openldap-software

openldap-software@openldap.org

2719 discussions

dnsDomain2.schema and aRecord
by Jürgen Magin 13 Dec '06

13 Dec '06

Hello I'm using dnsDomain2 schema with openldap 2.2.27 for dns server (pdns). When I look into the logfiles i saw that some questions are not answered by slapd. When I ask: ldapsearch -x -LLL "dc=hostname" i get the follwing answer: dn: dc=hostnanme,dc=example.local,ou=DNS,ou=Services,dc=example,dc=local objectClass: top objectClass: dNSDomain2 objectClass: domainRelatedObject dc: hostname aRecord: 192.168.1.1 pTRRecord: hostname.example.local associatedDomain: hostname.example.local ok, but ldapsearch -x -LLL "aRecord=192.168.1.1" or ldapsearch -x -LLL "aRecord=192*" returns nothing and ldapsearch -x -LLL "aRecord=*" returns all entries. The entry 'aRecord' is of type caseIgnoreIA5Match. What's wrong there? Any ideas? -- Mit freundlichen Grüßen Jürgen Magin ************************************************************** # # # OCTOGON Software Development GmbH # # http://www.octo-soft.de # # # # Jürgen Magin, Einsteinstr. 11, D 68519 Viernheim # # # # Tel : +49 6204/738353 # # Fax : +49 6204/914875 # # EMail : gaston(a)octo-soft.de # # # **************************************************************

4 11

syncrepl and slowness during updates
by Paul Main 12 Dec '06

12 Dec '06

Hello, Here at UCI we have just deployed syncrepl to replicate our LDAP directory. Unfortunately, we use an old directory structure (PH/QI) for our master database, and ldap gets updates from that system in batch. The batch process updates our master LDAP server, and syncrepl is used to push the changes out to all the other LDAP servers. This causes somewhere around 100 to 1000 entries to be updated all at once (out of 80k + entries in the LDAP directory). The problem we are experiencing is that when a syncrepl slave receives a bunch of updates, queries to these slaves slow down tremendously. We are talking going from a sub second query time for a single LDAP entry, to, in some cases, over 20 seconds response time for simple queries. This is causing all sorts of problems for us. One thing to note: the master does basically the same updates, but through an normal ldap client, rather than through syncrepl -- and it does not experience this slowness. We are using BDB, Openldap ver. 2.3.28 and our syncrepl entry looks something like this: syncrepl rid=11 provider=ldap://ldap3.nac.uci.edu:389 type=refreshAndPersist interval=0:00:00:05 searchbase="OU=University of California Irvine, O=University of California, C=US" filter="(objectClass=*)" scope=sub schemachecking=off sizelimit=0 timelimit=0 updatedn="cn=root,OU=University of California Irvine, O=Universi ty of California, C=US" bindmethod=simple binddn="uid=nsp,OU=University of California Irvine, O=University of California, C=US" credentials="REMOVED" starttls=yes retry=1,2,3,4,5,+ Any help would be appreciated, -Paul Main Network and Academic Computing Services University of California, Irvine

3 3

misc.schema bundled with OpenLDAP - recommended?
by Gavin Henry 12 Dec '06

12 Dec '06

Hi all, I notice that misc.schema says at the top: 20 # Not recommended for production use! 21 # Use with extreme caution! This definitely the case?, as I wanted to use 'nisMailAlias' and 'rfc822MailMember' from it, but not sure now. I've done our own schema ages ago with suretecMailAlias/suretecMailAliasMember, so might stick with that, but wanted to use a bundled schema for most things. Should we stick with our own for Mail Aliases, or use bundled? Advice? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

3 3

Question about OpenLDAP
by Mark Hennessy 12 Dec '06

12 Dec '06

I have a user who tries to connect from an IP x.x.x.31, but they keep getting rejected. The ACL is using IPs to allow anonymous read-only connections. I have a client at another host that's also in the ACL by IP which is set to use an anonymous connection and that works. What should I be looking for with this client that's not working? Also, I built OpenLDAP without SASL on purpose. This is serving a simple database that could potentially have lots of reads and no writes from a couple of trusted hosts. Any help in this matter would be greatly appreciated! This is OpenLDAP from FreeBSD ports built supposedly without SASL. Dec 11 13:34:19 x slapd[2566]: conn=28 fd=10 ACCEPT from IP=x.x.x.31:1691 (IP=0.0.0.0:389) Dec 11 13:34:19 x slapd[2566]: conn=28 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Dec 11 13:34:19 x slapd[2566]: conn=28 op=0 SRCH attr=supportedCapabilities Dec 11 13:34:19 x slapd[2566]: conn=28 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 11 13:34:19 x slapd[2566]: conn=28 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Dec 11 13:34:19 x slapd[2566]: conn=28 op=1 SRCH attr=supportedSASLMechanisms Dec 11 13:34:19 x slapd[2566]: conn=28 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 11 13:34:19 x slapd[2566]: conn=28 op=2 BIND dn="" method=137 Dec 11 13:34:19 x slapd[2566]: conn=28 op=2 RESULT tag=97 err=7 text=unknown authentication method Dec 11 13:34:19 x slapd[2566]: conn=28 op=3 UNBIND Dec 11 13:34:19 x slapd[2566]: conn=28 fd=10 closed -- Mark Hennessy

2 5

Re: Cannot get "logpurge" to work
by Tony Earnshaw 12 Dec '06

12 Dec '06

Dave Horsfall wrote: >> Our format in slapd.conf is slightly different from yours: >> logpurge 02:00:00 24:00 > > Not according to the manual page... The above would say to purge entries > older than 2 hours, and to scan every 24 hours; was that your intention? Yes, the entries aren't worth much to us once they've done their job, any querying by us is done immediately after an update (which even for a modification for many hundreds of modifications happens like greased lightning over all slaves) and such a modification produces thousands of these records, since there's one record for each attribute. Leaving them for 24 hours is OK nad I really want an immediate delete. That's what our original shell script did. I'd seriously suggest you go ahead with delta-syncrepl and have a look at chaining referrals from slave servers; they're two facilities in the latest 2.3 that are worth gold to us, in any event. --Tonni -- Tonni Earnshaw tonni @ barlaeus.nl

1 0

Re: Cannot get "logpurge" to work
by Quanah Gibson-Mount 11 Dec '06

11 Dec '06

--On Tuesday, December 12, 2006 10:19 AM +1100 Dave Horsfall <daveh(a)ci.com.au> wrote: > On Sun, 10 Dec 2006, Quanah Gibson-Mount wrote: > >> Well, it works perfectly for me... >> My syntax is a bit different than yours though: > > For all intents and purposes they are identical; define the accesslog > first, then associate it with a directory. > > Here's a bigger extract; I didn't really want to clutter things up: > ># ># The accesslog database. ># > database bdb > suffix cn=log > rootdn cn=root > directory /var/tmp/slapd.accesslog > index objectClass,reqStart eq > ># ># Play with "auditlog". ># > overlay auditlog > auditlog /var/tmp/slapd.auditlog Are you confusing auditlog and accesslog? They are two entirely different things. I'm not sure they mix well, either... --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

2 1

translucent and syncprov overlay together?
by Karsten Künne 11 Dec '06

11 Dec '06

Hi, is there a way to use the translucent and the syncprov overlay together on one database? I always get "syncprov_db_open: invalid config, lastmod must be enabled" if I try. I have "lastmod on" in my config but apparently the translucent overlay or the implicit back-ldap backend it loads sets it to off which the syncprov overlay doesn't like. What I want to do is to replicate the local override entries to another server with a similar translucent configuration. I don't want to replicate the entries pulled in via the translucent overlay, of course. Karsten.

1 0

Re: Cannot get "logpurge" to work
by Howard Chu 11 Dec '06

11 Dec '06

Dave Horsfall wrote: > On Sun, 10 Dec 2006, Quanah Gibson-Mount wrote: > >>> Nope; still not purging, even with a 5-minute scan. >> Well, it works perfectly for me... >> >> My syntax is a bit different than yours though: > > [...] > >> In your example configuration, you didn't show the overlay bit being >> inside another database definition, but I assume it is... > > Yes, it is, and it took a while to work that one out; talk about > economical documentation :-) The overlay keyword is documented in slapd.conf(5) under the General Database Options. The first sentence of this section states: Options in this section only apply to the configuration file section for the database in which they are defined. The documentation for the overlay keyword begins: Add the specified overlay to this database. I would think it's clear from these statements that overlay configurations are only valid on specific databases. Why use a thousand words to say the same thing over and over again? Why write any documentation at all when the existing documents are so obviously being ignored? -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc OpenLDAP Core Team http://www.openldap.org/project/

1 0

Re: Cannot get "logpurge" to work
by Quanah Gibson-Mount 11 Dec '06

11 Dec '06

--On Monday, December 11, 2006 1:28 PM +1100 Dave Horsfall <daveh(a)ci.com.au> wrote: > OpenLDAP 2.3.27 There are known bugs with logpurge in that version, I'd advise upgrading. Get 2.3.30. ;) --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

2 1

Re: Cannot get "logpurge" to work
by Quanah Gibson-Mount 10 Dec '06

10 Dec '06

--On Monday, December 11, 2006 3:20 PM +1100 Dave Horsfall <daveh(a)ci.com.au> wrote: > On Mon, 11 Dec 2006, Dave Horsfall wrote: > >> > There are known bugs with logpurge in that version, I'd advise >> > upgrading. Get 2.3.30. ;) >> >> Thanks; I've been waiting for 2.3.30 to be marked as STABLE, but I >> haven't seen any issues with it lately. > > Nope; still not purging, even with a 5-minute scan. Well, it works perfectly for me... My syntax is a bit different than yours though: ####################################################################### # accesslog database definitions ####################################################################### database hdb suffix cn=accesslog directory /var/lib/ldap/accesslog rootdn cn=accesslog index default eq index entryCSN index objectClass index reqEnd index reqResult index reqStart .... ####################################################################### # stanford.edu database definitions ####################################################################### database hdb suffix "dc=stanford,dc=edu" rootdn "cn=manager,dc=stanford,dc=edu" .... overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 In your example configuration, you didn't show the overlay bit being inside another database definition, but I assume it is... --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software