openldap-software

openldap-software@openldap.org

2719 discussions

Mirror Mode
by Jorge Medina 01 Jul '08

01 Jul '08

Hi, I am trying to configure OpenLDAP in mirror mode. From what I understood, the documentation suggests having two servers configured in mirror mode, plus a set of replicas. (As shown in the diagram at the end of the page at http://www.openldap.org/doc/admin24/replication.html#Configuring%20the%2 0different%20replication%20types) The documentation suggests that the backend LDAP module can be used as the load balancer. Nevertheless the documentation is missing the sections on configuring this module. http://www.openldap.org/doc/admin24/backends.html#LDAP a) I am assuming the replicas are just read-only replicas. Right? b) If a client requires to write to the directory, how are these request forwarded to the active mirror? c) Does anyone knows how to configure the LDAP backend to act as a proxy? d) Is mirror mode mature? Is it ready for production use? Any help or pointers are appreciated. -Jorge

2 1

syncprov and translucent
by Andy Cobaugh 30 Jun '08

30 Jun '08

As one might expect, mixing the translucent and syncprov overlays together on top of the same bdb database doesn't work. Because translucent uses back-ldap, lastmod is being set to off, while syncprov needs it to be on in order to function. I wonder if it might be possible to change the behavior of back-ldap to allow lastmod again? In my case, I only care about replicating changes that are stored in the local bdb database by the translucent overlay, and I never send updates back to the target ldap server. I suppose I could come up with something where I slapcat, then let the slaves pick up the ldif and see if it's different from the last time. If it is, shutdown slapd, delete the database files, slapadd, start slapd. I really want to avoid doing that though, since I consider that a hack and a half. Thoughts? Is enabling lastmod for back-ldap just a matter of commenting out some lines? --andy

3 2

modrelay 0.1
by joel reed 30 Jun '08

30 Jun '08

This is an OpenLDAP overlay that intercepts ADD and MODIFY requests for posixAccount and organization type entries, and relays the changes to a postgresql database. This code CANNOT be used anywhere else without modification. Consider it sample code only! Posting only in the spirit of share and share alike. Version 0.2 of the attached code will handle modrdn and delete requests and read the connection string from slapd.conf. This version is simpler. jr /** * modrelay.c * * Copyright (C) 2008 Joel W. Reed * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted only as authorized by the OpenLDAP * Public License. * * A copy of this license is available in file LICENSE in the * top-level directory of the distribution or, alternatively, at * http://www.OpenLDAP.org/license.html. * * SEE LICENSE FOR MORE INFORMATION * * Author: Joel W. Reed * Email: joelwreed(a)gmail.com * Version: 0.1 * Updated: 06.29.2008 * * modrelay * * This is an OpenLDAP overlay that intercepts ADD and MODIFY requests * for posixAccount and organization type entries, and relays the changes to * a postgresql database. */ #include "portable.h" #include <ac/string.h> #include <ac/ctype.h> #include "slap.h" #include "ldif.h" #include "libpq-fe.h" #include "config.h" // TODO: figure out config api #define CONNECTION_STRING "your connection string goes here" static slap_overinst modrelay; static ObjectClass *oc_posix_account; static ObjectClass *oc_organization; static ObjectClass *oc_dcobject; typedef struct modrelay_data { ldap_pvt_thread_mutex_t mutex; PGconn* connection; } modrelay_data; PGconn* get_db_connection(modrelay_data *ad) { // we lazily connect to the db whenever first needed if (ad->connection != NULL) return ad->connection; ad->connection = PQconnectdb(CONNECTION_STRING); if (!ad->connection || (PQstatus(ad->connection) != CONNECTION_OK)) { Debug( LDAP_DEBUG_ANY, "%s: failed to connect to database!\n", modrelay.on_bi.bi_type, 0, 0 ); } return ad->connection; } static void modrelay_process_organization(Operation* op, Entry* entry) { static const char INSERT_SQL[] = "insert into organization (id, version, name, description, mail_host, dn) values (nextval('organization_sequence'), 0, $1, $2, $3, $4)"; static const char UPDATE_SQL[] = "update organization set name=$1, description=$2, mail_host=$3 where dn=$4"; static int PARAM_CNT = 4; slap_overinst* on = (slap_overinst *)op->o_bd->bd_info; modrelay_data *ad = on->on_bi.bi_private; PGconn* connection = get_db_connection(ad); const char* paramValues[PARAM_CNT]; paramValues[0] = paramValues[1] = paramValues[2] = ""; paramValues[3] = entry->e_nname.bv_val; Debug( LDAP_DEBUG_TRACE, "%s: modrelay_response for add/edit organization %s\n", modrelay.on_bi.bi_type, paramValues[3], 0 ); Attribute* attr; for (attr = entry->e_attrs; attr; attr = attr->a_next ) { if (!strcmp(attr->a_desc->ad_cname.bv_val, "o")) paramValues[0] = attr->a_vals[0].bv_val; else if (!strcmp(attr->a_desc->ad_cname.bv_val, "description")) paramValues[1] = attr->a_vals[0].bv_val; else if (!strcmp(attr->a_desc->ad_cname.bv_val, "mailHost")) paramValues[2] = attr->a_vals[0].bv_val; } const char* SQL = (op->o_tag == LDAP_REQ_ADD)? INSERT_SQL : UPDATE_SQL; PGresult* res = PQexecParams(connection, SQL, PARAM_CNT, NULL, paramValues, NULL, NULL, 0); ExecStatusType status = PQresultStatus(res); if (status != PGRES_COMMAND_OK) { Debug(LDAP_DEBUG_ANY, "%s: org database error: (%d) %s\n", modrelay.on_bi.bi_type, status, PQresultErrorMessage(res)); Debug(LDAP_DEBUG_ANY, "%s: SQL: %s o:%s\n", modrelay.on_bi.bi_type, SQL, paramValues[0]); Debug(LDAP_DEBUG_ANY, "%s: desc:%s, mailHost:%s\n", modrelay.on_bi.bi_type, paramValues[1], paramValues[2]); } PQclear(res); } static void modrelay_process_user(Operation* op, Entry* entry) { slap_overinst* on = (slap_overinst *)op->o_bd->bd_info; modrelay_data *ad = on->on_bi.bi_private; PGconn* connection = get_db_connection(ad); static const char INSERT_SQL[] = "insert into person (id, version, first_name, last_name, email_address, dn) values (nextval('person_sequence'), 0, $1, $2, $3, $4)"; static const char UPDATE_SQL[] = "update person set first_name=$1, last_name=$2, email_address=$3 where dn=$4"; static int PARAM_CNT = 4; const char* paramValues[PARAM_CNT]; paramValues[0] = paramValues[1] = paramValues[2] = ""; paramValues[3] = entry->e_nname.bv_val; Debug( LDAP_DEBUG_TRACE, "%s: modrelay_response for add/edit user \n", modrelay.on_bi.bi_type, 0, 0 ); Attribute* attr; for (attr = entry->e_attrs; attr; attr = attr->a_next ) { if (!strcmp(attr->a_desc->ad_cname.bv_val, "givenName")) paramValues[0] = attr->a_vals[0].bv_val; else if (!strcmp(attr->a_desc->ad_cname.bv_val, "sn")) paramValues[1] = attr->a_vals[0].bv_val; else if (!strcmp(attr->a_desc->ad_cname.bv_val, "mail")) paramValues[2] = attr->a_vals[0].bv_val; } const char* SQL = (op->o_tag == LDAP_REQ_ADD)? INSERT_SQL : UPDATE_SQL; PGresult* res = PQexecParams(connection, SQL, PARAM_CNT, NULL, paramValues, NULL, NULL, 0); ExecStatusType status = PQresultStatus(res); if (status != PGRES_COMMAND_OK) { Debug(LDAP_DEBUG_ANY, "%s: user database error: (%d) %s\n", modrelay.on_bi.bi_type, status, PQresultErrorMessage(res)); } PQclear(res); if (op->o_tag == LDAP_REQ_ADD) { struct berval usersdn, orgdn; dnParent(&entry->e_nname, &usersdn ); dnParent(&usersdn, &orgdn); Debug( LDAP_DEBUG_TRACE, "%s: modrelay_response linking user: %s to org: %s \n", modrelay.on_bi.bi_type, entry->e_nname.bv_val, orgdn.bv_val ); static const char LINK_SQL[] = "insert into organization_person (organization_person_id, person_id) values ((select id from organization where dn=$1), (select id from person where dn=$2))"; paramValues[0] = orgdn.bv_val; paramValues[1] = entry->e_nname.bv_val; res = PQexecParams(connection, LINK_SQL, 2, NULL, paramValues, NULL, NULL, 0); status = PQresultStatus(res); if (status != PGRES_COMMAND_OK) { Debug(LDAP_DEBUG_ANY, "%s: user link database error: (%d) %s\n", modrelay.on_bi.bi_type, status, PQresultErrorMessage(res)); } PQclear(res); } } static int modrelay_response( Operation *op, SlapReply *rs ) { slap_overinst* on = (slap_overinst *)op->o_bd->bd_info; modrelay_data *ad = on->on_bi.bi_private; Entry* entry = NULL; /* if error no point in continuing */ if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE; switch (op->o_tag) { case LDAP_REQ_ADD: entry = op->ora_e; break; case LDAP_REQ_MODIFY: if ( overlay_entry_get_ov( op, &op->o_req_ndn, NULL, NULL, 0, &entry, on ) != LDAP_SUCCESS || entry == NULL ) { Debug( LDAP_DEBUG_ANY, "modrelay_response MODIFY cannot get entry for <%s>\n", op->o_req_dn.bv_val, 0, 0); return SLAP_CB_CONTINUE; } break; default: return SLAP_CB_CONTINUE; } ldap_pvt_thread_mutex_lock(&ad->mutex); /* is this a object class we care about */ if (is_entry_objectclass( (entry), oc_posix_account, 0)) modrelay_process_user(op, entry); else if ((is_entry_objectclass( (entry), oc_organization, 0))&& (is_entry_objectclass( (entry), oc_dcobject, 0))) modrelay_process_organization(op, entry); ldap_pvt_thread_mutex_unlock(&ad->mutex); if (op->o_tag == LDAP_REQ_MODIFY) overlay_entry_release_ov( op, entry, 0, on ); return SLAP_CB_CONTINUE; } static int modrelay_delete(Operation *op, SlapReply *rs ) { return SLAP_CB_CONTINUE; } static int modrelay_db_init(BackendDB *be, ConfigReply *cr) { slap_overinst *on = (slap_overinst *)be->bd_info; modrelay_data *ad = ch_calloc(1, sizeof(modrelay_data)); on->on_bi.bi_private = ad; ldap_pvt_thread_mutex_init( &ad->mutex ); ad->connection = NULL; return 0; } static int modrelay_db_destroy(BackendDB *be, ConfigReply *cr) { slap_overinst *on = (slap_overinst *)be->bd_info; modrelay_data *ad = on->on_bi.bi_private; ldap_pvt_thread_mutex_destroy( &ad->mutex ); if (ad->connection != NULL) PQfinish(ad->connection); free( ad ); return 0; } int modrelay_init() { modrelay.on_bi.bi_type = "modrelay"; modrelay.on_bi.bi_db_init = modrelay_db_init; modrelay.on_bi.bi_db_destroy = modrelay_db_destroy; modrelay.on_response = modrelay_response; modrelay.on_bi.bi_op_delete = modrelay_delete; oc_posix_account = oc_find( "posixAccount" ); if(oc_posix_account == NULL) { Debug( LDAP_DEBUG_ANY, "%s: unable to find default ObjectClass \"posixAccount\".\n", modrelay.on_bi.bi_type, 0, 0 ); return -1; } oc_organization = oc_find( "organization" ); if(oc_organization == NULL) { Debug( LDAP_DEBUG_ANY, "%s: unable to find default ObjectClass \"organization\".\n", modrelay.on_bi.bi_type, 0, 0 ); return -1; } oc_dcobject = oc_find( "dcObject" ); if(oc_dcobject == NULL) { Debug( LDAP_DEBUG_ANY, "%s: unable to find default ObjectClass \"dcObject\".\n", modrelay.on_bi.bi_type, 0, 0 ); return -1; } return ( overlay_register(&modrelay) ); } int init_module( int argc, char *argv[] ) { return modrelay_init(); }

1 0

automatic uidnumber overlay version 0.2
by joel reed 30 Jun '08

30 Jun '08

Please find attached version 0.2 of the uidnumber overlay I posted previously (http://www.openldap.org/lists/openldap-software/200806/msg00029.html). This version does not search the directory every time a posixAccount add entry request comes in - only the first time such a request is made to the directory. Subsequent requests are processed via the cached next uidNumber overlay data. This version of the overlay tracks the next uidNumber per database (the previous version used a static, overlay scoped variable). Just posting in case anyone ever finds it of use for their environment. jr

1 1

memberOf attribute indexing
by George Holbert 30 Jun '08

30 Jun '08

Hello, For a bdb-backend server that utilizes slapo-memberof and services searches filtered on memberOf, is it beneficial to configure indexes for the memberOf attribute? In other words, is memberOf stored pretty much like any other attribute, or is it computed dynamically on every search (making it "un-indexable")? Thank you for your time! -- George

2 3

finding the max value of an attribute
by openldap 28 Jun '08

28 Jun '08

Hi every when searching values in the LDAP directory, it certainly has occured to everybody to have to find the maximum value of an attribute. e.g. when defining a new user in the directory you might specify one more than the maximum value of all uidNumber attributes as the new user's uidNumber. i was looking at RFC 2254 and 4515, but could not find anything obvious. is there a way to find the maximum value of an attribute and possibly the DN to whom it belongs only using ldap-search (no perl or php prgramming)? or did i just oversee something obvious? any hint is very much appreciated. thank you very much. suomi

2 1

Log files building up with large group
by Steve Smith 27 Jun '08

27 Jun '08

Hi, I have directory with a group with ~220,000 users in it. This group is frequently updated (several times an hour). This appears to be causing the BDB transaction logs to grow very large; over the course of a day they grow to about 36GB. These all appear to be active; neither 'slapd_db_archive -d' or DB_LOG_AUTOREMOVE has any effect. Is there anything that can be done about this or is this an unavoidable side-effect of the transaction system? Thanks, Steve

3 5

Query regarding the Transaction Management support in OpenLDAP
by kumar.nitin＠wipro.com 27 Jun '08

27 Jun '08

Hi, This is the query regarding the Transaction Management support in OpenLDAP. We are planning to use OpenLDAP in our project. We are using bdb as back-end. We have explored so many things in OpenLDAP but couldn't find whether Transaction Management (commit, rollback in case of failure) is possible in OpenLDAP. If it is possible please let us know how we can configure it. If you need more information, please let me know. With Regards, Nitin Kumar +91-9999499757 Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

ppolicy+syncrpl: pwd* attributes lost
by Chris G. Sellers 27 Jun '08

27 Jun '08

I have n-way multimaster replication setup. Works great. I have slapo_ppolicy setup, it too works. the problem I appear to have is that whichever server does the password change, the pwd* attributes are set, and then removed from the other server. So, if I do a password change on server1, the record for user A on server1 shows pwdChangedTime The record for user A on server2 shows the modificationTime but the pwdChangedTime is deleted The same goes if I use server2 and look at server1. At first, I thought it may be due to the clear_hash setting, but that didn't seem to make an impact. Any ideas? I know I must have something missing but I'm just not seeing it. --- password-hash {SSHA} ########################################################################### database bdb suffix "dc=nitle,dc=org" rootdn "cn=MASTERUSER,dc=nitle,dc=org" rootpw {SSHA}WAYTOOSECRETFORYOU directory /home/ldap/openldap/var/openldap-data serverID 1 limits dn.exact="cn=mirroruser,ou=ou,dc=nitle,dc=org" size=unlimited time=unlimited syncrepl rid=010 provider=ldap://ldapserveronoe.nitle.org:999999999 binddn="cn=mirroruser,ou=ou,dc=nitle,dc=org" bindmethod=simple credentials=OOOOOHHHH searchbase="dc=nitle,dc=org" type=refreshAndPersist scope=sub interval=00:00:00:10 retry="15 5 300 +" timeout=1 schemachecking=off starttls=yes attrs = "*,structuralObjectClass ,entryUUID ,entryCSN ,creatorsName ,createTimestamp,modifiersName,modifyTimestamp,pwdPolicySubentry" # syncdata=accesslog syncrepl rid=011 provider=ldap://ldapserverTwo.nitle.org:999999999 binddn="cn=ldap`1,dc=nitle,dc=org" bindmethod=simple credentials=OOOOOHHHH searchbase="dc=nitle,dc=org" type=refreshAndPersist schemachecking=off scope=sub interval=00:00:00:10 retry="15 5 300 +" timeout=1 starttls=yes attrs = "*,structuralObjectClass ,entryUUID ,entryCSN ,creatorsName ,createTimestamp,modifiersName,modifyTimestamp,pwdPolicySubentry" # syncdata=accesslog overlay syncprov mirrormode true ## INDICES TO MAINTAIN index objectClass eq index cn,mail,surname,givenname eq,subinitial index uidNumber,gidNumber,memberuid,member,uniqueMember eq ## PASSWORD POLICY OVERLAY ## overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=nitle,dc=org" ppolicy_hash_cleartext # ppolicy_use_lockout ++++++++++++++++++++++++++++++++++++++ Chris G. Sellers | Internet Engineer | NITLE 734.661.2318 | chris.sellers(a)nitle.org Jabber: csellers(a)nitle.org | AIM: imthewherd

5 7

Re: slapd replication (push based)
by Gavin Henry 26 Jun '08

26 Jun '08

> Yes, it's really messy. Thanks, I know. > actually my desperate need for this made me overcome my laziness. > i compiled the slapd from source, run the tests, immediately after the > test045 copied the slapd.1. ...slapd.3.conf files. this made me > understand what is really going on there. > > my understanding is that i need to run two instances of slapd on master > (master + proxy) proxy is pulling down changes from master and stores > them in it's backend (ldap backend pointing to slave server) all the > rest is question of acl's. > > can you correct me please, if i'm wrong. > trying to implement it right now. You can do it in one slapd configuration/instance. -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software