openldap-software

openldap-software@openldap.org

2719 discussions

Problem using PLAIN SASLMechanism
by Steffen Gruner 26 Jun '08

26 Jun '08

Hi, I have to configure an second LDAP Server to store an big directory. This server should use our primary LDAP server to check the logins. Here My Problem: >ldapsearch -Y PLAIN -W -D uid=root,o=yyy,c=com -b "o=yyy,c=com" -s base supportedSASLMechanisms -d1 -O maxssf=0 ldap_create Enter LDAP Password: ldap_sasl_interactive_bind_s: user selected: PLAIN ldap_int_sasl_bind: PLAIN ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 127.0.0.1:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_int_sasl_open: host=grunix ldap_err2string ldap_sasl_interactive_bind_s: Unknown authentication method (-6) I have read I have to use PLAIN because of saslauthd can't use other mechanisms, is that right? The other mechanisms don't work also :-( Here the result of the sasl test application: > testsaslauthd -s ldap -u root -p yyy -f /var/run/saslauthd/mux 0: OK "Success." And here my configuration: /usr/lib/sasl2/slapd.conf: mech_list: PLAIN LOGIN GSSAPI DIGEST-MD5 CRAM-MD5 EXTERNAL pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux log_level: 7 Here my /etc/openldap/slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args security ssf=0 sasl-host 127.0.0.1 sasl-realm YYY.COM sasl-secprops none access to dn.base="" by * read access to dn.base="cn=Subschema" by * read database bdb suffix o=yyy,c=com rootdn cn=admin,o=yyy,c=com rootpw secret directory /var/lib/openldap-data index objectClass eq access to dn.subtree="o=yyy,c=com" by * read I have entered "{SASL}root" to the userPassword attribute to forward the password to SASL. versions: openldap 2.4.10 cyrus-sasl 2.1.22 Has anyone an Idea what happens? regards, Steffen

2 1

2.4.10 slow when deleting member from large group
by Andrew Findlay 25 Jun '08

25 Jun '08

I have a server with 20,000 account entries and one group that has 10,000 members. Deleting members from that group is very slow on OpenLDAP 2.4.10, though adding goes at a reasonable speed. Here is the test operation: ----------------------------------------------------------------------- dn: uniqueIdentifier=tenK,ou=groups,uniqueIdentifier=o_000000,dc=orgs,dc=dir,dc=example,dc=com changetype: modify delete: member member: uniqueIdentifier=a_004996,ou=accounts,uniqueIdentifier=o_000006,dc=orgs,dc=dir,dc=example,dc=com - add: member member: uniqueIdentifier=a_999999,ou=accounts,uniqueIdentifier=o_000005,dc=orgs,dc=dir,dc=example,dc=com ----------------------------------------------------------------------- On 2.3.42 that takes about 1s with the caches warm, but on 2.4.10 it takes almost 9s, most of which is CPU time. The test machine has 2GB of memory and the DB_CONFIG looks like this for BDB: ----------------------------------------------------------------------- # memory cache size # gigabytes bytes number-of-regions # set_cachesize 0 150000000 1 # Logbuffer size # bytes # set_lg_bsize 2097152 # Remove the roll-forward transaction logs automatically # This reduces the space used by the database but it also reduces # the disaster-recovery options. set_flags DB_LOG_AUTOREMOVE ----------------------------------------------------------------------- There is no disk activity during most of the 9s, with a large burst of writes at the end. There have been various discussions about *adding* members to large groups in the past, but the problems appeared to have been solved in recent versions. The problem is certainly related to indexing, as if I remove indexing from the 'member' attribute I get times of about 0.3s on 2.4.10. (Note: overall times are measured by timing an ldapmodify script, so not very accurate below 0.5s) Does anyone know why this operation should have got slower from 2.3.x to 2.4.x ? Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

3 4

ldapmodify problems
by Jason Gerfen 24 Jun '08

24 Jun '08

I am having a problem with the following command: ldapmodify -n -v -h DOMAIN -D "CN=DOMAINADMIN" -w DOMAINADMINPASS -f .UID2SID/modify-06.19.2008-mclame.ldif I am not sure why this is but if anyone could give me some pointers on the ldapmodify command I would appreciate it. The contents of the modify-06.19.2008-mclame.ldif dn: CN=mclame mclame,CN=Users,DC=domain,DC=com changetype: modify modify: dn cn msSFUName unixHomeDirectory msSFUHomeDirectory uidNumber gidNumber loginShell dn: CN=mclame,CN=Users,DC=domain,DC=com cn: mclame cn: mclame msSFUName: mclame unixHomeDirectory: /home/mclame msSFUHomeDirectory: /home/mclame uidNumber: 100002 gidNumber: 514 loginShell: /bin/false The user currently has the following attributes: # mclame mclame, Users, domain.com dn: CN=mclame mclame,CN=Users,DC=domain,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: mclame mclame sn: mclame givenName: mclame distinguishedName: CN=mclame mclame,CN=Users,DC=domain,DC=com instanceType: 4 whenCreated: 20080619140016.0Z whenChanged: 20080619180607.0Z displayName: mclame mclame uSNCreated: 4241241 uSNChanged: 4244208 name: mclame mclame objectGUID:: uPoBsrLWmkyZZnEepncVoQ== userAccountControl: 66048 badPwdCount: 2 codePage: 0 countryCode: 0 badPasswordTime: 128583575598392739 pwdLastSet: 128583576167656250 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAL7j9qjJ2TgWHykd9b7YBAA== accountExpires: 9223372036854775807 sAMAccountName: mclame sAMAccountType: 805306368 userPrincipalName: mclame(a)domain.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=domain,DC=com msSFUName: mclame -- Jas

4 5

nested groups
by Grzegorz Marszałek 23 Jun '08

23 Jun '08

Hello! How to implement nested groups in openldap? I mean - server side. I'd like to just to query group and find out all of it's members, including those in nested groups. Thanks in advance for help! --- Grzegorz Marszałek graf0(a)post.pl

3 2

ppolicy by group
by Andy Loughran 23 Jun '08

23 Jun '08

When ppolicy is set as default, it applies globally to the entire LDAP tree: dn: cn=default,ou=policies,dc=zednax,dc=com Is it possible to set the ppolicy by group? Regards, Andy

8 11

ldapmodify and authentication
by Jason Gerfen 20 Jun '08

20 Jun '08

I am new to the ldapmodify tool and I am attempting to import a .ldif file to change some schema attributes. The problem is that when I run the ldapmodify tool I am receiving the following error: jason@valhalla ~/scripts $ ldapmodify -f .UID2SID/modify-06.20.2008-mclame.ldif -h domain -D Administrator -w password SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found) Can I disable this GSSAPI authentication or is this something I need to configure or use kinit to obtain? Thanks.

3 2

Installation problem with Berkeley DB
by Nuno Manuel Martins 20 Jun '08

20 Jun '08

Hello, When trying to install OpenLDAP 2.3.42 I got an error complaining about berkely DB 4.3. I Googled around and found out that OpenLDAP does not like version 4.4 so I downloaded and installed version Berkeley DB 4.5 I then tried to configure with ./configure --includedir=/usr/local/bdb4.5 (where I installed the new version). Still, the configure script is going to fetch my old version. So I decided to rename the files of the old version in /usr/lib and link the same files to the ones in /usr/local/bdb4.5... somehow he still thinks I am using BDB 4.3 with the error: checking for Berkeley DB major version... 4 checking for Berkeley DB minor version... 3 checking for Berkeley DB link (-ldb43)... no checking for Berkeley DB link (-ldb-43)... no checking for Berkeley DB link (-ldb-4.3)... no checking for Berkeley DB link (-ldb-4-3)... no checking for Berkeley DB link (-ldb-4)... no checking for Berkeley DB link (-ldb4)... no checking for Berkeley DB link (-ldb)... yes checking for Berkeley DB version match... Berkeley DB version mismatch header: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) library: Berkeley DB 4.5.20: (September 20, 2006) So my question... is there any way to force the location of Berkeley DB when running configure? Thank you, Nuno

3 9

Force syncrepl client to do complete sync?
by Andrew Findlay 20 Jun '08

20 Jun '08

I have a syncrepl setup where some slaves get a portion of the full DIT that is defined by access-control on the master. This works well until the ACLs change or some other data update (such as group membership) allows the slave to see a different subset of the DIT. The problem is twofold: 1) The slave might now have data that it should delete. 2) The slave might now be allowed to see more data so it should replicate it. The current syncrepl implementation does not seem to handle this case very well on its own, and I don't want to delete the whole of the slave DB. Is there aome way that I can force a complete re-sync on a live server? I tried deleting the contextCSN through LDAP, but of course it won't let me do that on the slave. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 3

use dynlist for company name? A second question of practical use of dynlist
by Zhang Weiwu 19 Jun '08

19 Jun '08

I am setting up a business directory of contact persons and companies. I have this structure in mind: ou=companies,dc=demo cn=company1, ou=companies,dc=demo o: Company Name 1 ... cn=company2, ou=companies,dc=demo o: Company Name 2 ... ou=persons,dc=demo uid=user1,ou=persons,dc=demo cn: John Brown company: cn=company1, ou=companies,dc=demo o: Company Name 1 ... uid=user2,ou=persons,dc=demo cn: Jason Brown company: cn=company2, ou=companies,dc=demo o: Company Name 2 ... My problem: if a company updates its name, it has to be updated in 2 places: the company record, and the person record. If company name change is only updated in ou=company1, the search for "finds all people working in ABC Co.ltd" would not work as expected. Updating company names in 2 places causes 2 problems: 1: more work; 2: potentially the two doesn't match, then we have to align the records. I wish to use dynlist for o attribute for the entries in ou=persons. But that means dynlist is used in thousands of records. Is this a proper practical use of dynlist?

2 3

a second stupid dynlist question: can LDAP URI be relative?
by Zhang Weiwu 19 Jun '08

19 Jun '08

Hello. I wonder is it possible to write dynlist that automatically harvest email address from all its sub-entries. I know this works: dn: ou=People,dc=example,dc=com childrenMail: ldap:///ou=People,dc=example,dc=com?mail?sub?(objectClass= person) But is it possible to write URI in the way that it doesn't explicitly refer to the dn of the current entry? e.g.: dn: ou=People,dc=example,dc=com childrenMail: ldap:///.?mail?sub?(objectClass=person) Best regards

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-software