openldap-software

openldap-software@openldap.org

2719 discussions

Updating a private schema (cn=config)?
by Andrzej Jan Taramina 10 Dec '08

10 Dec '08

I need to update one of our internal LDAP schemas, but am not sure of the best process to use. Haven't managed to find any info on this, especially using the newer cn=config configuration stuff. Using the latest Ubuntu Intrepid OpenLDAP version (2.4.11) I've tried deleting the schema, but keep getting a "server won't allow" error. Deleting all my LDAP entries doesn't help that. It seems that once you have a schema defined you can't delete it using a GUI tool like Luma nor using LDIF directives with OpenLDAP running. Do I just shut down my LDAP server, and delete the entry in the cn=config directory, then re-install the new schema version? What about any entries that depend on the schema? Will they be affected...that is, do I need to delete them all and re-add them? I guess if I knew when a schema is actually used (eg. only at add/modify times....or are there links to from the entries that are used at other times?) it would help? Thanks for the advice... -- Andrzej Taramina Chaeron Corporation: Enterprise System Solutions http://www.chaeron.com

3 2

2.4.13 update troubles
by Emmanuel Dreyfus 10 Dec '08

10 Dec '08

Hello Upgrading to 2.4.13 is troublesome at mine slapadd eats the top object, then a bunch of children organizationalUnit, and it hangs on the first inetOrgPerson. A kernel trace shows that slapd loops on a select(0, NULL, NULL NULL, &something) system call. With the -q flag, slapadd manages to load the whole tree. But slapd will hang in the same null select loop on the first search request. I had to downgrade back to 2.4.11, as 2.4.13 was just unable to answer requests. It also seems slapd is still unable to reload an accesslog database, but IIRC? this is an old problem: str2entry: invalid value for attributeType reqControls #0 (syntax 1.3.6.1.4.1.4203.666.11.5.3.1) slapadd: could not parse entry (line=41025) -- Emmanuel Dreyfus manu(a)netbsd.org

3 4

Re: syncrepl breaks on fax attribute removal
by Will Nowak 09 Dec '08

09 Dec '08

On this subject, has anyone packaged 2.4.13 for Ubuntu Hardy? We've got to upgrade our cluster from 2.4.9 -- I am happy to do this myself, but if someone else has... Thanks, -Will On Tue, Dec 9, 2008 at 1:08 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 09, 2008 5:57 PM +0000 Emmanuel Dreyfus > <manu(a)netbsd.org> wrote: > >> On Tue, Dec 09, 2008 at 09:52:14AM -0800, Quanah Gibson-Mount wrote: >>>> >>>> It's 2.4.11. A bit behind, I will upgrade to have this fixed. >>> >>> Please keep replies on the list. :) >> >> Sorry. >> >>> It was fixed in 2.4.13: >>> Fixed slapd syncrepl MOD of attrs with no EQ rule (ITS#5781) >> >> Is that a master or replica bug? Which one must be upgraded in order >> to have the problem addressed? > > slapo-syncprov is (generally) the master bits. So this would be a replica > side fix. Of course, there were plenty of fixes to slapo-syncprov too by > 2.4.13, so you may want to upgrade both. :P > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: syncrepl breaks on fax attribute removal
by Quanah Gibson-Mount 09 Dec '08

09 Dec '08

--On Tuesday, December 09, 2008 5:46 PM +0000 Emmanuel Dreyfus <manu(a)netbsd.org> wrote: > On Tue, Dec 09, 2008 at 09:43:50AM -0800, Quanah Gibson-Mount wrote: >> What release? I thought this was fixed. > > It's 2.4.11. A bit behind, I will upgrade to have this fixed. Please keep replies on the list. :) It was fixed in 2.4.13: Fixed slapd syncrepl MOD of attrs with no EQ rule (ITS#5781) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

syncrepl breaks on fax attribute removal
by Emmanuel Dreyfus 09 Dec '08

09 Dec '08

Hello facsimileTelephoneNumber has no equality matching rule. This makes it a bit difficult to remove. ldapvi will compain because: ldap_modify: Inappropriate matching (18) additional info: modify/delete: facsimileTelephoneNumber: no equality matching rule Using ldapmodify, it is possible to delete all facsimileTelephoneNumber attributes, but then, replicas get out of sync: null_callback : error code 0x12 syncrepl_entry: rid=217 be_modify failed (18) do_syncrepl: rid=217 retrying I have to destroy the replicas database and get the resync from scratch. Kind of silly, isn't it? Is that issue known? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

Re: Replication failling and not retrieving all entries
by Quanah Gibson-Mount 09 Dec '08

09 Dec '08

--On Tuesday, December 09, 2008 8:18 AM -0200 Gustavo Lima <gustavopml(a)gmail.com> wrote: > > > 2008/12/8, Quanah Gibson-Mount <quanah(a)zimbra.com>: > > --On Monday, December 08, 2008 4:21 PM -0200 Gustavo Lima > <gustavopml(a)gmail.com> wrote: > > > > Hi All, > > Anyone can help us with this one? > > > Use a current release. > > > > Unfortunally I do not have this option. Only on Debian Lenny release. Any > other clue? No. Keep replies to the list. You asked for help with what to do, and I gave you the only really usable advice. I suggest you go and read the changelogs, for example, between the release you are on, and the final OpenLDAP 2.3 series release, OpenLDAP 2.3.43 release. There were many major fixes to replication that occurred. The release in lenny unfortunately has a number of bugs. If what you want is to run a production LDAP service, you're going to need to know how to maintain the LDAP software. I also advise reading: <http://www.openldap.org/faq/data/cache/1456.html> Regards, Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

dynlist-overlay and requesting an attribute
by Wilhelm Meier 08 Dec '08

08 Dec '08

Hi, I have a problem with the dynlist overlay: when I request all attributes of an object, the dynlist expansion is done: kmux-ldap:~# ldapsearch -LLL -x '(uid=kmux.admin)' dn: uid=kmux.admin,ou=Benutzer,dc=kmux,dc=de objectClass: inetLocalMailRecipient objectClass: sambaSamAccount objectClass: shadowAccount objectClass: posixAccount objectClass: inetOrgPerson objectClass: kmuxAccount labeledURI: ldap:///ou=Gruppen,dc=kmux,dc=de??one? (&(objectClass=posixGroup)(memberUid=kmux.admin)) labeledURI: ldap:///ou=Gruppen,dc=kmux,dc=de??one? (&(objectClass=posixGroup)(gidNumber=999)) member: cn=VPN,ou=Gruppen,dc=kmux,dc=de member: cn=Drucker,ou=Gruppen,dc=kmux,dc=de member: cn=Hauptbenutzer,ou=Gruppen,dc=kmux,dc=de member: cn=CMS,ou=Gruppen,dc=kmux,dc=de member: cn=ERP,ou=Gruppen,dc=kmux,dc=de member: cn=cdrom,ou=Gruppen,dc=kmux,dc=de member: cn=plugdev,ou=Gruppen,dc=kmux,dc=de member: cn=audio,ou=Gruppen,dc=kmux,dc=de member: cn=Administratoren,ou=Gruppen,dc=kmux,dc=de (excuse for the line wrapping) (some attributes are not shown) If I request the attribute "member" I get an empty search result: kmux-ldap:~# ldapsearch -LLL -x '(uid=kmux.admin)' member dn: uid=kmux.admin,ou=Benutzer,dc=kmux,dc=de Any hints? -- Wilhelm

2 4

Replication failling and not retrieving all entries
by Gustavo Lima 08 Dec '08

08 Dec '08

Hi All, I have a big network with one master openldap 2.3.30 running on Debian Etch fully updated. I have other 27 consumers using replication on refresAndPersist type working 100% fine with one exception. This exception have the same configurations off all other servers. I have already changed the WAN provider (it was planned to change it), the switch where the server is connected, network cable, the hole server and nothing seems to change the strange behavior. What happens is this specific machine does not receive all the 8323 objects from the master. On debug mode it does not show any error. The openldap simply thinks the replica have finished. Then some seconds later it start replicating again but not from the stop point. The best that I have is 5217 objects replicated. My conf on this server was copied from another working installation and then changed the "rid". This is how my conf is: ####################################################################### # SCHEMAS ####################################################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/samba.schema ####################################################################### # GERAL ####################################################################### #allow bind_v2 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 4 64 16384 sizelimit 20000 tool-threads 1 ####################################################################### # MODULOS ####################################################################### modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov ####################################################################### # BACKEND ####################################################################### backend bdb checkpoint 512 30 ####################################################################### # DATABASE ####################################################################### database bdb suffix "dc=company" rootdn "cn=replicator,dc=company" rootpw {SSHA}password directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on ###################################################################### # ACL ###################################################################### access to dn.base="" by * read access to * by dn="cn=admin,dc=company" write by dn="cn=replicator,dc=company" write by * read access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=company" write by dn="cn=replicator,dc=company" write by self write by anonymous auth by * none ###################################################################### # TLS ###################################################################### TLSCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP TLSCACertificateFile /etc/ldap/certs/cacert.pem TLSCertificateFile /etc/ldap/certs/servercrt.pem TLSCertificateKeyFile /etc/ldap/certs/serverkey.pem TLSVerifyClient never ###################################################################### # REPLICACAO ###################################################################### syncrepl rid=51 provider=ldaps://ldap bindmethod=simple binddn="cn=replicator,dc=company" credentials=password searchbase="dc=company" schemachecking=off type=refreshAndPersist retry="30 30 600 72" ###################################################################### # Indices ###################################################################### index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index memberUid eq,subinitial index mail eq,subinitial index givenname eq,subinitial index uidNumber eq index gidNumber eq index entryUUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass eq index sambaGroupType eq index sambaSIDList eq index uniqueMember eq index entryCSN eq When the replication stops the log just shows: Dec 8 15:55:09 mg slapd[6529]: syncrepl_entry: LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Dec 8 15:55:09 mg slapd[6529]: bdb_idl_fetch_key: [7cdee34d] Dec 8 15:55:09 mg slapd[6529]: send_ldap_result: err=0 matched="" text="" Dec 8 15:55:09 mg slapd[6529]: syncrepl_entry: be_search (0) Dec 8 15:55:09 mg slapd[6529]: syncrepl_entry: uid=pr0239$,ou=maquinas,dc=matriz,dc=company Dec 8 15:55:09 mg slapd[6529]: do_syncrep2: LDAP_RES_SEARCH_RESULT Dec 8 15:55:09 mg slapd[6529]: connection_get(39) Note that the first line is saying LDAP_SYNC_ADD and not LDAP_SYNC_MODIFY once this user is already loaded. Anyone can help us with this one? Thanx in advance. Gustavo

2 1

Problem deleting olcLimits with OpenLDAP 2.3.39
by openldap.lists＠frei-family.ch 08 Dec '08

08 Dec '08

Hi all, We have a problem with modifying the multivalue attribute "olcLimits". No matter if I try a "delete" or "replace" it always throws the error: ldapmodify: Internal (implementation specific) error (80). If I do the same on olcAccess (which is a multivalue attribute as well) it works. We are using an 2.3.39 server. I tried the operation below with ldapmodify 2.3.39 and 2.3.34. Both Versions of ldapmodify lead to the same error. $ ldapmodify -x -D "cn=manager,cn=config" -w password dn: olcDatabase={3}hdb,cn=config changetype: modify delete: olcAccess modifying entry "olcDatabase={3}hdb,cn=config" dn: olcDatabase={3}hdb,cn=config changetype: modify delete: olcLimits modifying entry "olcDatabase={3}hdb,cn=config" ldapmodify: Internal (implementation specific) error (80) -------- log (loglevel = -1) for attempted deletion of olcLimits ... Dec 4 10:04:51 z000572 slapd[2676]: [ID 552196 local4.debug] oc_check_allowed type "modifiersName" Dec 4 10:04:51 z000572 slapd[2676]: [ID 552196 local4.debug] oc_check_allowed type "modifyTimestamp" Dec 4 10:04:51 z000572 slapd[2676]: [ID 131099 local4.debug] send_ldap_result: conn=15 op=2 p=3 Dec 4 10:04:51 z000572 slapd[2676]: [ID 291653 local4.debug] send_ldap_result: err=80 matched="" text="" Dec 4 10:04:51 z000572 slapd[2676]: [ID 324658 local4.debug] send_ldap_response: msgid=3 tag=103 err=80 Dec 4 10:04:51 z000572 slapd[2676]: [ID 588225 local4.debug] conn=15 op=2 RESULT tag=103 err=80 text= Dec 4 10:04:51 z000572 slapd[2676]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Dec 4 10:04:51 z000572 slapd[2676]: [ID 802679 local4.debug] daemon: activity on: Dec 4 10:04:51 z000572 slapd[2676]: [ID 522297 local4.debug] 18r Dec 4 10:04:51 z000572 slapd[2676]: [ID 100000 local4.debug] Dec 4 10:04:51 z000572 slapd[2676]: [ID 694296 local4.debug] daemon: read activity on 18 Dec 4 10:04:51 z000572 slapd[2676]: [ID 525477 local4.debug] connection_get(18) Dec 4 10:04:51 z000572 slapd[2676]: [ID 611214 local4.debug] connection_get(18): got connid=15 Dec 4 10:04:51 z000572 slapd[2676]: [ID 138202 local4.debug] connection_read(18): checking for input on id=15 Dec 4 10:04:51 z000572 slapd[2676]: [ID 812316 local4.debug] ber_get_next on fd 18 failed errno=0 (Error 0) Dec 4 10:04:51 z000572 slapd[2676]: [ID 549122 local4.debug] connection_read(18): input error=-2 id=15, closing. Dec 4 10:04:51 z000572 slapd[2676]: [ID 685210 local4.debug] do_unbind Dec 4 10:04:51 z000572 slapd[2676]: [ID 734893 local4.debug] connection_closing: readying conn=15 sd=18 for close Dec 4 10:04:51 z000572 slapd[2676]: [ID 218904 local4.debug] conn=15 op=3 UNBIND Dec 4 10:04:51 z000572 slapd[2676]: [ID 959580 local4.debug] connection_close: deferring conn=15 sd=-1 Dec 4 10:04:51 z000572 slapd[2676]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero Dec 4 10:04:51 z000572 slapd[2676]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero Dec 4 10:04:51 z000572 slapd[2676]: [ID 925745 local4.debug] connection_resched: attempting closing conn=15 sd=18 Dec 4 10:04:51 z000572 slapd[2676]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Dec 4 10:04:51 z000572 slapd[2676]: [ID 330685 local4.debug] connection_close: conn=15 sd=-1 Dec 4 10:04:51 z000572 slapd[2676]: [ID 609413 local4.debug] daemon: waked Dec 4 10:04:51 z000572 slapd[2676]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero Dec 4 10:04:51 z000572 slapd[2676]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero Dec 4 10:04:51 z000572 slapd[2676]: [ID 423323 local4.debug] daemon: removing 18 Dec 4 10:04:51 z000572 slapd[2676]: [ID 952275 local4.debug] conn=15 fd=18 closed ... Is this a known problem or are we doing something completely wrong ? Thanks for any hints and pointers Christoph

2 1

dublin core (dcSubject, dcTitle, etc.,)
by Brett ＠Google 06 Dec '08

06 Dec '08

Hello, I was looking for the dublin core schema for openldap (metadata for ontologies / search collections) ? I have found http://tools.ietf.org/html/draft-hamilton-dcxl-02 which defines oids and ldap schema for the 15 dublin core attributes, but as an expired ietf draft. I created a test dublincore.schema from this. The draft is http://tools.ietf.org/html/draft-hamilton-dcxl-02 which expired in 1998, unless there is newer one (although there are other examples of "draft" standarts in wide use) ? Anyone have any more recent information as to wether some form this draft was ever released as a RFC ? Alternatively, is there a better / more standard way of storing dublin core metadata in openldap ? Cheers Brett

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software