openldap-technical February 2020

openldap-technical@openldap.org

26 participants
36 discussions

How to simulate slow queries?
by Andrey Brindeyev 25 Feb '20

25 Feb '20

Hello! I'm trying to debug a specific issue that is related to slow queries, so I need a way how to simulate slow LDAP server responses. It will be optimal if I can set a specific number of seconds per query shape, but a general (configured) delay is fine too. I've already tried the retcode overlay, and I think it only simulates the slow bind scenarios and not the slow query responses. Here's an excerpt from my slapd.conf: overlay retcode retcode-parent "ou=Users,dc=acme,dc=qa" #retcode-item "uid=mdb" 0x00 retcode-item "uid=mdb" 0x00 sleeptime=4 retcode-item "cn=user1" 0x00 retcode-item "cn=user2" 0x00 retcode-item "cn=user3" 0x00 retcode-item "cn=user4" 0x00 retcode-item "cn=user5" 0x00 If there's no way this can be configured using existing options in OpenLDAP, I appreciate advice wherein the source code I need to insert the sleep construct. Ideally, it should work with the retcode overlay, so that I can test the slow bind scenarios and slow query responses at the same time. Thanks, Andrey.

1 0

SSH groups
by Клеусов Владимир Сергеевич 20 Feb '20

20 Feb '20

Hi, I connected ldap linux clients to the OpenLDAP server. I need to make a certain group of users able to connect to certain computers. How do I do this ?

5 5

Critical Issue : Openldap Slave Performance Issue of high recq
by keerthi krishnan 20 Feb '20

20 Feb '20

Hi , We have environment of multi-master and slave replication . master1 < =====> master 2 | | | | Slave 1 Slave 1 & & slave 2 slave 2 Now we are facing issue in all slaves, where replication from master is very slow. All slaves are single threaded. We are seeing High RECQ and sometimes server goes unavailable, untill we restart the slapd service. tcp 757967 0 ****:36340 <http://10.8.234.141:36340/> *****:636 <http://10.8.241.41:636/> ESTABLISHED 22160/slapd Could someone tell me, what kind of tuning we can perform?. If we make multi threaded, it will not have much performance. Kindly help .. Production servers are having this issue. Other system configuration like (Memory, load, disk) everything looks okay. I checked this kernel parameters as well. net.core.rmem_max = 4194304 net.ipv4.tcp_rmem = 4096 65536 4194304 Regards K.Keerthiga

2 1

Re: Urgent: New User with context CSN permission
by keerthi krishnan 17 Feb '20

17 Feb '20

hi Quanah, Thanks for guiding me. I have figured it out. It is working now. On Sun, 16 Feb 2020 at 01:22, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, February 15, 2020 9:21 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > Hi Quanah, > > > Now the user replmonitor has admin privilege, where it can list all cn > > ,. I have tried adding attrs=contextcsn , but no luck. Could you please > > guide me, how can i restrict this. > > contextcsn is an internally managed operational attribute, which means you > need to explicilty request it as a part of your search operation, or > request that all operational attrs be returned. How are you testing > whether or not the bind DN has the ability to read the attribute? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Urgent: New User with context CSN permission
by keerthi krishnan 16 Feb '20

16 Feb '20

Hi Quanah, Let me explain in detail. Now I can search the entire OU and contextCSN as below . I am searching with bind dn. ++ olcAccess: {1}to dn.subtree="dc=ldapprod,dc=com" by dn="cn=a dmin,dc=ldapprod,dc=com" write by dn="uid=authuser, dc=ldapprod,dc=com" write by dn="uid=repluser, dc=ldapprod,dc=com" read by dn="uid=replmonitor, dc=ldapprod,dc=com" read by * none ++ ldapsearch -x -H ldaps://IP address -D "uid=replmonitor,dc=ldapprod,dc=com" -W -b "dc=ldapprod,dc=com" contextCSN +++++ # ldapprod.com dn: dc=ldapprod,dc=com contextCSN: 20200212065804.242207Z#000000#000#000000 contextCSN: 20200213163933.076777Z#000000#001#000000 # admin, ldapprod.com dn: cn=admin,dc=ldapprod,dc=com # group, ldapprod.com dn: ou=group,dc=ldapprod,dc=com # people, ldapprod.com dn: ou=people,dc=ldapprod,dc=com # repluser, ldapprod.com dn: uid=repluser,dc=ldapprod,dc=com # authuser, ldapprod.com dn: uid=authuser,dc=ldapprod,dc=com # monitor, ldapprod.com dn: cn=monitor,dc=ldapprod,dc=com # replmonitor, ldapprod.com dn: uid=replmonitor,dc=ldapprod,dc=com +++++ Now replmonitor, got full access like admin where it can do all operation like cn=admin user. Now I want to restrict the user replmonitor only it can search and query contextcsn attr not any other dn. How can i achieve this?. Kindly guide me. On Sun, 16 Feb 2020 at 01:22, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, February 15, 2020 9:21 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > Hi Quanah, > > > Now the user replmonitor has admin privilege, where it can list all cn > > ,. I have tried adding attrs=contextcsn , but no luck. Could you please > > guide me, how can i restrict this. > > contextcsn is an internally managed operational attribute, which means you > need to explicilty request it as a part of your search operation, or > request that all operational attrs be returned. How are you testing > whether or not the bind DN has the ability to read the attribute? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Urgent: New User with context CSN permission
by keerthi krishnan 16 Feb '20

16 Feb '20

> > Hi Quanah, > > Thanks for the clarification. > > I have added as below > > +++ > olcAccess: {1}to dn.subtree="dc=ldapprod,dc=com" by dn="cn=a > dmin,dc=ldapprod,dc=com" write by dn="uid=authuser, > dc=ldapprod,dc=com" write by dn="uid=repluser, > dc=ldapprod,dc=com" read by dn="uid=replmonitor, > dc=ldapprod,dc=com" read by * none > +++ > > Now the user replmonitor has admin privilege, where it can list all cn ,. > I have tried adding attrs=contextcsn , but no luck. Could you please guide > me, how can i restrict this. > > Regards > K.Keerthiga > > > > On Fri, 14 Feb 2020 at 09:12, Quanah Gibson-Mount <quanah(a)symas.com> > wrote: > >> >> >> --On Friday, February 14, 2020 8:03 AM +0530 keerthi krishnan >> <keerthikrishnan1369(a)gmail.com> wrote: >> >> >> > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by >> > anonym >> > >> > ous auth by dn="cn=admin,dc=ldapprod,dc=com" write by dn="u >> > >> > id=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,d >> > >> > c=ldapprod,dc=com" read by * none >> > >> > olcAccess: {1}to dn.subtree="dc=ldappro,dc=com" by dn="cn=a >> > >> > dmin,dc=ldapprod,dc=com" write by dn="uid=authuser,dc=ldapprod,dc=com" >> > write by >> > >> > dn="uid=repluser,dc=ldapprod,dc=com" read by * none >> > >> > olcAccess: {2} to dn.subtree="dc=ldapprod,dc=com" attrs=contextCSN by >> > dn="uid=replmonitor,dc=ldapprod,dc=com" read by * none >> > =======> newly added >> >> Hi, >> >> As documented in the slapd.access(5) man page, ACL processing stops on >> the >> first matching rule. Since rule {1} covers access to all attributes >> except >> userPassword, your query for contextCSN matches rule {1} and rule {2} >> never >> fires. >> >> You probably want to move access rule {2} to be in front of {1}, and add >> additional "by" clauses to the rule to allow the admin, authuser, and >> repluser access to the attr. >> >> Regards, >> Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Product Architect >> Symas Corporation >> Packaged, certified, and supported LDAP solutions powered by OpenLDAP: >> <http://www.symas.com> > >

2 1

syncrepl syncing but not updating, contextCNS missing and schemacheck off
by jehan.procaccia＠imtbs-tsp.eu 15 Feb '20

15 Feb '20

Hello my syncrepl consumer does get initial synchronisation, but then is never updated I struggled a lot , to finally discover that contextCNS is not created on that replica, that might explain why it is not updated after initial sync . after different "try and catch" (ACLs, checpoint values etc ...) I finally discovered that setting schemachecking to *Off* (cf full syncrepl config below) on the consumer syncrepl config corrected the pb, contextCNS is then finally created after inital sync (after few dozen of seconds ...) and subsequent updated on master does get replicated on consumer. Shemas a stricly the same on provider (master) end consumer (replica) what would explain that schemachecking directive to break syncrepl contextCNS to be created ? is it wrong to run replicas with schemacheck Off ? maybe related , but no real solution to me : https://stackoverflow.com/questions/6525984/syncrepl-syncing-but-not-updati… regards syncrepl rid=081 provider=ldaps://master.int.fr type=refreshAndPersist searchbase="dc=int,dc=fr" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=*off* bindmethod=simple retry="60 10 300 +" binddn="cn=rep,ou=dsa,dc=int,dc=fr" credentials="secret" updateref ldaps://master.int.fr:636

3 6

LDAPS and ssh public key
by Клеусов Владимир Сергеевич 15 Feb '20

15 Feb '20

Hi I use ldaps . Will I be able to set up authentication using the SSH public key ? I use LDAP account Manager (https://www.ldap-account-manager.org/lamcms/) Here https://www.ldap-account-manager.org/static/doc/manual/ch04s02.html now You can manage your public keys for SSH in Lam if you have installed the LPK patch for SSH or configured AUTHORIZEDKEYSCOMMAND& What does OR mean ? Google says that i need to download the scheme for SSH keys and add the script to AUTHORIZEDKEYSCOMMAND. But in https://code.google.com/archive/p/openssh-lpk/wikis/Main.wiki written To use lpk you must either use standard ldap (not recommended) or LDAP + TLS. ldaps:// URLs will not work. So in the end ssh key +LDAPS will not work ? Or is there a way to use ssh key +LDAPS ?

2 1

Re: Urgent: New User with context CSN permission
by keerthi krishnan 14 Feb '20

14 Feb '20

Hi Quanah, Thanks for your reply. Please find the requirements and permission ++++++++++++++++++++ We have setup of master and slave replication, where we have two users admin(default), authuser and repluser for replication which has full admin privilege. I am trying to create a new user “replmonitor” which I want to give access only to attribute contextCSN . Replmonitor user ++++ # replmonitor, ldapprod.com dn: uid=replmonitor,dc=ldapprod,dc=com objectClass: simpleSecurityObject objectClass: account uid: replmonitor description: LDAP rreplication monitor userPassword:: ###################### ++++ This is the complete olcaccess for the users in olcDatabase={3}mdb. ++ olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=ldapprod,dc=com" write by dn="u id=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,d c=ldapprod,dc=com" read by * none olcAccess: {1}to dn.subtree="dc=ldappro,dc=com" by dn="cn=a dmin,dc=ldapprod,dc=com" write by dn="uid=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,dc=ldapprod,dc=com" read by * none olcAccess: {2} to dn.subtree="dc=ldapprod,dc=com" attrs=contextCSN by dn="uid=replmonitor,dc=ldapprod,dc=com" read by * none =======> newly added olcLimits: {0}dn.exact="uid=repluser,dc=ldapprod,dc=com" tim e.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimite d olcLimits: {1}dn.exact="uid=authuser,dc=ldapprod,dc=com" tim e.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimite d olcSecurity: tls=1 ++ ++++++++++++++++++ [root@devldap cn=config]# ldapsearch -x -H ldaps://10.0.0.1 -D "uid=replmonitor,dc=ldapprod,dc=com" -W -b "ldapprod,dc=com" contextCSN Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=ldapprod,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object Please help me, what I am missing here that I am not able to query the ContextCSN . Got struck for a complete day. On Fri, 14 Feb 2020 at 03:21, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, February 13, 2020 5:50 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > > > access to dn.base="dc=domain,dc=com" attrs=entry,children,contextcsn by > > dn.exact="uid=replmonitor,dc=domain,dc=com" read by * none > > Access statements without the context of the full configuration provide no > real information that can be acted upon the majority of the time. I would > also note that "by * none" at the end of an ACL is implicit, as discussed > in the slapd.access(5) man page, so there is no reason to explicitly list > it. > > If you want help with your ACLs, you need to provide your configuration > (minus passwords). > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Urgent: New User with context CSN permission
by keerthi krishnan 14 Feb '20

14 Feb '20

Hi Team, Requirements: I want to create user and provide only access to contextCSN. I have tried to create user and gave privilege as below. access to dn.base="dc=domain,dc=com" attrs=entry,children,contextcsn by dn.exact="uid=replmonitor,dc=domain,dc=com" read by * none But it results as ldapsearch -x -H ldaps:// -D "uid=replmonitor,dc=domain,dc=com" -W -b "dc=domain,dc=com" Enter LDAP Password: search: 2 result: 32 No such object Please someone help me with the acl for the new user where it can list the contextCSN Regards K.Keerthiga

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical February 2020