openldap-technical March 2011

openldap-technical@openldap.org

102 participants
107 discussions

slapd segfaults in one node of master-master
by Dave Smith 29 Mar '11

29 Mar '11

We run version 2.4.16 on two RHEL4 platforms in master-master configuration. One of our nodes regularly reports a segfault and exits. The log is shown below. This is a production platform so we run minimal logging for performance reasons. We have been running openldap in this configuration for 2 years without a problem. The issues started after we applied as schema change and added more users accounts to the system. The schema changes we straight-forward. We added a few optional attributes to existing objects and added one new object to our schema. Nothing that required data fixes. Our schema provides an auxiliary user account object that we use with the standard "account" object. We have a number of additional objects that are related user authentication and authorization. We applied these same changes in various development and testing environments without problem. The other thing we did was add a lot of users accounts. Prior to this release we had some 6000 users accounts. Now we have over 15000 user accounts. We are concerned that our problem may be related to the additional load from these users. We are planning further grow in the user-base. One thing I should mention is that our system is more write-heavy that the NIS replacement system. We change attributes on the account record on every authentication request. We suspect this might be replication related because when we dump (using slapcat) and compare the two nodes, one user account record is missing from the node with the segfaults. This weekend we plan to rebuild this node from the slapcat output of the other. We hope this will resolve our problem. Mar 21 00:59:02 msgeuroha slapd: slapd startup succeeded Mar 21 01:47:29 msgeuroha kernel: slapd[19367]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 01:53:58 msgeuroha slapd: slapd startup succeeded Mar 21 03:46:54 msgeuroha kernel: slapd[14167]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 03:51:34 msgeuroha slapd: slapd startup succeeded Mar 21 09:10:34 msgeuroha kernel: slapd[6834]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 --DS

2 1

YubiKey authentication
by Francis Swasey 28 Mar '11

28 Mar '11

My boss dropped by and asked me if it would be possible to have our OpenLDAP servers (2.4) which are currently using the {SASL} password form to authenticate against saslauthd which goes to Kerberos be configured (on a per entry basis) to authenticate against the YubiKey or Kerberos. Has anyone set up an OpenLDAP server to authenticate against YubiKey? Or hooked YubiKey's authenication into SASL? (google hasn't found anything for me yet) Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

replication possibilities
by denethorr＠o2.pl 28 Mar '11

28 Mar '11

Dear OpenLDAPs users, i want to integrate CMS with working OpenLDAP 2.3.30 tree to authorize CMS users. I use OpenLDAP for postfix maps, samba domain, posix accounts and VPN users. Because my CMS is in location which is not controlled by IT departament, i dont want to replicate whole tree, but about 30 accounts. I will need cn, userPassword or/and sambaNTPassword. Is it possible to do it with ldap builtin replication mechanism or should i write some scripts? Any examples? Best Regards, Jan

1 0

8 principal limitation in openldap
by Srivatsav M 28 Mar '11

28 Mar '11

Hi, We are using OpenLDAP for authenticating users registered in a LDAP server (Open LDAP, Active Directory). After adding 8 principals (/etc/ldap.conf), none of the users registered in the /etc/ldap.conf file are able to login. nss_base_passwd OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_shadow OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_group OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname Can you please share the reason for this 7 limitation in the open ldap library. or how I can fix this issue. I am looking i for the header file in the source files whhich has this constant or limitation defined. Tried googling, but it appears that no one has encountered this issue. Some customers are running into this issue and it has become a severity 1 issue to fix. Thanks Ramakanth

5 4

Internal (implementation specific) error (80) and cannot allocate memory
by Hendrik van der Ploeg 28 Mar '11

28 Mar '11

Hello People, I'm importing a ldif file in a ldapserver which has 200 different databases on it. The max is 256 by the way. I import the ldif in every database only with a different DN per database of course. I can import the ldif file in about 30 databases and then the server gives the error message: "ldapadd: Internal (implementation specific) error (80)" And in de slapd.log: bdb_locker_id: err Cannot allocate memory(12) The ldif file consist of about 8000 lines. Is there some kind of maximum entries per database and can I expand the maximum. I just can't imagine that there is a maximum of 8000 * 30 = 240000 Hope someone can help me. Regards, Hendrik

3 8

slapo-dds and data decoding error
by Michael Ströder 27 Mar '11

27 Mar '11

HI! For the fun of it I'm implementing a small Python script which sends a Refresh Request (RFC 2589). But slapo-dds (OpenLDAP 2.4.24) returns a protocol error due to a decoding error: Mar 24 20:48:38 nb2 slapd[8202]: conn=1015 op=1 EXT oid=1.3.6.1.4.1.1466.101.119.1 Mar 24 20:48:38 nb2 slapd[8202]: conn=1015 op=1 RESULT oid= err=2 text=data decoding error But what's wrong with the request value (BER file attached)? dumpasn1 output seems right to me: 0 51: SEQUENCE { 2 45: OCTET STRING : 'cn=DDS Test Raum,ou=Testing,dc=stroeder,dc=de' 49 2: INTEGER 332 : } Ciao, Michael.

2 3

suitable of ldap and openldap
by Ian Willis 27 Mar '11

27 Mar '11

Hi All I'm involved with a project where we're exporting information from a couple of bespoke systems for analytics purposes however there is a degree of sensitivity associated with some of the information. The developers of the analytics system have requested 3 API associated which they would like to have for accessing objects which are as follows. The first two API's would be interactive. 1 Input (user_id, object) output bool whether a user can access the object 2 Input (user_id, (set of objects) output (set of objects a user can access) 3 Input (user_id) output (the set of objects a user can access) or possibly the set that a user can't access. (This API can be a couple of orders of magnitude slower than the previous two as it will only be provided as a response once per session.) We have been considering a URL/URI formal for the object identification. The object will be associated with either a set of users or groups and we're leaning towards groups. Initially there may only be two groups sensitive and general however over time a finer grained model has some longer term business appeal. Rather than create yet another bit of bespoke infrastructure I was considering recommending that the API is implemented using LDAP. The kicker is that there could be up to 2 or 3 hundred million objects split across 4000 or so users broken up into 500 groups. Most of these users currently exist in a Oracle backend for a bespoke app and most of the objects will be exported as rows from the database so essentially a row is an object. The shop is a mixed windows unix/linux shop where the directory is currently AD. The internal developers are primarily MS and one has already suggested putting the objects into AD however I've said that this would probably hose operational systems and wouldn't be such a bright idea. ADAM will be the next suggestion from the MS side and if that occurs I will be suggesting that openldap should be thrown into the mix for a bakeoff on the grounds that the best performing system should provide the service. If this comes to pass I will also be making sure that load times are in scope as well. Based upon the information above 1 Is this completely insane. 2 Any thoughts or suggestions as to the appropriate schemas for implementing this, database backends ie BDB, HDB, malloc replacement etc. LDIF scripts for loading object would be welcome :) On the bright side I do have a 16core sun 4600 at home for doing some initial feasibility work with 32G of RAM. In production I would expect that the limits on memory would be driven by response times and the amount of memory that AMD/intel hardware can support. I would expect that commercial support would need to occur as well however everything is too embryonic at present to push that barrow. My background is from the unix/linux open source area however I haven't really played enough with openldap to be confident of any concepts that I have the opportunity to push. Cheers Ian

2 1

Writing overlays: examples available?
by Marco Pizzoli 26 Mar '11

26 Mar '11

Hi all, I would like to learn how to write an overlay. I'm looking at overlay sources as available in the OpenLDAP package, but they appear to be too complex to me, particularly in not having clear comments/descriptions and, most of all, considering that I'm an occasional C programmer. I ask if someone could send to me their overlay written for very simple goals or even for fun. Some code that I can easily follow and so have an idea of which hook use to do a specific thing. Commented source would be great! :-) Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

How to obtain Operations Attributes
by Suneet Shah 25 Mar '11

25 Mar '11

Hello, I am using the Java JDK 1.6.x to query ldap. I am using the query below. However, I need to be able to pull out the operational attributes as well. Any thoughts on how I can obtain the list of operational attributes without having to specify them? SearchControls searchCtls = new SearchControls(); searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE); NamingEnumeration results = ctx.search( config.getBaseDn(), searchFilter, searchCtls); while (results != null && results.hasMore()) { SearchResult sr = (SearchResult)results.next(); Attributes searchAttrs = sr.getAttributes(); if (searchAttrs != null ) { NamingEnumeration values = searchAttrs.getAll(); while (values.hasMore()) { javax.naming.directory.Attribute atr = (javax.naming.directory.Attribute)values.next(); thanks for your help

3 4

Multimaster ldap related questions
by Cannady, Mike 25 Mar '11

25 Mar '11

I have implemented a multi-master two node ldap with openldap 2.4.22 and Berkely DB 4.8.26 on Redhat enterprise 5.4 with several readonly replicas off of the masters. I have a need to add several optional attributes to a schema and probably should upgrade to 2.4.24 as well. If this was a single-master server, it would be easy to do; just slapcat the ldap store, update software, change schema, slapadd the ldap store back, and resume slapd. I'm not sure how to do that with multi-master. One reason for using multi-master was if one master was down, the other would keep running. One should be able to upgrade one server, have it catch up with the changes that the other master had done while the first master is down and then repeat for the 2nd master. Is this possible? Has anyone done this and how was it done? I know in the near future, a high-level branch on my DIT will be purged and bulk reloaded. I have tested the load with a test setup of multi-master ldap. If I do it via ldapadd, it takes over 6 hours to load. With slapadd (and slapd down) it only takes 25 minutes plus the time for the other master to get up-to-date. Is there any way that I can speed-up the update with ldapadd? I have pieces of my slapd.conf for the 1st master at the end of this email. Slapadd has two options that appear to be needed when dealing with multi-master or replicate nodes. The first is the "-S sid" option, the second is "-w". I'm a little confused what is used where. If you are doing a dump and restore operation (slapcat, delete database, slapadd) the only option you need is the "-w" option? If you are adding new entries offline then do both options need to be specified? Is there a multi-master best practice quide somewhere? Thanks for any help, ============== slapd.conf extract ==============: ServerID 001 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args sizelimit unlimited moduleload ppolicy.1a database bdb suffix "dc=htc,dc=com" rootdn "cn=Manager,dc=htc,dc=com" rootpw XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx directory /usr/local/var/openldap-data cachesize 50000 dncachesize 50000 idlcachesize 150000 checkpoint 1024 5 dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_bsize 2097152 dbconfig set_lg_regionmax 262144 dbconfig set_flags DB_LOG_AUTOREMOVE monitoring on index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq index uniqueIdentifier eq overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=htc,dc=com" syncrepl rid=002 provider=ldap://vmldapdev2.htc.external:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=htc,dc=com" attrs="*,+" bindmethod=simple binddn="uid=vmldapdev1,ou=replicants,ou=admin,dc=htc,dc=com" credentials=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX mirrormode TRUE overlay syncprov syncprov-checkpoint 1000 1 database monitor ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2011