openldap-technical November 2008

openldap-technical@openldap.org

53 participants
60 discussions

Active Directory caching
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, I'm looking for some references/answers as to how OpenLDAP and Active Directory work with regards to caching. The scenario I'm seeing is this: I have Apache on a RHEL5 machine authenticating users via LDAP. Its set to cache for 600s, so I dont overload the server unnecessarily. What I'm seeing though, is that something somewhere is caching old passwords. I can change the users password several times, and LDAP will authenticate using any of the passwords previously used. I've tried some timing tests of my own, and it seems that it takes up to 50mins for me first password change to take effect (an odd time to me). So I'm trying to figure out whos caching the other passwords, is it LDAP, or is it AD ? And if so where are the settings to look at? And what timers are involved? I actually don't mind the idea of caching older passwords, but only so long as I know how long it will be for, and what mechanism is doing it, then I can change it if need be. I'm setting these directives (taken straight from the Apache examples). LDAPSharedCacheSize 200000 LDAPCacheEntries 1024 LDAPCacheTTL 600 LDAPOpCacheEntries 1024 LDAPOpCacheTTL 600 My setups quite simple. Ive one Domain Controller. No proxies involved. I've read what I can online, and am getting stuck. Thanks, Adrian

2 1

Debugging a user authentication
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

2 2

LDAP logs
by Tom Cooper 14 Nov '08

14 Nov '08

Hi all, I am running openldap 2.3.27 and in the database directory log files are created called log.00000xxxx where xxxx is an incrementing number. Each log file is 10MB in size. Searching for it it looks like Berkely DB logs. How do I get rid of it as it chews up my disk space quite quickly? I have noticed that if they are deleted, my database becomes corrupted. Thanks. Tom To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

3 2

startup ldap problem
by GanGan 13 Nov '08

13 Nov '08

hello all, My problem, when I start my server ldap in my log Nov 13 12:34:10 srvtest3 slapd[3738]: daemon: shutdown requested and initiated. Nov 13 12:34:10 srvtest3 slapd[3738]: slapd shutdown: waiting for 0 threads to terminate Nov 13 12:34:10 srvtest3 slapd[3738]: slapd stopped. Nov 13 12:34:12 srvtest3 slapd[3800]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 2 2008 04:29:17) $ brewbuilder@hs20-bc2-2.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 55: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 60: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 65: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3801]: slapd starting I do not understand where is the problem, in my /etc/ldap.conf ? this command : getent passwd no user displays ldap someone would have an idea? thanks -- - GanGan -

4 4

(no subject)
by Bad Guy 12 Nov '08

12 Nov '08

Dear all, I am running the openldap 2.4.11 with 4 way masters (SID=001 to 004) configured. (my suffix is empty in slapd.conf) The data can be synced initially. I add records in 1 server and all the other 3 servers will have the new record added. However, I found that after running for some time, one server will have corrupted contextCSN in SID=001. dn: contextCSN:: sCttCIio0wAxNTQzMTMuMDQ1Mjk3WiMwMDAwMDAjMDAyIzAwMDAwMA== contextCSN: 20081107061013.853051Z#000000#001#000000 contextCSN: 20081107073602.911356Z#000000#003#000000 contextCSN: 20081107061028.825773Z#000000#004#000000 The contextCSN for SID=002 in server 1 is corrupted. So, whenever there is an update in SID=002 server, the SID=001 server will never get the update, however, when there is update in SID=003 or SID=004 server, the records will get updated in SID=001. We have a background cron job in each server running at 1 minutes interval to retrieve the records and set some user defined attributes if it meet some certain criteria. What's the cause to this corruption ? Is there any way to recover the corrupted contextCSN by command or script without rebuild the data ? Thanks _________________________________________________________________ 用部落格分享照片、影音、趣味小工具和最愛清單，盡情秀出你自己 — Windows Live Spaces http://spaces.live.com/

3 4

Password protection of TLS key
by Akke Bengtsson 12 Nov '08

12 Nov '08

Is it still a requirement that TLS keys must have their password nullified before using them in an openldap context? Some experimentation with slapd startup has revealed that for some combinations of OS and OpenLDAP version, I will be given a prompt for the TLS password and can also input it and the slapd daemon starts correctly. On other systems, I was prompted for the password but before I even could enter it, the slapd startup crashed. The tests were all performed doing a manual startup via "/etc/init.d/ldap start". Automatic startup means that the password, instead of being entered by a person, has to reside on file and thereby be accessible to potential intruders. Is there any way to prevent unprotected keys or passwords to keys in this context? Akke Bengtsson

2 1

Cannot modify directory entry with custom attribute
by James S. White 10 Nov '08

10 Nov '08

I cannot add a custom objectclass to a directory entry. When I remove my custom objectclass and attributes, I can modify the entry normally. When I add them, I get an "Invalid Syntax (21)" error. I've googled extensively, and can find other cases of this happening, but not an effective solution. What am I missing here? Details: #/etc/ldap/schema/venn.schema attributetype ( 1.1.2.1.1 NAME 'vennBase' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.2 NAME 'vennClass' DESC 'A single set this host belongs to' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClass ( 1.1.2.2.1 NAME 'vennHost' SUP top AUXILIARY MUST ( vennBase $ vennClass ) ) #added to /etc/ldap/slapd.conf include /etc/ldap/schema/venn.schema # command /etc/init.d/slapd restart #freyr.ldif dn: cn=freyr,ou=Hosts,dc=websages,dc=com cn: freyr objectclass: top objectclass: ipHost objectclass: device objectclass: vennHost ipHostNumber: 72.14.177.235 vennBase: debian-etch vennClass: ldap_server vennClass: bind9_server vennClass: cfengine_server vennClass: openldap_server vennClass: irc_server # command ldapmodify -xh freyr.websages.com -D "cn=root,dc=websages,dc=com" -f freyr.ldif -W #error modifying entry "cn=freyr,ou=Hosts,dc=websages,dc=com" ldap_modify: Invalid syntax (21) additional info: objectclass: value #3 invalid per syntax if I remove all the venn* stuff from the .ldif, everything works fine... Any help would be appreciated.

1 1

moving ldap-db via file-copying?
by Silvana 10 Nov '08

10 Nov '08

Hello! I hope you can help me, migrate my old ldap-db, problem is this: Our old server was running with ldap2.2.7? to serve as backend to the sambaserver and as of today its refusing to work or give errors (the ldap-daemon seems to start, but doesn't open the port, is not accessible, gives no errors and has to be killed, because stopping it gives no reaction) now, i've set up a new machine, to use ldap, given it the same suffix, cn, etc. the version of ldap is a newer one, than on the old box, although i'm not sure, how far they are removed. is it in some way possible, to just copy the files in /var/lib/ldap/ from the old server and insert them into the new box in the same folder? if so, which files would be ok to overwrite, which not? or woul i have to tweak some other files for that as well? or is this completely inconceivable (as i dread is the case), and if yes, how am i to get the files from the old server to the new one? any help on this would be greatly appreciated bye silvana

3 3

Re: ldap attributes - performance problem?
by Pavlos Parissis 09 Nov '08

09 Nov '08

On Sun, 09 Nov 2008 08:52:21 -0800 radim.roska(a)gmail.com wrote: > Hi, > > ok..then i guess there is not a problem :)..of course I'll add indexes, but > I was just thinking if its ok to have a lot of same attributes.. If the schema allows multiple values for this attribute then from OL point of view is fine. I assume that apache or any other LDAP client which is going to fetch this attribute will correctly handle the multiple values. Cheers, Pavlos > > thanks, > Radim > > On Nov 9, 2008 11:43am, Pavlos Parissis <p_pavlos(a)freemail.gr> wrote: > > Hi, > > > > > > > > I don't real understand your concerns. > > > > > > > > Are you worry about LDAP search performance? > > > > Adding indexes is your solution on this. > > > > > > > > Cheers, > > > > Pavlos > > > > > > > > > > > > On Sat, 8 Nov 2008 21:15:02 +0100 > > > > "Radim Roska" wrote: > > > > > > > > > Hi, > > > > > > > > > > I'm thinking about solution to following problem: authorization to > > > > > directories on our file server (accessed by webdav). Is it a performance > > > > > issue to build solution on following pattern? > > > > > > > > > > part of user's ldif > > > > > ... > > > > > uid=someone > > > > > allow_dir: directory1 > > > > > allow_dir: directory2 > > > > > allow_dir: directory3 > > > > > allow_dir: directory4 > > > > > > > > > > and then just htaccess directives in apache for every of these > directories > > > > > :) > > > > > > > > > > > > > > > it could happen that someone would have eg 50 of these > attributes...would > > > > > it be a problem? > > > > > > > > > > Thanks for advice and advanced opinion :) > > > > > Radim > > > > > > > >

1 0

ldap attributes - performance problem?
by Radim Roska 09 Nov '08

09 Nov '08

Hi, I'm thinking about solution to following problem: authorization to directories on our file server (accessed by webdav). Is it a performance issue to build solution on following pattern? part of user's ldif ... uid=someone allow_dir: directory1 allow_dir: directory2 allow_dir: directory3 allow_dir: directory4 and then just htaccess directives in apache for every of these directories :) it could happen that someone would have e.g. 50 of these attributes...would it be a problem? Thanks for advice and advanced opinion :) Radim

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2008