openldap-technical June 2009

openldap-technical@openldap.org

87 participants
100 discussions

ldappasswd use for admin
by Gustavo Mendes de Carvalho 28 Jun '09

28 Jun '09

Hi there, Does anybody know which parameters to use in ldappasswd command when admin user (cn=admin,dc=domain,dc=com) has to reset user's password ? The situation is: LDAP user forgot his/her password and LDAP Admin has to reset it, allowing his/her to login and then to change his/her password. Thanks in advance --- Gustvo Mendes de Carvalho email: gmcarvalho(a)gmail.com

3 2

monitor mirror mode
by François Mehault 26 Jun '09

26 Jun '09

Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François

2 1

RE: Case Ignore Ordering matching rule for IA5 String sysntax ?
by masarati＠aero.polimi.it 26 Jun '09

26 Jun '09

> Hi ! > > OK ... we will check that approach. > > Do you know if it was something forgotten in the RFC4517 ?... it > sounds > really odd (to me) that PrintableString (that is a subset of IA5String) > and DirectoryString (that is a superset) are allowed syntaxis for > "caseIgnoreOrderingMatch" ... but IA5String is not allowed to use it > (maybe I am missunderstanding/mixing things ....???) I do not recall in detail, but this or something related should have already been discussed (I'd let others step in if they know the story in more detail). Basically, it should be something like the caseIgnore stuff for IA5 was absent in the RFC 225* series, and it was not added to the RFC 451* series because IA5 is essentially obsolete, directoryString should be used instead. p.

5 4

ldap auth from external application
by Zdenek Styblik 26 Jun '09

26 Jun '09

Hi, I'd like to ask why is auth from external applications like eg. ftp server done via proxy user, and not straight with user provided credentials. The only thing I came up with is that there is possible risk with hi-jacking session due to flaw in application, still- I'm missing the big picture here. Or return code 49 is not enough for failed auth? Could somebody, please, clarify this for me? I'm sure there are really good reasons no to so (straight auth), still I've "found" pros in not having additional user which is capable to read others (even hashed) passwords, and probably no need to be password hash dependent as whole auth would be LDAPs domain. Thanks, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 6

openldap search configuration
by mukim pathan 26 Jun '09

26 Jun '09

Hi, I am using openldap 2.4.16 with bdb-4.5. This database has to give response to around 200 search queries at a time. I wish to know what my configuration of ldap should be so that this search queries will be answered in milliseconds. Any help will be appreciated. Regards, Mukim Pathan

1 0

Case Ignore Ordering matching rule for IA5 String sysntax ?
by Antonio Alonso 25 Jun '09

25 Jun '09

Hi ! We are trying to define (in our own ldap schema) an IA5String attribute type that is required to be managed (from our ldap clients) as "case insensitive" "greaterOrEqual" and "lessOrEqual" filters are required to be managed over this attribute, so we wanted to assigne (in its attribute type definition) an ORDERING matching requesting "case insensitive" behaviour According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO any ordering Matching Rule for IA5String syntax AND case insensitive support. We tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error (at schema loading) as attribute type syntax (IA5String) is not allowed for this "ordering match rule" We checked that defining the attribute as "PrintableString" works (as "caseIgnoreOrderingMatch" is a valid matching rule for that sysntax according to RFC4517) ... but we are really interested in IA5String syntax .... Does openLDAP server technolgy provide a "case insensitive ordering match" method for IA5String syntax ? Thanks in advance BR / Antonio Antonio Alonso Alarcón CUDB System Engineer Ericsson España, S.A. Phone: +34 91 339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) (Millenium building, Fax: +34 91 339 1636 5th floor, B1 side, desk 61) 28033 Madrid, Spain E-mail: antonio.alonso(a)ericsson.com

1 0

Re: OpenLDAP Mirror Mode configuration
by Mathieu MILLET 25 Jun '09

25 Jun '09

On Thu, 25 Jun 2009 07:41:42 -0600, Matt Kassawara <battery(a)writeme.com> wrote: > I'm running mirror mode on a pair of VMs and haven't noticed any issues > with > replication. If you're using VMware ESX/ESXi 3.5, I recommend configuring > Linux guests with the kernel boot parameter "clocksource=acpi_pm" and > configuring VMware Tools to handle clock management in the guest. Verify > NTP isn't running in the guest. Also, making sure the Linux kernel > periodic > interrupt timer runs at 100 Hz instead of 250 or 1000 Hz can reduce timing > issues. VMware provides some documentation on best practices for > performance tuning I'd recommend reading. Yes, I have read these (but was using VM workstation). Also, My experimentation was during last summer 2008 and at the same period VMWare switch from "DO NOT USE NTP in Guest, instead VmwareTools" to "Use NTP" without any explanation ... The main trouble was when modifying on both side "too quickly". Other testings with differents applications show up that virtualization is no good for timing-picky application (but it is going off-topic ;) Thanks for the sharing. Sincerely yours, Mathieu. > On Thu, Jun 25, 2009 at 12:16 AM, Mathieu MILLET <ldap(a)htam.net> wrote: > >> On Tue, 23 Jun 2009 09:36:23 +0100, Fernando Silva >> <fernandolrsilva(a)gmail.com> wrote: >> > Hi all, >> >> Hi >> >> > I'm trying to setup a Mirror Mode configuration using 2 machines >> > running >> > OpenLDAP v2.4.11 on both. To make things easy both machines are on the >> > same (private) network. >> > >> > [snip] >> > mirrormode on >> > >> > I'm using Ubuntu 8.10 inside a VMWare image, but both images are >> > running >> > on independent machines and the network on both is Bridge Mode. >> >> >From previous experiment, especially with OpenLDAP 2.4.11, I have very >> hard >> time with making OpenLDAP N-way replication working on VM, especially >> VMWare-based ones. >> >> The main problem was with the management of the system clock, where >> VMWare >> was making the clock slower and then make a "jump" to compensate the >> slowiness. So, I got a lot of line "new modification with older timer >> value" (can't remember the precise log line, though). >> >> I had to switch to plain physical server (which was my target by then). >> >> > All >> > seems well according to OpenLDAP manual, but maybe I'm missing >> > something. I start both servers using "slapd -d sync" in order to >> > filter >> > only the sync part. >> > >> > I created a script to insert 200 employees in my directory, to force >> > the >> > servers to sync up. When I start both servers and insert the employees >> > in machine 1, I get this too much lines with this sample: >> > slap_queue_csn: queing 0xb6851b4a >> 20090623082909.571025Z#000000#000#000000 >> > slap_graduate_commit_csn: removing 0xb82165c8 >> > 20090623082909.571025Z#000000#000#000000 >> > >> > So the CSN is being created (I think), but there's no sync to machine >> > 2, >> > which makes me frustated. . . >> > >> > I'd appreciate any comments you can have, especially if you already >> > have >> > this kind of setup running. >> > >> > Best regards, >> > Fernando >> >> Hope it can help. >> Sincerely yours, Mathieu MILLET. >> >>

1 0

getnetbyaddr not working with LDAP
by Eric Ritchie 25 Jun '09

25 Jun '09

I'm running 2.3.39 under Redhat 4.0. I'm transitioning my Redhat clients from NIS to LDAP. It seems that getnetbyaddr doesn't work under LDAP. The following perl code shows the problem: #!/usr/local/bin/perl -w use Socket; $n = getnetbyname ( "nasd" ); $name = getnetbyaddr($n, AF_INET); print "$name\n"; exit 0; Host running NIS: # ./eric.pl nasd Host running LDAP: # ./eric.pl Use of uninitialized value in concatenation (.) or string at ./eric.pl line 9. The getnetbyname call works and I can print out the network IP. Can anyone help with this? Thanks -- Eric Ritchie Interactive Brokers LLC 203-618-5868

1 1

OpenLDAP Mirror Mode configuration
by Fernando Silva 25 Jun '09

25 Jun '09

Hi all, I'm trying to setup a Mirror Mode configuration using 2 machines running OpenLDAP v2.4.11 on both. To make things easy both machines are on the same (private) network. Here's a sample of both my slapd.conf: Machine 1: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 001 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.2 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on Machine 2: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 002 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.1 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on I'm using Ubuntu 8.10 inside a VMWare image, but both images are running on independent machines and the network on both is Bridge Mode. All seems well according to OpenLDAP manual, but maybe I'm missing something. I start both servers using "slapd -d sync" in order to filter only the sync part. I created a script to insert 200 employees in my directory, to force the servers to sync up. When I start both servers and insert the employees in machine 1, I get this too much lines with this sample: slap_queue_csn: queing 0xb6851b4a 20090623082909.571025Z#000000#000#000000 slap_graduate_commit_csn: removing 0xb82165c8 20090623082909.571025Z#000000#000#000000 So the CSN is being created (I think), but there's no sync to machine 2, which makes me frustated. . . I'd appreciate any comments you can have, especially if you already have this kind of setup running. Best regards, Fernando

3 3

RHEL 5 rpms
by Adam Leach 25 Jun '09

25 Jun '09

Anyone know where to find RHEL 5 rpms that are higher than 2.4.11? -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2009