openldap-technical November 2009

openldap-technical@openldap.org

51 participants
58 discussions

Re: Queries very very slow + strange problem with indexes
by Jan Thiemo Fricke 20 Nov '09

20 Nov '09

Rein Tollevik schrieb: > Jan Fricke wrote: > >> I'm running openLdap 2.3.43 on CentOS 5.3. >> At the moment queries that return one entry of 20 take between 300ms and >> 600ms. The objectClass of the objects I query has no influence. The acl >> rules that allow users to write have also no significant influence on >> query speed. If I add >> >> index telephoneNumber eq >> >> to my slapd.conf, queries with (telephoneNumber=123) are very fast but >> return zero results although they should return one. >> >> Any ideas? I'm running out of ideas (Maybe because I'm new to LDAP :) ) > > You must run slapindex after modifying the index configuration. > > Rein > . > Long question, short answer. Thanks a lot! I won't have the chance to test it until monday. Just to make sure that I got it. I need to run slapindex only once to index existing pieces of data. After adding an attribute to the indexed entries of my slapd.conf and running slapindex the index will be refreshed automatically when datasets are modified. Jan

1 0

Queries very very slow + strange problem with indexes
by Jan Fricke 20 Nov '09

20 Nov '09

Hi members, I'm running openLdap 2.3.43 on CentOS 5.3. At the moment queries that return one entry of 20 take between 300ms and 600ms. The objectClass of the objects I query has no influence. The acl rules that allow users to write have also no significant influence on query speed. If I add index telephoneNumber eq to my slapd.conf, queries with (telephoneNumber=123) are very fast but return zero results although they should return one. Any ideas? I'm running out of ideas (Maybe because I'm new to LDAP :) ) Thanks in advance Jan -------------------------------------------------------------------------------- Here is my slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel acl database bdb suffix "dc=myDomain" rootdn "cn=admin,dc=myDomain" rootpw {SSHA}basdfasdfasdfasdfv directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=myDomain" write by anonymous auth by self write by * none access to dn.base="" by users read by dn="cn=admin,dc=myDomain" write access to dn.exact="dc=myDomain" by * read access to dn.exact="ou=users,dc=myDomain" by * read access to dn.sub="ou=users,dc=myDomain" filter=(objectclass=person) by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by self read access to dn.sub="ou=roles,ou=users,dc=myDomain" by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by * read access to dn.sub="ou=configs,dc=myDomain" by * read access to dn.sub="ou=contacts,dc=myDomain" by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by * read access to dn.sub="ou=roleRights,dc=myDomain" by set="user & ([cn=UserManagement,ou=roleRights,dc=myDomain]/member*)" write by * read --------------------------------------------------------------------------------- And also DB_CONFIG set_cachesize 0 20097152 0 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500

2 1

Password Troubles
by CASEIRO Philippe 20 Nov '09

20 Nov '09

Hello I have some troubles with some users. The user change is password (all works fine) It open sessions during lot of time After some hours the user couldn't login into ldap server clients anymore. Did somebody ever had the same problem ? I don't see anything in logs (Lv 256). The only thing is an "Invalid credentials" returned by pam_ldap on login failures but nothing in ldap logs. If I reset the password all works fine back. Thanks for you help -- Philippe Caseiro

1 1

Accentuation problem
by M. Rodrigo Monteiro 19 Nov '09

19 Nov '09

Hi all! I'm using OpenLDAP 2.4.15 and Samba 3.4.2 (all native from Fedora 11 64 bits). When I try to change the displayName to a name that contains an accent, gives me this error: # cat /tmp/790 dn: uid=antonio.oliveira,ou=Usuarios,DC changetype: modify replace: displayName displayName: Antônio Kelvis Costa de Oliveira # ldapmodify -x -H ldap://localhost -D "cn=root,DC" -w "PASS" -P 3 -f /tmp/790 modifying entry "uid=antonio.oliveira,ou=Usuarios,DC" ldap_modify: Invalid syntax (21) additional info: displayName: value #0 invalid per syntax The problem is with OpenLDAP, Samba, or with the attribute (schema)? Regards, Rodrigo. -- M. Rodrigo Monteiro falecom(a)rodrigomonteiro.net "Free as in Freedom, not free as in free beer" "As we are liberated from our own fear, our presence automatically liberates others" Linux User # 403730

1 0

OpenLdap 2.4.17 and openssl 0.9.8l and datagram-based TLS
by Robert Hanson 18 Nov '09

18 Nov '09

Our customer is requiring us to use openssl 0.9.8l They have determined that there is a problem with datagram based TLS; as long as we're not using datagram-based TLS for communication to slapd, we can go ahead and approve this. How do I find out if I'm using datagram-based TLS? Is it something in the slapd.conf file or is it something in the build of openldap? Or is it just not an issue?

2 1

Issues with SSL/TLS + GSSAPI when modifying uniqueMember attribute (bug???)
by Rahul Amaram 18 Nov '09

18 Nov '09

Hi, With OpenLDAP + TLS/SSL + GSSAPI, trying to modify the value of the multivalued attribute uniqueMember to ["uid=user1,ou=People,dc=example,dc=com", "uid=user2,ou=People,dc=example,dc=com", "uid=user3,ou=People,dc=example,dc=com", ...] hangs when the number of members cross 398. If instead of user1, user2, user3, ... I use usr1, usr2, usr3 ... then also it hangs but that was when the number of members cross 408. Further using u1, u2, u3, ... it hangs when the number of members cross 430. I couldn't figure out the reason for this behaviour. Either way the solution to the problem seemed to be in setting maxssf to 0. Below is an example command on how I used this property: $ LDAPSASL_SECPROPS="maxssf=0" LDAPTLS_CACERT=/etc/ssl/certs/rootcacert-dbs.example.com.pem ldapmodify -H "ldap://dbs.example.com" -Y GSSAPI -f data.ldif -ZZ Is the hanging anticipated behaviour? Is setting maxssf=0 the proper solution or is there a better solution? Regards, Rahul.

2 2

slapcat kills slapadd
by Peter Mogensen 18 Nov '09

18 Nov '09

I know this is probably a "don't do that", but I was somewhat surprised by the outcome. I was doing a: slapadd -S 1 -q -w -l ~/load_noCSN.ldif ... and wanted to see what was actually added to the database, so I ran slapcat - which immediately made bot apps crash. => bdb_last_id: get failed: DB_PAGE_NOTFOUND: Requested page not found (-30986) (slapd 2.4.19, BDB4.8 using hdb) /Peter

2 3

Racecondition when loading schemas?
by Peter Mogensen 18 Nov '09

18 Nov '09

Hi, I experience something weird. I've set up an empty set of mirrormode servers. No databases. Only cn=config. Now I try to add a database on server 1 and see it's existance replicated to server-2. I do this with a small shell-script which calls ldapadd somthing like this: for F in $LDIFDIR/*.ldif; do ldapadd -YEXTERNAL -H ldapi:/// -f $F done $LDIFDIR contains files like this: 00moduleload.ldif 10attributeoptions.ldif 30evolutionperson.ldif 31rfc2739.ldif 70database.ldif It loads OK, but *almost* always "evolutionperson" does not get replicated to server-2. That's almost, because *sometime* it does. If I run the ldapadd command manually it almost always does. So I figure that there's some kind of race condition which prevents "evolutionperson" from getting replicated. But I can't see why. It doesn't depend on anything from the other files. (inetOrgPerson schema is alread loaded before this). /Peter

2 1

How to replicated Account machine
by Dominguez, Gaston Matias 18 Nov '09

18 Nov '09

Hi people, Im having troubles with replication, i use syncrepl and it s working fine but when my PDC is down , the user cannt logon to BDC because it hasnt the account on the ldap base. How i can resolve this ¿? Someone knows about it? Config. PDC Administrador:x:0:0:Netbios Domain Administrator:/home/Administrador:/bin/false nobody:x:999:514:nobody:/dev/null:/bin/false cpu-004$:*:1000:515:Computer:/dev/null:/bin/false tonga01:x:1001:513:System User:/home/tonga01:/bin/bash srvbc01$:*:1002:515:Computer:/dev/null:/bin/false cpu-001$:*:1003:515:Computer:/dev/null:/bin/false tonga02:x:1004:513:System User:/home/tonga02:/bin/bash BDC Administrador:x:0:0:Netbios Domain Administrator:/home/Administrador:/bin/false nobody:x:999:514:nobody:/dev/null:/bin/false tonga01:x:1001:513:System User:/home/tonga01:/bin/bash tonga02:x:1004:513:System User:/home/tonga02:/bin/bash regards.

1 0

How create OU
by Bruno Steven 18 Nov '09

18 Nov '09

Hi ... I have squid integrated with OpenLdap . I need create an Ou and a lot of groups but my Openldap is integrated with Samba too. How I could create OUs in enviroment integrated ? For examaple, I create users using smbldap-tools but this tool doesn´t create Ou. Thanks . -- Bruno Steven - Administrador de sistemas. LPIC-1 - LPI ID: lpi000119659 / Code: p2e4wz47e4 https://www.lpi.org/caf/Xamman/certification MCP-Windows 2003 - TranscriptID: 793804 / Access Code: 080089100 https://mcp.microsoft.com/authenticate/validatemcp.aspx P Antes de imprimir pense em sua responsabilidade e comprometimento com o Meio Ambiente. Before printing this message, think about your ecologic responsability and environment commitment.

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2009