openldap-technical March 2019

openldap-technical@openldap.org

29 participants
25 discussions

help needed for further investigation
by Thomas.Meller＠t-systems.com 07 Mar '19

07 Mar '19

Hello together. I am the heir of a setup based on RHEL 6.10 and Openldap 2.4.45 (ltb) A master syncrepls to a slave in type=refreshOnly using bindmethod=sasl, saslmech=external. The mapped techuser resides in ou=ServiceUser. All Clients also use user objects in the same ou to bind to the servers. I need to set new acls and decided to include a dedicated acl- and limits-configfile. The ACLs checked via slapacl look fine and run without problems on the test environment. (Which is based on the same 2.4.45 rpms, but the replica runs on RHEL 7.5) All slapd configuration make use of database mdb and an explicitly set maxsize. (which is sized sufficiently: 12 GB, 49 MB used) When implementing the configuration on a running system, the replica deletes the ou (that one with all the service user objects). Which is not what I want 8-/ How can I find out more about the reason for this peculiar result? I set the loglevel to 'stats sync' on the replica and 'sync' on the master. (fs size is limited for logs) The access limits are in place for this replication account and read access is granted as well. (might be I need to set something extra for operational attributes?) limits dn.subtree="ou=ServiceUser,..." size=unlimited (this is the replica) sizelimit unlimited timelimit 10 and limits dn.subtree="ou=ServiceUser,..." size=unlimited time=120 (in this order, this is the master) What do I need to look at to find what's missing? I am no openldap crack, but no newbie as well. Yet my openldap knowledge ist not very extended. Which further infos do I need to supply to maybe get help? The include statements for limits and acls are defined before the database configuration. I avoid using dynamic configuration to keep it all simple. Overlays in use: chain dynlist valsort memberof ppolicy (replica) syncprov ppolicy unique dynlist memberof refint valsort (master) Thank you, Thomas

3 4

setting up openldap to proxy to AD on SUSE ENT 12
by N6Ghost 06 Mar '19

06 Mar '19

hi all, I am trying to setup an openldap proxy to AD and i need to use SUSE Enterprise Linux 12. Hostname:/etc/openldap # rpm -qa|grep -i openldap openldap2-2.4.41-18.43.1.x86_64 openldap2-client-2.4.41-18.43.1.x86_64 what I am trying to do, is proxy an application (with 1000s of users) from talking directory to AD, to talking to openldap. and then have openldap talk to AD. look across the net is a bunch of stuff, but most of it does not seem to apply, or work. look at the offical doc, says use sasl but you must have an local entry with a {sasl] tag on the user thats not really ideal and work make a huge problem. a few of the posts online just said point to AD via ldap is possible? and this application also has a group lookup as part of its auth process... eg, only member of groupX can access.... any help in this would be huge. seems, i am mixing up a few different ways of doing this whats the bets way to do this? Thanks -N6ghost

5 7

Integer keys - order
by Sam Dave 01 Mar '19

01 Mar '19

When using integer keys (MDB_INTEGERKEY), is it guaranteed that when using mdb_cursor_get() to "loop through" my entire database, I will get the keys in the expected integer order? I thought I'd ask to be sure because I'm not sure if this expected behavior is documented.

1 0

Integer keys - drawbacks
by Sam Dave 01 Mar '19

01 Mar '19

Are there any known drawbacks to using integer keys (MDB_INTEGERKEY), performance or otherwise?

1 0

back-ldap timeout per operation
by Abdelkader Chelouah 01 Mar '19

01 Mar '19

Hello, I'm trying to figure out what is the behavior of back-ldap when the timeout (olcDbTimeout) is exceeded for a given operation ? Is the operation retried or aborted ?

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2019