openldap-technical August 2013

openldap-technical@openldap.org

70 participants
88 discussions

olcAccess best practices
by Jancewicz, Russell 02 Aug '13

02 Aug '13

Hello, I was wondering if there exists a best practices guide to crafting olcAccess rules? For example: Should I create a single entry per account I want to give access, granting all attributes they would need read/write access to with a particular filter? Or would I be better off grouping access granting to members of the groups and adding individual rules for special edge cases? Or are both these ideas off base and something else would be preferred? Currently I am granting access by groups with access to collections of attributes, however as I am discovering that some accounts need access to those attributes with different filters my rules are continually shifting and growing. Thank You, -Russell Janceiwcz University of Connecticut

2 1

mdb fixes for 2.4.35?
by Patrick Lists 02 Aug '13

02 Aug '13

Hi, Quanah mentioned in another posting to the list that there are some mdb fixes for 2.4.35. Is there a patch available somewhere or a location where I can download the source containing those fixes? Regards, Patrick

4 9

N-Way Master replication no contextcsn
by espeake＠oreillyauto.com 02 Aug '13

02 Aug '13

Trying a different method of replication to suit or need and I set up two test servers for n-way master mirroring servers. Both servers have the same configuration being fed to them through puppet. In the logs I can see them bind and check cookies but I get CSN too old, ignoring 20110608165005.984980Z#000000#000#000000 (olcOverlay= {4}syncprov,olcDatabase={1}hdb,cn=config) THen the last slapd entry in the log is rid=002 cookie=rid=002,sid=002,csn=20110915141524.047299Z#000000#000#000000 and then nothing else happens. If I make a change to user it never syncs to the other server. At this point I don't know what to look at or what you might want to look at to help diagnose the problem. I followed the documentation in the admin guide to set this up. Any and all help is appreciated. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

5 9

Fw: OpenLDAP (using BDB) stalls adding 65,536th entry
by Mark Cooper 01 Aug '13

01 Aug '13

Does anyone have opinions about questions 2 and 3? Thanks ----- Forwarded by Mark Cooper/Poughkeepsie/IBM on 08/01/2013 10:27 PM ----- From: Mark Cooper/Poughkeepsie/IBM To: Howard Chu <hyc(a)symas.com>, Cc: openldap-technical(a)openldap.org, openldap-technical-bounces(a)openldap.org Date: 07/30/2013 09:58 PM Subject: Re: OpenLDAP (using BDB) stalls adding 65,536th entry Not sure exactly how I am supposed to respond (reply all, or just to openldap-technical(a)openldap.org). So, excuse me if I did it wrong doing a reply all. I appreciate all the quick responses. I've been working on this issue for a couple of weeks, so it's great to be able to post a question and get back the answer so rapidly. I do have some follow-up questions based on the responses: 1) Quanah wrote: "This is indeed a BDB bit." Not sure I understand what that means. Is part of the delay due to BDB? It does seem like a whole bunch (maybe 30) log files getting written to file before processing resumes. 2) Index lists get collapsed into ranges - I assume this done to make processing more efficient. Is this a one time event? As I mentioned, I did not see it happen again. 3)If I know I'm going to have greater than 64K elements, is there any way to force it to use ranges at server startup and avoid the delay? I didn't see any such option. Quanah - Yes, I understood that 65,536 is a power of 2 and it's importance in computer processing :) Thanks again for the answers From: Howard Chu <hyc(a)symas.com> To: Mark Cooper/Poughkeepsie/IBM@IBMUS, openldap-technical(a)openldap.org, Date: 07/30/2013 05:11 PM Subject: Re: OpenLDAP (using BDB) stalls adding 65,536th entry Sent by: openldap-technical-bounces(a)openldap.org Mark Cooper wrote: > I've been doing some testing using OpenLDAP with BDB on a couple of different > platforms. I noticed a similar situation. When I sit in a loop doing adds, > at the 65,536th added entry the process stalls for a short period of time. > After a minute or two, the add succeeds. My first thought is that this is a > BDB issue, so I posted this question to Oracle's BDB forum. But I have yet to > receive any answer. This is all known/expected behavior. One (or more) of your index slots hit its maxsize of 65535 elements and was collapsed into a range. This typically happens with the objectClass index first, if you're adding a bunch of objects all of the same classes. Taking a minute or two is abnormal, but I suppose is possible if multiple indices hit the condition at the same time. > This situation seems to happen when I have around 43 10MB log files. During > the stall, I notice many log files are being written (another 25 or so), which > is a much quicker rate than was being written prior to the stall. > > The stall only happens once. I added another 350,000 entries and no more > stalls. I ran a few other tests. Added 65,535 entries. All is fine. As > soon as the next entry is add, even if I recycle the server, I hit the > condition. I even tried deleting 1,000 entries. I would then need to add > 1,0001 to get to 65,536 entries in the database and then hit the delay. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

DR scenerio
by espeake＠oreillyauto.com 01 Aug '13

01 Aug '13

Okay here is what we are wanting to do and I need to know if it is possible with openLDAP. We have a main production ldap server v. 2.4.28 running on Ubuntu 10.04 We are adding two servers that will handle authenication and refer writes to the main provider server. What I would like to to setup another provider in our DR site and have it pull replication from the main LDAP server once a day, maybe twice. Then in turn that server would be the provider for two consumers at the DR site that would handle auth requests and refer write to the provider at the DR site. But the no changes at the DR site would be written back to the main production provider. I don't want someone testing something in the DR to be written back to production. In a nut shell I want to have two systems that look the same and the information for the second system would come from a sync with the first system, but the second system would not be able to write back to the main system. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

Error 32 object not found.
by espeake＠oreillyauto.com 01 Aug '13

01 Aug '13

Here is the error message I get when I and trying to replicate my databases. Aug 1 11:05:41 tntest-ldap-2 slapd[4871]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Aug 1 11:05:41 tntest-ldap-2 slapd[4871]: do_syncrepl: rid=002 rc -2 retrying Here is the ldif from the master. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=secret olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.com olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" read by dn="uid=ldapAdmin,ou=system,dc=oreillyauto,dc=com" read by * none structuralObjectClass: olcDatabaseConfig entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20110503162710Z Here is the ldif from the consumer. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.co olcsyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="10 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=secret olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config ModifyTimestamp: 20110503162710Z Getting cloaser I think. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

how to configure subsuffix?
by Zeus Panchenko 01 Aug '13

01 Aug '13

hi all, I'm absolutely new to LDAP and need advice, please how is it better/correct to configure database to implement "corporative users tree" covered? what I mean is structure for head office (ho), branch 1 of head office (bo1), ... branch N of head office (boN): - ho -+- bo1 -+- People | +- Groups | +- Hosts ... | +- boN -+- People +- Groups +- Hosts I see it as core LDAP server which replicates db partially, to the consequent branches while trying to google the solution I found this (just what I described as I believe): http://www.centos.org/docs/5/html/CDS/ag/8.0/Configuring_Directory_Database… but it've occured not enough for me :( so, may somebody advice, how to implement the structure in .ldif? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

2 2

Removing Overlays Using cn=config
by Tim Gustafson 31 Jul '13

31 Jul '13

Hi, I would like to remove the "auditlog" overlay from one of my databases on my OpenLDAP server that is running 2.4.35 and is configured via cn=config. But, when I try to remove the overlay object, I get: 0x35 (LDAP_UNWILLING_TO_PERFORM) I Googled around about this, and found some older list messages about not being able to delete overlays, but most of those messages are years old and I was wondering if this has changed at all? If not, what is the "proper" way to remove an overlay? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

4 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2013