openldap-software

openldap-software@openldap.org

2719 discussions

OpenLDAP 2.4.16: can not add multiple 'member' attributes to object groupOfNames
by O. Hartmann 23 Jul '09

23 Jul '09

Hello, I try to add multiple member attributes to an object of type groupOfNames and I fail. The same is for objectClass groupOfUniqueNames. Whenever I try to add the multi-attribute, I receive an error like 'info: member: value #1 invalid per syntax, dec: invalid syntax'. I can add exactly one attribute of type 'member' for this object. Well, I'm confused, since this worked in older OpenLDAP versions (I'm now using 2.4.16). The client(s) I try to add attributes are 'ldapadd' with a regular LDIF file (file works well if only ONE member-attribute is specified), LUMA and LAM. All have their described problems. I guess there is a knob I've overseen or I do something conceptionally wrong with OpenLDAP 2.4. Can you help? Regards, Oliver P.S. Server is OpenLDAP 2.4.16 on FreeBSD 7.2 and 8.0, for information.

4 6

Re: performance issue behind a a load balancer 2.3.32
by Tom Ryan 22 Jul '09

22 Jul '09

I notice that you are talking about only one F5? How do you have your secondary F5 configured?? Perhaps the issue is in that? Granted, I realize this doesn't contribute to the conversation, but it does raise a point. Just saying... ----- Original Message ----- From: openldap-software-bounces+tomryan=camlaw.rutgers.edu(a)openldap.org <openldap-software-bounces+tomryan=camlaw.rutgers.edu(a)openldap.org> To: John Madden <jmadden(a)ivytech.edu> Cc: openldap-software(a)openldap.org <openldap-software(a)openldap.org> Sent: Tue Jul 21 22:03:52 2009 Subject: Re: performance issue behind a a load balancer 2.3.32 yep, for a production environment, running on only one, is a sure fire way to earn myself a sparkling new pink slip... -- David J. Andruczyk ----- Original Message ---- From: John Madden <jmadden(a)ivytech.edu> To: David J. Andruczyk <djandruczyk(a)yahoo.com> Cc: openldap-software(a)openldap.org Sent: Tuesday, July 21, 2009 4:47:07 PM Subject: Re: performance issue behind a a load balancer 2.3.32 On Tue, 2009-07-21 at 12:39 -0700, David J. Andruczyk wrote: > This is a large production environment (several hundred servers, > thousands of requests per minute) and the F5-LB is used to balance the > load and take care if a node needs to be taken out of service for maint Given, I run a smaller environment, but even on a several-years-old v2.2.x install I regularly see several thousand requests per second -- not minute -- with tons of logging enabled -- handled while hardly touching the CPU. Are you sure you really need multiple machines? John -- John Madden Sr UNIX Systems Engineer Ivy Tech Community College of Indiana jmadden(a)ivytech.edu

2 2

back_relay difficulties
by Jeff Doyle 22 Jul '09

22 Jul '09

1 0

DetlaSync rid
by Peter Clark 21 Jul '09

21 Jul '09

Hello, This is probably easy to but I did not find a straight forward answer posted. When using Delta Syncrepl do you use a unique number for the rid on each consumer in the slapd.conf? ie: 1 master and 3 slaves: slave 1: syncrepl rid=0 blah... slave 2: syncrepl rid=1 blah... slave 3: syncrepl rid=2 blah... Or can I just use syncrepl rid=0 on all 3 slaves? Thank you. Peter

3 2

RE: How do I get libldap to pick up changes in TLS_CACERTDIR?
by Lawrence Chan 21 Jul '09

21 Jul '09

> Subject: How do I get libldap to pick up changes in TLS_CACERTDIR? > Date: Wed, 1 Jul 2009 10:51:52 -0400 > > > Hi, > > I'm writing an application that connects to a slapd and the application uses ldap_start_tls_s to secure communication between itself and slapd before doing anything else. The version of openLDAP I'm using is 2.2.29... I know I should get a newer version, but I have no say on this matter, this is the version I have to use. The /etc/openldap/ldap.conf config file contains only one modification: > > TLS_CACERTDIR /usr/sw/certs > > I'm not sure how I can get libldap to re-process/re-check the contents of TLS_CACERTDIR without ending the application and restarting it. I initially thought that tearing down the session and re-creating one from scratch would do the trick, but that isn't working. > > Thanks, > Lawrence > I answered my own question and I'll add my solution to the mailing list archive for future reference. Going through the openldap code revealed to me that libldap keeps a default tls context. If you don't specify your own tls context for the LDAP session, then this is the one you're getting. This gets initialized once. So if you decide to change the contents of TLS_CACERTDIR while your LDAP client app is still running, the changes won't get detected (at least not immediately). This was troublesome, since new certificates wouldn't get picked up and deleted certificates didn't cause start_tls to fail. I got around this by managing my own tls context and setting this context to my session via ldap_set_option(ld, LDAP_OPT_X_TLS_CTX, my_ctx). Whenever the contents of the directory changed, I would disconnect the session and re-create the context and set it to the session. Managing your own context also implies that setting TLS_CACERTDIR is unnecessary. Caveat: In 2.2.29, the case statement in ldap_pvt_tls_set_option looks something like: case LDAP_OPT_X_TLS_CTX: if ( ld == NULL ) { tls_def_ctx = (SSL_CTX *) arg; } else { ld->ld_defconn->lconn_tls_ctx = arg; } return 0; It seems that ld_defconn can be NULL in some cases. So I tried to get around this by doing an anonymous bind before setting LDAP_OPT_X_TLS_CTX. Probably not the best strategy, but this strategy is the best I have right now and it seems to work. Cheers, Lawrence

1 0

aliasedObject not found
by Andreas Schoe 20 Jul '09

20 Jul '09

Hello list, I have some problems with alias Objects. I have setup an internal and an external tree. Some group accounts have to point from the external suffix to the internal one. Example: dn: cn=alias,ou=Groups,dc=intern,dc=de objectClass: top objectClass: groupOfUniqueNames cn: alias ... dn: cn=alias,ou=Groups,dc=extern,dc=de aliasedObjectName: cn=alias,ou=Groups,dc=intern,dc=de objectClass: top objectClass: extensibleObject objectClass: alias cn: alias ldapsearch -h ldap -x -a find -b "ou=Groups,dc=extern,dc=de" search: 2 result: 33 Alias problem matchedDN: alias,ou=Groups,dc=gfz-extern,dc=de text: aliasedObject not found System: OpenLDAP: 2.4.16, configured with --enable-overlays=yes solaris 10, SPARC The aliasedObjectName is set to "cn=alias,ou=Groups,dc=intern,dc=de" but the search result give back: "alias,ou=Groups,dc=gfz-extern,dc=de" for the matchedDN. Both trees are indexed with "olcDbIndex: cn pres,eq,approx,sub". I'm looking forward to your advice, hints and help. Thanks a lot! Andreas

2 4

Ndb-backend questions...
by Reinhard Nappert 20 Jul '09

20 Jul '09

Hi, I try to get openldap 2.4.16 running with the MySQL Cluster 7.0.6 as backend. Is there a documentation available, how to configure openldap and my-sql? Specifically, I want to know if I can define more than one suffix, which point to different databases (multiple suffix and dbname directives). If so, how to I associate a suffix with the desired database. Secondly, I got the connection with one suffix to work, but it looked like I have to start the mysql server as well. I thought that the backend-ndb talks directly ndb api. Thirdly, as far as I know, the backend-ndb also allows you to read existing sql tables from the cluster. How does this work and how do you configure this. So far, I am not able to do that. Thanks for any pointers. -Reinhard

2 2

RE: [Openldap 2.4.16] Unable to use DB_CONFIG
by Brett Maxfield 19 Jul '09

19 Jul '09

I think you should read the manual again. That is not a DB_CONFIG. That looks like a slapd config file, in ldif format. -----Original Message----- From: Lepoutre Lionel <leplio(a)gmail.com> Sent: Friday, 17 July 2009 10:19 PM To: openldap-software(a)openldap.org Subject: [Openldap 2.4.16] Unable to use DB_CONFIG Hello, I am trying to use the DB_CONFIG file as it seems to be the good way to configure my hdb database. My LDAP start without any DB_CONFIG, but when I put a DB_CONFIG file I have an error: "unrecognized name-value pair: dn:" Here is an extract of my files (I have changed my personal information by MY...) - slapd.conf: ------------------------------------ database hdb suffix "MY_LDAP_SUFFIX" rootdn "MY_ROOT_DN" rootpw MY_ROOT_PASS directory /opt/local/openldap/var/openldap-data - DB_CONFIG: ----------------------------------- # global configuration settings dn: cn=config objectClass: olcGlobal cn: config # schema definitions dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=core,cn=schema,cn=config objectClass: olcSchemaConfig cn: core #backend definitions dn: olcBackend=hdb,cn=config objectClass: olcBackendConfig olcBackend: hdb # database definitions dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig olcDatabase: hdb olcSuffix: MY_LDAP_SUFFIX .... It seems to be because of the first line of my DB_CONFIG file but I have copied it from the documentation (http://www.openldap.org/doc/admin24/slapdconf2.html). Did I miss something? Is it not the good file for such configuration? Any help is welcome and sorry if it is a stupid question. Lionel

1 0

Re: saslmech=EXTERNAL
by Greek Ordono 17 Jul '09

17 Jul '09

Hi, What I'm trying to do is change the password[1] of user guest to see if my chain overlay will work with saslmech=external. Referring from this email[2] this should be working. But I'm a bit I confused cause I can't get this working while my syncrepl is working well. TIA [1] ldappaswd -s newPasswd - Set the new password to newPasswd. [2] http://www.openldap.org/lists/openldap-software/200808/msg00113.html -- Greek Ordono myppa: launchpad.net/~grexk/+archive/ppa --- On Wed, 7/15/09, Gavin Henry <ghenry(a)suretecsystems.com> wrote: From: Gavin Henry <ghenry(a)suretecsystems.com> Subject: Re: saslmech=EXTERNAL To: "Quanah Gibson-Mount" <quanah(a)zimbra.com>, "Greek Ordono" <grexk(a)yahoo.com> Cc: "openldap-software(a)openldap.org" <openldap-software(a)openldap.org> Date: Wednesday, July 15, 2009, 10:22 PM Also, -stseug is wrong. It should be: [-s base|one|sub] -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

3 2

Re: SOLVED saslmech=EXTERNAL
by Greek Ordono 17 Jul '09

17 Jul '09

Hi, After series of trial and error I finally get it working. The following configuration works for openldap-2.4.16: overlay chain chain-uri "ldap://server.group" #chain-uri "ldaps:///server.group" - not working at all[1]? chain-idassert-bind bindmethod=sasl saslmech=EXTERNAL binddn="cn=whatever" #starttls=yes/critical - even this? tls_cert=/etc/ldap/ssl/replicator-cert.pem tls_key=/etc/ldap/ssl/replicator-key.pem tls_cacert=/etc/ssl/certs/mgoc-cacert.pem tls_reqcert=demand mode=self chain-tls start chain-idassert-authzFrom "*" chain-return-error TRUE $ ldappasswd -x -D 'uid=guest,ou=users,dc=server,dc=group' -w1234 -sguest from the master you may something like this one: Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 PROXYAUTHZ dn="uid=guest,ou=users,dc=server,dc=group" Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 EXT oid=1.3.6.1.4.1.4203.1.11.1 Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 PASSMOD new Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 RESULT oid= err=0 text= on the slave: Jul 18 11:47:30 slave slapd[8915]: conn=0 op=0 BIND dn="uid=guest,ou=users,dc=server,dc=group" method=128 Jul 18 11:47:30 slave slapd[8915]: conn=0 op=0 BIND dn="uid=guest,ou=Users,dc=server,dc=group" mech=SIMPLE ssf=0 Jul 18 11:47:30 slave slapd[8915]: conn=0 op=0 RESULT tag=97 err=0 text= Jul 18 11:47:30 slave slapd[8915]: conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Jul 18 11:47:30 slave slapd[8915]: conn=0 op=1 PASSMOD new Jul 18 11:47:30 slave slapd[8915]: conn=0 op=1 RESULT oid= err=0 text= Thanks for all the people that tried to help me. [1] http://www.openldap.org/lists/openldap-software/200808/msg00012.html -- Greek Ordono myppa: launchpad.net/~grexk/+archive/ppa --- On Sat, 7/18/09, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: From: Quanah Gibson-Mount <quanah(a)zimbra.com> Subject: Re: saslmech=EXTERNAL To: "Greek Ordono" <grexk(a)yahoo.com>, ghenry(a)suretecsystems.com Cc: openldap-software(a)openldap.org Date: Saturday, July 18, 2009, 7:26 AM --On Friday, July 17, 2009 5:44 PM -0700 Greek Ordono <grexk(a)yahoo.com> wrote: > > Hi, > > What I'm trying to do is change the password[1] of user guest to see if > my chain overlay will work with saslmech=external. Referring from this > email[2] this should be working. But I'm a bit I confused cause I can't > get this working while my syncrepl is working well. TIA As I said, by using the "-x" mechanism, you are completely disabling SASL. Thus no SASL/EXTERNAL method is going to work. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software