openldap-technical November 2008

openldap-technical@openldap.org

53 participants
60 discussions

Re: configuring ppolicy overlay using cn=config
by Quanah Gibson-Mount 25 Nov '08

25 Nov '08

--On Tuesday, November 25, 2008 11:19 AM +0100 Vincent Panel <yohonet(a)gmail.com> wrote: > Well, I've more or less solved the problem : > > I've guessed the equivalent for cn=config was the following ldif entry : > > dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcPPolicyConfig > olcOverlay: {1}ppolicy > olcPPolicyDefault: "cn=default,ou=policies,dc=example,dc=com" > > And here's what I've got when I added this entry : > > ldap_add: Invalid syntax (21) > additional info: olcPPolicyDefault: value #0 invalid per syntax > > Now, I've removed the quotes of the last line and I have another > error, but it seems caused by the PPolicyDefault object not > existing... > > But I'm a bit moving forward without any piece of documentation, it's > a bit hard... Please keep replies on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Issues in Performance Tesing of OpenLDAP using SLAMD
by Shilpa Sethi 24 Nov '08

24 Nov '08

Hi all, Currently I am involved in an activity that deals with measuring performance of OpenLDAP on Solaris 10 - x_86 machine. Hardware Specs - 1. Two identical servers (Servers 'NodeA' and 'NodeB') with the following configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2220 (2.8GHz/1MB) processor * 1x 4GB PC2-5300 DDR2-667 memory * 2x 146GB HDD 15K RPM (Hardware RAID-1, so available disk space is 146 GB). 2. One server 'NodeC' is used as a traffic injector and has the following hardware configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2218 * 4x 2GB PC2-5300 DDR2-667 memory * 4x 73GB HDD 10K RPM. Software installation common to all servers: 1. JDK 1.6 2. Symas CDS Version 3.9.3 For traffic injection, SLAMD v2.0.0-alpha1 is installed on NodeC. Both Node A and B are Mirror-Mode replicas. The database is having 1 Million subscribers and both the cache sizes are set as follows in slapd.conf : cachesize 250000 idlcachesize 250000 i.e 25% of the subscriber base. Two identical SLAMD SearchRate Jobs, one pointing to Node A and other to Node B are run from Node C. However, there is a wide difference in the number of lookups/sec performed in both the servers. The read rates obtained vary in the ratio of 1:7 or so on both the servers. I am using 1 SLAMD client and 2 threads for targeting on 1 server. If I increase the number of thread, SLAMD starts reporting exceptions. Please suggest a way by which Predictable/ similar read rates could be achieved on both the servers as both being exactly same. Thanks a ton in advance for suggesting a solution. Regards Shilpa Sethi A R I C E N T Plot 6, Electronic City, Sector - 18, Gurgaon 122015 Haryana, India ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 11

Symbol problem with 2.4.13
by William Jojo 24 Nov '08

24 Nov '08

AIX 5.3, OpenLDAP 2.4.13, BDB 4.6.21.3 Previously I emailed the list about symlinking libldap.so to libldap_r.so. For OpenLDAP 2.4.11 this worked perfectly. I have built 2.4.13 with the exact same options and now I get the following error from ldapsearch after symlinking: Could not load program ldapsearch: rtld: 0712-001 Symbol ldap_derefresponse_free was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_parse_derefresponse_control was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_create_deref_control_value was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. Is this a problem with lazy runtime resolution or did something library-wise change in this version? Or, am I just being an idiot and missing something obvious? Cheers, Bill

2 1

Lost Replications
by Burton, Kris - Acision 24 Nov '08

24 Nov '08

All, I am running 2.4.11 with ITS 5709 back ported. What I found digging through CVS was that this impacted syncprov.c 1.147.2.38 ctxcsn.c 1.40.2.6 -> 1.40.2.10 proto-slap.h 1.670.2.31 I can attach my patch file if that would be helpful. What we are seeing now is that on our patched version of 2.4.11 that we lose every 32767 or 32768 entry. This is consistent first we lose the 32767 then the 32768 and this pattern continues rotating back and forth. We pulled the latest RE24 branch and the problem appears to be resolved there. I am not sure if this is a separate ITS, that has been resolved or if there is more to the ITS 5709 that I missed. Hopefully this problem is distinct enough that someone recognizes it and can point me to the proper fix. In the test we produced this we were running mirror mode replication and can produce the problem adding 1 million entries via slapadd. We plan to move forward with 2.4.13 when it's released but for now we need to go forward with 2.4.11. Thanks, Kris Burton This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

RE: Data sync tools
by Bad Guy 24 Nov '08

24 Nov '08

The delay seems due to lost of network connections can't be detected (traceroute indicates 7 hops). So, can I use mastercheckint=5 in slapd.conf to periodic check the master server ? 5 means 5 sec ? Also, the parameter "mastercheckint" can be used in N-way master ? Thanks a lot. > Date: Thu, 20 Nov 2008 20:51:02 +0000> From: ghenry(a)OpenLDAP.org> To: badguy9588(a)hotmail.com> CC: openldap-technical(a)openldap.org> Subject: Re: Data sync tools> > > ----- "Bad Guy" <badguy9588(a)hotmail.com> wrote:> > > Dear all,> > > > We are running a multi-master openldap 2.4.11, we always get delay> > sync in some servers.> > > > Is there any way to do a periodic re-sync without restarting the> > openldap slapd daemon ?> > Can you provide more details please.> > -- > Kind Regards,> > Gavin Henry.> OpenLDAP Engineering Team.> > E ghenry(a)OpenLDAP.org> > Community developed LDAP software.> > http://www.openldap.org/project/ _________________________________________________________________ 聰明搜尋和瀏覽網路的免費工具列 — MSN 搜尋工具列 http://toolbar.live.com/

2 2

ldap_simple_bind_s ok ,but ldap_simple_bind no
by owen nirvana 24 Nov '08

24 Nov '08

I write a dll using Novel CLDAP SDK, because no dev files from openLDAP could be use in windows. basically, they are same, and I found the same problems yet. ldap_simple_bind could not work , but ldap_simple_bind_s is ok. the former return "Operations Error", maybe it is the problem of LDAP Server, ( debian lenny, openLDAP 2.4.11 deb) gtalk:freeespeech@gmail.com

2 1

configuring ppolicy overlay using cn=config
by Vincent Panel 21 Nov '08

21 Nov '08

Hi, I was able to succesfully load the module and "assign" the overlay to the database by using cn=config configuration style. I had to import an LDIF similar to this : add olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy to have the equivalent of the "overlay ppolicy" directive in slapd.conf But now, I try to have the equivalent of the "ppolicy_default" directive. I've had a quick look at the code and it seems and attribute olcPPolicyDefault exists, but it doesn't work... Could you give me a hand ? Thanks, Vincent

2 1

Re: import LDIF file from openldap to redhat directory server
by Pierangelo Masarati 21 Nov '08

21 Nov '08

Please keep postings to the list revathi ganesh wrote: > Thanks for your reply.. > Can you give me the procedure how to back up the entire openldap to LDIF file > > # ldapsearch -x -LLL > openldap.ldif > > Is this correct. No. Please read my previous message, which contains an indication of the correct procedure. p. > > Thanks > > > --- On Fri, 21/11/08, Pierangelo Masarati <ando(a)sys-net.it> wrote: > >> From: Pierangelo Masarati <ando(a)sys-net.it> >> Subject: Re: import LDIF file from openldap to redhat directory server >> To: "revathi ganesh" <cholam20(a)yahoo.co.in> >> Cc: openldap-technical(a)openldap.org >> Date: Friday, 21 November, 2008, 12:23 AM >> revathi ganesh wrote: >>> Dear gurus >>> >>> I have installed redhat directory server in a new >> server. The OS is RHEL V5. >>> We already are running openldap in RHEL V4. Now how >> can I import the all the datas (user accounts) from openldap >> to RHDS. >>> Please give me the procedure. >> To extract the data in LDIF, you can use slapcat(8). Then, >> you probably better ask on a RHDS list. >> >> p. >> >> >> Ing. Pierangelo Masarati >> OpenLDAP Core Team >> >> SysNet s.r.l. >> via Dossi, 8 - 27100 Pavia - ITALIA >> http://www.sys-net.it >> ----------------------------------- >> Office: +39 02 23998309 >> Mobile: +39 333 4963172 >> Fax: +39 0382 476497 >> Email: ando(a)sys-net.it >> ----------------------------------- > > > Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/ Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

6 6

Memory consumption issue
by tkohlhepp 21 Nov '08

21 Nov '08

Hi guys, I've discovered a major memory issue. We have an OpenLDAP server (2.4.11) running with almost 2 million entries. When I do a ldapsearch to retrieve the entire tree the memory consumption grows and grows and will never stop before it ate the entire RAM and swap. My slapd.conf file looks like this: include /var/ldap/ldap-ds/etc/schema/core.schema include /var/ldap/ldap-ds/etc/schema/netmobile.schema include /var/ldap/ldap-ds/etc/schema/netmobile.acc.schema include /var/ldap/ldap-ds/etc/schema/netmobile.zMRDB.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/ldap/ldap-ds/var/run/slapd.pid argsfile /var/ldap/ldap-ds/var/run/slapd.args access to * by dn="cn=replica,ou=replica,ou=ldapaccounts,o=netmldap" write by users read by anonymous read access to * by self write by users read by anonymous read #threads 2 # all logging #loglevel -1 # only syncrepl logging loglevel 16640 ####################################################################### # BDB database definitions ####################################################################### database monitor access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,ou=netm,ou=people,o=netmldap" write by dn.exact="cn=admin,ou=netm,ou=people,o=netmldap" read by * none database bdb suffix "cn=accesslog" rootdn "cn=Admin,o=netmldap" directory /var/ldap/ldap-ds/cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=Admin,o=netmldap" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database config rootdn "cn=admin,cn=config" rootpw config database bdb suffix "o=netmldap" rootdn "cn=Admin,o=netmldap" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}5ycg8tSV/i0Z99FKaylr0Az5x1nBA8TC directory /var/ldap/ldap-ds/o=netmldap #dbcachesize 1000000 cachesize 1000 idlcachesize 3000 cachefree 500 searchstack 8 #readonly on # Indices to maintain index default pres,eq index cn index netmzMRDBPhoneNumber index netmAccNumAddr index netmAccNumPort index netmLogin2 index netmPortalName index netmCarrierID # new indices - 2007-01-15 index netmLogin pres,eq index netmClientContractUniqueName index netmPrivateMail index netmContactTecEmail index netmContactBillingEmail index netmFirmEmail index netmContactCommEmail index netmzMRDBCarrier index netmzMRDBblacklistLA index netmzMRDBPortingDate index objectClass pres,eq index entryCSN,entryUUID eq # Save the time that the entry gets modified lastmod on overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 limits dn.exact="cn=Admin,o=netmldap" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited sizelimit -1 The DB_CONFIG look like this set_cachesize 0 8435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 # will automatically remove transaction logs # this setting isn't recommended set_flags DB_LOG_AUTOREMOVE When I start slapd is consumes that much RAM total kB 478476 After doing the search it looks like this total kB 937316 I've done a pmap -x to see where the memory goes but this process is marked as anonymous. So I don't know how to get this memory back. I have to restart the LDAP server to get this memory released. I would appreciate if someone could help me to solve this issue. Thanks Thorsten

5 7

Ldap Add Fail
by karthikeyan.chetty＠wipro.com 20 Nov '08

20 Nov '08

Dear open-ldap Team, Currently we are using ldap Version-2.4.8 on our Fedora Core 9 machine. When we try to create a computer account using ldap-add with non admin user we are getting error "insufficientAccessRights". Please let us know how we can add computer account in Active Directory with non admin users?? Thanks in advance. S.Karthikeyan Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2008