openldap-software

openldap-software@openldap.org

2719 discussions

Adding a new user to existing LDAP group
by Subbarao Karanam 03 Sep '09

03 Sep '09

We already have a created LDAP Database with multiple groups and users.Now I want to add a new user and assign him to existing group I have created a newuser.ldif file as follows dn: uid=test,ou=people,dc=crmsldap,dc=agilent changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: test sn: test uid: test userPassword: test uidNumber: 10000 gidNumber: 300 homeDirectory: /home/test dn: cn=admin,ou=groups,dc=crmsldap,dc=agilent changetype: modify memberUid: test When I run the script /opt/symas/bin/ldapmodify -x -D "cn=Manager,dc=crmsldap,dc=agilent" -W -f newuser.ldif it gives an error as follows ldapmodify: modify operation type is missing at line 21, entry "cn=admin,ou=groups,dc=crmsldap,dc=agilent" Thanks Subbarao

3 2

openldap configuration error
by Jittinan Suwanrueangsri 02 Sep '09

02 Sep '09

Hi I have configure openldap 2.4.16 with following option env CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include" LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib" ./configure --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-monitor=mod --enable-spasswd=yes --enable-modules=yes --enable-wrappers=yes --enable-overlays=mod --with-cyrus-sasl --with-tls=openssl --enable-dynacl=yes --enable-crypt=yes --enable-lmpasswd=yes After run make test command there is error as shown below >>>>> Starting test018-syncreplication-persist ... running defines.sh Starting producer slapd on TCP/IP port 9011... Using ldapsearch to check that producer slapd is running... Using ldapadd to create the context prefix entry in the producer... Starting consumer slapd on TCP/IP port 9014... Using ldapsearch to check that consumer slapd is running... Using ldapadd to populate the producer directory... Waiting 7 seconds for syncrepl to receive changes... Stopping the provider, sleeping 10 seconds and restarting it... Using ldapsearch to check that producer slapd is running... Waiting 7 seconds for consumer to reconnect... Using ldapmodify to modify producer directory... Using ldappasswd to change some passwords... Waiting 7 seconds for syncrepl to receive changes... Stopping consumer to test recovery... Modifying more entries on the producer... Restarting consumer... Waiting 7 seconds for syncrepl to receive changes... Try updating the consumer slapd... ldapmodify failed (255)! >>>>> ./scripts/test018-syncreplication-persist failed (exit 255) make[2]: *** [bdb-mod] Error 255 make[2]: Leaving directory `/home/jittinans/openldap-2.4.16/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/home/jittinans/openldap-2.4.16/tests' make: *** [test] Error 2 but after that I change to not build backend as module env CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include" LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib" ./configure --enable-bdb=yes --enable-hdb=yes --enable-ldap=yes--enable-monitor=yes --enable-spasswd=yes --enable-modules=yes --enable-wrappers=yes --enable-overlays=mod --with-cyrus-sasl --with-tls=openssl --enable-dynacl=yes --enable-crypt=yes --enable-lmpasswd=yes I work correctly.Why?

2 4

Should OpenLdap Log Level modification dynamically take in account ?
by Yann CARRE 01 Sep '09

01 Sep '09

Hello I use OpenLdap with the dynamic configuration (directory slapd.d) I can modify the oclLogLevel of the cn=config entry but it seems that there is no effect on the traces printing. Is something wrong in my configuration? Thanks Yann

3 2

Problems with boolean in schema
by Rodrigo Costa 30 Aug '09

30 Aug '09

Dear openldap community, I'm using a boolean entrance in my DB which when I try to load using a LDIF file I receive an error message. The attribute definition is : ############################### # ATTRIBUTES FOR INTERCEPTION --------------------------------------------------------------------------- ############################### # # isinterception # # tells if the admin user is authaurised to manage the interception flag # of the user subscriptions # Attributetype ( 1.3.6.1.4.1.6287.300.1.112 NAME 'isinterception' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) Which I double checking in RFC2252 where I have definition : 6.4. Boolean ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' ) Values in this syntax are encoded according to the following BNF: boolean = "TRUE" / "FALSE" Boolean values have an encoding of "TRUE" if they are logically true, and have an encoding of "FALSE" otherwise. My LDIF file has the entrance(with traces during load) : => str2entry: "dn: loginname=protectedaccess,ou=ADMINUSERS,ou=PROFILECONF,ou=INDEXES,o=domain,c=fr objectclass: adminuser objectclass: interception loginname: protectedaccess loginpasswd: {CRYPT}inRf5tBzmUVog profileidlist: 100,101,102,103,104,105,106,107 sitelist: brtldpvip mailboxgroup: 255 isinterception : TRUE interceptprefix : 88 interceptsecretcode : 1234 interceptprofileid : 104 " >>> dnPrettyNormal: <loginname=protectedaccess,ou=ADMINUSERS,ou=PROFILECONF,ou=INDEXES,o=domain,c=fr> <<< dnPrettyNormal: <loginname=protectedaccess,ou=ADMINUSERS,ou=PROFILECONF,ou=INDEXES,o=domain,c=fr>, <loginname=protectedaccess,ou=adminusers,ou=profileconf,ou=indexes,o=domain,c=fr> <= str2entry: str2ad(isinterception): AttributeDescription contains inappropriate characters slapadd: could not parse entry (line=590) => str2entry: "dn: loginname=webccuser1,ou=ADMINUSERS,ou=PROFILECONF,ou=INDEXES,o=domain,c=fr objectclass: adminuser loginname: webccuser1 loginpasswd: {CRYPT}ajc0hX/PgdoZM profileidlist: 100,101,102,103,105,106,107 sitelist: brtldpvip mailboxgroup: 255 See error above as "AttributeDescription contains inappropriate characters". The attribute isinterception has all letters in uppercase as expected. and I also verified for unprinted characters but I do not see anything there. This file loads in openldap 2.3 without any problems but I could not load without this message in 2.4.x. Do you have any idea about what it could be? Regards, Rodrigo.

2 1

Deletion of 2000 records on master causes complete resync on Shadow
by Serge Dubrouski 27 Aug '09

27 Aug '09

Hello - In our infrastructure we have one master and 2 shadow OpenLDAP 2.4.13 servers with db-4.6.21 backend database, The directory contains about 110000 records. Today we had to delete about 2000 records on the master and that caused a complete refresh on shadows. I mean shadows started to delete all records in their databases. In the log files it started with appearing these messages: Aug 27 14:59:40 berlin slapd[4138]: do_syncrep2: rid=011 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Aug 27 14:59:40 berlin slapd[4138]: do_syncrep2: cookie=rid=011,csn=20090827205939.642722Z#000000#000#000000 Then it started deleting records: Aug 27 14:59:45 berlin slapd[4138]: syncrepl_del_nonpresent: rid=011 be_delete cn=,,,,, Aug 27 14:59:46 berlin slapd[4138]: syncrepl_del_nonpresent: rid=011 be_delete cn=..... Aug 27 14:59:46 berlin slapd[4138]: syncrepl_del_nonpresent: rid=011 be_delete cn=..... Aug 27 14:59:46 berlin slapd[4138]: syncrepl_del_nonpresent: rid=011 be_delete cn=.... Aug 27 14:59:46 berlin slapd[4138]: syncrepl_del_nonpresent: rid=011 be_delete cn=.... Aug 27 14:59:46 berlin slapd[4138]: syncrepl_del_nonpresent: rid=011 be_delete cn=... And deleted records that were deleted records for a whole directory and then started putting them back. Does anybody know if this is expected behavior? -- Serge Dubrouski.

2 1

openldap 2.4.11 multi-master replication fails and overlay stacking order
by Alan Evans 27 Aug '09

27 Aug '09

I have two issues. 1. Multi-master replication does not seem to work reliably for me, changes on master1 often do not get replicated to master2 or vice versa. One thing I think is a bit weird is that I have to use "mirrormode on" but reading the documentation mirrormode is not really multi-master, its master w/ failover basically. All writes should go to one master but I want true multi-master where writes can go to either master at any time. If I remove mirrormode on I get "unwilling to perform" or update referrals when trying to write to my masters. Should I be using mirrormode for multi-master replication? 2. I am not sure my overlays are ordered in the best way and wonder if this misordering is a part of the replication problems I am seeing. Can anyone offer any suggestions as to what I might have wrong for multi-master replication or for the proper stacking order of my overlays? I am using openldap 2.4.11 and I am configuring everything with slapd.conf. I am trying to update to 2.4.16 but I need a reliable RPM for it. It is company policy that the build tools do not go on production servers so I must find an RPM or build an RPM on our build box. --- Begin master1 slapd.conf --- ...globals, schema and such... password-hash {SSHA} ServerID 1 # access.conf contains all access statements which get rsynced # to all master and slave ldap servers include /etc/openldap/access.conf authz-policy both sizelimit unlimited database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index member,uniqueMember,memberOf eq,pres index entryCSN,entryUUID eq overlay accesslog logdb cn=log logops writes session logpurge 7+00:00 1+00:00 overlay ppolicy ppolicy_default cn=ppolicy_default,ou=policies,dc=example,dc=com ppolicy_use_lockout true syncrepl rid=001 provider=ldap://master2/ bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" schemachecking=off type=refreshAndPersist starttls=yes tls_reqcert=never retry="60 5 600 +" overlay syncprov syncprov-checkpoint 100 10 mirrormode on overlay unique unique_uri "ldap:///o=*,dc=example,dc=com?uid?sub?(objectClass=posixAccount)" unique_uri "ldap:///o=*,dc=example,dc=com?uidNumber?sub?(objectClass=posixAccount)" unique_uri "ldap:///o=*,dc=example,dc=com?cn?sub?(objectClass=posixGroup)" overlay dynlist dynlist-attrset posixGroup memberURL memberUid:uid overlay memberof memberof-refint TRUE memberof-dangling error --- End master1 slapd.conf --- Master2 slapd.conf is identical except for being ServerID 2 and its syncrepl provider is master1.

1 0

cache configuration constraints question
by Rodrigo Costa 27 Aug '09

27 Aug '09

openldap community, I would like your comments about some cache configuration. I'm sending attached my slapd.conf for full information about my system. Since I have some memory constraints I needed to limit using cache configuration in slapd.conf file. #Cache values #cachesize 10000 cachesize 20000 dncachesize 3000000 #dncachesize 400000 #idlcachesize 10000 idlcachesize 30000 #cachefree 10 cachefree 10000 Since I was initially testing using only ldapseach through all DB, dncachesize in 3,000,000 was controlling correctly the use of memory. Then using the same cache constraints in slapd.conf I create a jmeter script with a csv file that individually search for each entrance in the DB. This would be understand as individual ldapsearch with individual entrances search different from a ldapsearch for all entrances in DB. But for my surprise the memory was consumed much faster and when around 500K entrances were searched , much less than the ldapsearch full in 3,000,000 cache, I already had the same memory consumption. In this way I had a crash in slapd since the memory was all allocated. I would like your help to understand these memory constraints configuration and why memory consumption behavior was so different in these 2 cases. For summary : Case 1: Search full DB using a single ldapsearch (ldapsearch <parameters> filter=* ) Case2: Multiple searches to all entrances in DB using like multiple ldapsearch (ldapsearch <parameters> filter=<unique DB>) Is there any difference between these two cases based in cache limitation? Maybe I've some incorrect understanding about cache configuration. Best Regards, Rodrigo.

1 0

[Openldap 2.4.16] Is it possible to force synchronization: files log.xxxx not treated after a crash
by Lepoutre Lionel 25 Aug '09

25 Aug '09

Hello, I am using openldap 2.4.16 in a multi-master configuration mode (2 servers on linux system - LFS). My problem is that some data are not synchronised on one of my server and I have some "log.xxxx" files in my var/openldap-data/ directory. I think it is normal as these files are the synchronisation files and are not suppress until the synchronisation is validated (in my DB_CONFIG I have set the parameter: set_flags DB_LOG_AUTOREMOVE). The replication is at that moment working (I have made some tests) but I know that the ldap process has crashed as I found some logs: *Aug 20 10:08:40 bpldap02s kernel: slapd[19783]: segfault at 0 ip 080926f3 sp ad5a03a0 error 4 in slapd[8048000+1b9000]* But I was on holidays while it happens so I don't have more information on how it happens. Is there something I can do to force the files to be treated? I have read some articles about "slurpd" but I am not sure it can be used with my version. For the moment I only see the solution: "slapcat -> ldapadd" to synchronize both instances but if you have any other solution... Thank you for your help. Lionel

4 7

Possible linux tuning for high/constant load connections
by Rodrigo Costa 25 Aug '09

25 Aug '09

OpenLdap software community, I would like to request your experience for some issue I'm facing trying to use jmeter for testing openldap load test. I made a script that keeps around 10 simultaneous thread connections with a ramp time of 1 second. I also use a csv file with the records filters so the bind+search+unbind always pass by all records existent in the DB. The issue I'm facing is that after sometime I see some connections being refused(no bind) but after sometime the connections start to be accepted again. Analyzing the logs and everything else I could notice the following things happening in the system : 1) I see that all connections are accept by the openldap machine and then the TIME_WAIT connections start to increase(what make sense); [root@brtldp11 ~]# netstat -an --protocol=inet -t|wc -l 11636 (around this) 2) After normally the number of connections(ESTABLISHED, TIME_WAIT, etc) increase to values normally over 12,000 then it start to reduce; 3) When these connections start to reduce then I start to see after sometime in the output error for jmeter connections ; <sample t="177" lt="0" ts="1251214974190" s="false" lb="LDAP Bind" rc="800" rm="javax.naming.CommunicationException: 10.142.15.170:389 [Root exception is java.net.ConnectException: Cannot assign requested address]" tn="Thread Group1 1-2" dt="text" by="409"> <responseData class="java.lang.String"><ldapanswer><operation><opertype>bind</opertype> <baseobj>ou=CONTENT,o=domain,c=fr</baseobj> <binddn>cn=admin,ou=CONTENT,o=domain,c=fr</binddn> <connectionTO>3000</connectionTO> </operation> <responsecode>800</responsecode> <responsemessage>javax.naming.CommunicationException: 10.142.15.170:389 [Root exception is java.net.ConnectException: Cannot assign requested address]</responsemessage> </ldapanswer> </responseData> </sample> 4) Also start to see at syslog(LOG4) for openldap(loglevel 2) messages like below : Aug 25 12:42:59 brtldp11 slapd[2720]: connection_read(27): no connection! Aug 25 12:42:59 brtldp11 slapd[2720]: connection_read(43): no connection! Aug 25 12:42:59 brtldp11 slapd[2720]: connection_read(28): no connection! Aug 25 12:42:59 brtldp11 slapd[2720]: connection_read(40): no connection! Aug 25 12:43:00 brtldp11 slapd[2720]: connection_read(37): no connection! Aug 25 12:43:00 brtldp11 slapd[2720]: connection_read(30): no connection! Aug 25 12:43:01 brtldp11 slapd[2720]: connection_read(23): no connection! Aug 25 12:43:02 brtldp11 slapd[2720]: connection_read(36): no connection! Aug 25 12:43:02 brtldp11 slapd[2720]: connection_read(41): no connection! 5) The netstat results decrease and all start over again until behavior follows all steps again. [root@brtldp11 ~]# netstat -an --protocol=inet -t|wc -l 9217 I tried to check all tuning parameter I knew and I could not find explanation. Some parameters are : [root@brtldp11 ~]# cat /proc/sys/net/ipv4/ip_local_port_range 32768 61000 [root@brtldp11 ~]# ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 196607 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 65535 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 10240 cpu time (seconds, -t) unlimited max user processes (-u) 196607 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited I can be sure the test is trying to behave as expected since if I check the ESTABLISHED connections I can see the simultaneous connections I expect. Like : [root@brtldp11 ~]# grep ESTA* log1.txt |wc -l 9 Like I configured in the test for around 10 simultaneous connections with 1 second ramp. This was not supposed to be a so high load test but this strange behavior is happening. Even with this small number of connections I have this issue and then time by time there are some connections refused. Also when I see this situation I try to call ldapsearch and I saw : [root@brtldp12 jakarta-jmeter-2.3.4]# [root@brtldp12 jakarta-jmeter-2.3.4]# time ldapsearch -LLL -x -D "cn=admin,ou=CONTENT,o=domain,c=fr" -w secret -b "ou=CONTENT,o=domain,c=fr" -H ldap://10.142.15.170:389 'pnnumber=+554184096814' ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) real 0m0.059s user 0m0.000s sys 0m0.023s Running after some seconds I can recover data from this query. Any ideas? Can this be some openldap configuration? Anyone already configured some heavy load test and OS tuning for openldap? Best Regards, Rodrigo.

1 0

Re: tlsverifyclient security implications
by Josh.Mullis＠cox.com 24 Aug '09

24 Aug '09

..."If the client does not send a certificate, it can still connect." Does that mean that traffic is still encrypted if a certificate is not used? ----- Original Message ----- From: Emmanuel Dreyfus <manu(a)netbsd.org> To: Mullis, Josh (CCI-Atlanta); openldap-software(a)openldap.org <openldap-software(a)openldap.org> Sent: Sun Aug 23 02:59:05 2009 Subject: Re: tlsverifyclient security implications Josh Mullis <josh.mullis(a)cox.com> wrote: > What are the security implications concerning the following setting in > slapd.conf: > tlsverifyclient allow As far as I understand, if the client sends a certificate, then slapd can use it to map client to a LDAP DN, like this: authz-regexp cn=foo uid=foo,dc=example,dc=net If the client does not send a certificate, it can still connect. -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

7 8

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software