openldap-technical November 2014

openldap-technical@openldap.org

66 participants
69 discussions

export directory in LDIF format
by Jerry 11 Nov '14

11 Nov '14

I have a strange problem exporting my directory into LDIF format. I am using the "mdb" format with openldap. /usr/local/sbin/slapcat -l MyDomain.net.ldif -b "dc=MyDomain,dc=net" If I run this command after starting "slapd", it works fine. However, I have this configured to run from a CRON job at midnight. It fails with this message: 5460a615 mdb_db_open: database "dc=MyDomain,dc=net" cannot be opened: No such file or directory (2). Restore from backup! 5460a615 backend_startup_one (type=mdb, suffix="dc=MyDomain,dc=net"): bi_db_open failed! (2) slap_startup failed This also occurs from the command line if the database has not been accessed for several hours, usually on a weekend. Restarting "slapd" immediately corrects the problem. I have checked and "slapd" is running when the failure occurs. I tried accessing the database and then using the backup command; however, the failure still continues. That is assuming that it failed to begin with obviously. Is there some sort of a "sleep" mode or something like that, that I am not aware of, or some really hard to debug "bug" somewhere? -- Jerry

4 4

How do I say to LDAP to use my configuration instead of the default one?
by Abel Guzmán Sánchez 11 Nov '14

11 Nov '14

Hi, I am writing because some time ago I have done some things with LDAP. But I am unable to make the new versions work (2.4.x). Basically I create the config file but I am unable to say to LDAP to use it instead of the default one. Is that clear somewhere in the documentation? can anyone help me? I have followed the official documentation and I managed to compile and create the config files (Config manual <http://www.openldap.org/doc/admin24/slapdconf2.html>), after this I have an ldif file like this: root@helpDesk10000:~# cat base.ldif # example config file - global configuration entry dn: cn=config objectClass: olcGlobal cn: config # olcReferral: ldap://root.openldap.org # internal schema dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the core schema include: file:///usr/local/etc/openldap/schema/core.ldif <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> # <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend olcAccess: to * by * read # set a rootpw for the config database so we can bind. # deny access to everyone else. dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {SSHA}EQpw7T2x2Num+krwRjq/ZYczmRgaX1Km olcAccess: to * by * none # HDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=helpdesk,dc=co,dc=bw olcDbDirectory: /var/lib/ldap-database olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw olcDbIndex: uid pres,eq olcDbIndex: cn,sn pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read root@helpDesk10000:~# Then the LDAP add apparently works: root@helpDesk10000:~# ldapadd -Y EXTERNAL -H ldapi:/// -vn -f base.ldif add objectClass: olcGlobal add cn: config !adding new entry "cn=config" add objectClass: olcSchemaConfig add cn: schema !adding new entry "cn=schema,cn=config" add objectClass: olcSchemaConfig add cn: core add olcAttributeTypes: ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) ( 2.5.4.4 NAME (...) add olcDbDirectory: /var/lib/ldap-database add olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw add olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw add olcDbIndex: uid pres,eq cn,sn pres,eq,approx,sub objectClass eq add olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read !adding new entry "olcDatabase=bdb,cn=config" root@helpDesk10000:~# after that I start slapcat and it says this: root@helpDesk10000:~# slapcat 545b828d bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=my-domain,dc=com". 545b828d bdb_monitor_db_open: monitoring disabled; configure monitor database to enable root@helpDesk10000:~# *How do I say to LDAP to use my configuration instead of the default one?* Thank you!

2 1

PFS: ITS#7506 in master but not in release
by Christopher Odenbach 10 Nov '14

10 Nov '14

Hi, while I was trying to find out why slapd does not use Perfect Forward Secrecy I found bug #7506 from september 2013. The patch has already been applied to the master branch but still cannot be found in any released version since. Why is this so? I would like to see good encryption in OpenLDAP for Debian. Regards, Christopher -- ====================================================== Dipl.-Ing. Christopher Odenbach Zentrum fuer Informations- und Medientechnologien Universitaet Paderborn Raum N5.311 odenbach(a)uni-paderborn.de Tel.: +49 5251 60 5315 ======================================================

4 6

Ppolicy not working on openldap on ubuntu 12.04 server
by Guruprasad Kulkarni 10 Nov '14

10 Nov '14

Hi, I am using Ubuntu 12.04 LTS server and have installed openldap on it. The commands used were: apt-get install slapd ldap-utils dpkg-reconfigure slapd I selected the default options for the questions asked. I am having a hard time trying to make ppolicy work on it. I loaded the ppolicy.schema by making the following change to /etc/ldap.conf: include /etc/ldap/schema/ppolicy.schema I even tried the command "moduleload ppolicy.la" None have worked. If anyone knows of a way to make it work, please let me know. -Guruprasad

2 1

Backing up openldap
by Jerry 10 Nov '14

10 Nov '14

Before changing over to "mdb" from "bdb", I ran a script that used slapcat to generate an LDIF file every night. Since updating to "mdb", that script fails if "slapd" is running. That is expected behavior from what I have been reading. <http://www.openldap.org/faq/data/cache/288.html> My question is how do I export the directory into an LDIF file if "slapd" is running, or is that not supported? I could easily modify the script to shut down the program, backup the directory in an LDIF format and restart the program; however, that seems overly ambitious. I understand that "replication" is an option, but I don't know if I really want to go that route at this time. -- Jerry

3 2

Re: Replication restores deleted user
by kevin sullivan 09 Nov '14

09 Nov '14

Thank you very much for the advice and the example config! I generally convert my slapd.conf to cn=config, I just find it easier to use the slapd.conf when debugging. But this gives me hope that my problem could be an issue with the conversion of slapd.conf to cn=config or something that I can find in your configuration. Thank you again, and I will let you know what I find! On Fri, Oct 31, 2014 at 3:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, October 31, 2014 4:13 PM -0400 kevin sullivan < > kevin4sullivan(a)gmail.com> wrote: > > >> >> >> >> >> Quanah, >> >> Thank you for the suggestion to move to delta-syncrepl MMR. >> Unfortunately, I am having problems setting this up properly. After >> reading through some documentation, I thought it would be simple but when >> I bring up slapd on my two servers, they both start using around 100% CPU >> and in the debug output the two servers are constantly looping through >> all of the objects in my DIT and saying that the objects have not changed: >> >> 5453d6b5 @(#) $OpenLDAP: slapd 2.4.39 (Jun 18 2014 05:19:18) $ >> >> mockbuild@x86-028.build.eng.bos.redhat.com:/builddir/build/BUILD/openldap >> -2.4.39/openldap-2.4.39/build-servers/servers/slapd >> 5453d6b5 hdb_monitor_db_open: monitoring disabled; configure monitor >> database to enable >> 5453d6b5 slapd starting >> ... >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: dc=example,dc=com, UUID: >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN dc=example,dc=com >> 20141031161001.910968Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (dc=example,dc=com) >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: >> ou=users,dc=example,dc=com, UUID: 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN >> ou=users,dc=example,dc=com 20141031161001.922234Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 ou=users,dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (ou=users,dc=example,dc=com) >> ..... >> 5453d6b5 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT >> 5453d6b5 do_syncrep2: rid=001 cookie= >> ... Repeated forever ... >> >> Am I configuring something incorrectly? >> >> To refresh your memory, I am running 2.4.39-8. I have two servers >> (server1 and server2) that I want to setup in delta-syncrepl MMR >> MirrorMode. >> > > Hi Kevin, > > I stopped using the deprecated slapd.conf format years ago, as it's prone > to misuse and incorrect setup. Your supplied config is an example of why > it's a bad idea to use slapd.conf (For example, you have serverID under the > database section, when it's a global option, etc). I'd strongly advise you > to switch to using cn=config so that you can have an actual validated > configuration. It also makes troubleshooting a lot easier to do. > > Aside from that, your log simply shows the server comparing each entry > between the two servers... Sounds like they didn't start out believing they > were in sync and are trying to get there. > > Here's an example of my config, using cn=config (slapcat export) minus the > schema: > > <http://pastebin.com/nv1WNX2y> > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 10

LDAP Admin updating OpenLDAP and something very odd ...
by Kevin Teague 08 Nov '14

08 Nov '14

I am using the "LDAP Admin” tool to update an OpenLDAP server on Windows. This works just fine. However, when I update members of a group in LDAP with LDAP Admin, those changes are not be seen by another application which queries LDAP (Atlassian's Crowd). Clearly this application is caching results from LDAP and there is a bug in that application's caching where updates don't get detected (I can always see changes made with LDAP Admin with other LDAP). If I update LDAP with other clients (python-ldap, phpldapadmin), then that application has no problem seeing the updates. It’s only when modifications are made with LDAP Admin that updates aren’t seen. Yeah, it's a super weird bug … Is there something on an OpenLDAP server which tells clients if an entry has been modified? And it’s possible to somehow bypass that thing which gets updated? I can modify a group with LDAP Admin and run an LDIF and see that the modifyTimestamp field is being properly updated. I'm totally stumped as to how an OpenLDAP entry can be updated in a way that another client (with possibly aggressive or buggy query result caching) is able to somehow ignore that update.

2 1

Replication : consumer to master server
by Yannick Barbeaux 07 Nov '14

07 Nov '14

Hello all, I asked this question a few days ago but I guess I entered into too many details so did not get any answer. So I will try to be as conscise as possible this time: After configuring and running a replication based on the consumer-producer method (syncrepl), can a consumer become the master ldap server (after shutting down the original master/producer) ? I tried by removing the syncprov module on the consumer but without success. Thanks. Yannick

2 1

Openldap Master Slave configuration
by Elmopi, Stefano 07 Nov '14

07 Nov '14

Hi, I have a configuration with a Master and 4 Slave. Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 and all are configured with olc. All applications that use OpenLDAP for their login are configured to do queries on slave and this creates problems with some options of Ppolicy, Let me explain. I have configured the option that after a user wrong your password 5 times, it is locked. and here lies the problem, because the slave database is read-only and then the block is not reported to the Master and the user does not lock !!! I read that you could do something using the Chain Overlay but I found little documentation and everything I tried did not work. Anyone have any ideas to suggest ?? Thanks Best Regards Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

2 1

LMDB performance tip
by Howard Chu 07 Nov '14

07 Nov '14

Just recently measured: when doing a bulk-load of a DB that's larger than RAM, it's faster to turn off WRITEMAP and just use regular writes. When the DB is much larger than RAM, and LMDB is reusing old pages, most likely the next page to be written will not currently be in memory. If you just access the mapped page (writing to it) the OS will have to page it in first. This is an unnecessary I/O operation since you're simply going to overwrite its contents anyway. If you do a regular write() from a buffer instead, the OS just writes it to the target page, no page-in required. Strangely enough, this performance advantage disappears when under an active random read/write workload. I haven't yet worked out why that is. Perhaps the cost of multiple memcpy's comes into play. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical November 2014