openldap-technical June 2009

openldap-technical@openldap.org

87 participants
100 discussions

UCARP setup
by Ivan Ordonez 09 Jun '09

09 Jun '09

Hi, Has anyone here have any experience using UCARP with openldap? http://www.ucarp.org/project/ucarp Our department want to use UCARP to provide automatic failover but I'm at lost on how to make two machines replicate openldap data. If you have a better suggestion, or ideas on how to make it work, please let me know. Thanks in advance. -Ivan

2 2

using search filter for operational attributes (pwdAccountLockedTime)
by Tyler Gates 09 Jun '09

09 Jun '09

Hey guys, From my understanding pwdAccountLockedTime is an operational attribute and by ldap v3 definition it must be 'requested' to obtain the value. However, when I include this attribute as part of a search filter against one of my master servers I get results back but when I run it against my proxy (back_ldap) ldap server, I get nothing. Only when I request the attribute do I get something off the proxy. If operational attributes should not be seen unless requesting them then how come on my master servers it returns fine but not on the proxy? Is there a way to make the proxy behave the same as the master's in this regard? Or do I possible have some ACL issues? Thanks, Tyler

2 2

make test problem during openldap 2.4.16 installation
by mukim pathan 09 Jun '09

09 Jun '09

Hi, I am trying to install new release of openldap 2.4.16. I have installed Berkley DB 4.7. ./configure went normally but "make test" got hang. Following is the message it showed... >>>>> Test succeeded >>>>> ./scripts/test000-rootdse completed OK. >>>>> Starting test001-slapadd ... running defines.sh Running slapadd to build slapd database... Is there any solution to this? Regards, Mukim Pathan

3 2

Practices : DN filtering alternatives
by Lorenzo Pastrana 09 Jun '09

09 Jun '09

I've been reading (and actually experienced) that DN, not being a full class attribute, is not filterable (read : with wildcards / patterns). I've been thinking about 'duplicating' the DN in an attribute since the hidden 'entryDN' attribute is not accessible either but that sounds ugly and redundant to me. If there is a commonly used alternative to filtering DNs I'd be glad to hear. Thanks. Lorenzo Pastrana R&D Head @ Happy End -------------------------- Web Shop Multimédia Design Visual Communication & Publishing -------------------------- Tél.: +33 1 42 47 83 09 Fax.: +33 1 47 70 70 19 E-mail : lorenzo.pastrana(a)happyend.fr

4 4

Problems with replication (syncrepl, syncprov)
by Florian Götz 08 Jun '09

08 Jun '09

Hi everybody, i got two OpenLDAPs (2.4.12) running. One providing the syncrepl Overlay and one the syncprov. The LDAP system is used for user authentication over a samba server. I created a user "backup" with all the rights to see all parts of the DIT of the primary ldap. If I connect to the primary with this user I can see all entries. The sync-configuration used on both machines is attached at the end of this mail. Now I got the following problem that only the ou´s group and users get syncronized on the backup machine. The rest like "computers" and other ou´s don´t get replicated, so I don´t get a full backup of the primary LDAP. Can someone help me with the config? I think the one attached should work, but ... :) Mit freundlichen Grüßen Florian Götz Primary LDAP ===================== # Provide Backupdata for second machine overlay syncprov syncprov-checkpoint 10 2 syncprov-sessionlog 100 Backup LDAP ====================== # Backup from primary LDAP syncrepl rid=1 provider=ldap://x.x.x.x binddn="uid=backup,ou=Users,dc=example,dc=de" bindmethod=simple credentials="*********" searchbase="dc=example,dc=de" filter="objectClass=*" type=refreshAndPersist retry="5 10 30 +" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited ---------------------------------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6569 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

2 1

Uncategorized exception
by mukim pathan 08 Jun '09

08 Jun '09

Hi, I am getting following exception while i am doing search using spring-ldap. org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' Caused by: javax.naming.NamingException: [LDAP: error code 80 - internal error]; remaining name '' at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at javax.naming.directory.InitialDirContext.search(Unknown Source) at org.springframework.ldap.core.LdapTemplate$4.executeSearch(LdapTemplate.java:230) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:272) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:234) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:548) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:532) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:383) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:406) at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:424) I don't see any reason for this as everything was working fine and suddenly this exception came. Can you tell me any reason for this? Regards, Mukim Pathan

2 1

Newbie question about ldif
by J. Bakshi 08 Jun '09

08 Jun '09

Dear all, greetings to all. Hope I have joined the right list to discuss about openldap technology. I am working with typo3 and openldap. Typo3 is a CMS ( content management system ) just like Drupal, Joomla etc.. I like to implement an openldap based system where I can have a organization based structure like department, company etc and can store persons with their name, address, contact along with userid/password which will be used to authenticate the front end user login in typo3. To start with I need a well designed ldif file. I have already get some example ldif from internet but those are missing the useris/password authentication. More over the " objectclass: organizationalPerson " " objectclass: inetOrgPerson " "objectClass: dcObject" "objectClass: organization" are very much confusing :-( Could any one kindly enlighten me a little about those "objectcalss" and which one is best suited for my requirement ? A sample ldif file with little explanation will help me a great. Thanks

3 5

Help with ACL's
by Tyler Gates 08 Jun '09

08 Jun '09

Hello, I'm having a hard time setting some ACL's for my particular setup. I have a structure as follows: dn: uid=*,ou=people,dc=example,dc=com # uid contains several unix/linux user ids dn: cn=*,ou=groups,dc=example,dc=com # cn contains several unix/linux groups. uid's (not the complete dn) are supplied to the memberUid fields What I would like to do is place an organizationalRole in each group and have ACL's setup so that it's uniqueMembers have access to certain attrs (say for example sn) for the uid's (which correspond to those in ou=people) specified in the memberUid fields of the group in which the organizationalRole is placed. psuedo code would be something as follows: access to group/posixAccount/memberUid.regex("cn=(.*),ou=groups,dc=example,dc=com") attrs sn by group/organizationalRole/uniqueMembers/.regex("cn=admin,cn=$1,ou=groups,dc=example,dc=com") write Thanks, Tyler

3 9

ldapi -> "Confidentiality required" problem
by Gunnar Frenzel 08 Jun '09

08 Jun '09

Hello, I've configured openldap (v2.4.16 on FreeBSD 7.2) to listen on ldaps (with self signed certificate) as well as ldapi. rc.cof: slapd_enable="YES" slapd_flags='-h "ldapi:///var/run/openldap/ldapi/ ldaps:///"' slapd_owner="ldap:ldap" slapd_sockets="/var/run/openldap/ldapi" slapd.conf: database bdb suffix "dc=mydomain,dc=com" rootdn "cn=Manager,dc=mydomain,dc=com" rootpw password directory /var/db/openldap-data index objectClass eq security ssf=128 TLSCACertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateFile /usr/local/etc/openldap/ssl/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/ssl/cert.key TLSVerifyClient never Connecting to ldaps (port 636) with clients such as Thunderbird, Apache Directory Studio works fine. But when I try to connect via ldapi (port 389) from a webmail tool on the same server I always get the error "Confidentiality required" from openldap. I want to connect to ldapi (as it is local on the server) without TLS or other encryption but openldap doesn't seem to allow that in my configuration. I tried localSSF set to 0 which doesn't make any difference... I'd be thankful for any advice with this issue. Best regards, Gunnar

3 6

openldap, bdb versions and performance issue
by jakjr 08 Jun '09

08 Jun '09

Hello Guys, Last week I upgraded our openldap server to 2.4.16 and we had terrible performance problems. Quanah suggested me to use this options with bdb compilation: --enable-posixmutexes --with-mutex=POSIX/pthreads I compiled and tested openldap with different versions of BDB and the results are odd: OpenLDAP version BDB version Test time 1 (seconds) Test time 2 (seconds) Test time 3 (seconds) 2.4.16 BDB 4.5.20 256.2008 260.5799 273.933 2.4.16 BDB 4.6.21 265.428 260.2496 255.0599 2.4.16 BDB 4.7.25 261.5573 254.2001 259.9456 2.3.30-5 (debian package) BDB 4.2.52 257.7173 251.3512 250.8456 The test consist on make some operations: for ($i=0; $i<=1; $i++) { make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); make_add(1000); make_search(10000); make_mod(500); make_get_entries(10000); make_del(200); } Like you can see, the best result was using to old version of openldap server with the old version of BDB. Even more odd was the use of CPU. Using these old versions, the consume of CPU was half then using the new ones. The slapd.conf and DB_CONFIG were the same on all tests. Here are the compilation lines: BDB: CFLAGS="-Wall -g -O2" CPPFLAGS="-I/usr/include/tcl8.5" LDFLAGS="-lpthread" ../dist/configure --enable-cxx --enable-compat185 --enable-rpc --enable-tcl --enable-posixmutexes --with-uniquename --with-tcl=/usr/lib/tcl8.5 --with-mutex=POSIX/pthreads --enable-test Openldap: CFLAGS="-Wall -g -D_FILE_OFFSET_BITS=64 -O2" ./configure --prefix=/usr --libexecdir=/usr/lib --sysconfdir=/etc --localstatedir=/var --mandir=/usr/share/man --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-aci --enable-cleartext --enable-crypt --enable-spasswd --enable-modules --enable-rewrite --enable-slp --enable-wrappers --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-meta=mod --enable-monitor=mod --enable-relay=mod --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc DB_CONFIG: set_cachesize 0 524288000 0 set_lk_max_objects 15000 set_lk_max_locks 15000 set_lk_max_lockers 15000 set_shm_key 5 slapd.conf: some index and cachesize 10000 idlcachesize 10000 Is there some wrong or these are the expected results ? I appreciate any tip. Best regards, João Alfredo

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2009