openldap-technical June 2020

openldap-technical@openldap.org

41 participants
49 discussions

Multiple memberOf overlays
by John C. Pfeifer 05 Aug '25

05 Aug '25

I am in the process of converting an existing LDAP infrastructure to OpenLDAP. I have a case where it would be convenient for two different objectClasses to map into the memberOf attribute. Is it possible to define two overlay configs or will they end up fighting each other over the memberOf attribute? For instance: dn: olcOverlay={5}memberofA,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {5}memberofA olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassA olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf dn: olcOverlay={6}memberofB,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {6}memberofB olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassB olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf // John Pfeifer Division of Information Technology University of Maryland, College Park

4 3

Problem with "force user to password reset at first login
by Rajagopal Rc 30 Oct '23

30 Oct '23

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 9

Q: UNKNOWN attributeDescription "AUDITCONTEXT" inserted.
by Ulrich Windl 22 Jul '20

22 Jul '20

Hi! After systemd tearing down one of our LDAP servers I noticed the following message when the server was restarted: slapd[10525]: UNKNOWN attributeDescription "AUDITCONTEXT" inserted. The next line logged was: slapd[10525]: olcServerID: value #1: SID=0x002 (listener=ldap://...:389) (the server is that of SLES12 SP4, 2.4.41 from opensuse-buildservice) The server is one of three MM servers that all have the same configuration and the same version. The schema knows in olcAttributeTypes (olcSchemaConfig): ( 1.3.6.1.4.1.4203.666.11.5.1.30 NAME 'auditContext' DESC 'DN of auditContainer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) What I'l like to know: Is there any thing I could fix in the configuration to make the message go away, or is it some software issue in slapd? Regards, Ulrich

4 10

anonymize data
by Olivier - 21 Jul '20

21 Jul '20

Hi all, I have a question anonymizing data. My openldap have some confidential data inside and I would like this : if a person has a flag confidentiality set to 1 (or is in a special ou), openldap will replace or answer a different data. For example : if we request "sn" on this record , it will reply "Smith" dn: cn=Smith,ou=public,c=com confidentiality: 0 sn: Smith if we request "sn" on this record , it will reply "XXX" dn: cn=Bond,ou=public,c=com confidentiality: 1 sn: Bond I'm not sur Openldap can offer this kind of functionnality. Thanks for your help !

5 6

slapd 2.4.44 Performance problems
by daniel.zuniga＠gmail.com 01 Jul '20

01 Jul '20

Hello, We are running OpenLDAP with a relatively small user base (15K users) and the server does not seem to be able to keep up with demand when there are multiple concurrent logins (20 users X 70 searches each) during user login. When users login to the server all cores in the server (8) run at 100% utilization, sometimes for as long as 20 minutes (depending on how many users are logging in concurrently). We have experimented and read and re-read the Tuning guidance but with very little success. We have tried increasing the number of available cores to slapd, but it does not use more than 8. We have also increased the number of threads from 16 to 32, but that also does not seem to have an effect nor does it seem to allow slapd to use all 16 cores (slapd seems limited to 8 cores regardless of the number of threads defined). The server has plenty of memory available and configured the db cache to use as much as in needs, but that does not seem to improve matters. Can you offer any guidance? Thanks.

3 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 01 Jul '20

01 Jul '20

Thank you for the pointers. I will setup delta syncrepl and test to verify if I see the issue or not. Thanks Rahul On Mon, Jun 29, 2020 at 4:02 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, June 29, 2020 4:20 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Thank you for creating the bug. I have added myself as CC. Based on > > the configuration information I have provided, can you provide a set of > > guidelines to configure my setup to use delta-syncrepl. > > The admin guide already provides information the configuration bits > necessary to set up delta-syncrepl. Generally: > > a) You need a secondary DB to store the accesslog data from the accesslog > overlay. > > b) You need to reconfigure the olcSyncrepl config to make use of the > accesslog db. > > <https://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl> > > And a blog post I wrote that gives some example configs: > > < > https://mishikal.wordpress.com/2019/04/23/configuring-mmr-using-delta-syncr… > > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 3

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Thank you for creating the bug. I have added myself as CC. Based on the configuration information I have provided, can you provide a set of guidelines to configure my setup to use delta-syncrepl. Thanks Rahul On Mon, Jun 29, 2020 at 3:10 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 29, 2020 3:59 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Thank you for reproducing the issue. What is the course of action > > from here on? There will be an openldap release with the fix? or a patch > > will be released? Also can you share the bug # once you raise it. How > > will I get notified once the issue is fixed and is released? > > Hi Kumar, > > As was stated before, use delta-syncrepl as it avoids these types of > issues > with standard syncrepl. I'm guessing this is another variation of issue > #8125 (<https://bugs.openldap.org/show_bug.cgi?id=8125>), although I'm > initially filing a separate bug in case it is a different problem, issue > #9282 (<https://bugs.openldap.org/show_bug.cgi?id=9282>). > > You can add yourself to the CC of the issue to track its status and > resolution. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Thank you for reproducing the issue. What is the course of action from here on? There will be an openldap release with the fix? or a patch will be released? Also can you share the bug # once you raise it. How will I get notified once the issue is fixed and is released? Thanks Rahul On Mon, Jun 29, 2020 at 2:55 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, June 23, 2020 5:04 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Hi Quanah > > Hi Kumar, > > I was able to reproduce the issue, thanks for the report. I'll file a bug > for it. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Please find my answers inline a) Both servers have no DB, but are using these configs [Rahul] Both servers are started with an empty database. Both servers are in Provider and consumer mode. Our application is running on both servers as well. To start with our application is active on Server A, which means data will be written to server A database.and is synced/replicated to server B b) DB is added to server A and replicated to server B [Rahul] Yes since server A has our application in active mode hence data is written on server A and replicated to server B. c) server A is stopped [Rahul] yes we reboot the server A. d) You say "data is removed", I'm not sure what this means. A single entry? Multiple entries? The entire database? [Rahul] Now our application is active on Server B. Using server B removed "a Single Entry" which was removed from server B database as well. e) S1 is restarted, and the deleted data is replicated back to both nodes. [Rahul] Yes deleted data is replicated back to both nodes. when S1 is restarted slapd is configured in provider/consumer mode but our application is still active on server B which means writes will only happen at server B and should be synced to server A. Thank you for all the help so far. I have no intention of interrupting your work. Please look at my issue based on your convenience. Let me know if you have any other questions. Thanks Rahul On Tue, Jun 23, 2020 at 3:43 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, June 23, 2020 1:47 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Both the servers are set up as master as well as consumer so that > > sync works in both directions. So > > the sync setup is like "A -> B", > > and when A fails B is updated and the expectation is that "B -> A" should > > work because a multi master setup is already in place. Let me know based > > on the attached configuration files if my assumption is correct or not. > > > > > > Also Add data works when A fails and B is updated then sync "B -> A"works > > fine. > > > > After Delete data sync does not work when A fails and data is deleted > > from B. Once A comes back both databases have data which was deleted on > B. > > Hi, > > I'll see if I can reproduce your issue with the configs provided (Assuming > they look correct after I finish reviewing them in full), but I want to > confirm the exact steps: > > a) Both servers have no DB, but are using these configs > > b) DB is added to server A and replicated to server B > > c) server A is stopped > > d) You say "data is removed", I'm not sure what this means. A single > entry? Multiple entries? The entire database? > > e) S1 is restarted, and the deleted data is replicated back to both nodes. > > Note that I do have a paid job that keeps me busy, so this is a best > effort > when I have time available to investigate. > > Thanks, > Quanah > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

LMDB transaction flags
by Stefano Cossu 29 Jun '20

29 Jun '20

Hello, I'd like to be able to know if a LMDB transaction is active, valid, dirty, read-only, etc. From the documentation I read that such information is in mt_flags of the mdb_txn structure, which is opaque. I don't see any function exposing mt_flags. Is there any other way to read that information?

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2020