openldap-technical July 2023

openldap-technical@openldap.org

29 participants
33 discussions

Slapd migrate from hdb to lmdb on 2.5.13
by Richard Rosner 24 Jul '23

24 Jul '23

Hi, I just upgraded our servers from Debian 11 to 12. I'm not sure if this is an upstream change, but slapd 2.5 on Debian 12 doesn't support the HDB and BDB backends, so the database needs to be migrated to LMDB. Unfortunately I neglected to check the backend in use for all instances. Our main slapd instance already used LMDB, but another instance, that's just getting a copy of that database through sync replication, was still using HDB. At first I only noticed an error during upgrade. I found a guide (https://sources.debian.org/src/openldap/2.5.13%2Bdfsg-5/debian/slapd.README… line 255 following) to do the upgrade to 2.5.x if it fails, which showed me the error. lt_dlopenext failed: (back_hdb) file not foundslapadd: could not add entry dn="cn=module{0},cn=config" (line=16): <olcModuleLoad> handler exited with 1 Closing DB... So I followed the setps under "BDB/HDB backends removed: migrating to LMDB backend". But upon trying to restore the backup again, it just told me slapadd: could not add entry dn="cn=config" (line=1): Closing DB... The first set of lines in cn\=config.ldif reads dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 71b384b4-aca9-1032-883a-d9850217023f creatorsName: cn=config createTimestamp: 20130908080726Z entryCSN: 20130908080726.757296Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130908080726Z So I'm not sure what it wants to tell me now. I already checked against the config of the main instance, made a few modifications, but the error message is the same. Here the modifications: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 71b384b4-aca9-1032-883a-d9850217023f creatorsName: cn=config createTimestamp: 20130908080726Z olcTLSCACertificateFile: /etc/ssl/certs/xyz-chain.pem olcTLSCertificateFile: /etc/ssl/certs/mail.domain.de.cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/mail.domain.de.private.pem entryCSN: 20130908080726.757296Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=mail modifyTimestamp: 20130908080726Z Could anybody tell me what exactly the problem is? Richard

2 12

SASL DIGEST-MD5 users/radius?
by Quanah Gibson-Mount 24 Jul '23

24 Jul '23

Hello, There is work underway for a new release of cyrus-sasl 2.1 series that offiicially supports OpenSSL 3.0. One issue that has been encountered is that there is no remaining supported cipher algorithms in the cyrus-sasl DIGEST-MD5 implementation, which used the historic rc4/des or 3des, when compiling against OpenSSL3. The general question for this list is, is there anyone who is still using the historic SASL DIGEST-MD5 mechanism and would not be able to move to a secure SASL mechanism such as SCRAM? Thanks! --Quanah

1 0

slapindex a 60GB mdb in reasonable time
by maud.parratt＠bjss.com 24 Jul '23

24 Jul '23

Hi, I have an openldap instance that I'd like to migrate to arm64, just loading a mdb from an amd64 instance results in all filtered queries returning empty results, which is resolved by running slapindex. I've managed to get this to complete in reasonable time using an arm64 mac and a tmpfs volume to hold a smaller test mdb in memory, but I can't replicate this performance in the cloud and I can't fit the prod mdb into tmpfs and have enough memory to work with left over. I've noticed that despite setting olcToolThreads high, it only ever pins one CPU, so I wonder if it's the difference in single threaded performance of my m1max mac vs a graviton2 instance? Is there any way to get slapindexing to use more than one cpu, or are there any other performance improvements you can suggest? I need it to complete within 6 hours maximum to fit into a change window. I'd prefer not to resort to running a parallel instance out of service and then swap the two over if it can be helped. It doesn't go at a consistent rate, but right now it looks like it'd take 2-3 days to complete. I'm passing -t and -q to slapindex. I'd appreciate any advice you could give.

4 22

In mirrormode on mode, one of the machines lost data.
by w2574694205＠sina.com 24 Jul '23

24 Jul '23

"I built two openldap servers using mirrormode on mode. After stopping the openldap processes on both servers and restarting them, one of the openldap servers lost some data while the other one remained normal. I waited for several synchronization cycles but the lost data could not be recovered. When I tried to query the lost data, I could not find it, and when I tried to add it, I was told that it already existed. Before shutting down, I took a snapshot of the machines. After restoring to the snapshot, I only started one openldap process on either of the two machines and their data was normal. However, after one data synchronization, the data on one of the machines was lost again." server01 lost some data this is server01 slapd.conf: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 1 syncrepl rid=150 provider=ldap://server02 bindmethod=simple binddn="cn=admin,dc=xitong,dc=qianxin,dc=com" credentials="passwd" searchbase="dc=xitong,dc=qianxin,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on this is server02 slapd.conf: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 20 syncrepl rid=150 provider=ldap://server01 bindmethod=simple binddn="cn=admin,dc=xitong,dc=qianxin,dc=com" credentials="passwd" searchbase="dc=xitong,dc=qianxin,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on This is the log when I start server02 and then start server01： server02： slapd[153895]: slap_client_connect: URI=ldap://server01 DN="cn=admin,dc=xitong,dc=qianxin,dc=com" ldap_sasl_bind_s failed (-1) slapd[153895]: do_syncrepl: rid=150 rc -1 retrying slapd[153895]: slap_client_connect: URI=ldap://server01 DN="cn=admin,dc=xitong,dc=qianxin,dc=com" ldap_sasl_bind_s failed (-1) slapd[153895]: do_syncrepl: rid=150 rc -1 retrying slapd[153895]: conn=1003 fd=11 ACCEPT from IP=server01-ip:64036 (IP=0.0.0.0:389) slapd[153895]: conn=1003 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" method=128 slapd[153895]: conn=1003 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" mech=SIMPLE bind_ssf=0 ssf=0 slapd[153895]: conn=1003 op=0 RESULT tag=97 err=0 qtime=0.000066 etime=0.000462 text= slapd[153895]: conn=1003 op=1 SRCH base="dc=xitong,dc=qianxin,dc=com" scope=2 deref=0 filter="(objectClass=*)" slapd[153895]: conn=1003 op=1 SRCH attr=* + slapd[153895]: conn=1003 op=1 syncprov_op_search: got a persistent search with a cookie=rid=150,sid=001,csn=20230716091536.511728Z#000000#001#000000 slapd[153895]: conn=1003 op=1 syncprov_findbase: searching conn=1003 op=1 syncprov_op_search: registered persistent search conn=1003 op=1 syncprov_findcsn: mode=FIND_CSN csn=20230716091536.511728Z#000000#001#000000 slapd[153895]: conn=1003 op=1 syncprov_findcsn: csn==20230716091536.511728Z#000000#001#000000 not found slapd[153895]: conn=1003 op=1 syncprov_findcsn: csn<=20230716091536.511728Z#000000#001#000000 found slapd[153895]: conn=1003 op=1 syncprov_findcsn: mode=FIND_PRESENT csn= slapd[153895]: conn=1003 op=1 syncprov_sendinfo: present syncIdSet cookie= slapd[153895]: conn=1003 op=1 INTERMEDIATE oid=1.3.6.1.4.1.4203.1.9.1.4 slapd[153895]: conn=1003 op=1 ENTRY dn="cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=system,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=security,cn=system,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=audit,cn=system,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="ou=gidnumber,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="ou=policies,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 ENTRY dn="cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[153895]: conn=1003 op=1 syncprov_search_response: cookie=rid=150,sid=014,csn=20230716091536.629686Z#000000#001#000000 slapd[153895]: conn=1003 op=1 syncprov_sendinfo: refreshPresent cookie=rid=150,sid=014,csn=20230716091536.629686Z#000000#001#000000 slapd[153895]: conn=1003 op=1 INTERMEDIATE oid=1.3.6.1.4.1.4203.1.9.1.4 slapd[153895]: conn=1003 op=1 syncprov_search_response: detaching op slapd[153895]: do_syncrep1: rid=150 starting refresh (sending cookie=rid=150,sid=014,csn=20230716091536.629686Z#000000#001#000000) slapd[153895]: syncrepl_message_to_entry: rid=150 DN: ou=gidNumber,dc=xitong,dc=qianxin,dc=com, UUID: 11ba8ea0-b805-103d-9ccd-b18d19d8567b slapd[153895]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7fb4fa8f2700 slapd[153895]: syncrepl_entry: rid=150 inserted UUID 11ba8ea0-b805-103d-9ccd-b18d19d8567b slapd[153895]: dn_callback : entries have identical CSN ou=gidNumber,dc=xitong,dc=qianxin,dc=com 20230720112814.263879Z#000000#000#000000 slapd[153895]: syncrepl_entry: rid=150 be_search (0) slapd[153895]: syncrepl_entry: rid=150 ou=gidNumber,dc=xitong,dc=qianxin,dc=com slapd[153895]: syncrepl_entry: rid=150 entry unchanged, ignored (ou=gidNumber,dc=xitong,dc=qianxin,dc=com) slapd[153895]: syncrepl_message_to_entry: rid=150 DN: cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 4320059e-bb3c-103d-8a4c-37ca95023e01 slapd[153895]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7fb4fa8f2700 slapd[153895]: syncrepl_entry: rid=150 inserted UUID 4320059e-bb3c-103d-8a4c-37ca95023e01 slapd[153895]: dn_callback : entries have identical CSN cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com 20230720112815.295348Z#000000#000#000000 slapd[153895]: syncrepl_entry: rid=150 be_search (0) slapd[153895]: syncrepl_entry: rid=150 cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com slapd[153895]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com) slapd[153895]: do_syncrep2: rid=150 LDAP_RES_INTERMEDIATE - REFRESH_DELETE slapd[153895]: do_syncrep1: rid=150 finished refresh slapd[153895]: do_syncrepl: rid=150 rc -1 retrying slapd[153895]: conn=1003 op=2 UNBIND slapd[153895]: conn=1003 fd=11 closed server01: slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.472410Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.472535Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474296Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474368Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474657Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474825Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474897Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474932Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.474973Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475011Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475037Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475128Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475154Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475183Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475217Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475241Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475270Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475351Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475392Z#000000#001#000000 manage=0 slapd[85336]: slap_get_csn: conn=-1 op=0 generated new csn=20230720114843.475414Z#000000#001#000000 manage=0 slapd[85336]: syncprov_db_open: starting syncprov for suffix dc=xitong,dc=qianxin,dc=com slapd[85336]: slapd starting slapd[85336]: do_syncrep1: rid=150 starting refresh (sending cookie=rid=150,sid=001,csn=20230716091536.511728Z#000000#001#000000) slapd[85336]: do_syncrep2: rid=150 LDAP_RES_INTERMEDIATE - SYNC_ID_SET slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 11ab4eb8-b805-103d-972c-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com ours 20230716091536.553583Z#000000#001#000000, new 20230716091536.513653Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 11acb24e-b805-103d-972d-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com ours 20230716091536.561584Z#000000#001#000000, new 20230716091536.522757Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 11ade9f2-b805-103d-972e-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com ours 20230716091536.569582Z#000000#001#000000, new 20230716091536.530734Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 11ae9050-b805-103d-972f-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com ours 20230716091536.573931Z#000000#001#000000, new 20230716091536.534994Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 11af3d48-b805-103d-9730-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com ours 20230716091536.579566Z#000000#001#000000, new 20230716091536.539423Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=system,dc=xitong,dc=qianxin,dc=com, UUID: 11b08284-b805-103d-9731-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=system,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=system,dc=xitong,dc=qianxin,dc=com ours 20230716091536.591594Z#000000#001#000000, new 20230716091536.547746Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=system,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com, UUID: 11b12d4c-b805-103d-9732-b9f3032e5223 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 be_add cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com (68) slapd[85336]: dn_callback : new entry is older than ours cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com ours 20230716091536.595832Z#000000#001#000000, new 20230716091536.552121Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=security,cn=system,dc=xitong,dc=qianxin,dc=com, UUID: 11b885c4-b805-103d-9ccb-b18d19d8567b slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: dn_callback : entries have identical CSN cn=security,cn=system,dc=xitong,dc=qianxin,dc=com 20230716091536.600260Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=security,cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=security,cn=system,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=audit,cn=system,dc=xitong,dc=qianxin,dc=com, UUID: 11b95bf2-b805-103d-9ccc-b18d19d8567b slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: dn_callback : entries have identical CSN cn=audit,cn=system,dc=xitong,dc=qianxin,dc=com 20230716091536.605744Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=audit,cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=audit,cn=system,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: ou=gidNumber,dc=xitong,dc=qianxin,dc=com, UUID: 11ba8ea0-b805-103d-9ccd-b18d19d8567b slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: dn_callback : new entry is older than ours ou=gidNumber,dc=xitong,dc=qianxin,dc=com ours 20230720112814.263879Z#000000#000#000000, new 20230716091536.613594Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 ou=gidNumber,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (ou=gidNumber,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: ou=policies,dc=xitong,dc=qianxin,dc=com, UUID: 11bc5082-b805-103d-9cce-b18d19d8567b slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: dn_callback : entries have identical CSN ou=policies,dc=xitong,dc=qianxin,dc=com 20230716091536.625081Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 ou=policies,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (ou=policies,dc=xitong,dc=qianxin,dc=com) slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com, UUID: 11bd03ec-b805-103d-9ccf-b18d19d8567b slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: dn_callback : entries have identical CSN cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com 20230716091536.629686Z#000000#001#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com) slapd[85336]: do_syncrep2: rid=150 LDAP_RES_INTERMEDIATE - REFRESH_PRESENT slapd[85336]: do_syncrep2: rid=150 cookie=rid=150,sid=014,csn=20230716091536.629686Z#000000#001#000000 slapd[85336]: do_syncrep1: rid=150 finished refresh slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11a73b5c-b805-103d-9cbd-b18d19d8567b, dn dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11a9b7b0-b805-103d-9cbe-b18d19d8567b, dn cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11ab0386-b805-103d-9cbf-b18d19d8567b, dn cn=ALL,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=ALL,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11ace4c6-b805-103d-9cc0-b18d19d8567b, dn cn=work,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=work,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11ad87b4-b805-103d-9cc1-b18d19d8567b, dn cn=yarn,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=yarn,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11aebb70-b805-103d-9cc2-b18d19d8567b, dn cn=mr,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=mr,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b01e84-b805-103d-9cc3-b18d19d8567b, dn cn=hbase,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=hbase,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b16668-b805-103d-9cc4-b18d19d8567b, dn cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b29f06-b805-103d-9cc5-b18d19d8567b, dn cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b3d75e-b805-103d-9cc6-b18d19d8567b, dn cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b48140-b805-103d-9cc7-b18d19d8567b, dn cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b55d68-b805-103d-9cc8-b18d19d8567b, dn cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b73340-b805-103d-9cc9-b18d19d8567b, dn cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=system,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 nonpresent UUID 11b7d8c2-b805-103d-9cca-b18d19d8567b, dn cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 adding entry cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com to non-present list slapd[85336]: nonpresent_callback: rid=150 present UUID 11b885c4-b805-103d-9ccb-b18d19d8567b, dn cn=security,cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 present UUID 11b95bf2-b805-103d-9ccc-b18d19d8567b, dn cn=audit,cn=system,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 present UUID 11bc5082-b805-103d-9cce-b18d19d8567b, dn ou=policies,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 present UUID 11bd03ec-b805-103d-9ccf-b18d19d8567b, dn cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com slapd[85336]: nonpresent_callback: rid=150 had 15 items left in the list slapd[85336]: slap_queue_csn: queueing 0x7f20fc10fd60 20230716091536.629686Z#000000#001#000000 slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b7d8c2-b805-103d-9cca-b18d19d8567b slapd[85336]: slap_graduate_commit_csn: removing 0x7f20fc10fd60 20230716091536.629686Z#000000#001#000000 slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=admin,cn=system,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=system,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=system,dc=xitong,dc=qianxin,dc=com (66) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=system,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_checkpoint: running checkpoint slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b73340-b805-103d-9cc9-b18d19d8567b slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b55d68-b805-103d-9cc8-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=noah,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b48140-b805-103d-9cc7-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=s3,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b3d75e-b805-103d-9cc6-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=flume,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b29f06-b805-103d-9cc5-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=kafka,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b16668-b805-103d-9cc4-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=hive,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=hbase,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11b01e84-b805-103d-9cc3-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=hbase,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=mr,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11aebb70-b805-103d-9cc2-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=mr,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=yarn,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11ad87b4-b805-103d-9cc1-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=yarn,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=work,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11ace4c6-b805-103d-9cc0-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=work,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=ALL,cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11ab0386-b805-103d-9cbf-b18d19d8567b slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=ALL,cn=default,dc=xitong,dc=qianxin,dc=com (0) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete cn=default,dc=xitong,dc=qianxin,dc=com (66) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=cn=default,dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11a9b7b0-b805-103d-9cbe-b18d19d8567b slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: syncrepl_del_nonpresent: rid=150 be_delete dc=xitong,dc=qianxin,dc=com (66) slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: conn=-1 op=0 syncprov_add_slog: adding csn=20230716091536.629686Z#000000#001#000000 to sessionlog, uuid=11a73b5c-b805-103d-9cbd-b18d19d8567b slapd[85336]: slap_queue_csn: queueing 0x7f20fc111370 20230716091536.629686Z#000000#001#000000 slapd[85336]: conn=-1 op=0 syncprov_matchops: recording uuid for dn=dc=xitong,dc=qianxin,dc=com on opc=0x7f20fc006268 slapd[85336]: slap_graduate_commit_csn: removing 0x7f20fc111370 20230716091536.629686Z#000000#001#000000 slapd[85336]: conn=1000 fd=14 ACCEPT from IP=server02:52108 (IP=0.0.0.0:389) slapd[85336]: conn=1000 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" method=128 slapd[85336]: conn=1000 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" mech=SIMPLE bind_ssf=0 ssf=0 slapd[85336]: conn=1000 op=0 RESULT tag=97 err=0 qtime=0.000023 etime=0.000186 text= slapd[85336]: conn=1000 op=1 SRCH base="dc=xitong,dc=qianxin,dc=com" scope=2 deref=0 filter="(objectClass=*)" slapd[85336]: conn=1000 op=1 SRCH attr=* + slapd[85336]: conn=1000 op=1 syncprov_op_search: got a persistent search with a cookie=rid=150,sid=014,csn=20230716091536.629686Z#000000#001#000000 slapd[85336]: conn=1000 op=1 syncprov_findbase: searching slapd[85336]: conn=1000 op=1 syncprov_op_search: registered persistent search slapd[85336]: conn=1000 op=1 ENTRY dn="ou=gidnumber,dc=xitong,dc=qianxin,dc=com" slapd[85336]: conn=1000 op=1 syncprov_search_response: Entry cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com CSN 20230716091536.629686Z#000000#001#000000 older or equal to ctx 20230716091536.629686Z#000000#001#000000 slapd[85336]: conn=1000 op=1 ENTRY dn="cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com" slapd[85336]: conn=1000 op=1 syncprov_sendinfo: refreshDelete cookie= slapd[85336]: conn=1000 op=1 INTERMEDIATE oid=1.3.6.1.4.1.4203.1.9.1.4 slapd[85336]: conn=1000 op=1 syncprov_search_response: detaching op slapd[85336]: do_syncrep2: rid=150 cookie=rid=150,sid=014 slapd[85336]: syncrepl_message_to_entry: rid=150 DN: ou=gidNumber,dc=xitong,dc=qianxin,dc=com, UUID: 11ba8ea0-b805-103d-9ccd-b18d19d8567b slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) csn=(none) tid 0x7f21088a2700 slapd[85336]: dn_callback : entries have identical CSN ou=gidNumber,dc=xitong,dc=qianxin,dc=com 20230720112814.263879Z#000000#000#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 ou=gidNumber,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (ou=gidNumber,dc=xitong,dc=qianxin,dc=com) slapd[85336]: do_syncrep2: rid=150 cookie=rid=150,sid=014 slapd[85336]: syncrepl_message_to_entry: rid=150 DN: cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com, UUID: 4320059e-bb3c-103d-8a4c-37ca95023e01 slapd[85336]: syncrepl_entry: rid=150 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f21090a3700 slapd[85336]: dn_callback : entries have identical CSN cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com 20230720112815.295348Z#000000#000#000000 slapd[85336]: syncrepl_entry: rid=150 be_search (0) slapd[85336]: syncrepl_entry: rid=150 cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com slapd[85336]: syncrepl_entry: rid=150 entry unchanged, ignored (cn=test011,cn=default,dc=xitong,dc=qianxin,dc=com) This is the log printed by openldap when I try to get data from other machines: slapd[85336]: conn=1001 fd=15 ACCEPT from IP=Myserver:56212 (IP=0.0.0.0:389) slapd[85336]: conn=1001 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" method=128 slapd[85336]: conn=1001 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" mech=SIMPLE bind_ssf=0 ssf=0 slapd[85336]: conn=1001 op=0 RESULT tag=97 err=0 qtime=0.000043 etime=0.000286 text= Jul 20 19:49:20 4txf46unrccv slapd[85336]: conn=1001 op=1 UNBIND Jul 20 19:49:20 4txf46unrccv slapd[85336]: conn=1001 fd=15 closed Jul 20 19:49:20 4txf46unrccv slapd[85336]: conn=1002 fd=15 ACCEPT from IP=Myserver:56214 (IP=0.0.0.0:389) Jul 20 19:49:20 4txf46unrccv slapd[85336]: conn=1002 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" method=128 Jul 20 19:49:20 4txf46unrccv slapd[85336]: conn=1002 op=0 BIND dn="cn=admin,dc=xitong,dc=qianxin,dc=com" mech=SIMPLE bind_ssf=0 ssf=0 Jul 20 19:49:20 4txf46unrccv slapd[85336]: conn=1002 op=0 RESULT tag=97 err=0 qtime=0.000047 etime=0.000188 text= slapd[85336]: conn=1002 op=1 SRCH base="dc=xitong,dc=qianxin,dc=com" scope=1 deref=0 filter="(objectClass=*)" slapd[85336]: conn=1002 op=1 SRCH attr=hasSubordinates objectclass entryFlags userAccountControl lockouttime msDS-UserAccountDisabled ms-DS-UserAccountAutoLocked slapd[85336]: conn=1002 op=1 ENTRY dn="ou=policies,dc=xitong,dc=qianxin,dc=com" slapd[85336]: conn=1002 op=1 ENTRY dn="ou=gidnumber,dc=xitong,dc=qianxin,dc=com" slapd[85336]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000043 etime=0.000524 nentries=2 text= slapd[85336]: conn=1002 op=2 SRCH base="ou=policies,dc=xitong,dc=qianxin,dc=com" scope=1 deref=0 filter="(objectClass=*)" slapd[85336]: conn=1002 op=2 SRCH attr=hasSubordinates objectclass entryFlags userAccountControl lockouttime msDS-UserAccountDisabled ms-DS-UserAccountAutoLocked slapd[85336]: conn=1002 op=2 ENTRY dn="cn=default,ou=policies,dc=xitong,dc=qianxin,dc=com" slapd[85336]: conn=1002 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000045 etime=0.000417 nentries=1 text=

1 1

question on include ./acls/*.conf
by cYuSeDfZfb cYuSeDfZfb 20 Jul '23

20 Jul '23

Hi, We're wondering: is there some clever way to include any number of .conf files that exist in a certain directory? Something like, in slapd.conf: include /opt/symas/etc/openldap/acls/*.conf This would allow us to simply add & remove.conf files under that directory, and restart openldap. We're now getting errors: /opt/symas/etc/openldap/slapd.conf: line 109 (include /opt/symas/etc/openldap/acls/*.conf) could not stat config file " /opt/symas/etc/openldap/acls/*.conf": No such file or directory Is that way of configuring (wildcard includes) not supported..? Or are we missing something else? Is there some other way of doing this..?

3 3

Re: python-lmdb crashing ( d <= env->me_pglast' failed in mdb_freelist_save()) - unusable 300gb database
by mark jayson 19 Jul '23

19 Jul '23

Yep, my bad. LMDB version bundled is 0.9.29. >>> print(lmdb.version()) (0, 9, 29) On Wed, Jul 19, 2023 at 2:11 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Wednesday, July 19, 2023 2:59 AM +0800 mark jayson > <mark.alvarez123(a)gmail.com> wrote: > > > > > The lmdb version I'm using is: > > > > Python 3.10.6 > > > > lmdb==1.4.1 > > I'm going to guess that's the version of the python LMDB library. But the > deeper question is what is the version of the LMDB C library it is linked > to? > > --Quanah > > > > >

1 0

python-lmdb crashing ( d <= env->me_pglast' failed in mdb_freelist_save()) - unusable 300gb database
by mark jayson 18 Jul '23

18 Jul '23

Hello, I've created a program that writes data to an lmdb database using python bindings. I've written about 300gb worth of data but when I was re-reading the database by running my script again, it crashes immediately. Did a backtrace in gdb and this is what I got: Really have no clue what's going on here. I suspect that the server has rebooted (or was rebooted by someone while I was running the script but I thought lmdb is crash-proof. Do you have any idea how to best troubleshoot this? The database is worth 300gb+ so it's not easy to share it, not to mention it contains sensitive information. Starting program: /usr/bin/python3 read_events.py -d jul012022-23/ [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". build/lib/mdb.c:3274: Assertion 'len >= 0 && id <= env->me_pglast' failed in mdb_freelist_save() Program received signal SIGABRT, Aborted. __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737350283264) at ./nptl/pthread_kill.c:44 44 ./nptl/pthread_kill.c: No such file or directory. (gdb) backtrace #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737350283264) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140737350283264) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140737350283264, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007ffff7c96476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007ffff7c7c7f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007ffff62fb3e2 in mdb_assert_fail (env=0x5555565b49f0, expr_txt=expr_txt@entry=0x7ffff62fe308 "len >= 0 && id <= env->me_pglast", func=func@entry=0x7ffff62fe930 <__func__.13> "mdb_freelist_save", line=line@entry=3274, file=0x7ffff62fe010 "build/lib/mdb.c") at build/lib/mdb.c:1545 #6 0x00007ffff62f10df in mdb_freelist_save (txn=0x555556752950) at build/lib/mdb.c:3274 #7 mdb_txn_commit (txn=0x555556752950) at build/lib/mdb.c:3646 #8 0x00007ffff62f369b in txn_db_from_name (env=env@entry=0x7ffff61c8090, name=<optimized out>, flags=262144) at lmdb/cpython.c:1017 #9 0x00007ffff62f6e1d in env_open_db (self=0x7ffff61c8090, args=<optimized out>, kwds=<optimized out>) at lmdb/cpython.c:1665 #10 0x00005555556b23a9 in ?? () #11 0x0000555555699c14 in _PyEval_EvalFrameDefault () #12 0x0000555555696176 in ?? () #13 0x000055555578bc56 in PyEval_EvalCode () #14 0x00005555557b8b18 in ?? () #15 0x00005555557b196b in ?? () #16 0x00005555557b8865 in ?? () #17 0x00005555557b7d48 in _PyRun_SimpleFileObject () #18 0x00005555557b7a43 in _PyRun_AnyFileObject () #19 0x00005555557a8c3e in Py_RunMain () #20 0x000055555577ebcd in Py_BytesMain () #21 0x00007ffff7c7dd90 in __libc_start_call_main (main=main@entry=0x55555577eb90, argc=argc@entry=14, argv=argv@entry=0x7fffffffe378) at ../sysdeps/nptl/libc_start_call_main.h:58 #22 0x00007ffff7c7de40 in __libc_start_main_impl (main=0x55555577eb90, argc=14, argv=0x7fffffffe378, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe368) at ../csu/libc-start.c:392 #23 0x000055555577eac5 in _start () (gdb) client_loop: send disconnect: Broken pipe For what it's worth, this is how I've opened the database environment: dbenv = lmdb.open(db_dir, map_size=1099511627776, max_dbs=11, readahead=False)

3 3

Different loglevels based on IP prefix?
by Dick Visser 18 Jul '23

18 Jul '23

Hi Is there any way to configure slapd to log queries from certain addresses differently? I'm asking because we would like to have detailed logging for real traffic, but the loglevel we picked (stats + sync) our health checks cause a lot of noise. Since the health checks are located at specific IP addresses/prefixes, ideally we could have less or no logging for those. thanks Dick Visser

2 1

Re: [EXT] Re: pwdAccountLockedTime does not have any impact
by CVZ 17 Jul '23

17 Jul '23

Hi Everybody, Tanks Clément and tempo for your replies. Sorry for my late reply, last week was really busy. I confirm that applying ppolicy configuration, its now working fine. Ulrich, bellow, you have all the steps (Ubuntu with 2.5.14 openldap) Thanks / Merci Best Damien #configppolicy.ldif dn: olcOverlay=ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=abc,dc=org sudo -u openldap slapadd -n0 -l configppolicy.ldif ################### # Policies.ldif dn: ou=policies,dc=abc,dc=org objectClass: organizationalUnit ou: policies sudo -u openldap slapadd -n1 -l Policies.ldif ################### # Policies2.ldif dn: cn=default,ou=policies,dc=abc,dc=org objectClass: pwdPolicy objectClass: organizationalRole cn: default pwdAttribute: userPassword pwdMinAge: 0 pwdMinLength: .... pwdCheckQuality: 2 pwdMaxFailure: ... pwdLockout: TRUE pwdLockoutDuration: .... ... sudo -u openldap slapadd -n1 -l Policies2.ldif And restart slapd service On 12/7/23 15:42, Windl, Ulrich wrote: > Hi! > > You mean something like this?: > dn: cn=PP-Default,dc=policies,dc=...,dc=de > changetype: add > objectClass: namedObject > objectClass: pwdPolicy > cn: PP-Default > pwdAllowUserChange: TRUE > pwdAttribute: userPassword > pwdCheckQuality: 1 > pwdExpireWarning: 604800 > pwdFailureCountInterval: 1209600 > pwdLockout: TRUE > pwdLockoutDuration: 1800 > pwdMaxFailure: 10 > pwdMinAge: 30 > pwdMinLength: 8 > pwdMustChange: TRUE > pwdSafeModify: FALSE > > This is for an older version (obviously), however... > > Regards, > Ulrich > > -----Original Message----- > From: tempo(a)net-c.com <tempo(a)net-c.com> > Sent: Tuesday, July 11, 2023 6:02 PM > To: bremont(a)cvz.es; openldap-technical(a)openldap.org > Subject: [EXT] Re: pwdAccountLockedTime does not have any impact > > Hi, > > Could you show us your ppolicy settings please ? > > As far as I remember, you need at least pwdLockout set to TRUE in order to have the attribute pwdAccountLockedTime checked. > > > > > De : CVZ <bremont(a)cvz.es> > À : openldap-technical(a)openldap.org > Sujet : pwdAccountLockedTime does not have any impact > Date : 11/07/2023 11:41:41 Europe/Paris > > > > Hi Everybody, <https://urldefense.com/v3/__https://stackoverflow.com/posts/76341444/timeli… > > > Sorry, we are figghting with pwdAccountLockedTime. > > > I want to use "pwdAccountLockedTime" attribute to automatically lock an account using OpenLDAP (v.2.5.14). Whatever the value in the field, the account is never locked. > > I first started by activating the "ppolicy" module using slapadd and a ppolicy-module.ldif file suh as mentioned here "https://urldefense.com/v3/__https://stackoverflow.com/questions/49257247/ho… " <https://urldefense.com/v3/__https://stackoverflow.com/questions/49257247/ho… > , then I have checked that the module is loaded and I did not have any problem: > > $ sudo slapcat -n 0 | grep olcModuleLoad | grep ppolicy > olcModuleLoad: {0}ppolicy > > > Then, I have extended the LDAP scheme to allow using of ppolicy attributes such as "pwdAccountLockedTime". I have set it to "00000101000000Z" in order to lock permanently an account (to check if it was working). But I still can connect (using LDAP Admin tools) with the account that was supposed to be locked. > > We also tried to modify the value > > > dn: uid=... > replace: pwdAccountLockedTime > pwdAccountLockedTime: 20221021135537Z > > And even with dates in the future, but we are still able to connect. With whoami command, or from a SOGo webmail connected to the LDAP server. > > > Any idea? > Thank in advance for your help. > > > Best > Damien > >

1 0

Openldap 2.4 : Replication issue
by ramprasad.sharma＠orange.com 14 Jul '23

14 Jul '23

Dear Team, I'm facing a weird issue : My env is : root@repnode:~# ldap-utils/focal-security,focal-updates,now 2.4.49+dfsg-2ubuntu1.9 amd64 [installed,automatic] libldap-2.4-2/focal-security,focal-updates,now 2.4.49+dfsg-2ubuntu1.9 amd64 [installed,automatic] libldap-common/focal-security,focal-updates,now 2.4.49+dfsg-2ubuntu1.9 all [installed,automatic] sssd-ldap/focal-security,focal-updates,now 2.2.3-3ubuntu0.12 amd64 [installed,automatic] root@repnode:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 20.04.6 LTS Release: 20.04 Codename: focal root@repnode:~# Earlier, I was using two replications, without any filter and attrs..both were working fine.. But I got the requirement to select specific attributes from the master node. I applied filters and attrs based on the requirement. ( I Checked it in ldapsearch and it was working fine ) ( searchbase in both replications are different ) Replication highlighted in green is working fine.. But the replication highlighted in red is not working when applied filters , attrs or both ( without filters and attrs , it will replicating full data of that subtree ). syncrepl rid=AAA provider=ldaps://master.node:636/ bindmethod=simple filter="(objectClass=posixAccount)" attrs="cn,uid,x1sshPubKey,x2sshPubKey,uidNumber,gidNumber,homeDirectory,gecos,loginShell,description,sshPublicKey" binddn="cn=rep,dc=di-diod,dc=tech" credentials=XX searchbase="ou=people,dc=di-diod,dc=tech" scope=sub schemachecking=on type=refreshOnly interval=00:00:00:01 retry="30 5 300 3" # Replication source # The replication source must declare before mirrormode syncrepl rid=BBB provider=ldaps://master.node:636/ bindmethod=simple binddn="cn=rep,dc=di-diod,dc=tech" credentials=XX searchbase="ou=groups,dc=di-diod,dc=tech" filter="(objectClass=posixGroup)" attrs="cn,gidNumber,memberUid" scope=sub schemachecking=on type=refreshOnly interval=00:00:00:01 retry="30 5 300 3" I'm wondering, what I've done wrong here..Please help me for this issue. Warm Regards, Ram Prasad Sharma +91-9871192778 Orange Restricted ____________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical July 2023