openldap-software

openldap-software@openldap.org

2719 discussions

Syncrepl issues in multi-versions environment
by Thibault Le Meur 15 Sep '08

15 Sep '08

Hi openldap Gurus, I'm sorry for the long post, but I try to give as much details as possible. We are having serious issues with syncrepl replication and our 3 openldap servers. These issues first occurred when one of the servers was upgraded to openldap 2.4.11 while the two others were (and still are) openldap-servers-2.3.39 and openldap-servers-2.3.30. My main goal in writing this email is to make sure our 3-servers architecture is supported and to check if my setup is correct. Just to let you know, the issues we've found so far include: * having the openldap 2.3.x servers unable to restart (with a crash report) [seems to be due to several contextCSN on the openlda2.4 server database] * sometimes the subtree obtained from the openldap2.4 by syncrepl processes in openldap2.3 servers disapears (by reading the log, with loglevel 16384,it seems that the NON PRESENT phase of the LdapSync protocol decides that entries are no more in the openldap2.4 provider [though they are still present]). Since I have a doubt about our replication structure which uses syncrepl and subordinate databases, I wonder if it is really supported by these versions of openldap. I would really appreciate if someone could have a look at this and say if the following scenario is supported: ------------------------ AllServers have the following DIT: dc=mycompany,dc=edu | |-dc=A,dc=mycompany,dc=edu | |-dc=B,dc=mycompany,dc=com | |-dc=B,dc=mycompany,dc=com Each server replicates 2 subtrees from {dc=A, dc=B, dc=C} and is the provider for the remaining one. Server A has the following setup: ================================= * a section used to glue the subordinate "dc=B,dc=mycompany,dc=com" subtree, with content replicated from the ldap.B.supelec.fr * section used to glue the subordinate "dc=C,dc=mycompany,dc=com" subtree, with content replicated from the ldap.C.supelec.fr * section having the root suffix "dc=mycompany,dc=com" and managing its own subtree dc=A,dc=mycompany,dc=com The configuration file looks like: * First section is used to get data from the B server, and set it in the dc=B,dc=mycompany,dc=com glued subtree (using subordinate keyword) database bdb suffix "dc=B,dc=mycompany,dc=com" rootdn "cn=mgr,dc=mycompany,dc=com" subordinate directory /openldap/openldap-data-B syncrepl rid=125 provider=ldaps://ldap.B.supelec.fr type=refreshOnly interval=00:00:03:00 retry="60 10 300 +" searchbase="dc=B,dc=mycompany,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,dc=mycompany,dc=com" credentials="password" * Second section is used to get data from the C server, and set it in the dc=C,dc=mycompany,dc=com glued subtree (using subordinate keyword) database bdb suffix "dc=C,dc=mycompany,dc=com" rootdn "cn=mgr,dc=mycompany,dc=com" subordinate directory /openldap/openldap-data-C syncrepl rid=120 provider=ldaps://ldap.C.supelec.fr type=refreshOnly interval=00:00:03:00 retry="60 10 300 +" searchbase="dc=C,dc=mycompany,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,dc=mycompany,dc=com" credentials="password" * Third section is used to define data from the A server, it has a root suffix of "dc=mycompany,dc=com" and owns his own subtree dc=A,dc=mycompany,dc=com database bdb suffix "dc=mycompany,dc=com" rootdn "cn=mgr,dc=mycompany,dc=com" rootpw THEPASS directory /openldap/openldap-data-A overlay syncprov syncprov-checkpoint 100 10 Server B has the symetric setup: ================================= * section used to glue the subordinate "dc=C,dc=mycompany,dc=com" subtree, with content replicated from the ldap.C.supelec.fr * section used to glue the subordinate "dc=A,dc=mycompany,dc=com" subtree, with content replicated from the ldap.A.supelec.fr * section having the root suffix "dc=mycompany,dc=com" and managing its own subtree dc=B,dc=mycompany,dc=com Server C has the symetric setup: ================================= * section used to glue the subordinate "dc=B,dc=mycompany,dc=com" subtree, with content replicated from the ldap.B.supelec.fr * section used to glue the subordinate "dc=A,dc=mycompany,dc=com" subtree, with content replicated from the ldap.A.supelec.fr * section having the root suffix "dc=mycompany,dc=com" and managing its own subtree dc=C,dc=mycompany,dc=com ------------------------ Do you think this structure is supported by these versions of openldap? Though not explicitely described in the "Upgrading from 2.3.x" section of the Administrator guide, I've read in the slapd.conf manpage (openldap2.4) that the "serverID" new parameter is required when using "separate masters contributing to a glued set of databases." which, I think, is a correct description of our structure. Thus I added a "serverID 20" parameter to the openldap2.4 server's configuration. Am I right in using serverID for our setup? Adding this parameter had a side effect though: we end up having two contextCSN cookies on the openldap2.4 database suffix entry. We managed to get rid of these by: * extracting the database content with "slapcat -g", * deleting contextCSN and entryCSN lines form the file, * then purging the bdb files and importing with 'slapadd -g -l'. Do you think this is a correct procedure to restart from scratch our openldap2.4 server ? I thank you in advance for any information and advice you could give me in order to get back to a working configuration. Regards, Thibault

3 3

SASL/GSSAPI authentication error
by Frederick Kramer 15 Sep '08

15 Sep '08

Hello, I have authentication problems while accessing the LDAP database. Each attempt to view or modify the DB leads to this error: [root@mysystem]~> ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found) On the other hand users can log on, change their passwords and so on - all that's working fine. I found some similar problems in the web but no answer to those helped me to solve this. I suppose it's not a big thing and apologize for my limited understanding of ldap and authentification procedures. Thanks for any help Best regards Fred

3 2

synchronization problems
by Grzegorz Marszałek 15 Sep '08

15 Sep '08

Hello! I'm using slapd 2.4.9 on ubuntu. I've got one master, and many read- only slaves. Last week I've seen something very strage - I was "playing" with acls, and there was small window of time, when one slave couldn't see all entries I should on master. Problem is, that after fixing this problem in acls slave haven't synchronized properly (I could do ldapsearch at master from slave's shell and gen all entries, but local replica haven't this data). Reestarting slapd haven't helped. I have to stop slapd, delete everything but DB_CONFIG in /var/lib/ldap and start it again. So my question is: what could create such a problem? And, more important: how can I monitor slapd slaves for such problems? Is there any ready solution for this (nagios plugins, or maybe just some script)? Cheers --- Grzegorz Marszałek graf0(a)post.pl

2 1

RE: ACL resolving
by JUNG, Christian 15 Sep '08

15 Sep '08

Hi Quanah, thanks for your help. You're right; it works as expected. I don't know what I've done exactly; maybe I had a typo in the DN of the uniqueMember... Bye Chris > -----Original Message----- > From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] > Sent: Monday, September 15, 2008 7:19 AM > To: JUNG, Christian; OpenLDAP Software Mailinglist (E-Mail) > Subject: Re: ACL resolving > > > --On Wednesday, September 10, 2008 4:26 PM +0200 "JUNG, Christian" > <christian.jung(a)saarstahl.com> wrote: > > > Hi, > > > > does slapd resolve the ACLs only at start time? > > > > I have following ACL defined: > > Using groups in acls has always worked for me, without having > the results > cached. Have you run slapd with acl tracing to see what it reports? > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

ACL resolving
by JUNG, Christian 14 Sep '08

14 Sep '08

Hi, does slapd resolve the ACLs only at start time? I have following ACL defined: access to * by group/groupOfUniqueNames/uniqueMember="cn=admins,dc=example,dc=com" write by * read which should allow only members of the group cn=admins write access to the whole directory. Others may only read. The group looks like this: dn: cn=admins,dc=example,dc=com objectClass: groupOfUniqueNames cn: admins description: LDAP administrators uniqueMember: cn=manager,dc=example,dc=com uniqueMember: uid=chris,ou=user,dc=example,dc=com If I add a member to the group, it seems that I have to restart slapd to allow the new member write access to the directory. Is this correct or am I missing something? Bye Chris -- phone: +49 6898/10-4987 web : www.saarstahl.de mail : Hofstattstraße 106a D 66333 Voelklingen

2 1

Got Search entry without sync control
by Scott Briggs 12 Sep '08

12 Sep '08

Hi, I'm trying to figure out a problem I'm having with an ldap server that stopped replicating with log entries like: do_syncrep2: rid=002 got search entry without Sync State control do_syncrepl: rid=001 retrying So can anyone tell me what "got search entry without sync state control" means? I could only find 1 other reference to someone who had this error but nothing was mentioned about what this means. I'm running openldap ver. 2.4.9 in a multimaster setup (2 servers) on Ubuntu hardy. Thanks. Scott

3 3

Resetting entryCSN and timestamps
by Mathieu MILLET 10 Sep '08

10 Sep '08

Hi everyone, I would like to know if it is possible to make changes on the entryCSN and/or Timestamps ? I know they are operational attributes and I can't modify them through LDAP. I see one useful interest to this is if I want to restore the content of a directory and considered this content as autoritative in a mutli-master replication environment. For now, my main concerns are headaches with playing OpenLdap replication between virtual machines (and the "special" time management). And I would like to reset some of the CSN/Timestamps. I have for example a lot of messages : dn_callback : new entry is older than ours cn=schema,cn=config Does anybody have any idea how to do that ? I'm running OpenLDAP 2.4.11 from sources. Thank you in advance for any answer, Sincerely yours, Mathieu MILLET. -- Mathieu MILLET mailto:ldap@htam.net ----

1 1

Implementing monitor in DB ldap existent
by Reynaldo Quezada V. 10 Sep '08

10 Sep '08

Hi to everybody! I have a DB Openldap that is OK, but I going to implement monitor. I learn the domumentation slapd-monitor and followed the steeps 1.- add to the slapd.conf database monitor 2.- I configured the ACL's access to dn.subtree="cn=Monitor" by dn.base="cn=Manager,dc=ife.org.mx" write by users read by * read 3.- Check the core.schema is OK But I start the service, made some changes to the users and search the results of the monitoring... ldapsearch -LLL -x -b "cn=Modify,cn=Operations,cn=Monitor" -H ldaps://ldap.resource.net objectclass=* The result: dn: cn=Modify,cn=Operations,cn=Monitor objectClass: monitorOperation cn: Modify Idon't see nothing about the changes that I realized in the monitoring... Is the correct form to start the monitoring in a DB ldap existent? thanks a lot for you help __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.com.mx/

3 3

2-way Multimaster replication (including configuration) and TLS certificate
by Mathieu MILLET 10 Sep '08

10 Sep '08

Hi everyone, I was able to make a 2-way Multimaster replication (including configuration) with TLS, by specifying "manually" the certificate (and key) for the 2nd server (certificate different from the 1st server). The servers replicated, OK. But after the "first replication", the cn=config of the 2nd now contains the TLSCertificateFile and TLSCertificateKeyFile of the 1st server, which is point less. The 2nd server can't now start, because it can't find its certificate (and key), which is normal ... Is it possible to specify "multiple" certificates in the cn=config file ? Or should I go with using alternateSubjectAltName in certificates (which is not pretty) ? I would really want to go to multimaster for configuration for the following (source of typing faults) elements : - authz-regexp - schema - acl - overlays configuration$ I'm using OpenLDAP 2.4.11 compiled from source on RHEL4U5. Thanks in advance for any answer, Sincerely yours, Mathieu MILLET. -- Mathieu MILLET mailto:ldap@htam.net -- -- Mathieu MILLET mailto:ldap@htam.net

2 2

Re: sasl-secprops' minssf not setting SASL SSF correctly
by PGNet 10 Sep '08

10 Sep '08

> No where does it say there that it sets the minimum SSF of connections. Stating what it doesn't say is unhelpful. My question is posed because of my misunderstanding of what is does say. > It > says it specifies the minimum or maximum acceptable SSF. I.e., if you set > the minimum SSF to 128, and an incoming connection only uses 56, then XYZ > won't be usable. The distinction between "minimum SSF" and "minimum acceptable SSF" is somewhat non-obvious, and still lost on me. > I've generally used this type of restriction more with ACLs, such as: > > by dn.base="cn=xyz,dc=example,dc=com" sasl_ssf=56 read There's no mention of 'sasl_ssf' in 'man slapd.conf'; Rather, only in 'man slapd.access'. Where, it states: sasl_ssf=<n> set the minimum required Security Strength Factor (ssf) needed to grant access On the 'man slapd.conf' page, minssf=<factor> property specifies the minimum acceptable security strength factor as an integer approximate to effective key length used for encryption Again, the difference is completely unclear. Perhaps someone else might take a helpful stab at clarifying the diff? In the context of my originally posted question, rephrased: Why does *addition* of "maxssf=256" (the maximum acceptable security strength factor) to "sasl-secprops ..." cause the 'SASL SSF' reported "ldapwhoami -ZZ" to change from SASL SSF: 56 --> SASL SSF: 0 ?

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software