openldap-software

openldap-software@openldap.org

2719 discussions

Re: Configure Syncrepl with subordinate db
by Moser 24 Sep '08

24 Sep '08

Hi! Petter Solgaard schrieb: > --------ACCESSLOG----- > > database hdb > rootdn "cn=accesslog" > > overlay syncprov I'm not sure, if this is causing your trouble. Try to define accesslog as 2nd subordinate and name it to "cn=accesslog,dc=.....,dc=com". Marc

1 0

Configure Syncrepl with subordinate db
by Petter Solgaard 22 Sep '08

22 Sep '08

Hi I'm trying to set up at new ldap-cluster (openldap 2.4.9 on Ubuntu 8.04). I have splitt the DIT into two dbs, where I have a ou=system under the base that is a subordinate db to the top db. Both dbs is on the same server. What I am wondering is where I should insert the replication information. I tired to put the replication information under the top db on the master and under the top db on the slave. What happens is that information is replicated between the top dbs, but not the subordinates (master to server). I tried adding an additional rid on the subordinate db on the slave and this made the replication work for the subordniate also. But when I the tested with a reboot of the servers the base became corrupt and I had to install everything all over again. Could someone confirm that the replication information should be under the top db on the provider and under both dbs on the consumer? *********************** * Slapd.conf provider: * *********************** modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor moduleload back_bdb moduleload syncprov moduleload accesslog ---------SUBORDINATE---- database hdb suffix "ou=system,dc=......,dc=com" limits dn.exact="cn=replicator,dc=......,dc=com" size=unlimited time=unlimited subordinate index entryUUID,entryCSN eq access to * by dn="cn=replicator,dc=.....,dc=com" read by peername.ip=127.0.0.1 read by * none --------ACCESSLOG----- database hdb rootdn "cn=accesslog" overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replicator,dc=.....,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart eq --------TOP----- database hdb suffix "dc=.....,dc=com" rootdn "cn=Manager,dc=....,dc=com" rootpw verysecret ### Replikerings-innstillinger ### overlay glue overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 # Let the replicator DN have limitless searches limits dn.exact="cn=replicator,dc=....,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited index entryUUID eq lastmod on access to * by peername.ip=127.0.0.1 read by ssf=128 users read by * none *********************************** * Slapd.conf consumer: * *********************************** # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor moduleload back_bdb -------SUBORDINATE------ database hdb suffix "ou=system,dc=....,dc=com" limits dn.exact="cn=replicator,dc=....,dc=com" size=unlimited time=unlimited index entryUUID eq access to * by dn="cn=replicator,dc=....,dc=com" read by peername.ip=127.0.0.1 read by * none --------TOP----- database hdb # The base of your directory in database #1 suffix "dc=....,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=Manager,dc=....,dc=com" rootpw verysecret # Replication from master syncrepl rid=100 provider="ldap://ldap.****.****.com:389" type=refreshAndPersist searchbase="dc=.....,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=on bindmethod=simple binddn="cn=replicator,dc=.....,dc=com" credentials="secret" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" retry="60 +" syncdata=accesslog # Refer updates to the master updateref "ldap://ldap.****.****.com:389" index entryUUID eq lastmod on access to * by peername.ip=127.0.0.1 read by ssf=128 users read by * none -- Kind regards Petter S

2 1

Re: OpenLDAP C++ overlay
by Pierangelo Masarati 22 Sep '08

22 Sep '08

Русаков Денис wrote: > > 20.09.08, 18:26, "Pierangelo Masarati" <ando(a)sys-net.it>: > >> Русаков Денис wrote: >>> Hello, all I'd like to ask, is it possible to write OpenLDAP overlay >>> in C++ language? If so could you please provide me some example of >>> code, g++ compile and link options? I tried to do it myself, but only >>> what I've got was not started slapd daemon, but if I use gcc (C >>> language) all is ok. Thank you, Denis >> You can simply use OpenLDAP's libtool like this: >> ./libtool --mode=compile g++ -I include/ -I servers/slapd/ -fPIC \ >> -o cxxover.lo -c cxxover.cc >> ./libtool --mode=link g++ -lstdc++ -module -o libcxxover.la cxxover.lo >> p. >> Ing. Pierangelo Masarati >> OpenLDAP Core Team >> SysNet s.r.l. >> via Dossi, 8 - 27100 Pavia - ITALIA >> http://www.sys-net.it >> ----------------------------------- >> Office: +39 02 23998309 >> Mobile: +39 333 4963172 >> Fax: +39 0382 476497 >> Email: ando(a)sys-net.it >> ----------------------------------- > > Thank you for your e-mail, but I'd like to have shared object file and write in slapd.conf something like that: moduleload mymodule.so. > How could I do this? The above actually generates a shared object file (on architectures where this is possible), which are then loaded by "moduleload yourmodule.la" in slapd.conf. See, for example, the Makefile provided in contrib/slapd-modules/smbk5pwd/. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: OpenLDAP C++ overlay
by Pierangelo Masarati 22 Sep '08

22 Sep '08

Русаков Денис wrote: > I've got only: > lt_dlopenext failed: (libmymodule.la) /usr/lib/libmymodule.a: invalid ELF header > slapd destroy: freeing system resources. > slapd stopped. > connections_destroy: nothing to destroy. > > What should I do with invalid ELF header? Well, all I can say right now is that it works for me. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

2 1

syncrepl 2.4 parse error
by FRLinux 22 Sep '08

22 Sep '08

Hello, I have a master on OpenLDAP 2.3 (BDB 4.2) on FreeBSD 6.3-STABLE. I have been replicating its directory via syncrepl which works flawlessly on 2.3 systems. I have installed a brand new system using FreeBSD 7.1-BETA and OpenLDAP 2.4.11 (BDB 4.6). Using the same synrepl configuration, il fails to parse the configuration file. I did read the migration guide and the admin guide for 2.4 but I can't make sense of this. In debug mode, this is what i get (changed my dc with example): <<< dnNormalize: <dc=example,dc=com> /usr/local/etc/openldap/slapd.conf: line 177: Error: parse_syncrepl_line: unable to parse "updatedn=cn=MyAdminr,dc=example,dc=com" . failed to add syncinfo Now, the relevant slapd.conf conf bit is: syncrepl rid=666 \ provider=ldaps://master.example.com:636 \ type=refreshAndPersist \ searchbase="dc=example,dc=com" \ scope=sub \ filter="(objectClass=*)" \ attrs="*" \ schemachecking=off \ updatedn="cn=MyAdmin,dc=example,dc=com" \ bindmethod=simple \ binddn="cn=LdapSyncUser,dc=example,dc=com" \ credentials=mysupersecretpass updateref ldaps://master.example.com Has anyone encountered this before? A bit of reading on various threads did not return anything useful so far. Cheers, Steph

2 2

OpenLDAP C++ overlay
by Русаков Денис 20 Sep '08

20 Sep '08

Hello, all I'd like to ask, is it possible to write OpenLDAP overlay in C++ language? If so could you please provide me some example of code, g++ compile and link options? I tried to do it myself, but only what I've got was not started slapd daemon, but if I use gcc (C language) all is ok. Thank you, Denis

2 1

Invalid syntax :protocol information: no validator for syntax
by Prashant kulkarni 19 Sep '08

19 Sep '08

Hi I am trying to add the value to the attribute "protocol information" which is required in our schema but I am getting the error Invalid syntax :protocol information: no validator for syntax 1.3.6.1.4.1.1466.115.121.1.42 from the earlier mailing list I have found The problem seems to be lack of validations in the schema_init.c source code for attribure 'Protocol Information' {"( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )", 0, NULL, NULL, NULL}, isn't it that including values like dnPretty ,UTF8StringValidate..etc in the code instead of NULL values may resolve the problem this attribute protocolInformation is defined in core.schema I personally feel that for those attributes where validation are NULL in schema_init.c , the openLDAP should not force the validation and give this error message as all these attributes in which validation are not defined becomes unusable . So any idea how to resolve this ? there is any way to modify any of the config file in openldap to disable this validation for protocol information ? do I have to raise bug request for the same and is this going to be fixed in next openLDAP release. Any help and suggestions in this direction is highly appreciated. as I am porting the schema from Sun directory server and & I have to use this protocol informatoin attribute so as our LDAP application which is utilized by thousands of people can be migrated to OpenLDAP. I am not getting these kind of error in Tivoli/Sun and Microsoft Active directory for editing of this attribute . thanks and regards Prashant

1 0

Re: Dependency issue with libldap2.4_2-2.4.11-1.rhel5.i386.rpm
by Buchan Milne 18 Sep '08

18 Sep '08

On Thursday 18 September 2008 16:12:37 karthikd(a)aol.in wrote: > Hello All, > > I was initially trying to build openldap 2.4.11 source on a RHEL 5.0 > system, where in I ran into dependency issues with BDB 4.2, since RHEL > 5.0 comes only with BDB 4.3. > > While searching the openldap-software mailing lists, I came across a > post from Mr.Buchan Milne saying he has openldap 2.4 binary packages on > his site > > http://staff.telkomsa.net/packages/rhel5/openldap/ > > So, I downloaded the openldap 2.4.11 packages from the site above. > > First, I tried to install openldap2.4-2.4.11-1.rhel5.i386.rpm, which > gave me the following dependency errors : > > rpm -ivh openldap2.4-2.4.11-1.rhel5.i386.rpm > warning: openldap2.4-2.4.11-1.rhel5.i386.rpm: Header V3 DSA signature: > NOKEY, key ID 60d204a7 > error: Failed dependencies: > libldap2.4_2 = 2.4.11-1.rhel5 is needed by > openldap2.4-2.4.11-1.rhel5.i386 > > So, then I downloaded libldap2.4_2-2.4.11-1.rhel5.i386.rpm which gave > me the following dependncy errors during installation: > > rpm -ivh libldap2.4_2-2.4.11-1.rhel5.i386.rpm > warning: libldap2.4_2-2.4.11-1.rhel5.i386.rpm: Header V3 DSA signature: > NOKEY, key ID 60d204a7 > error: Failed dependencies: > openldap2.4 >= 2.1.25-4mdk is needed by > libldap2.4_2-2.4.11-1.rhel5.i386 > > I couldn't understand what this dependency error is. Any pointers would I should probably put this somewhere else than just where it is (http://staff.telkomsa.net/packages/OpenLDAP.repo), but it does contain this information: # 1)Save as /etc/yum.repos.d/OpenLDAP.repo # wget http://staff.telkomsa.net/packages/OpenLDAP.repo -O /etc/yum.repos.d/OpenLDAP.repo # 2) # RHEL5: # yum upgrade openldap-servers # or # yum install openldap2.4-servers # RHEL4 and older: # yum install openldap2.3-servers # or # yum install openldap2.4-servers # Install libhoard or lib64hoard for a better memory allocator If you download the RPMS individually, you need to do something like: rpm -Uvh libldap2.4_2-2.4.11-1.rhel5.i386.rpm openldap2.4-2.4.11-1.rhel5.i386.rpm (these two packages are inter-dependant, so they must be upgraded together). Regards, Buchan

1 0

using OpenLDAP client to change directory schema
by Klaus Heinrich Kiwi 17 Sep '08

17 Sep '08

Hi, My understanding is that OpenLDAP software doesn't support subschema modification over LDAP operations, but I'm willing to use OpenLDAP client to change cn=schema on an LDAP server (different vendor) that supports it. Is that possible? Or is the OpenLDAP checking for cn=schema at the client? The output I'm getting is: [root@pam ~]# ldapmodify -H ldap://host -D cn=root -w passwd -x -ZZ -a -f /usr/share/doc/krb5-server-ldap-1.6.2/kerberos.ldif ldapmodify: invalid format (line 5) entry: "cn=schema" [root@pam ~]# Thanks, -Klaus -- Klaus Heinrich Kiwi <klausk(a)linux.vnet.ibm.com> Linux Security Development, IBM Linux Technology Center

3 4

schema replication 2.4
by Daniel Paufler 17 Sep '08

17 Sep '08

Hello List I already searched the archives but did not find a clue. I am using slapd 2.4.9 on Ubuntu Hardy. I set up two servers, one master, one slave. On the master, i have cn=config with samba schema included. On the slave, i do a full clean install via: rm -rf slapd.d/* slaptest -f slapd.conf.old -F slapd.d chown openldap:openldap slapd.d -R This gives me an empty database and standard cn=config with nothing but standard build-in schema. (core, cosine, nis, inetorgperson) Going further, i insert the syncrepl statement on the slave ldapadd -W -x -D "cn=admin,cn=config" -f init_slave_db.ldif ---- dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcsyncrepl: {0}rid=001 provider=ldap://masterLDAP binddn="cn=replication,dc=tree" bindmethod=simple credentials=<PW> searchbase="dc=tree" type=refreshAndPersist interval=00:00:00:10 - add: olcUpdateRef olcUpdateRef: ldap://masterLDAP ----- Now, my whole LDAP dc=tree is aviable on the slave. If i now insert syncrepl for cn=schema,cn=config ldapadd -W -x -D "cn=admin,cn=config" -f init_slave_config.ldif ------ dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://masterLDAP binddn="cn=admin,cn=config" bindmethod=simple credentials=<PW> searchbase="cn=schema,cn=config" type=refreshOnly interval=00:00:00:10 --- When i now want to change the slave daemon loglevel by entering olcLoglevel, i get an error 53: no update referral summing up, when i insert schema replication, i can not change anythin in cn=config on my slave - not only in cn=schema,cn=config. Is that default behavior or do i miss something? Any hints appreciated. Daniel

4 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software