtree. I compiled openldap with the LDAP backend, because this is only a proxy that forwards request to another directory. > > Following is my configuration: > > >> include /local/home/hasleda4/openldap/etc/openldap/schema/core.schema >> include /local/home/hasleda4/openldap/etc/openldap/schema/cosine.schema >> include /local/home/hasleda4/openldap/etc/openldap/schema/inetorgperson.schema >> >> pidfile /local/home/hasleda4/openldap/var/run/gaad-slapd.pid >> argsfile /local/home/hasleda4/openldap/var/run/gaad-slapd.args >> >> database ldap >> suffix "dc=company,dc=com" >> uri "ldaps://other-dir.net:26930" >> >> access to dn.subtree="ou=people,ou=intranet,dc=company,dc=com" by dn.subtree="ou=applications,ou=intranet,dc=company,dc=com" read >> by * none >> access to dn.subtree="ou=applications,ou=intranet,dc=company,dc=com" by users read >> by anonymous auth >> by * none >> access to * by * read >> > > As by the first ACL, anonymous users are not allowed to bind against "ou=people,ou=intranet,dc=novartis,dc=com". > If I now try to bind, the ACL seems not to be evaluated (I run slapd with -d 128 to see ACL processing, and there is no output during the BIND) and the BIND operation succeeds if I give the correct password. > > Is this a bug? Or just how openldap behaves for bind operations? > Is there another way to deny bind operations for a subtree? > > Thanks for any response. > > Cheers > Dani > > > > > Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.n.c. Via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ------------------------------------------ Office: +39.02.23998309 Mobile: +39.333.4963172 Email: pierangelo.masarati(a)sys-net.it ------------------------------------------

1 0

OpenLDAP with referrals to other directory services
by Prakash Velayutham 12 Jan '07

12 Jan '07

Hello All, I have a requirement for a new infrastructure we are building. Our organization has a AD holding all employees' account. I maintain a separate OpenLDAP server with other users' that are not employees. Both the groups (employees and non-employees) need access to a group of Linux/Windows/Solaris/Mac servers. I want the employees to authenticate against AD and non-employees to authenticate against OpenLDAP server. Also all the Unix-related attributes for employees and all attributes for non-employees must come from OpenLDAP server. I think this should be achievable by some combination of referral and the OpenLDAP directory design. I just can't seem to get the right idea, though. Any suggestions/pointers? TIA, Prakash

2 1

Question about multiple Backends
by Simon Maier 12 Jan '07

12 Jan '07

Hi, I have a tricky Question, at least I think it ist. At the computing center of our university we use a groupware (openxchange). This gropware needs a LDAP server with write access. For this reason it can't be integrated into the centralised LDAP of the university. Still it's the idea, that the users are authenticated against the central password store. The problem is the passwords should not be synchronised with the centralised database/LDAP-server for security reasons. For the same reasons the use of the ldap backend + slapo-translucent + slapo-rwm is not possible. The third reason for this is, thata the users on this server are only a subset (around 60) of the users on the centralised Directory (around 10 000) and it will stay that way. Yet the server has access to a webservice of the database. This webservice is given the username and a password and it gives back a vlue of 0, if the user is authenticated, of 1, if the user could not be authenticated and of 2, if the authentication request was submitted by an ip-Adress not authorised to do so. The usernames are the same on the local LDAP and the database. My first idea was to use the perl backend to "catch" the passwords during the bind process and implement the bind in perl. Yet I doubt, this is possible. My next idea was to put the whole subtree under the perl backend and do a rewrite (slapo-rwm) for everything onto a different subtree which would be created similar to the first subtree. The perl Module would only implement 'bind' and 'compare' which are easy to implement in the perl code and return 'unwilling to perform' on any other request, because it can't be implemented by means of the webservice and isn't needed anyway. That way the passwords are not stored on the LDAP-Server and everything should work. Do you all think this is possible/wise? Is there a better/easier way to reach the goal? Regards Simon

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software