openldap-technical February 2014

openldap-technical@openldap.org

85 participants
90 discussions

Re: LDAP via TLS
by Tim Dunphy 20 Feb '14

20 Feb '14

Hey Dan, Those docs you pointed me to worked beautifully! And thanks for the examples from your own config. I've used those too. Worked great! Thanks again. Although I do also apprecaite the advice to read the official docs. Good advice, however the ones that I've been pointed to worked well for me. I'll read the official docs for a fuller understanding tho. Tim On Wed, Feb 19, 2014 at 2:08 PM, Dan Pritts <danno(a)umich.edu> wrote: > I have simply > > TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt > TLSCertificateFile /etc/pki/tls/certs/ldap.icpsr.umich.edu.crt > TLSCertificateKeyFile /etc/pki/tls/private/ldap.icpsr.umich.edu.key > > > in my slapd.conf. CACertificateFile is almost certainly not required > for a server cert. > > > Maybe you are running into an oddity of the cn=config? Have you tried > just opening up the permissions to make sure the files are world readable? > no selinux involved? > > > > Folks on the list will probably yell at you to use the current version > rather than the centos packages. > > If you look through the archives for the last few weeks, you will find a > pointer to a site that has rpm builds of current openldap. > > Tim Dunphy <bluethundr(a)gmail.com> > February 19, 2014 at 1:35 PM > Hey ldap folks! > > I've attempted to add TLS capabilities to my newly created LDAP server > using the following document: > > http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=3 > > This is how my cert files are looking in terms of ownership and > permissions: > > [root@puppet:~] #ls -l /etc/pki/tls/*/* | grep ldap > -r-------- 1 ldap root 1241 Feb 19 13:06 /etc/pki/tls/certs/ldap.crt > -r-------- 1 ldap root 1021 Feb 19 13:05 /etc/pki/tls/misc/ldap.csr > -r-------- 1 ldap root 1679 Feb 19 13:01 /etc/pki/tls/private/ldap.key > > I got to the point where I'm attempting to add the configuration > parameters to my ldap setup like so: > > [root@puppet:~] #ldapmodify -Y EXTERNAL -H ldapi:/// > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > dn: cn=config > add: olcTLSCertificateFile > olcTLSCertificateFile: /etc/pki/tls/certs/ldap.crt > - > add: olcTLSCertificateKeyFile > olcTLSCertificateKeyFile: /etc/pki/tls/private/ldap.key > modifying entry "cn=config" > ldap_modify: Inappropriate matching (18) > additional info: modify/add: olcTLSCertificateFile: no equality > matching rule > > > These are the package version numbers I have installed via yum on CentOS > 6.5: > > openldap-2.4.23-34.el6_5.1.x86_64 > openldap-devel-2.4.23-34.el6_5.1.x86_64 > openldap-servers-2.4.23-34.el6_5.1.x86_64 > openldap-clients-2.4.23-34.el6_5.1.x86_64 > > Can anyone offer some wisdom as to why this error is happening? Or perhaps > offer some better documentation on how to enable the TLS abilities of > openldap? > > Thanks > Tim > > -- > GPG me!! > > gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B > > > -- > Dan Pritts > ICPSR Computing & Network Services > University of Michigan > +1 (734)615-7362 > -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 2

trouble with acls
by brendan kearney 19 Feb '14

19 Feb '14

list, i am running the below version: @(#) $OpenLDAP: slapd 2.4.26 (Jun 27 2012 15:27:46) $ mockbuild@x86-16.phx2.fedoraproject.org:/builddir/build/BUILD/openldap-2.4.26/openldap-2.4.26/build-servers/servers/slapd i have the below acls: olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by * none olcAccess: {1}to attrs=loginShell by self write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to dn.subtree="dc=bpk2,dc=com" by dn="cn=adm-srv,dc=bpk2,dc=com" write by dn="cn=kdc-srv,dc=bpk2,dc=com" read by * none olcAccess: {4}to dn.subtree="dc=bpk2,dc=com" by set="[cn=ldapAdmins,ou=Groups, dc=bpk2,dc=com]/memberUid & user/uid" write by set="[cn=users,ou=Groups,dc=bp k2,dc=com]/memberUid & user/uid" read by * none i issue the below search query: ldapsearch -h ldap1 -Y GSSAPI -b 'dc=bpk2,dc=com' -s sub '(objectclass=ipHost)' and get the below output: SASL/GSSAPI authentication started SASL username: brendan(a)BPK2.COM SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=bpk2,dc=com> with scope subtree # filter: (objectclass=ipHost) # requesting: ALL # # search result search: 4 result: 32 No such object # numResponses: 1 the logs for acls show: 2014-02-19T18:41:17.562950-05:00 server slapd[2033]: => access_allowed: search access to "dc=bpk2,dc=com" "entry" requested 2014-02-19T18:41:17.562976-05:00 server slapd[2033]: => dn: [3] 2014-02-19T18:41:17.562986-05:00 server slapd[2033]: => dn: [4] dc=bpk2,dc=com 2014-02-19T18:41:17.562996-05:00 server slapd[2033]: => acl_get: [4] matched 2014-02-19T18:41:17.563005-05:00 server slapd[2033]: => acl_get: [4] attr entry 2014-02-19T18:41:17.563014-05:00 server slapd[2033]: => acl_mask: access to entry "dc=bpk2,dc=com", attr "entry" requested 2014-02-19T18:41:17.563024-05:00 server slapd[2033]: => acl_mask: to all values by "uid=brendan,ou=users,dc=bpk2,dc=com", (=0) 2014-02-19T18:41:17.563034-05:00 server slapd[2033]: <= check a_dn_pat: cn=adm-srv,dc=bpk2,dc=com 2014-02-19T18:41:17.563043-05:00 server slapd[2033]: <= check a_dn_pat: cn=kdc-srv,dc=bpk2,dc=com 2014-02-19T18:41:17.563052-05:00 server slapd[2033]: <= check a_dn_pat: * 2014-02-19T18:41:17.563290-05:00 server slapd[2033]: <= acl_mask: [3] applying none(=0) (stop) 2014-02-19T18:41:17.563327-05:00 server slapd[2033]: <= acl_mask: [3] mask: none(=0) 2014-02-19T18:41:17.563336-05:00 server slapd[2033]: => slap_access_allowed: search access denied by none(=0) 2014-02-19T18:41:17.563344-05:00 server slapd[2033]: => access_allowed: no more rules i am trying to figure out why i keep getting denied. i tried slapacl: sudo slapacl -F /etc/openldap/slapd.d -v -U brendan(a)BPK2.COM -b "dc=bpk2,dc=com" "dc/read:bpk2,dc=com" this shows a weird user dn and an error: authcDN: "uid=brendan(a)bpk2.com,ou=users,dc=bpk2,dc=com" read access to dc=bpk2,dc=com: DENIED are my olcRegExp statements wrong: olcAuthzRegexp: {0}uid=([^,]*),cn=bpk2.com,cn=gssapi,cn=auth uid=$1,ou=Users,dc=bpk2,dc=com olcAuthzRegexp: {1}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=Users,dc=bpk2,dc=com where am i not going about this correctly? any help would be appreciated. brendan kearney

1 0

LDAP via TLS
by Tim Dunphy 19 Feb '14

19 Feb '14

Hey ldap folks! I've attempted to add TLS capabilities to my newly created LDAP server using the following document: http://www.server-world.info/en/note?os=CentOS_6&p=ldap&f=3 This is how my cert files are looking in terms of ownership and permissions: [root@puppet:~] #ls -l /etc/pki/tls/*/* | grep ldap -r-------- 1 ldap root 1241 Feb 19 13:06 /etc/pki/tls/certs/ldap.crt -r-------- 1 ldap root 1021 Feb 19 13:05 /etc/pki/tls/misc/ldap.csr -r-------- 1 ldap root 1679 Feb 19 13:01 /etc/pki/tls/private/ldap.key I got to the point where I'm attempting to add the configuration parameters to my ldap setup like so: [root@puppet:~] #ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config add: olcTLSCertificateFile olcTLSCertificateFile: /etc/pki/tls/certs/ldap.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/pki/tls/private/ldap.key modifying entry "cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcTLSCertificateFile: no equality matching rule These are the package version numbers I have installed via yum on CentOS 6.5: openldap-2.4.23-34.el6_5.1.x86_64 openldap-devel-2.4.23-34.el6_5.1.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 openldap-clients-2.4.23-34.el6_5.1.x86_64 Can anyone offer some wisdom as to why this error is happening? Or perhaps offer some better documentation on how to enable the TLS abilities of openldap? Thanks Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 2

RE: Syncrepl and mmr
by Quanah Gibson-Mount 19 Feb '14

19 Feb '14

--On Wednesday, February 19, 2014 2:20 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > First had this (mm-server1): > 5304e1ff olcMirrorMode: value #0: <olcMirrorMode> database is not a shadow > slapadd: could not add entry dn=olcDatabase={1}bdb,cn=config (line=2260) For MMR Mode, MirrorMode must be set to TRUE. If it does not accept TRUE then there is something wrong with your configuration. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

how to get list of valid attributes
by Umar Draz 18 Feb '14

18 Feb '14

HI All I want a list of valid attributes for specific objectClass e.g. I have a user abc with the dn of this user is cn=Abc User,ou=accounts,dc=mydom,dc=com the abc user has these object classes posixAccount shadowAccount OrginizatinalPerson yubikeyUser now I want to get the valid schema attribute of yubikeyUser for only the above mentioned user. Is this possible? Umar

4 3

ldapsearch error - Unknown error (60)
by Auteria W. Winzer Jr. 18 Feb '14

18 Feb '14

To the members of the mailing list, Upon a test search I'm getting the following error: $ ldapsearch -LLL -v -z none -x -e "2.16.840.1.113730.3.4.9" -h bugsbunny.bar -p 9999 -b "ou=foo,o=bar" -D "uid=xxx,ou=foo,o=bar" -w "xxxxxxxx" "(&(objectClass=groupOfUniqueNames)(displayname=*))" displayname ldap_initialize( ldap://bugsbunny.bar:9999 ) filter: (&(objectClass=groupOfUniqueNames)(displayname=*)) requesting: displayname Unknown error (60) Additional information: VLV Control When looking up the error I noticed the following: LDAP_SORT_CONTROL_MISSING - 60 (x'3C) - Unused in standards. Sun LDAP Directory Server only. Server did not receive a required server-side sorting control. Can someone that has experience with this type of LDAP search criteria assist me to obtain a final resolution? Thanks to everyone, and regards, Auteria Winzer Jr.

4 11

Sun LDAP to OpenLDAP
by Suresh Prajapati 18 Feb '14

18 Feb '14

Hi , We are migrating our infrastructure from Sun Solaris to AWS. So as a part of migration we need to do the transition from Sun Directory Server to OpenLDAP. I exported the user database in ldif file from Sun LDAP. Now I am trying to import the database in to OpenLDAP Server on Ubuntu which I've installed in AWS. While importing the database I am getting a lots of error , because the sun schema for storing the users and openldap is totally different. The issue I'm currently stuck on is getting the data in the LDIF into a format that can be imported using slapadd/ldapadd Any help would be appreciated Below are the details for Ubuntu Server and OpenLDAP Server OS : Distributor ID: Ubuntu Description: Ubuntu 10.04 LTS Release: 10.04 OpenLDAP Version : *slapd 2.4.21-0ubuntu5.7 OpenLDAP server (slapd)* Thanks Suresh

3 3

Syncrepl and mmr
by Borresen, John - 0442 - MITLL 18 Feb '14

18 Feb '14

All, The following are excerpts from my multi-master logs and at the end are the cn=config dbase for both systems. I can see that communications are being attempted, but not succeeding. The other day, entries were added to "cn=role2,ou=sudoers,dc=example,dc=ldap" to the Syncrepl... I have opened up my ACLs (may not be reflected in the cn=config below) for "uid=replicator,ou=Admins,dc=example,dc=ldap" and "cn=ldapadmin,dc=example,dc=ldap". The replicator account is the rootDN for /var/lib/openldap/accesslog with read privs on olcDatabase={1}bdb (primary dbase). The ldapadmin account is the rootDN for the olcDatabase={1}bdb and full write privs on the accesslog dbase. The olcSyncRepl rids are authenticating to ldapadmin (I removed the binding to replicator for troubleshooting -- alas no affect). I am hoping some other eyes can see where my mistake(s) are and point me in the correct direction. Honestly, I am not even sure where to start asking questions. If I read the ACLs sections correctly (both in the Admin Guide and man-page), the rootDNs are granted full read/write everywhere privs by default to their respective Databases. So, with that logic I shouldn't have to put the "replicator" in the olcAccess for olcDataBase={2}bdb (accesslog dbase)...only the ldapadmin account should have an entry. Correct? And, I shouldn't have to put the ldapadmin account in the olcAccess for the olcDatabase={1}bdb (primary dbase). Correct? What am I missing? And where? MM-SERVER1: 52fce402 PRESENT 52fce402 => access_allowed: search access to "reqStart=20140211203819.000000Z,cn=accesslog" "objectClass" requested 52fce402 => acl_get: [1] attr objectClass 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "objectClass" requested 52fce402 => acl_mask: to all values by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: search access granted by write(=wrscxd) 52fce402 => access_allowed: search access granted by write(=wrscxd) 52fce402 <= test_filter 6 52fce402 => send_search_entry: conn 2109 dn="reqStart=20140211203819.000000Z,cn=accesslog" 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entry" requested 52fce402 => acl_get: [1] attr entry 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entry" requested 52fce402 => acl_mask: to all values by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result not in cache (reqType) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqType" requested 52fce402 => acl_get: [1] attr reqType 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqType" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result not in cache (reqDN) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqDN" requested 52fce402 => acl_get: [1] attr reqDN 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqDN" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result not in cache (reqMod) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "reqMod" requested 52fce402 => acl_get: [1] attr reqMod 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "reqMod" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: result was in cache (reqMod) 52fce402 => access_allowed: result was in cache (reqMod) 52fce402 => access_allowed: result was in cache (reqMod) 52fce402 => access_allowed: result not in cache (entryCSN) 52fce402 => access_allowed: read access to "reqStart=20140211203819.000000Z,cn=accesslog" "entryCSN" requested 52fce402 => acl_get: [1] attr entryCSN 52fce402 => acl_mask: access to entry "reqStart=20140211203819.000000Z,cn=accesslog", attr "entryCSN" requested 52fce402 => acl_mask: to value by "cn=ldapadmin,dc=example,dc=ldap", (=0) 52fce402 <= check a_dn_pat: uid=replicator,ou=admins,dc=example,dc=ldap 52fce402 <= check a_dn_pat: cn=ldapadmin,dc=example,dc=ldap 52fce402 <= acl_mask: [2] applying write(=wrscxd) (stop) 52fce402 <= acl_mask: [2] mask: write(=wrscxd) 52fce402 => slap_access_allowed: read access granted by write(=wrscxd) 52fce402 => access_allowed: read access granted by write(=wrscxd) 52fce402 conn=2109 op=1 ENTRY dn="reqStart=20140211203819Z,cn=accesslog" MM-SERVER2: 52fce47a =>do_syncrep2 rid=001 ldap_result ld 0x97b3ed0 msgid 2 wait4msg ld 0x97b3ed0 msgid 2 (infinite timeout) wait4msg continue ld 0x97b3ed0 msgid 2 all 0 ** ld 0x97b3ed0 Connections: * host: mm-server1.example.ldap port: 389 (default) refcnt: 2 status: Connected last used: Thu Feb 13 10:27:54 2014 ** ld 0x97b3ed0 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x97b3ed0 request count 1 (abandoned 0) ** ld 0x97b3ed0 Response Queue: Empty ld 0x97b3ed0 response count 0 ldap_chkResponseList ld 0x97b3ed0 msgid 2 all 0 ldap_chkResponseList returns ld 0x97b3ed0 NULL ldap_int_select read1msg: ld 0x97b3ed0 msgid 2 all 0 ber_get_next ldap_read: want=8, got=8 0000: 30 81 b2 02 01 02 64 48 0.....dH ldap_read: want=173, got=173 0000: 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 30 38 ..cn=accesslog08 0010: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0020: 32 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 20140203183831.7 0030: 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 51838Z#000000#00 0040: 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 31 2e 1#000000.c0a..1. 0050: 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 3.6.1.4.1.4203.1 0060: 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 00 04 .9.1.2.E0C...... 0070: 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 30 31 <rid=001,sid=001 0080: 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 38 33 ,csn=20140203183 0090: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 00a0: 30 30 23 30 30 31 23 30 30 30 30 30 30 00#001#000000 ber_get_next: tag 0x30 len 178 contents: ber_dump: buf=0x9764590 ptr=0x9764590 end=0x9764642 len=178 0000: 02 01 02 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 ...dH..cn=access 0010: 6c 6f 67 30 38 30 36 04 08 65 6e 74 72 79 43 53 log0806..entryCS 0020: 4e 31 2a 04 28 32 30 31 34 30 32 30 33 31 38 33 N1*.(20140203183 0030: 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 30 30 831.751838Z#0000 0040: 30 30 23 30 30 31 23 30 30 30 30 30 30 a0 63 30 00#001#000000.c0 0050: 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 a..1.3.6.1.4.1.4 0060: 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 203.1.9.1.2.E0C. 0070: 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 .....<rid=001,si 0080: 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 d=001,csn=201402 0090: 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 5a 03183831.751838Z 00a0: 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 30 #000000#001#0000 00b0: 30 30 00 read1msg: ld 0x97b3ed0 msgid 2 message type search-entry ber_scanf fmt ({xx) ber: ber_dump: buf=0x9764590 ptr=0x9764593 end=0x9764642 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({a) ber: ber_dump: buf=0x9764590 ptr=0x97645df end=0x9764642 len=99 0000: 30 61 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0a..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 32 04 45 30 43 4203.1.9.1.2.E0C 0020: 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 2c 73 ......<rid=001,s 0030: 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 34 30 id=001,csn=20140 0040: 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 33 38 203183831.751838 0050: 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 30 30 Z#000000#001#000 0060: 30 30 30 000 ber_scanf fmt (o) ber: ber_dump: buf=0x9764590 ptr=0x97645fb end=0x9764642 len=71 0000: 04 45 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 .E0C......<rid=0 0010: 30 31 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 01,sid=001,csn=2 0020: 30 31 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 0140203183831.75 0030: 31 38 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 1838Z#000000#001 0040: 23 30 30 30 30 30 30 #000000 ldap_get_dn_ber ber_scanf fmt ({ml{) ber: ber_dump: buf=0x9764590 ptr=0x9764593 end=0x9764642 len=175 0000: 64 48 04 0c 63 6e 3d 61 63 63 65 73 73 6c 6f 67 dH..cn=accesslog 0010: 30 38 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 0806..entryCSN1* 0020: 04 28 32 30 31 34 30 32 30 33 31 38 33 38 33 31 .(20140203183831 0030: 2e 37 35 31 38 33 38 5a 23 30 30 30 30 30 30 23 .751838Z#000000# 0040: 30 30 31 23 30 30 30 30 30 30 a0 63 30 61 04 18 001#000000.c0a.. 0050: 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 1.3.6.1.4.1.4203 0060: 2e 31 2e 39 2e 31 2e 32 04 45 30 43 0a 01 01 04 .1.9.1.2.E0C.... 0070: 00 04 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 ..<rid=001,sid=0 0080: 30 31 2c 63 73 6e 3d 32 30 31 34 30 32 30 33 31 01,csn=201402031 0090: 38 33 38 33 31 2e 37 35 31 38 33 38 5a 23 30 30 83831.751838Z#00 00a0: 30 30 30 30 23 30 30 31 23 30 30 30 30 30 30 0000#001#000000 ber_scanf fmt ({em) ber: ber_dump: buf=0x950b980 ptr=0x950b980 end=0x950b9c5 len=69 0000: 30 43 0a 01 01 04 00 04 3c 72 69 64 3d 30 30 31 0C......<rid=001 0010: 2c 73 69 64 3d 30 30 31 2c 63 73 6e 3d 32 30 31 ,sid=001,csn=201 0020: 34 30 32 30 33 31 38 33 38 33 31 2e 37 35 31 38 40203183831.7518 0030: 33 38 5a 23 30 30 30 30 30 30 23 30 30 31 23 30 38Z#000000#001#0 0040: 30 30 30 30 30 00000 52fce47a do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD (cn=accesslog) ldap_msgfree ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 17 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed 52fce47a do_syncrepl: rid=001 rc -1 retrying 52fce47a daemon: activity on 1 descriptor 52fce47a daemon: activity on:52fce47a 52fce47a daemon: epoll: listen=7 active_threads=0 tvp=zero MM-SERVER2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 1b256f1e-2f15-4538-8a6f-5b021d015e35 creatorsName: cn=config createTimestamp: 20140122200748Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211613.134974Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211613Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: 1191cf8f-8d46-4f2e-8aba-e65537210029 creatorsName: cn=admin,cn=config createTimestamp: 20140129175231Z entryCSN: 20140129175429.232704Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129175429Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 77451682-9629-4753-9a80-5cc0e69a7482 creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: d7f25d3b-7ad1-4625-a577-a23a22b5494d creatorsName: cn=config createTimestamp: 20140122200748Z entryCSN: 20140122200748.381523Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140122200748Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 5a87b5f1-c445-4e0e-ba97-6d2d63093704 creatorsName: cn=config createTimestamp: 20140122200748Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=simple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" read by * none olcAccess: {1}to * by * read entryCSN: 20140203200931.503493Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203200931Z dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 04afe1bf-40c7-425a-8b25-74f8687323fc creatorsName: cn=admin,cn=config createTimestamp: 20140129180447Z entryCSN: 20140129180447.701059Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180447Z dn: olcOverlay={1}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 54b5fa00-8244-41d3-923d-0743a10bf192 creatorsName: cn=admin,cn=config createTimestamp: 20140129180903Z entryCSN: 20140129180903.479192Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180903Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: ff63820b-fbe4-4a65-8c00-99e2cc28fca5 creatorsName: cn=admin,cn=config createTimestamp: 20140129175923Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190415.581904Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190415Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9246709d-7a9b-41f3-bca8-f665add4e4f2 creatorsName: cn=admin,cn=config createTimestamp: 20140129180331Z entryCSN: 20140129180331.702641Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129180331Z MM-SERVER2: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcArgsFile: /var/lib/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcListenerThreads: 1 olcLocalSSF: 71 olcPidFile: /var/lib/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcTLSProtocolMin: 0.0 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 84a58742-a1ce-4714-a743-14daf3f40c75 creatorsName: cn=config createTimestamp: 20131218155313Z olcLogLevel: stats olcSecurity: tls=0 olcServerID: 1 ldap://mm-server1.example.ldap olcServerID: 2 ldap://mm-server2.example.ldap entryCSN: 20140131211906.564734Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140131211906Z contextCSN: 20140206183618.370299Z#000000#002#000000 contextCSN: 20140121211615.993780Z#000000#004#000000 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov olcModuleLoad: {1}accesslog structuralObjectClass: olcModuleList entryUUID: ab2c7f52-e10f-4233-aa17-ac8b051defcf creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z entryCSN: 20140129182642.147840Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182642Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by self write by users read by anonymous auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 46ec808c-285f-442f-8c70-d5bb8c2d39de creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=example,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=example,dc=ldap olcRootPW:: <password> olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/openldap/openldap-data olcDbCacheSize: 1000 olcDbConfig: {0}# $OpenLDAP$ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}#set_cachesize 0 268435456 1 olcDbConfig: {17}set_cachesize 0 2147483648 1 olcDbConfig: {18} olcDbConfig: {19}# Data Directory olcDbConfig: {20}#set_data_dir db olcDbConfig: {21} olcDbConfig: {22}# Archive/deletion olcDbConfig: {23}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {24} olcDbConfig: {25}# Transaction Log settings olcDbConfig: {26}set_lg_regionmax 262144 olcDbConfig: {27}set_lg_bsize 2097152 olcDbConfig: {28}#set_lg_dir logs olcDbConfig: {29} olcDbConfig: {30}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezMxfSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: sn eq,sub olcDbIndex: departmentNumber eq olcDbIndex: mail eq,sub olcDbIndex: automountKey eq olcDbIndex: memberUid eq olcDbIndex: printerURI eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 94ff450b-aa70-4507-9ca6-51cdd740ea3e creatorsName: cn=config createTimestamp: 20131218155313Z olcMirrorMode: TRUE olcLimits: {0}dn.exact="cn=ldapadmin,dc=example,dc=ldap" size=unlimited time=u nlimited olcSyncrepl: {0}rid=001 provider=ldap://mm-server1.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcSyncrepl: {1}rid=002 provider=ldap://mm-server2.example.ldap bindmethod=si mple binddn="uid=replicator,ou=Admins,dc=example,dc=ldap" credentials=<password> interval=01:00:00:00 searchbase="dc=example,dc=ldap" logbase="cn=accesslog" schemachecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs="*,+" syncdata=accesslog starttls=no olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn.exact="cn=ldapadmin,dc=example,dc=ldap" write by dn.exact="uid=r eplicator,ou=Admins,dc=example,dc=ldap" read olcAccess: {1}to * by * read entryCSN: 20140206183618.370299Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140206183618Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {0}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 6e4e1508-5eb9-4372-bbd1-813f859b0acc creatorsName: cn=admin,cn=config createTimestamp: 20140129182321Z entryCSN: 20140129182321.004272Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182321Z dn: olcOverlay={1}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 9108e0db-ba9e-4b40-b743-4016c61582bc creatorsName: cn=admin,cn=config createTimestamp: 20140129183014Z entryCSN: 20140129183014.073365Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129183014Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/openldap/accesslog olcSuffix: cn=accesslog olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: 9b42a346-de9b-42d5-8a3b-3167f80d4b01 creatorsName: cn=admin,cn=config createTimestamp: 20140129182320Z olcAccess: {0}to * by dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" w rite by * none olcLimits: {0}dn.exact="uid=replicator,ou=Admins,dc=example,dc=ldap" time.soft =unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcRootDN: uid=replicator,ou=Admins,dc=example,dc=ldap entryCSN: 20140203190210.968231Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140203190210Z dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 0366206b-4295-4463-952c-0b233646c24d creatorsName: cn=admin,cn=config createTimestamp: 20140129182831Z entryCSN: 20140129182831.866738Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140129182831Z dn: olcDatabase={3}monitor,cn=config objectClass: olcDatabaseConfig olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admin,cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig entryUUID: 691d6dfc-82af-4e12-8f03-be93d5d5436b creatorsName: cn=admin,cn=config createTimestamp: 20140114170424Z entryCSN: 20140114170424.436842Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140114170424Z olcDatabase: {3}monitor Thanks in advance, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu

2 5

LMDB: transactions across dbis, dbi lifetime
by Martin Lucina 18 Feb '14

18 Feb '14

Hi, I'm having trouble understanding the interaction between txns and dbis in LMDB. Quoting from the docs for mdb_dbi_open(): The database handle will be private to the current transaction until the transaction is successfully committed. If the transaction is aborted the handle will be closed automatically. After a successful commit the handle will reside in the shared environment, and may be used by other transactions. This function must not be called from multiple concurrent transactions. A transaction that uses this function must finish (either commit or abort) before any other transaction may use this function. 1. Is it legal to: a. begin a txn b. open a bunch of dbis in that txn. c. perform some operations (get/put) on distinct dbis. d. commit the txn. In other words, may a txn span multiple dbis? 2. AFTER the initial transaction in which mdb_dbi_open() was called has been committed, can I freely use the dbi in subsequent transactions? I.e. stash it away in a static variable? 3. Is the dbi still valid if a subsequent transaction on it is aborted with mdb_txn_abort()? The first part of the quoted paragraph suggests not...? I have tested at least points 1. and 2. above and "it seems to work" but I'd like to verify that this is actually expected usage. I've not particularly tested for point 3. but it would make programming to the API rather hard if I had to reopen dbis whenever a higher level operation fails. Martin

2 2

Use the current date/timestamp in filters
by Laurent Meunier 16 Feb '14

16 Feb '14

Hi, I'm trying to build a ldap query with the current date or the current timestamp (something like myAttributeDate >= now()). All solutions I've found on Internet require to compute the current date in a script and then build the ldap query with the computed date. Unfortunately, I can't do this because the ldap query will be in a static file: ldap_filter in /etc/saslauthd.conf. Is it possible with OpenLDAP to use the current date or timestamp in a ldap query without compute it in a script? Thanks. -- Laurent Meunier <laurent(a)deltalima.net>

4 5

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2014