openldap-software

openldap-software@openldap.org

2719 discussions

Re: delta-syncrepl missing changes
by Quanah Gibson-Mount 30 Jan '09

30 Jan '09

--On Friday, January 30, 2009 3:17 PM -0700 Serge Dubrouski <sergeyfd(a)gmail.com> wrote: > On Fri, Jan 30, 2009 at 2:55 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: >> --On Friday, January 30, 2009 1:55 PM -0500 Francis Swasey >> <Frank.Swasey(a)uvm.edu> wrote: >> >> >>> Yes, one of my co-workers calls reloading a fresh dump from the master: >>> "nuke and repave" -- and (sadly) we're getting good at it. Which >>> brings up another question. Back in the days of slurpd, we could force >>> a replica to accept a change by using the correct DN to send the change >>> it had missed. Is there any way to do something similar using syncrepl >>> (or delta-syncrepl)? I think the answer is no -- but as long as I'm >>> making a nuisance of myself, I figure I might as well ask. >> >> I'd think you could use the -c option to slapd to give the replica a >> really old cookie and force it to fall back to doing a fully syncrepl >> refresh, but that's going to take a lot lot longer than slapcat/slapadd. > > Do you really have to use slapcat/slapadd? Can't you just use a backup > copy of the database from the master service? I mean one created with > db_hotbackup. Keep replies on the list. It depends, if the architecture is the same on all of them, you could shut down the master, run db_recover to force all the checkpoints out, and then copy the DB & its log files over, yes. I've done that before. But what's guaranteed to be portable is slapcat/slapadd, so that's why I reference it. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

"ldap_start_tls: Protocol error (2)" and I do not know why
by Nathan Huesken 30 Jan '09

30 Jan '09

Hi, I created ssl certificates using this guide: http://www.credentia.cc/certs/howto/openldap.html Generating a slapd.cert and slapd.key file I added: olcTLSCertificateFile: /etc/ldap/ssl/slapd.cert olcTLSCertificateKeyFile: /etc/ldap/ssl/slapd.key olcTLSCRLCheck: none olcTLSVerifyClient: never to cn=config.ldif file. I also put TLS_REQCERT never into /etc/ldap/ldap.conf Now I try to search: ldapsearch -x -D "cn=admin,dc=*********,dc=***" -b 'dc=**********,dc=***' '(objectclass=*)' -W -ZZ -v ldap_initialize( <DEFAULT> ) ldap_start_tls: Protocol error (2) I do not know what goes wrong, the log file does not tell me much: Jan 30 23:20:56 ********** slapd[20043]: daemon: read active on 14 Jan 30 23:20:56 ********** slapd[20043]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jan 30 23:20:56 ********** slapd[20043]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jan 30 23:20:56 ********** slapd[20043]: connection_get(14) Jan 30 23:20:56 ********** slapd[20043]: connection_get(14): got connid=4 Jan 30 23:20:56 ********** slapd[20043]: connection_read(14): checking for input on id=4 Jan 30 23:20:56 ********** slapd[20043]: ber_get_next on fd 14 failed errno=0 (Success) Jan 30 23:20:56 ********** slapd[20043]: connection_read(14): input error=-2 id=4, closing. Jan 30 23:20:56 ********** slapd[20043]: connection_closing: readying conn=4 sd=14 for close Jan 30 23:20:56 ********** slapd[20043]: connection_close: conn=4 sd=14 Jan 30 23:20:56 ********** slapd[20043]: daemon: removing 14 Jan 30 23:20:56 ********** slapd[20043]: conn=4 fd=14 closed (connection lost) Jan 30 23:20:56 ********** slapd[20043]: daemon: activity on 1 descriptor Jan 30 23:20:56 ********** slapd[20043]: daemon: activity on: Jan 30 23:20:56 ********** slapd[20043]: Jan 30 23:20:56 ********** slapd[20043]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jan 30 23:20:56 ********** slapd[20043]: daemon: epoll: listen=9 active_threads=0 tvp=zero What else could be wrong? Thanks! nathan

1 0

Ldap configuration (Group permission)
by Miguel 29 Jan '09

29 Jan '09

Hello, I m trying to configure the ldap . I have created two groups (contact and administradores) within another one (people). I would like administradores group to have all the permissions over contacts group. I have modified the slapd.conf in this way, but it doesn't work: access to dn=".*,ou=contacts,ou=people,dc=mcm,dc=com" by dn=".*,ou=administradores,ou=people,dc=mcm,dc=com" write by * read could anybody help me? thank you in advance, Miguel

2 2

Securing cn=config
by Peter Mogensen 29 Jan '09

29 Jan '09

After hours of searching through mailing lists, reading man pages and FAQs and the admin-guide and trying every possible combination I can think of, I still can't find the answer on how to secure cn=config The FAQ says that in slapd 2.4 cn=config respects ACLs, but I can't even limit auth against the rootdn with an ACL. There has to be a recommended way, but I can't find it. I guess a lot pf people would have benefit from a FAQ example on how to do it. I would have expected this to work: database config rootpw config access to dn.exact="cn=config" by peername="127.0.0.1" auth by * none but not... /Peter

2 2

openldap and dovecot-sasl
by Nathan Huesken 29 Jan '09

29 Jan '09

Hi, is it possible to use dovecot-sasl for authentication instead of Cyrius Sasl? If yes, what has to be done? Thanks! Nathan

1 0

Syncrepl with back-sql provider (again)
by alessio 28 Jan '09

28 Jan '09

Here <http://www.openldap.org/lists/openldap-software/200708/msg00015.html> I can read that "Indeed back-sql was intended to loosely support acting as a syncrepl provider (limited to refreshOnly) it's currently broken, and it's never been fixed". Has this issue been fixed in openldap-2.4? Greetings, A

1 0

OpenLDAP/TLS main: TLS init def ctx failed: -207
by Technical Home 27 Jan '09

27 Jan '09

Hello, I now try to add SSL/TLS support to my OpenLDAP server 2.4.11 . So I create a CA and a signed certificate by this CA. This point seems to be ok : ------------------------------------------------------------------------------------------------------------------------------------------------------ root@SERVER:~# openssl verify -CAfile /etc/ssl/certs/cacert.pem /etc/ssl/certs/SERVER.crt /etc/ssl/certs/SERVER.crt: OK ------------------------------------------------------------------------------------------------------------------------------------------------------ And i add it to my slapd configuration with following commands as specified in the ubuntu documentation (https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html#openldap-co…) ------------------------------------------------------------------------------------------------------------------------------------------------------ root@SERVER:~# ldapmodify -x -D cn=admin,cn=config -W Enter LDAP Password: dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/SERVER.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/cakey.pem modifying entry "cn=config" ------------------------------------------------------------------------------------------------------------------------------------------------------ But when restarting slapd, I always obtain this output : ------------------------------------------------------------------------------------------------------------------------------------------------------ root@SERVER:~# slapd -h 'ldap://127.0.0.1:389 ldaps://192.168.1.200:636' -g openldap -u openldap -F /etc/ldap/slapd.d/ -d 16383 @(#) $OpenLDAP: slapd 2.4.11 (Oct 24 2008 23:44:05) $ buildd@palmer:/build/buildd/openldap-2.4.11/debian/build/servers/slapd main: TLS init def ctx failed: -207 slapd stopped. connections_destroy: nothing to destroy. ------------------------------------------------------------------------------------------------------------------------------------------------------ I search all my sunday long what could be this "main: TLS init def ctx failed: -207" but I was not able to find what causes it. In openssl file ssl.h, 207 code refers to the macro "#define SSL_F_SSL_VERIFY_CERT_CHAIN 207". It seems to mean that it (slapd or openssl ?) can't verify my certificate string, but I just verified before my certificate with the openssl command which told it is OK. I'm lost. Can you help me ? Thanks in advance, Regards, Gilles

5 5

LDAP Crash while replication
by Andi Gorhan 27 Jan '09

27 Jan '09

Hello, I configured two Master LDAP Server and everything works perfect with replication. The database contains 10 000 entrys Now I want to simulate a Server Break so I stopped LDAP while adding 100 LDAP entrys (30000-30099) via ldapadd. All entrys are available on both Masters (so replication works) expect the last entry before break down LDAP (while entry 30050). So at Master 1 all entrys until 30050 are available, on Master 2 all entrys are available until 30049. LDAP was not able to sync it before break down. That is ok. Then I brought LDAP back on Master 1 and the Last entry (30050) was synced by LDAP to Master 2. All seems to work perfect but now I looked into the Debug Log and LDAP on Master 2 is rescan the whole Database: ... entry_decode: "uid=339,dc=local,dc=de" <= entry_decode(uid=339,dc=local,dc=de) entry_decode: "uid=340,dc=local,dc=de" <= entry_decode(uid=340,dc=local,dc=de) ... Is that normal because it takes a long long time. In the future I will have millions of user and a rescan would cost much time. Is it possible to avoid this behaviour of LDAP. Does anybody have experience with that? Thank you, Andi

1 0

Race condition when using slapo-unique?
by Magne Land 26 Jan '09

26 Jan '09

Hi, I am using OpenLDAP 2.3.43 with BDB 4.5.20 and recently encountered a problem where two different entries were created with the same mail attribute value. The problem is that the mail attribute was defined as unique in slapd.conf: index mail eq,sub overlay unique unique_attributes mail The two similar entries were created about 300 milliseconds apart. To add to the confusion, an ldapsearch for the same mail value occurred at roughly the same time. So far I have not been able to reproduce this, which indicates that it is a race condition. I hope someone can help me, or direct me to some documentation. Regards, Magne Land

2 3

64bit compile fails on Solaris 10
by John Center 26 Jan '09

26 Jan '09

Hi, I'm trying to compile OpenLDAP v2.4.13 on Solaris 10 using Sun Studio 12. Everything is building fine until it gets to slapd itself. It fails linking .libs/slapdS.o: rm -f .libs/slapd.nm .libs/slapd.nmS .libs/slapd.nmT creating .libs/slapdS.c (cd .libs && cc -c "slapdS.c") rm -f .libs/slapdS.c .libs/slapd.nm .libs/slapd.nmS .libs/slapd.nmT cc -g -fast -fsimple=0 -fns=no -xtarget=ultraT1 -xarch=sparcvis2 -m64 -xipo -mt -xcode=pic32 -xpagesize=default -xlic_lib=sunperf .libs/slapdS.o -o .libs/slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o lock.o controls.o extended.o passwd.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o alock.o txn.o version.o -xarch=v9 -L/opt/python2/lib/sparcv9 -L/opt/perl5/lib/sparcv9 -L/opt/heimdal/lib/sparcv9 -L/opt/db/lib/sparcv9 -L/opt/gnu/lib/sparcv9 -L/opt/local/lib/sparcv9 -L/usr/sfw/lib/sparcv9 -L/usr/lib/sparcv9 libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap_r/.libs/libldap_r.so /opt/ws/dists/Services/openldap-2.4.13/libraries/liblber/.libs/liblber.so -L/opt/db/lib ../../libraries/liblber/.libs/liblber.so -mt /opt/gnu/lib/sparcv9/libltdl.so /opt/db/lib/sparcv9/libdb-4.7.so -L/opt/tcl/lib/sparcv9 -lrt -L/opt/SUNWspro/prod/lib/v9 -L/usr/ccs/lib/sparcv9 -L/opt/AS/perl5/lib/CORE -lperl -ldl -lm -lpthread -licuuc -licudata -lsasl /opt/heimdal/lib/libgssapi.so /opt/heimdal/lib/libheimntlm.so /opt/heimdal/lib/libkrb5.so /opt/heimdal/lib/libhx509.so /opt/heimdal/lib/libwind.so -ldoor /opt/heimdal/lib/libhcrypto.so /opt/heimdal/lib /libasn1.so /opt/heimdal/lib/libcom_err.so /opt/heimdal/lib/libroken.so -ldb-4 - lssl -lcrypto -lresolv -lgen -lnsl -lsocket -ldb -lumem -R/opt/openldap/lib/sparcv9 -R/opt/gnu/lib/sparcv9 -R/opt/db/lib/sparcv9 -R/opt/heimdal/lib -R/opt/python2/lib/sparcv9 -R/opt/perl5/lib/sparcv9 -R/opt/heimdal/lib/sparcv9 -R/opt/local/lib/sparcv9 -R/usr/sfw/lib/sparcv9 -R/usr/lib/sparcv9 -R/opt/AS/perl5/lib/CORE cc: Warning: -xarch=v9 is deprecated, use -m64 to create 64-bit programs ld: fatal: file .libs/slapdS.o: wrong ELF class: ELFCLASS32 I think slapdS.c is generated dynamically by ltmain.sh, seen in the line: (cd .libs && cc -c "slapdS.c") I don't know what slapdS.c does, but I think "-m64" needs to be passed to cc here; unfortunately I don't know how to do it. I've searched through the mail archives w/o much luck. Could someone please explain to me what I'm missing? Thanks. -John -- John Center Villanova University

3 9

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software