openldap-technical February 2016

openldap-technical@openldap.org

56 participants
68 discussions

Problem with "force user to password reset at first login
by Rajagopal Rc 30 Oct '23

30 Oct '23

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 9

slapd-meta
by Fr3ddie 07 Nov '16

07 Nov '16

Hello to the list, I'm trying to configure the slapd-meta OpenLDAP backend on an online cn=config configuration with no luck. Slapd version is 2.4.39 (the maximum I can achieve on the target machines building from vanilla source). The documentation is clear but too concise for me so I will try to explain what I'm trying to do to see if there is anybody that can help me. Currently I have 3 slapd servers that share a common root for the DIT, i.e.: dc=loc1,dc=root dc=loc2,dc=root dc=loc3,dc=root What I would like to achieve is to obtain a fourth server that contains the previous trees, along with its own tree, i.e. a server that contains: dc=loc0,dc=root (locally hosted data) dc=loc1,dc=root (coming from the first server, chasing referrals) dc=loc2,dc=root (coming from the second server, chasing referrals) dc=loc3,dc=root (coming from the third server, chasing referrals) this way, all the clients connecting to this server will be able to retrieve data also from the other three remote servers. As far as I understood, I only need to configure the "loc0" server to access the other three servers and get the data to serve to clients. I have already configured the fourth server with its local DIT and this is the configuration: # cat 'cn=config.ldif' dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid structuralObjectClass: olcGlobal creatorsName: cn=config olcServerID: 1 olcThreads: 32 olcToolThreads: 8 olcRequires: LDAPv3 olcConnMaxPendingAuth: 100 olcTLSCACertificateFile: /etc/ssl/certs/my_ca_cert.pem olcTLSCertificateFile: /etc/ssl/certs/this-host_x509_cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/this-host_x509_key.key olcTLSVerifyClient: try olcTimeLimit: 600 olcLogLevel: stats2 sync [...] # cat 'cn=module{0}.ldif' dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}accesslog structuralObjectClass: olcModuleList [...] Schema files are the following: cn={0}core.ldif cn={1}cosine.ldif cn={2}nis.ldif cn={3}inetorgperson.ldif cn={4}dyngroup.ldif cn={5}kerberos.ldif # cat 'olcDatabase={1}hdb.ldif' dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=loc0,dc=root olcAccess: {0}to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn =admin,dc=loc0,dc=root" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=loc0,dc=root" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=loc0,dc=root olcRootPW:: xxxxxxxxxxxxxxxxxxxx olcDbCacheSize: 10000 olcDbCheckpoint: 512 10 olcDbConfig: {0}set_cachesize 0 524288000 1 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbConfig: {4}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 30000 olcDbIndex: default pres,eq [...] structuralObjectClass: olcHdbConfig olcSyncrepl: {0}rid=0 provider=ldap://second-host.loc0.root bindmethod=s imple binddn="cn=admin,dc=loc0,dc=root" credentials=xxxxxx searchbase="dc=loc0,dc=root" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObj ect)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syn cdata=accesslog starttls=yes olcMirrorMode: TRUE [...] On top of this DB I have the "syncprov" and the "accesslog" overlays configured (these are two servers in "MirrorMode", configured following the OpenLDAP admin documentation). I believe this DB is the ones containing the actual "loc0" DIT data... Then I have the accesslog DB for the replica (with the syncprov overlay on top): # cat 'olcDatabase={2}hdb.ldif' dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=loc0,dc=root olcDbConfig: {0}set_cachesize 0 524288000 1 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbConfig: {4}set_flags DB_LOG_AUTOREMOVE olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart [...] On top of this environment I start loading the needed modules with this LDIF file: version: 1 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: back_ldap - add: olcModuleLoad olcModuleLoad: back_meta - add: olcModuleLoad olcModuleLoad: rwm and it seems I'm able to load the new modules without errors into the configuration, thus I obtain: # cat 'cn=module{0}.ldif' dn: cn=module{0} structuralObjectClass: olcModuleList objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}accesslog olcModuleLoad: {3}back_ldap olcModuleLoad: {4}back_meta olcModuleLoad: {5}rwm [...] Now I try to load the slapd-meta directives into a new database using this LDIF: version: 1 dn: olcDatabase={3}meta,cn=config objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: {3}meta olcSuffix: dc=root olcDbURI: "ldap://server-loc1.loc1.root/dc=loc1,dc=root" olcDbIdAssertBind: bindmethod=simple binddn="cn=admin,dc=loc1,dc=root" credentials=xxxxxx starttls=yes tls_reqcert=demand olcDbURI: "ldap://server-loc2.loc2.root/dc=loc2,dc=root" olcDbIdAssertBind: bindmethod=simple binddn="cn=admin,dc=loc2,dc=root" credentials=xxxxxx starttls=yes tls_reqcert=demand olcDbURI: "ldap://server-loc3.loc3.root/dc=loc3,dc=root" olcDbIdAssertBind: bindmethod=simple binddn="cn=admin,dc=loc3,dc=root" credentials=xxxxxx starttls=yes tls_reqcert=demand but I obtain an error that sticks me trying various combinations without success: # ldapadd -Y EXTERNAL -H ldapi:/// -f slapd-META-DB-CREATION.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcDatabase={3}meta,cn=config" ldap_add: Object class violation (65) additional info: attribute 'olcDbURI' not allowed and: # tail /var/log/openldap/slapd.log Nov 9 19:47:17 server01 slapd[32392]: conn=1025 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:47:29 server01 slapd[32392]: conn=1052 op=2 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Nov 9 19:49:47 server01 slapd[32392]: conn=1327 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:52:17 server01 slapd[32392]: conn=1628 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:54:46 server01 slapd[32392]: conn=1929 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:57:07 server01 slapd[32392]: Entry (olcDatabase={3}meta,cn=config), attribute 'olcDbURI' not allowed Into the slapd-meta documentation the "URI" directive is mentioned but the "DbURI" seems to raise a "better error", in fact if I try to modify the above LDIF file using "URI" I obtain: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcDatabase={3}meta,cn=config" ldap_add: Undefined attribute type (17) additional info: olcUri: attribute type undefined Moreover, it is not stated into the slapd-meta docs that the slapd-ldap backend is needed by slapd-meta but, anyway, I think its needed because if I try to load the slapd-meta alone it raises an error (I don't remember exactly which one). At this point I'm stuck to this error and I wasn't able to find any hint on the web to solve this :( The examples I was able to find were related with the static slapd.conf configuration, I counldn't find any "full" configuration example using the cn=config. I'm wondering if I should create a "cn=root" actual DB first and then link the sub-DITs to it, or, maybe, add some other overlay... I really can't understand how it should work :( Can please anybody help me? Thank you very much

3 9

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

storing HA1 password hash for HTTP DIGEST, SIP, TURN
by Daniel Pocock 06 Mar '16

06 Mar '16

Hi all, There are a few protocols that use a HA1[1] password hash, such as HTTP DIGEST[1], SIP DIGEST[2] and TURN[3] (which uses HMAC rather than DIGEST) Is there a standard LDAP attribute name for storing a HA1 value or should it be stored in a regular userPassword attribute as described in the manual[4]? I came across smbk5pwd for keeping SMB password attributes in sync. Is there a similar facility for keeping HA1 passwords in sync when a user changes the password or how could a developer go about adding that, would the smbk5pwd source be a useful model? Regards, Daniel 1. http://tools.ietf.org/html/rfc2617#section-3 2. https://tools.ietf.org/html/rfc3261#section-22.4 3. https://tools.ietf.org/html/rfc5389#section-15.4 4. http://www.openldap.org/doc/admin24/security.html#Password%20Storage

3 5

O: Oracle/SAP and LDAP connections
by Ulrich Windl 25 Feb '16

25 Feb '16

Hi! I noticed that one of our servers running SAP Solution Manager with Oracle has more than 70 established connections to one of our LDAP servers. According to lsof most connections belong to Oracle processes; each process seems to have its own connection: oracle 8447 oracsm 10u IPv4 16950 0t0 TCP 172.20.16.33:42599->172.20.17.200:ldap oracle 8449 oracsm 10u IPv4 16964 0t0 TCP 172.20.16.33:42699->172.20.17.200:ldap oracle 8451 oracsm 10u IPv4 16979 0t0 TCP 172.20.16.33:42799->172.20.17.200:ldap oracle 8453 oracsm 10u IPv4 16994 0t0 TCP 172.20.16.33:42843->172.20.17.200:ldap oracle 8455 oracsm 10u IPv4 17009 0t0 TCP 172.20.16.33:42899->172.20.17.200:ldap oracle 8457 oracsm 10u IPv4 17024 0t0 TCP 172.20.16.33:42999->172.20.17.200:ldap oracle 8465 oracsm 10u IPv4 17106 0t0 TCP 172.20.16.33:43499->172.20.17.200:ldap oracle 8467 oracsm 10u IPv4 17120 0t0 TCP 172.20.16.33:43532->172.20.17.200:ldap oracle 8469 oracsm 10u IPv4 17122 0t0 TCP 172.20.16.33:43599->172.20.17.200:ldap oracle 8471 oracsm 10u IPv4 17123 0t0 TCP 172.20.16.33:43699->172.20.17.200:ldap oracle 8478 oracsm 10u IPv4 17127 0t0 TCP 172.20.16.33:43899->172.20.17.200:ldap oracle 10172 oracsm 10u IPv4 18911 0t0 TCP 172.20.16.33:45598->172.20.17.200:ldap oracle 10197 oracsm 10u IPv4 18920 0t0 TCP 172.20.16.33:45599->172.20.17.200:ldap CSM_70_BT 10412 csmadm 5u IPv4 1348471 0t0 TCP 172.20.16.33:60332->172.20.17.200:ldap sapstarts 11352 csmadm 8u IPv4 20890 0t0 TCP 172.20.16.33:45799->172.20.17.200:ldap ms.sapCSM 11698 csmadm 6u IPv4 21277 0t0 TCP 172.20.16.33:48199->172.20.17.200:ldap CSM_70_DP 11699 csmadm 5u IPv4 21424 0t0 TCP 172.20.16.33:48299->172.20.17.200:ldap gwrd 11737 csmadm 9u IPv4 21480 0t0 TCP 172.20.16.33:48354->172.20.17.200:ldap icman 11738 csmadm 10u IPv4 23751 0t0 TCP 172.20.16.33:48399->172.20.17.200:ldap CSM_70_DI 11740 csmadm 5u IPv4 23815 0t0 TCP 172.20.16.33:48699->172.20.17.200:ldap CSM_70_DI 11741 csmadm 5u IPv4 23801 0t0 TCP 172.20.16.33:48499->172.20.17.200:ldap CSM_70_DI 11742 csmadm 5u IPv4 23806 0t0 TCP 172.20.16.33:48599->172.20.17.200:ldap CSM_70_DI 11743 csmadm 5u IPv4 23817 0t0 TCP 172.20.16.33:48899->172.20.17.200:ldap CSM_70_DI 11744 csmadm 5u IPv4 23816 0t0 TCP 172.20.16.33:48799->172.20.17.200:ldap CSM_70_DI 11745 csmadm 5u IPv4 19863 0t0 TCP 172.20.16.33:55488->172.20.17.200:ldap CSM_70_DI 11746 csmadm 5u IPv4 19856 0t0 TCP 172.20.16.33:55484->172.20.17.200:ldap CSM_70_DI 11747 csmadm 5u IPv4 19900 0t0 TCP 172.20.16.33:55498->172.20.17.200:ldap CSM_70_DI 11748 csmadm 5u IPv4 19880 0t0 TCP 172.20.16.33:55493->172.20.17.200:ldap CSM_70_DI 11749 csmadm 5u IPv4 19878 0t0 TCP 172.20.16.33:55489->172.20.17.200:ldap CSM_70_UP 11750 csmadm 5u IPv4 19862 0t0 TCP 172.20.16.33:55487->172.20.17.200:ldap CSM_70_EN 11751 csmadm 5u IPv4 19889 0t0 TCP 172.20.16.33:55494->172.20.17.200:ldap CSM_70_SP 11755 csmadm 5u IPv4 23865 0t0 TCP 172.20.16.33:51634->172.20.17.200:ldap CSM_70_UP 11756 csmadm 5u IPv4 19941 0t0 TCP 172.20.16.33:55522->172.20.17.200:ldap oracle 11778 oracsm 7u IPv4 23927 0t0 TCP 172.20.16.33:55477->172.20.17.200:ldap oracle 11780 oracsm 7u IPv4 23943 0t0 TCP 172.20.16.33:55478->172.20.17.200:ldap oracle 11782 oracsm 7u IPv4 23983 0t0 TCP 172.20.16.33:55482->172.20.17.200:ldap oracle 11784 oracsm 7u IPv4 23981 0t0 TCP 172.20.16.33:55479->172.20.17.200:ldap oracle 11786 oracsm 7u IPv4 23984 0t0 TCP 172.20.16.33:55483->172.20.17.200:ldap oracle 11792 oracsm 7u IPv4 19879 0t0 TCP 172.20.16.33:55492->172.20.17.200:ldap oracle 11794 oracsm 7u IPv4 19959 0t0 TCP 172.20.16.33:55524->172.20.17.200:ldap oracle 11797 oracsm 7u IPv4 24100 0t0 TCP 172.20.16.33:55538->172.20.17.200:ldap oracle 11800 oracsm 7u IPv4 19990 0t0 TCP 172.20.16.33:55528->172.20.17.200:ldap oracle 11807 oracsm 7u IPv4 20023 0t0 TCP 172.20.16.33:55532->172.20.17.200:ldap oracle 11810 oracsm 7u IPv4 20059 0t0 TCP 172.20.16.33:55533->172.20.17.200:ldap oracle 11813 oracsm 7u IPv4 20062 0t0 TCP 172.20.16.33:55534->172.20.17.200:ldap oracle 11815 oracsm 7u IPv4 20064 0t0 TCP 172.20.16.33:55537->172.20.17.200:ldap oracle 11820 oracsm 7u IPv4 20081 0t0 TCP 172.20.16.33:55539->172.20.17.200:ldap CSM_70_BT 11963 csmadm 5u IPv4 1355947 0t0 TCP 172.20.16.33:61710->172.20.17.200:ldap sapstarts 14502 csmadm 8u IPv4 26768 0t0 TCP 172.20.16.33:57594->172.20.17.200:ldap ms.sapCSM 14870 csmadm 6u IPv4 27174 0t0 TCP 172.20.16.33:57659->172.20.17.200:ldap en.sapCSM 14871 csmadm 9u IPv4 27215 0t0 TCP 172.20.16.33:58272->172.20.17.200:ldap oracle 14882 oracsm 10u IPv4 27217 0t0 TCP 172.20.16.33:58273->172.20.17.200:ldap jlaunch 14890 csmadm 14u IPv4 27282 0t0 TCP 172.20.16.33:58283->172.20.17.200:ldap jlaunch 14891 csmadm 14u IPv4 27688 0t0 TCP 172.20.16.33:58284->172.20.17.200:ldap jlaunch 14892 csmadm 14u IPv4 27678 0t0 TCP 172.20.16.33:58282->172.20.17.200:ldap nscd 15591 root 13u IPv4 28333 0t0 TCP 172.20.16.33:60503->172.20.17.200:ldap CSM_70_BT 31006 csmadm 5u IPv4 1293312 0t0 TCP 172.20.16.33:63365->172.20.17.200:ldap Other machines (running the same OS and SAP also) just have one connection established to an LDAP server. Does anybody know why Oracle uses that many connections, and possibly whether there is a configurable parameter to avoid that many connections. Regards, Ulrich

1 0

LMDB compiler warning
by John GM44 24 Feb '16

24 Feb '16

Hello.. First, thank you for the effort to provide LMDB to the community. I'm compiling LMDB 0.9.17 using msvc2013 x64 and it compiled successfully with only one warning: mdb.c(7224): warning C4333: '>>' : right shift by too large amount, data loss. Is this something I need to correct and if so, how would I go about it please? Thank you, John

3 2

PasswordHash
by Borresen, John - 0444 - MITLL 24 Feb '16

24 Feb '16

All, I found Quanah's response to a post (http://www.openldap.org/lists/openldap-devel/201411/msg00012.html), which brought up a question(s). 1) I have the olcModule pw-sha2.la loaded in "cn=module{0},cn=config" 2) Looking at Quanahs reply, in the link above, he states: now, if you want to make something like say, SHA512 the default, then you need to modify the frontend config db: dn: olcDatabase={-1},cn=config changetype: modify replace: olcPasswordHash olcPasswordHash: {SSHA512} Now, if I add, something like the above, and the current olcRootPW attribute shows {SSHA}, is that going to modify current password hashes or only going forward? I tried the above, on cn=config, but received the following error "According to the schema attribute olcPasswordHash is not allowed" Thanks in advance, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 4

Re: LDIF?
by Quanah Gibson-Mount 24 Feb '16

24 Feb '16

--On Wednesday, February 24, 2016 12:50 AM +0100 Emmanuel Lécharny <elecharny(a)gmail.com> wrote: >> > No to mention there is a missing dc Attribute in the entry. Good point. It's unlikely the author meant to combine the two objectClasses. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

2 1

Re: Regarding lmdb
by Howard Chu 24 Feb '16

24 Feb '16

Hor Meng Yoong wrote: > Dear Howard > > Thank you for your great effort in creating lmdb. > > I am looking a solution that can sync multiple lmdb slaves to one lmdb master. > Changes from the each lmdb slave are also updated to other lmdb slaves via the > lmdb master. > > Any up-to-date, up-and-running lmdb slaves can vote among themsleves to become > he next master in the event that the master fails. To prevent islanding and > multiple masters, vote is only allowed if there are at least a minimum numbers > (configurable) of interconnected lmdb slaves. > > To improve efficiency, data protection, a master table inside the lmdb master > decides which lmdb slaves should be updated, such as frequency of update, > tables to be updated. Drastic database operation (e.g., table creation and > deletion) shall only be initiated from he master. > > Bases on current design architecture and future design plan, what is the best > way for this to be implemented. Replication is a non-goal for LMDB. In OpenLDAP we already have a multimaster replication protocol built on LDAP; we don't need replication in the database engine. Projects that aim to build replication as an LMDB feature are misguided. An embedded database engine's only job is to store and retrieve bytes using local storage. Nothing else. What you're talking about belongs at a higher abstraction layer and has nothing to do with the DB engine. Whatever system you are trying to design is orthogonal to the storage engine. I suggest you look into Dynomite using memcacheDB. http://techblog.netflix.com/2014/11/introducing-dynomite.html https://github.com/LMDB/memcachedb Note that any time you start dealing with network services, you immediately incur the need for authentication, authorization, and privacy controls. Please don't be like the rest of the NoSQL crowd and only realize this after the fact. You will need a proper network protocol, one that's designed to be efficient and secure. You'll also need a decent data model for serializing data over the wire. Most of what you'll need has already been invented and formalized in a spec - we call it LDAP. > Besr regards > Hor Meng > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

How to monitor and test write ldap?
by jupiter 24 Feb '16

24 Feb '16

Hi, I am setting a nagios scripts to monitor the LDAP server. While I can run ldapsearch to check and read data from LDAP, I also want to write dummy data to LDAP database to make sure both read / write are functional well. What is the proper way to run come command in nagios script to write dummy data to LDAP? Or if you have good solution to check write process? Thank you. Kind regards, - jupiter

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2016