openldap-technical October 2017

openldap-technical@openldap.org

28 participants
75 discussions

Ensure uniqueness over multiple attributes?
by Karsten Heymann 13 Oct '17

13 Oct '17

Hi, does the unique overlay support checking multiple values for a single uniqueness check? Our clients can use emails in two attributes (think mail and mailAlias) and addresses have to be unique in regard to both fields, which means an address that is used in either of them cannot be used in any other of them. Is that possible? +Karsten

3 4

Re: [ldapmodify] multiple entries of the same attibute
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 6:06 PM +0200 richard lucassen <mailinglists(a)lucassen.org> wrote: > How do I tell ldapmodify just to delete 1 particular item with > AttributeValue=X, and not all of them? You do a delete+add, just like Dieter said. What you did in your example was a replace op. I.e., you'd do something like: dn: <whatever> changetype: modify delete: mail mail: my-value - add: mail mail: my-value --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Small tip to speed up large imports with ldapadd
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 5:44 PM +0200 Karsten Heymann <karsten.heymann(a)gmail.com> wrote: > > Hi Quanah, > > > > 2017-10-13 16:15 GMT+02:00 Quanah Gibson-Mount <quanah(a)symas.com>: > > Why not just set dbnosync option as documented in the > slapd-mdb(5)/slapd-bdb(5)/slapd-hdb(5) man pages? > > > > > I tried that as well, and it made the import faster, but at least in my > setup using eatmydata still was a *lot* faster. > > > Another option, which I didn't think about when building my test setup, > would have been to put the data directory into a ram disk during the > import and move it to disk afterwards. > > > Either way, each variant seem quite similiar with regard to what effort > they take, so I'm quite happy with my setup. If you're using back-mdb, you could play with the writemap environment flag as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Small tip to speed up large imports with ldapadd
by Karsten Heymann 13 Oct '17

13 Oct '17

Hi Quanah, 2017-10-13 16:15 GMT+02:00 Quanah Gibson-Mount <quanah(a)symas.com>: > > Why not just set dbnosync option as documented in the > slapd-mdb(5)/slapd-bdb(5)/slapd-hdb(5) man pages? > I tried that as well, and it made the import faster, but at least in my setup using eatmydata still was a *lot* faster. Another option, which I didn't think about when building my test setup, would have been to put the data directory into a ram disk during the import and move it to disk afterwards. Either way, each variant seem quite similiar with regard to what effort they take, so I'm quite happy with my setup. BR Karsten

1 0

Re: [ldapmodify]multiple entries of the same attibute
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 3:29 PM +0200 Ralf Mattes <rm(a)mh-freiburg.de> wrote: >> Is there a way to tell ldapmodify to change just a particular entry? > > A change of a single value equals a delete of that value plus an add of > the new value, doesn't it? Yes. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Small tip to speed up large imports with ldapadd
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 4:57 PM +0200 Karsten Heymann <karsten.heymann(a)gmail.com> wrote: > - I like the way ldapadd logs complete entries it failed to import, that > makes analyising the cause of the import error much simpler, after e.g. > fixing the schema I can ldapdd these error files directly again to see if > the fix works Why not just set dbnosync option as documented in the slapd-mdb(5)/slapd-bdb(5)/slapd-hdb(5) man pages? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Small tip to speed up large imports with ldapadd
by Karsten Heymann 13 Oct '17

13 Oct '17

Hi, as I am in the situation where I have to do large imports with ldapadd, I wanted to share a little tip that is saving me a lot of time and may be helpful to others too. As I don't care for data consistency *while* importing (if the import should abort, I can alway restart the process), I'm stopping the regular slapd and run it manually under the control of 'eatmydata', a little tool that LD_PRELOAD's all filesystem sync operations to noops. This has increased the speed of my import tests by several orders of magnitude. Here's my script (slightly obfuscated): systemctl stop slapd rm -f /srv/ldap/data/* systemd-run --unit=slapd-fastimport eatmydata /usr/sbin/slapd -d 0 -s 0 -h ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d sleep 2 ldapadd -Y EXTERNAL -H ldapi:/// -Q -c -S errorlog -f data.ldif systemctl stop slapd-fastimport sleep 2 systemctl start slapd grep Error: errorlog | sort | uniq -c | sort -n Best regards Karsten

2 2

Admin roles by group membership per OU
by Ervin Hegedüs 12 Oct '17

12 Oct '17

Hi, here is my scenario: dn: dc=mycompany,dc=hu dn: ou=ABC Customer,dc=mycompany,dc=hu +- dn: cn=group1abc,ou=ABC Customer,dc=mycompany,dc=hu +- dn: cn=group2abc,ou=ABC Customer,dc=mycompany,dc=hu +- dn: cn=groupabcadmin,ou=ABC Customer,dc=mycompany,dc=hu +- dn: uid=user1,ou=ABC Customer,dc=mycompany,dc=hu +- dn: uid=user2,ou=ABC Customer,dc=mycompany,dc=hu dn: ou=XYZ Customer,dc=mycompany,dc=hu +- dn: cn=group1xyz,ou=XYZ Customer,dc=mycompany,dc=hu +- dn: cn=group2xyz,ou=XYZ Customer,dc=mycompany,dc=hu +- dn: uid=user1,ou=XYZ Customer,dc=mycompany,dc=hu +- dn: uid=user2,ou=XYZ Customer,dc=mycompany,dc=hu ... the cn=groupabcadmin,ou=ABC Customer node above looks like this: dn: cn=groupabcadmin,ou=ABC Customer,dc=mycompany,dc=hu objectClass: groupOfNames cn: groupabcadmin member: uid=user1,ou=ABC Customer,dc=mycompany,dc=hu I'ld like to set up, that the all member of cn=groupabcadmin group, now the "uid=user1,ou=ABC Customer",... user can write the db (add, modify, delete) under his own OU, specially the ou=ABC Customer,dc=mycompany,dc=hu. I've found this example: http://www.openldap.org/faq/data/cache/52.html Now the config looks like this: dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mycompany,dc=hu olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcAccess: {3}to dn.children="ou=ABC Customer,dc=mycompany,dc=hu" by self write by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=mycompany,dc=hu" write by * auth olcLastMod: TRUE The uid=user1 user password is right, I can read with it from DB. But when I would like to add a new user, I've got: ldap_add: Insufficient access (50) additional info: no write access to parent and in log: Oct 11 17:03:16 open-ldap slapd[25821]: mdb_dn2entry("uid=user2,ou=abc customer,dc=mycompany,dc=hu") Oct 11 17:03:16 open-ldap slapd[25821]: => mdb_dn2id("uid=user2,ou=abc customer,dc=mycompany,dc=hu") Oct 11 17:03:16 open-ldap slapd[25821]: <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) Oct 11 17:03:16 open-ldap slapd[25821]: => mdb_entry_decode: Oct 11 17:03:16 open-ldap slapd[25821]: <= mdb_entry_decode Oct 11 17:03:16 open-ldap slapd[25821]: => access_allowed: add access to "ou=ABC Customer,dc=mycompany,dc=hu" "children" requested Oct 11 17:03:16 open-ldap slapd[25821]: => dn: [2] Oct 11 17:03:16 open-ldap slapd[25821]: => acl_get: [3] attr children Oct 11 17:03:16 open-ldap slapd[25821]: => acl_mask: access to entry "ou=ABC Customer,dc=mycompany,dc=hu", attr "children" requested Oct 11 17:03:16 open-ldap slapd[25821]: => acl_mask: to all values by "uid=user1,ou=abc customer,dc=mycompany,dc=hu", (=0) Oct 11 17:03:16 open-ldap slapd[25821]: <= check a_dn_pat: * Oct 11 17:03:16 open-ldap slapd[25821]: <= acl_mask: [1] applying read(=rscxd) (stop) Oct 11 17:03:16 open-ldap slapd[25821]: <= acl_mask: [1] mask: read(=rscxd) Oct 11 17:03:16 open-ldap slapd[25821]: => slap_access_allowed: add access denied by read(=rscxd) Oct 11 17:03:16 open-ldap slapd[25821]: => access_allowed: no more rules Oct 11 17:03:16 open-ldap slapd[25821]: mdb_add: no write access to parent Oct 11 17:03:16 open-ldap slapd[25821]: send_ldap_result: conn=1208 op=1 p=3 Oct 11 17:03:16 open-ldap slapd[25821]: send_ldap_result: err=50 matched="" text="no write access to parent" Oct 11 17:03:16 open-ldap slapd[25821]: send_ldap_response: msgid=2 tag=105 err=50 Oct 11 17:03:16 open-ldap slapd[25821]: conn=1208 op=1 RESULT tag=105 err=50 text=no write access to parent What do I miss? Thanks, a.

3 8

Question about automounting nfs directories within ldap
by Bänsch, Christian (TF) 12 Oct '17

12 Oct '17

Dear Community, thank you for your help to made my ldap configuration runnable and the login for users working. Now I have the next question about automounting nfs directories. In my /etc/exports I have several directories /export/home 10.188.114.0/25(fsid=0,rw,sync,root_squash,secure,no_subtree_check) /export/software/linux 10.188.114.0/25(rw,root_squash,sync,subtree_check,secure) /export/calculate 10.188.114.0/25(rw,root_squash,sync,no_subtree_check) I want to export when the ldap user is going to login. But when I do this, I´ll get those error messages. Oct 9 09:59:13 fautm89 automount[13131]: attempting to mount entry /home/iwtm009 Oct 9 09:59:13 fautm89 automount[13131]: >> mount.nfs: access denied by server while mounting fautm89.ltm.uni-erlangen.de:/export/home/iwtm009 Oct 9 09:59:13 fautm89 automount[13131]: mount(nfs): nfs: mount failure fautm89.ltm.uni-erlangen.de:/export/home/iwtm009 on /home/iwtm009 Oct 9 09:59:13 fautm89 automount[13131]: failed to mount /home/iwtm009 Oct 9 10:00:01 fautm89 automount[13131]: attempting to mount entry /local/calculate Oct 9 10:00:01 fautm89 automount[13131]: >> mount.nfs: access denied by server while mounting fautm89.ltm.uni-erlangen.de:/export/calculate Oct 9 10:00:01 fautm89 automount[13131]: mount(nfs): nfs: mount failure fautm89.ltm.uni-erlangen.de:/export/calculate on /local/calculate Oct 9 10:00:01 fautm89 automount[13131]: failed to mount /local/calculate Oct 9 10:00:14 fautm89 automount[13131]: attempting to mount entry /local/linux Oct 9 10:00:14 fautm89 automount[13131]: >> mount.nfs: access denied by server while mounting fautm89.ltm.uni-erlangen.de:/export/software/linux Oct 9 10:00:14 fautm89 automount[13131]: mount(nfs): nfs: mount failure fautm89.ltm.uni-erlangen.de:/export/software/linux on /local/linux Oct 9 10:00:14 fautm89 automount[13131]: failed to mount /local/linux When I do e.g. a ls -la in /home on the server, I get drwx------ 79 iwtm009 tm 4096 Aug 22 13:15 iwtm009/ on the client I get dr-xr-xr-x 2 root root 0 Oct 9 09:47 iwtm009 Should I have to adjust this in slapd configuration or am I just blind to see it? -- Thank you in advance and best regards, Christian

2 2

Re: Replication error
by Quanah Gibson-Mount 12 Oct '17

12 Oct '17

--On Tuesday, October 10, 2017 6:39 PM +0200 Ervin Hegedüs <airween(a)gmail.com> wrote: > binddn="uid=repuser,dc=my,dc=domain,dc=hu" > Anyway - how can I solve this problem? Your uid=repuser,dc=my,dc=domain,dc=hu user does not have "read" access on the userPassword attribute. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical October 2017