March 2021 - openldap-technical

Index seems to return wrong amount of candidate causing really poor search performance

by chrichardso27＠gmail.com

Hi, Considering the following assumptions; - OpenLDAP version 2.4.51 - attributes objectClass and abc are indexed based on equality - the EQUALITY of attribute abc is based on distinguishedNameMatch - The database contains roughly 2 million entries - 2 entries have defined the attribute abc with a dn value cn=foo,dc=bar and objectClass=someClass - 2 entries have defined the attribute abc with a dn value cn=bar,dc=baz and objectClass=someClass Now, the issue started with really slow search performance using objectClass=someClass & abc=cn=foo,dc=bar as filter criteria. Debugging a while seems to indicate that the objectClass filter returns roughly 2 million entries as candidates. Now, one would expect that the second filter would return only the 2 potential candidates from the abc index, or a subset of the whole database but this is not the case. The second filter also returns nearly the whole database entries as potential candidates and causes really slow query performance. Interestingly, this only occurs when attribute abc has value cn=foo,dc=bar, but for some reason for the entry having attribute abc with value cn=bar,dc=baz the query returns immediately. In both cases, the actual entries matching the search return immediately but for the problematic search "(&(objectClass=someClass)(abc=cn=foo,dc=bar))", the completion of the search takes a long time (around 15 seconds to be precise). The issue started suddenly and wasn't a degradation of query performance over time. Few things I have tried - Rebuilt the whole database again - Reindex the existing database again - Testing with bdb and mdb as backends - Increased cache sizes for bdb to hold the whole database in cache - For bdb adjust the page size of the indexes according to suggestion by db_tuner - Change the order of the filters None of these made any difference. At the moment, there does not seem to be any good options to try. Any ideas or help would be greatly appreciated!

2 years, 1 month

6
18
0 / 0

Replacing the server during replication

by Клеусов Владимир Сергеевич

Hi, I have multi-master replication configured. https://pastebin.com/vYKsa9VY I want to replace ldap3. Please tell me how to do this ? I mean, how does the new server synchronize the current ldap database?

2 years, 5 months

4
11
0 / 0

MDB_MAP_FULL with plenty of free pages

by Jean-Charles ROGEZ

Hello, We use OpenLDAP 2.4.57 under RHEL8 with a configuration with 2 directories in MM and 2 replicas. We only write on one of the masters. The size of the LMDB database grows following writes of members of large groups (2000 members) by a batch which runs every 10 minutes. The base grows regularly and sometimes undergoes significant jumps until it reaches its maximum size. The lmdb_stat -ef command indicates that very few pages are used and everything else is free pages. The used pages are stable. [cid:image001.jpg@01D720BD.58844450] And yet, it is no longer possible to write in the directory. Sometimes it's on the master directory, sometimes on replicas where syncrepl fails. 2021-03-24T11: 52: 59.978157 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - mdb_id2entry_put: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached (-30792) "uid = us-00000301, ou = users, dc = bst, dc = ocn, dc = infra, dc = ftgroup " 2021-03-24T11: 52: 59.978184 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_null_callback: error code 0x50 2021-03-24T11: 52: 59.978202 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_entry: rid = 001 be_modify failed (80) 2021-03-24T11: 52: 59.978780 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - do_syncrepl: rid = 001 rc 80 retrying There is no transaction in progress: mdb_stat -r /var/lib/ldap/data/ Reader Table Status pid thread txnid 25076 7fa0e42c5480 - 25076 7fa0977fe700 - 25076 7fa097fff700 - 25076 7fa094cfa700 - 25076 7fa086ffe700 - 25076 7fa0857fb700 - 25076 7fa0867fd700 - 25076 7fa085ffc700 - 25076 7fa074ffc700 - The batch executes a lot of transactions < 2s. Restarting slapd does not resolve the problem. If we compact the database with mdb_copy -c, it only makes a few MB and it works again. The problem no longer appears without large groups. Why are free pages not used? Wouldn't there be a problem with writing many multi-valued attributes? Thank you for your help ! Jean-Charles Rogez [https://marketing.csnovidys.com/Logos/banniere_mail.png] [twitter icon]<https://twitter.com/csnovidys> [linkedin icon]<https://www.linkedin.com/company/novidy's> Jean-Charles ROGEZ Architecte Système | INTEGRATION SYSTEMES | PLESSIS Standard : +33180848010<tel:+33180848010> Ligne directe : <tel:r> Mobile : <tel:> Email : jean-charles.rogez(a)csnovidys.com<mailto:jean-charles.rogez@csnovidys.com>

2 years, 6 months

7
15
0 / 0

OpenLDAP LTB packages for 2.4.58 are available

by Clément OUDOT

Hello, LTB packages for OpenLDAP 2.4.58 are available: https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-58-packages-re... Download: https://ltb-project.org/download#openldap Thanks to OpenLDAP team and LTB team! Clément.

2 years, 6 months

1
0
0 / 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name

by Quanah Gibson-Mount

--On Tuesday, March 23, 2021 7:05 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Ok I will test this one. > Unfortunately I cannot test this as I see only during the cutover from > old to new servers.. > > Apart from additional logging do you suggest any tuning to take more 5k > ldap clients connections ? No, you've yet to even demonstrate that OpenLDAP is having any issue. All you've noted is that you're having some issue somewhere in your stack. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 years, 6 months

1
0
0 / 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name

by Quanah Gibson-Mount

--On Tuesday, March 23, 2021 6:45 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Yes presently logs enabled below in slapd.conf. > and during troubleshoot I have enabled loglevel -1 as well in the past. > ># enable a lot of logging - we might need it ># but generates huge logs ># loglevel -1 > loglevel 17384 I would strongly advise using the logging keywords (see slapd.conf(5)), it makes it a lot simpler to understand what is being done. And initially, just start with: loglevel stats It should generally provide information necessary to see if there are any issues occurring between the server and the backend. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 years, 6 months

1
0
0 / 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name

by Quanah Gibson-Mount

--On Tuesday, March 23, 2021 6:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > No, F5 is not closing the connections as I see connection on LDAP > servers which are coming via F5 on both the sites and also secondary site > server under F5 as well which are working fine when client connections > are coming via F5. What logging level do you have set on the OpenLDAP server side? I assume you're doing something like using back-ldap to proxy the connection from OpenLDAP to AD? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 years, 6 months

1
0
0 / 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name

by Quanah Gibson-Mount

--On Friday, March 19, 2021 1:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > > HI , > > Thanks for your time and response. > Looks like I missed this email. > > I don't see issue with AD here, Let me explain bit more > > We have 2 (1 master , 1 slave) servers in each site and those are under > F5 LB with TCP enabled. > > Under F5 setup > Primary site servers takes load around 3K Ldap clients > Secondary site servers take around 50K Ldap clients > > The problem which I am seeing with primary site server directly by > passing F5 layer when we test with 5-10 clients it's working as expected > no issue with GID name fetching however when we enabled servers under F5 > with all the clients we are seeing GID fetching issue. And we are not > offloaded any cert in F5 it just TCP so no issue with F5 here. > Similarly secondary site servers are working fine with F5 or directly > without any issue and Backend AD syncing is working fine in both the > sites. > > Both the sites configuration are intact except systems are in different > locations. > > The only difference I see is no of clients are high in primary site and > no errors in ldap server logs , I am not sure my ldap servers not able to > take more than 100 clients. I am guessing some tuning might required. Are you sure the F5 isn't silently closing connections? This is a common problem with F5's. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 years, 6 months

1
0
0 / 0

SHA-256 Password Support and OpenLDAP2-2.4.46 SLES15SP2

by Dario García Díaz-Miguel

Hello, We have a question related with the pw-sha2 module. We have deployed OpenLDAP2.4.46-9.31.1 on SLES15 SP2 from the official Suse Repository and we are able to use {CRYPT} {MD5} {SMD5} {SSHA} and {SHA}. We are awared that in order to support SHA-256 we have to load the contrib module named pw-sha2 which it was included on SLES12SP5 but is totally missing on SLES15SP2 package. This means that we would need to compile it, but due to limitations of the project we are working on we are not allowed to compile anything external. So I checked the changelog and I found that support was added on 2.4.32 release. Is it possible that the openldap2 package could have been compiled with the module features itself and I just need to add some kind of attribute or entry to my LDAP directory in order to enable it? We have tried to use Apache Directory Studio instead of slappasswd and we have set up a password to SHA256 but the bind won't work. Instead, CRYPT-SHA256 works so I can't figure out why. I suppose I'm totally misunderstanding this and the compilation of the module is required, but a little light ray of hope is there. Thank you so much. Regards. P Please consider the environment before printing this e-mail.

2 years, 6 months

6
13
0 / 0

warning in SLAPO_PPOLICY(5) regarding ppolicy_hash_cleartext

by Christopher Paul

Hello, I read the warning in SLAPO_PPOLICY(5) regarding ppolicy_hash_cleartext: "It is recommended that when this option is used that compare, search, and read access be denied to all directory users". Am I correct to presume that this means that the compare, search, read access be denied for directory users' _own_ (self) userPassword attrs, right? Because compare, search, read access to _other_ users' userPassword is rightfully denied typically by any sensible access control ruleset. (Right?) And if this document does mean to say that compare, search, and read access should be denied for directory users' _own_ (self) userPassword attrs, can someone please explain why, if users can read their userPassword, it would be worse for it to be encrypted than plain text? Many thanks, Chris Paul Rex Consulting, Inc email: chris.paul(a)rexconsulting.net web: http://www.rexconsulting.net <http://www.rexconsulting.net> phone, toll-free: +1 (888) 403-8996 ext 1

2 years, 6 months

3
3
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2021