openldap-software

openldap-software@openldap.org

2719 discussions

performance issue behind a a load balancer 2.3.32
by David J. Andruczyk 30 Jul '09

30 Jul '09

I work at a place with a fairly large openldap setup. (2.3.32). We have 3 large Read servers, Dell R900, 32 GB ram, 2x quadcore, hw RAID1 disks for ldap volume. The entire database takes about 13GB of physical disk space (the BDB files), and has a few million entries. DB_CONFIG is configurd to have the entire DB in memory (for speed), and slapd.conf cachesize is set to a million entries, to make as most effective use of the 32GB of ram this box has. We have them behind an F5 BigIP hardware load balancer (6400 series), and find that during peak times of the day, we get "connection deferred: binding" in our slapd.logs. (loglevel set to "none" (misnomer)), and a client request (or series of them) fails. If we use round robin DNS instead, we rarely see those errors. CPU usage is low, even during peak times, hovering at 20-50% of 1 core (the other 7 are idle) The interesting this are it seems to happen (the connection defered: binding) , only after a certian load threshold is reached (busiest time of day), and only when behind the F5's. I am suspected it might be the "conn_max_pending" or "conn_max_pending_auth" defaults (100 and 1000 respectively), as when behind the F5, all the connections will appear to come from the F5 addresses, vs RR dns where it's coming from a wde range of sources (eah of the servers. (well over 100+). We had tried experimenting with a higher number of threads previously, but that didn't seem to have a positive effect. Can any openLDAP guru's suggest some things to set/look for, i.e. (higher number of threads, higher defaults for conn_max_pending, conn_max_pending_auth). Any ideas on what a theoretical performance limit should be of a machine of this caliber? i.e. how many reqs/sec, how far will it scale, etc.. We have plans to upgrade to 2.4, but it's a "down the road item", and mgmt is demanding answers to "how far can this design scale as it is"... Thanks! -- David J. Andruczyk

9 22

slapcat and machines
by sgmayo＠mail.bloomfield.k12.mo.us 30 Jul '09

30 Jul '09

I am moving servers. I need to get the machine accounts (for samba) only from my old ldap directory. I don't want the users or anything, but only want the machines. How can I slapcat machines only? I guess that I am just wanting to get ou=Computers or something. I noticed that the manpage on both servers shows slapcat(8C), and the new server has an option '-a' that looks like it may do what I want, but the old one does not. I am still a newb on the ldap thing, so it is a bit confusing. Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

2 1

[multimaster cn=config] olcObjectIdentifier: value #0 olcObjectIdentifier: "olmLDAPAttributes" previously defined
by Thomas Chemineau 30 Jul '09

30 Jul '09

Hi, I am trying to build an OpenLDAP cluster in N-Way Multi-Master mode. I have three servers, all of them on the same network. The first provider has a configuration backend, and I want to replicate it over all nodes of my cluster. Configuration is OK, I am able to start the first provider and to play with it. I would like to run a second server, so that it replicates all of its configuration from the first provider. I do not follow exactly what it written in the online documentation, but my configuration is very similar. I create a "bootstrap" file (LDIF) with minimal information for my second node, and I slapadd it on the second node. So, I have a configuration directory, with only few files: cn=config.ldif cn=config olcDatabase={0}config.ldif olcDatabase={-1}frontend.ldif Now, I faced on a problem. I would like to start this node. It started well, but I have a lot of errors of duplicate values in OLC schema (olcObjectIdentifier, olcAttributeTypes, olcObjectClasses, olcLdapSyntaxes, etc...). See the attachment. Because of these errors, my configuration is not replicate (only the cn=schema.ldif), and my node is not operational. So, I would like to know why these errors occured ? Maybe I'm tired, but I can not find why. Any idea ? Best regards, Thomas. PS: in attachment, log and config from the second node. -- Thomas Chemineau

2 1

Enforcing Password Policy - Testing Lockout
by Subbarao Karanam 29 Jul '09

29 Jul '09

Hi, Currently I'm using Symas OPENLDAP 2.4.12.. It internally uses openLDAP 2.4.12 software I'm able to populate users in openldap database. Following is LDIF File I'm using ----- dn: dc=crmsldap,dc=company dc: crmsldap objectClass: dcObject objectClass: organization o: My company dn: ou=group,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: group dn: ou=people,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: people dn: ou=policies,dc=crmsldap,dc=company objectClass: top objectClass: organizationalUnit ou: policies dn: cn=default,ou=policies,dc=crmsldap,dc=company objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdMinLength: 2 pwdMaxFailure: 2 pwdLockout: TRUE pwdCheckQuality: 2 pwdExpireWarning: 600 pwdGraceAuthNLimit: 2 pwdInHistory: 2 pwdLockoutDuration: 0 pwdSafeModify: FALSE dn: cn=admin,ou=group,dc=crmsldap,dc=company objectClass: top objectClass: posixGroup gidNumber: 100 dn: uid=admin,ou=people,dc=crmsldap,dc=company objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: administrator sn: Administrator uid: admin userPassword: admin uidNumber: 1000 gidNumber: 100 homeDirectory: /home/admin pwdPolicySubentry:cn=default,ou=policies,dc=crmsldap,dc=company ---------- I have made all necassary changes to slapd.conf file After I give wrong password even 10 times. at the 11th time, if I give right password I'm able to login to openLDAP... Can somebody explain what is wrong in my LDIF File... Thanks Subbarao

1 0

Online config, delta syncrepl and overlay chain
by Christian Roessner 27 Jul '09

27 Jul '09

Hi, I had bought a german book (OpenLDAP 2.4 - Das Praxisbuch) and could successfully setup a delta-sync replication. Now I read about the ability to add the overlay chain on the consumer side to automatically redircet write rquests for the consumer to the provider. I am using an online configuration and I am not able to find answers how to add this overlay. I am using Ubuntu, which has built openldap with module-support. So I have already added the back_ldap.la module. Two questions I can not get answers: 1.) Do I need to add the overlay to the thb-backend or to the frontend? 2.) Could please somebody point me to the corresponting objectClasses that need to be added and the required attributes? The book lists the follwing: overlay chain chain-uri ldap://foo/ chain-idassert-bind bindmethod=simple binddn="..." credentials="..." mode=self flags=non-prescriptive chain-rebind-as-user true chain-return-error true I can not find the olcXYZ options. So, I thank you really very much for any help. :-) Christian

3 6

[Openldap 2.4.16] Unable to use DB_CONFIG
by Lepoutre Lionel 26 Jul '09

26 Jul '09

Hello, I am trying to use the DB_CONFIG file as it seems to be the good way to configure my hdb database. My LDAP start without any DB_CONFIG, but when I put a DB_CONFIG file I have an error: "unrecognized name-value pair: dn:" Here is an extract of my files (I have changed my personal information by MY...) - slapd.conf: ------------------------------------ database hdb suffix "MY_LDAP_SUFFIX" rootdn "MY_ROOT_DN" rootpw MY_ROOT_PASS directory /opt/local/openldap/var/openldap-data - DB_CONFIG: ----------------------------------- # global configuration settings dn: cn=config objectClass: olcGlobal cn: config # schema definitions dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=core,cn=schema,cn=config objectClass: olcSchemaConfig cn: core #backend definitions dn: olcBackend=hdb,cn=config objectClass: olcBackendConfig olcBackend: hdb # database definitions dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig olcDatabase: hdb olcSuffix: MY_LDAP_SUFFIX .... It seems to be because of the first line of my DB_CONFIG file but I have copied it from the documentation ( http://www.openldap.org/doc/admin24/slapdconf2.html). Did I miss something? Is it not the good file for such configuration? Any help is welcome and sorry if it is a stupid question. Lionel

2 2

Re: tls init def ctx failed: -1 with my cacert signed certs
by Jelle de Jong 25 Jul '09

25 Jul '09

Brian A. Seklecki wrote: > On Fri, 2009-07-24 at 15:11 +0200, Jelle de Jong wrote: >> Hello everybody, >> >> This is my first post to this list so thank you for making and >> supporting openldap and be gentle on me :) >> >> I have a server that has cacert.org signed certificats, I use them for >> apache > > Does: > /usr/share/ca-certificates/cacert.org/root.crt > > Have an entire concatenated CA Chain? Are there intermediate certs? > > try: > > $ openssl x509 -text -in /usr/share/ca-certificates/cacert.org/root.crt > > > ~BAS > > >> https, postfix and dovecot. Now I am trying to use them to get a >> secure only access to openldap. I am still a bit new to openldap but I >> get this output: >> >> http://debian.pastebin.com/m449836db >> >> What is going on? >> Hi BAS, thank you for helping, I gathered some more information I hope it can help to see what is going on, I can't make anything from the debug output of the openldap server http://debian.pastebin.com/m56aaee1e Thanks in advance, Jelle

5 7

LDAP and SASL problem
by Gildas Bayard 24 Jul '09

24 Jul '09

Hello, I'm setting up a new ldap server on ubuntu server 8.04.3 LTS. man slapd.conf encourages me into using SASL auth for rootdn instead of setting the rootpw parameter in slapd.conf. So I created a user in sasldb with saslpasswd2. sasldblistusers2 give me admin@coruscant: userPassword which is what is expected. But then I see that the password there is in plain text so I don't really get the advantage of using SASL then. So I decide to use saslauthd instead (which in turn will use pam by default). My problem is that I could not find how to tell openldap to use saslauthd instead of sasldb. I tried to add a /usr/lib/sasl2/slapd.conf file with this inside (world readable): pwcheck_method: saslauthd But it seems that this file is not read. I see that ubuntu created a /etc/ldap/sasl2 directory for me but how could I know if sasl is looking in it? How does sasl know it has to look for a slapd.conf file and not openldap.conf or whatever.conf? Could someone shed some light on this subject for me? Cheers, Gildas

3 3

tls init def ctx failed: -1 with my cacert signed certs
by Jelle de Jong 24 Jul '09

24 Jul '09

Hello everybody, This is my first post to this list so thank you for making and supporting openldap and be gentle on me :) I have a server that has cacert.org signed certificats, I use them for apache https, postfix and dovecot. Now I am trying to use them to get a secure only access to openldap. I am still a bit new to openldap but I get this output: http://debian.pastebin.com/m449836db What is going on? Thanks in advance, Jelle de Jong

2 1

Unique overlay usage with filter
by Kyle Blaney 23 Jul '09

23 Jul '09

I'm using the unique overlay in OpenLDAP 2.4.16 and finding it too easy to violate the uniqueness constraints I have defined. For example, if I have the following in my slapd.conf (taken from slapo-unique man page): overlay unique unique_uri ldap:///?cn?sub?(sn=e*) I can violate the uniqueness constraints as follows: 1. Add an entry with cn=a and sn=e. 2. Add a second entry with cn=a and sn=f. 3. Modify the sn of the second entry so that sn=e. The attribute modification succeeds but causes a violation of the uniqueness constraints. Is there any way to configure OpenLDAP so that the attribute modification fails due to a constraint violation? Kyle Blaney

3 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software