openldap-technical February 2014

openldap-technical@openldap.org

85 participants
90 discussions

OpenLDAP slapd problems - ldap_result: Can't contact LDAP server (-1) --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 04 Feb '14

04 Feb '14

Low Sensitivity/Aerospace Internal Use Only Working on a CentOS-6.5 server, running LTB Project's slapd-2.4.38. Someone suggested I implement a cn=admin,cn=config for a cn=config setup. (I don't know how to technically word that). Anyway, I need to make TLS-related changes and was told to do the following command: ldapmodify -x -D "cn=admin,cn=config" -W -d 256 ...then at the blank line type the following, each on a single line: Dn: cn=config Changetype: modify Add: olcTLSCipherSuite OlcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3 <CTRL-D> I have been getting an error reponse of: ldap_result: Can't contact LDAP server (-1) This __ONLY__ occurs after I hit <CTRL-D>, not before. Yes, the daemon, slapd, is actually running, but after this failure it abruptly stops. I know this because in a separate terminal on the same system, I am running a while-loop with a ps -e | grep slapd in it. Please note the "-x" option according to the man page for ldapmodify is supposed to Use simple authentication instead of SASL. Thank you all for your help, hopefully you can: 1) tell me what this error means, and 2) how to fix my problem so that I can complete the olcTLSxxxx changes I need to implement. Warron French, MBA, SCSA The Aerospace Corporation Sr. UNIX SA & Storage Admin Mailstop: CH1-230 Desk: 571-307-5311 Cell: 703-967-8936 Low Sensitivity/Aerospace Internal Use Only

4 16

re: search on multimaster gives 2 different results
by Gare Calhoun 04 Feb '14

04 Feb '14

Hello, Follow-up on how I solved this issue: Dumped an ldif copy of the offending server and reloaded that server with slapadd. This corrected the autogroups on that server. We are doing a lot of programmatic additions, updates, and deletions to OpenLDAP, which could have caused the initial issue. hth someone. Gare - *To*: *openldap-technical(a)openldap.org <openldap-technical%40openldap.org>* - *Subject*: *search on multimaster gives 2 different results* - *From*: *Gare Calhoun <gcalhoun(a)antioch.edu <gcalhoun%40antioch.edu>>* - Date: Thu, 19 Dec 2013 16:56:00 -0600 ------------------------------ Hello, We are running 2 servers in multimaster mode ; openldap-2.4.35 on CentOS 6.6 using the autogroup overlay. I have a search filter (APersonCategory=*ADJ*) that returns different numbers of records when queried against each server. The actual records exist on both servers. 1 server is not returning all expected records. The other server returns records as expected. There is no index defined for this attribute in slapd.conf on either server. schema definition of attribute is same on each server: attributetype ( 1.3.6.1.4.1.5923.1.1.1.23 NAME 'APersonCategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Would someone suggest what to look at to troubleshoot this? Thank you very much for your assistance. -Gare Calhoun -- . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gare Calhoun Antioch University IT Services, Software Developer

1 0

RE: Syncrepl and mmr
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 11:03 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I saw that too...and been going through the ACLs to find where...they are > identical (albeit, so far as I have found) between the two servers. I would suggest you slapcat cn=config for each master, and do a diff of the database portion. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: Syncrepl and mmr
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 9:56 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Here is a log snippet from mm-server2: This clearly shows that access to userPassword was denied by your ACLs on MMR2. Clearly there is some difference in the ACLs stored in cn=config between MMR1 and MMR2. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 04 Feb '14

04 Feb '14

--On Tuesday, February 04, 2014 9:31 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: ># slapadd -w -q -F /usr/local/openldap/etc/openldap/slapd.d -l ># /usr/local/openldap/etc/openldap/ldif/backup/example_ldap.ldif > _#################### 100.00% eta none elapsed none fast! > Closing DB... ># /usr/local/openldap/sbin/slapindex -F ># /usr/local/openldap/etc/openldap/slapd.d Why would you run slapindex after a slapadd, given that slapadd already indexes the DB? --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

java API for SAML integration
by Jignesh Patel 04 Feb '14

04 Feb '14

We have been using SimpleSAMLphp with openldap 2.4.33. Is there any Java API available which can provide similar functionality? Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

4 4

set-based constraint for prefix
by Michael Ströder 04 Feb '14

04 Feb '14

HI! Maybe I'm overlooking something obvious... I'd like to enforce a prefix naming convention by using a set-based constraint. The idea is that 'cn' value of an entry should *start* with the 'cn' value of the superior entry and a hyphen. Example with Superior entry has 'cn: example': example-foo -> accept examplefoo -> disallow foo-bar -> disallow My problem is the "start with" since I cannot find a way to express the wildcard string in a set. The following does not work since [*] is interpreted literally so only the exact value 'example-*' is accepted: # 'cn' has to use superior entry's 'cn' value as prefix constraint_attribute cn set "(this/-1/cn + [-] + [*] ) & this/cn" restrict="ldap:///ou=ampua??sub?(|(objectClass=mySrvGroup)(objectClass=myGroup))" Any help is appreciated. Ciao, Michael.

3 2

Re: OpenLDAP 2.4.39 available
by Clément OUDOT 04 Feb '14

04 Feb '14

2014-01-30 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.39 is now available for download as detailed on our download > page: > > http://www.openldap.org/software/download/ > > Hi, packages from LDAP Tool Box were released this morning: http://ltb-project.org/wiki/download#openldap Clément.

1 0

changing database backend
by Aleksander Dzierżanowski 04 Feb '14

04 Feb '14

Hi, Any ideas how to migrate database from back-bdb to other backend (for example mdb), while using cn=config? When using slapd.conf - flat config file - it seems to be simple task. But how to do it using cn=config? For sure it is not online operation, and any offline modifications to LDIF config files are not recommended. Regards, — Olo

4 3

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Monday, February 03, 2014 4:22 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Well...that was a "doh!" on my part. <lol> > > One last stupid question for the evening. "slapcat" created the ldif, > when slapadd-ing to the the secondary, should I remove the extra lines > (ex. entryUUID, creatorsName,createTimeStamp)? Only if your goal is to completely break replication. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2014