openldap-technical March 2021

openldap-technical@openldap.org

31 participants
41 discussions

Multiple memberOf overlays
by John C. Pfeifer 05 Aug '25

05 Aug '25

I am in the process of converting an existing LDAP infrastructure to OpenLDAP. I have a case where it would be convenient for two different objectClasses to map into the memberOf attribute. Is it possible to define two overlay configs or will they end up fighting each other over the memberOf attribute? For instance: dn: olcOverlay={5}memberofA,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {5}memberofA olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassA olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf dn: olcOverlay={6}memberofB,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {6}memberofB olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassB olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf // John Pfeifer Division of Information Technology University of Maryland, College Park

4 3

Problem with "force user to password reset at first login
by Rajagopal Rc 30 Oct '23

30 Oct '23

Hi, I am trying to force users to change their password at first login or after password reset by administrator. Tried following: 1)Password policy 'pwdMustChange TRUE' doesn't seems to be working as non of the users get prompt to change their password at first login. 2) used the 'pwdReset TRUE' attribute in users attributes, and it won't prompt to change the password and didn't allow to login i observe below messages in log "slapd[12684]: connection restricted to password changing only slapd[12684]: send_ldap_result: err=50 matched="" text="Operations are restricted to bind/unbind/abandon/StartTLS/modify password" slapd[12684]: conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text=Operations are restricted to bind/unbind/abandon/StartTLS/modify password" Please help me configure the option to force all users to change their password at first login or after pwd reset by administrator. Thanks & Regards Raj Tata Consultancy Services Mailto: rajagopal.rc(a)tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Consulting ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 9

Index seems to return wrong amount of candidate causing really poor search performance
by chrichardso27＠gmail.com 18 Aug '21

18 Aug '21

Hi, Considering the following assumptions; - OpenLDAP version 2.4.51 - attributes objectClass and abc are indexed based on equality - the EQUALITY of attribute abc is based on distinguishedNameMatch - The database contains roughly 2 million entries - 2 entries have defined the attribute abc with a dn value cn=foo,dc=bar and objectClass=someClass - 2 entries have defined the attribute abc with a dn value cn=bar,dc=baz and objectClass=someClass Now, the issue started with really slow search performance using objectClass=someClass & abc=cn=foo,dc=bar as filter criteria. Debugging a while seems to indicate that the objectClass filter returns roughly 2 million entries as candidates. Now, one would expect that the second filter would return only the 2 potential candidates from the abc index, or a subset of the whole database but this is not the case. The second filter also returns nearly the whole database entries as potential candidates and causes really slow query performance. Interestingly, this only occurs when attribute abc has value cn=foo,dc=bar, but for some reason for the entry having attribute abc with value cn=bar,dc=baz the query returns immediately. In both cases, the actual entries matching the search return immediately but for the problematic search "(&(objectClass=someClass)(abc=cn=foo,dc=bar))", the completion of the search takes a long time (around 15 seconds to be precise). The issue started suddenly and wasn't a degradation of query performance over time. Few things I have tried - Rebuilt the whole database again - Reindex the existing database again - Testing with bdb and mdb as backends - Increased cache sizes for bdb to hold the whole database in cache - For bdb adjust the page size of the indexes according to suggestion by db_tuner - Change the order of the filters None of these made any difference. At the moment, there does not seem to be any good options to try. Any ideas or help would be greatly appreciated!

6 18

Replacing the server during replication
by Клеусов Владимир Сергеевич 06 Apr '21

06 Apr '21

Hi, I have multi-master replication configured. https://pastebin.com/vYKsa9VY I want to replace ldap3. Please tell me how to do this ? I mean, how does the new server synchronize the current ldap database?

4 11

MDB_MAP_FULL with plenty of free pages
by Jean-Charles ROGEZ 25 Mar '21

25 Mar '21

Hello, We use OpenLDAP 2.4.57 under RHEL8 with a configuration with 2 directories in MM and 2 replicas. We only write on one of the masters. The size of the LMDB database grows following writes of members of large groups (2000 members) by a batch which runs every 10 minutes. The base grows regularly and sometimes undergoes significant jumps until it reaches its maximum size. The lmdb_stat -ef command indicates that very few pages are used and everything else is free pages. The used pages are stable. [cid:image001.jpg@01D720BD.58844450] And yet, it is no longer possible to write in the directory. Sometimes it's on the master directory, sometimes on replicas where syncrepl fails. 2021-03-24T11: 52: 59.978157 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - mdb_id2entry_put: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached (-30792) "uid = us-00000301, ou = users, dc = bst, dc = ocn, dc = infra, dc = ftgroup " 2021-03-24T11: 52: 59.978184 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_null_callback: error code 0x50 2021-03-24T11: 52: 59.978202 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_entry: rid = 001 be_modify failed (80) 2021-03-24T11: 52: 59.978780 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - do_syncrepl: rid = 001 rc 80 retrying There is no transaction in progress: mdb_stat -r /var/lib/ldap/data/ Reader Table Status pid thread txnid 25076 7fa0e42c5480 - 25076 7fa0977fe700 - 25076 7fa097fff700 - 25076 7fa094cfa700 - 25076 7fa086ffe700 - 25076 7fa0857fb700 - 25076 7fa0867fd700 - 25076 7fa085ffc700 - 25076 7fa074ffc700 - The batch executes a lot of transactions < 2s. Restarting slapd does not resolve the problem. If we compact the database with mdb_copy -c, it only makes a few MB and it works again. The problem no longer appears without large groups. Why are free pages not used? Wouldn't there be a problem with writing many multi-valued attributes? Thank you for your help ! Jean-Charles Rogez [https://marketing.csnovidys.com/Logos/banniere_mail.png] [twitter icon]<https://twitter.com/csnovidys> [linkedin icon]<https://www.linkedin.com/company/novidy's> Jean-Charles ROGEZ Architecte Système | INTEGRATION SYSTEMES | PLESSIS Standard : +33180848010<tel:+33180848010> Ligne directe : <tel:r> Mobile : <tel:> Email : jean-charles.rogez(a)csnovidys.com<mailto:jean-charles.rogez@csnovidys.com>

7 15

OpenLDAP LTB packages for 2.4.58 are available
by Clément OUDOT 25 Mar '21

25 Mar '21

Hello, LTB packages for OpenLDAP 2.4.58 are available: https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-58-packages-rele… Download: https://ltb-project.org/download#openldap Thanks to OpenLDAP team and LTB team! Clément.

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 7:05 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Ok I will test this one. > Unfortunately I cannot test this as I see only during the cutover from > old to new servers.. > > Apart from additional logging do you suggest any tuning to take more 5k > ldap clients connections ? No, you've yet to even demonstrate that OpenLDAP is having any issue. All you've noted is that you're having some issue somewhere in your stack. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 6:45 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Yes presently logs enabled below in slapd.conf. > and during troubleshoot I have enabled loglevel -1 as well in the past. > ># enable a lot of logging - we might need it ># but generates huge logs ># loglevel -1 > loglevel 17384 I would strongly advise using the logging keywords (see slapd.conf(5)), it makes it a lot simpler to understand what is being done. And initially, just start with: loglevel stats It should generally provide information necessary to see if there are any issues occurring between the server and the backend. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 6:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > No, F5 is not closing the connections as I see connection on LDAP > servers which are coming via F5 on both the sites and also secondary site > server under F5 as well which are working fine when client connections > are coming via F5. What logging level do you have set on the OpenLDAP server side? I assume you're doing something like using back-ldap to proxy the connection from OpenLDAP to AD? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Friday, March 19, 2021 1:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > > HI , > > Thanks for your time and response. > Looks like I missed this email. > > I don't see issue with AD here, Let me explain bit more > > We have 2 (1 master , 1 slave) servers in each site and those are under > F5 LB with TCP enabled. > > Under F5 setup > Primary site servers takes load around 3K Ldap clients > Secondary site servers take around 50K Ldap clients > > The problem which I am seeing with primary site server directly by > passing F5 layer when we test with 5-10 clients it's working as expected > no issue with GID name fetching however when we enabled servers under F5 > with all the clients we are seeing GID fetching issue. And we are not > offloaded any cert in F5 it just TCP so no issue with F5 here. > Similarly secondary site servers are working fine with F5 or directly > without any issue and Backend AD syncing is working fine in both the > sites. > > Both the sites configuration are intact except systems are in different > locations. > > The only difference I see is no of clients are high in primary site and > no errors in ldap server logs , I am not sure my ldap servers not able to > take more than 100 clients. I am guessing some tuning might required. Are you sure the F5 isn't silently closing connections? This is a common problem with F5's. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2021