openldap-technical

openldap-technical@openldap.org

9851 discussions

Re: Replication issue during performance test with MMR configuration and LastBind enabled
by Falgon 16 Oct '24

16 Oct '24

Hello, I'm working on the same project as Meheni. Thanks for your answer, we'll try version 2.6 OpenLDAP using the lastbind-precision. However we have several questions for the current version we're using. Is this a known problem and referenced somewhere? (we haven't found it) Is it normal to find no replication error logs even in stats + sync mode? We ran some tests in sequential mode (300,000 accounts one after the other) and managed to reproduce the problem. -Denis Le mer. 11 oct. 2023 à 14:11, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > > > --On Tuesday, October 10, 2023 9:30 PM +0200 Ziani Meheni > <mehani06(a)gmail.com> wrote: > > > > > > > Hello, we are working on a project and we've come across a problem with > > the replication after performance testing : > > You need to use OpenLDAP 2.6 and then set the: > > lastbind-precision > > value. I use 5 minutes. > > --Quanah >

4 8

Advice for upgrade from OpenLDAP 2.4 to 2.6?
by gsafcik+ldap＠gmail.com 15 Oct '24

15 Oct '24

Hello all, We are planning an upgrade from OpenLDAP 2.4 to 2.6. We would like some guidance on the upgrade path. We are currently looking over the upgrade guides: - https://www.openldap.org/doc/admin25/appendix-upgrading.html - https://www.openldap.org/doc/admin26/appendix-upgrading.html Currently, we build OpenLDAP from source to create the RPMs and then install them. We are building version 2.4.56-4. Originally they were built for CentOS 7, but we've recently converted to AWS AL2023. We have 3 mdb write instances (synced to each other) and then many hdb read instances (consumers) syncing to those. The following are the RPMs built: - openldap-2.4.56-4.el7.x86_64.rpm - openldap-clients-2.4.56-4.el7.x86_64.rpm - openldap-compat-2.4.56-4.el7.x86_64.rpm - openldap-debuginfo-2.4.56-4.el7.x86_64.rpm - openldap-devel-2.4.56-4.el7.x86_64.rpm - openldap-servers-2.4.56-4.el7.x86_64.rpm We plan on addressing the components listed in those guides earlier and to build/install version 2.6 as we have before. We have run into an issue before where CPU spiked on our consumers when we tried to change them to mdb which stopped the 2.5 upgrade but now we're thinking of upgrading and changing the backend to mdb at the same time for the upgrade. We wanted to see if anyone has any advice or caveats that they've run into during their upgrades and to see if this general upgrade path is good. We appreciate any help anyone can offer with the OpenLDAP upgrade. Thanks!

3 2

ACL: write vs. manage
by Windl, Ulrich 14 Oct '24

14 Oct '24

Hi! Basically I have the same question as unanswered https://serverfault.com/q/998893/407952: What is the difference between write and manage? I have a use with write permissions for pwdGraceUseTime, and deleting that attribute requires "-e relax" for ldapmodify. However when my user ties it, it gets a ldap_modify: Insufficient access (50) Kind regards, Ulrich

2 1

symas2.6.7 is data transfer is faster in centos7 but very very slow in rocky8
by anilkumar.pathuri7＠gmail.com 11 Oct '24

11 Oct '24

Hi Team, GM We are working on moving from openldap2.4.44 to symasldap2.6.7. We have total of 13million docs. centos7 to centos7 is taking 1~2hours where as rocky8 is taking 48hours and more. Settings of centos7 and rocky8 are identical. We are moving to rocky8 as centos7 is EOL. Can you please let us know how we can fix the data transfer issue. Regards, Anil P

4 14

ldapsearch by aliased objectClass
by Joril 11 Oct '24

11 Oct '24

Hello, I've created an alias by following the FAQ at https://www.openldap.org/faq/data/cache/1111.html dn: uid=alias,ou=People,dc=example,dc=net objectclass: alias objectclass: extensibleObject uid: alias aliasedobjectname: uid=target,ou=Retired People,dc=example,dc=com The problem I'm facing is that this needs to be queried by an application (out of my control) that queries LDAP looking for a particular objectClass, like this: (&(objectClass=person)(uid=alias)) This query misses the alias, I guess because the alias object has just "alias" and "extensibleObject" as classes... Is this expected? Is there a way to work around this, server-side? I mean, to tell the LDAP server to look for "aliased" properties? Many thanks for your time!

3 3

An interesting note on using ldappasswd in OpenLDAP 2.4
by Windl, Ulrich 09 Oct '24

09 Oct '24

Hi! In the past I was using some LDAP administrator account to reset a user's password (using "ldappasswd -H $server -x -ZZ -D $admin -W "$DN""), and the system output the new password. But after having created a special account that ist to be used to reset passwords only, the same command failed with Result: Constraint violation (19) Additional info: Password fails quality checking policy So it seems the admin account circumvents the password policy restrictions, while the special account does not. But the main reason I'm writing this is that the passwords generated by ldappasswd do not seem to fulfill today's requirements (too short, basically). However 2.4 is very old, and it seems the current ldappasswd does no longer create automatic passwords (reading https://git.openldap.org/openldap/openldap/-/blob/master/clients/tools/ldap…). Regards, Ulrich

2 1

Slapd process randomly hangs on consumers and comes back to life after a while with no intervention
by Pierre-Jean CROUZET 20 Sep '24

20 Sep '24

Hello, To start with, this is my very first post on a mailing list of this kind. I've read much about how to do things right, like here: https://www.openldap.org/doc/admin24/troubleshooting.html or here: https://www.openldap.org/faq/data/cache/59.html Nonetheless, please do tell me if I'm not following the standards. I'm facing an issue with my OpenLDAP servers that I struggle to fix or even find info about. To summarize: We have an architecture of 2 providers with mirror mode replication for their configuration. They are LXC's hosted in a datacenter. We have 2 consumers with mirror mode replication for their config also, and they get the DB (mdb backend) from the above providers. They are VMs hosted in a different hypervisor and datacenter than the providers. We have a loadbalancing architecture in front that sends requests evenly to the 4 servers. The writes requests directed to the consumers are forwarded to the providers using the chain overlay. The slapd process of those 2 consumers randomly hangs. When it happens, the slapd service is still running and listening, but not a single query can go through, even the logging stops. Like a complete freeze. The service comes back to life after some time (several minutes, different every time) without any manual intervention. Trying to manually restart the process during such even obviously fails, unless I kill -9, which is not something I want to do. My observations so far : - The hangs appear only during business hours (nothing during nights or week-end). - Only the consumers hang. The providers are always fine. - CPU / RAM / Disks are fine before / during the crashes. - The hangs seem random and I could not find a way to trigger them at will. - strace shows the following lines in an infinite loop during hangs. ``` [pid 1082] gettimeofday({tv_sec=1726669191, tv_usec=694473}, NULL) = 0 [pid 1082] poll([{fd=18, events=POLLIN|POLLPRI}], 1, 100) = 0 (Timeout) [pid 1082] sched_yield() ``` It seems that the process is waiting for some data that never comes. The fd=18 is referencing to a TCP socket connected to provider1. So it would suggests that the provider is not sending what the consumer wants. This has led me to several suppositions: 1. Network issues Unlikely, since only those 2 servers in the DC are experiencing misbehavior, and I can telnet / ldapsearch from the faulty consumer to the provider with no problem during hangs. 2. Syncrepl / slapo-chain misconfiguration I might have a configuration problem, but no matter how much I review it, I don't see what's wrong. I've provided the syncrepl / slapo-chain conf in the config.ldif attachment. I've also provided several other attachments that I thought would be helpful: - log.txt => The slapd logs in trace level that show the last bind before the service hangs. - ldaps_request.log => An ldapsearch performed against the faulty consumer during hang. - starttls_request.log => Same as above, but using StartTLS => the connection seems successful and stops at the server hello TLS exchange. Versions : - slapd: 2.5.18 LTS - Server: Ubuntu 22.04 LTS I am a bit out of ideas on things I could try to fix the issues. Hence this email. I thank you for your time and I am very grateful for any help you could give me. Regards, Pierre-Jean

1 0

"realdn" in auditlog
by Christopher Paul 18 Sep '24

18 Sep '24

Hi OpenLDAP-Technical, What does a comment beginning with "realdn" mean in an auditlog LDIF? I see it after the first line of COMMENT FIELD INFORMATION on some modify operations. Running version 2.5.18 on Ubuntu. At first glance, it looks like it's due to overlays (refint, ppolicy) making modifications as a result of an operation by "realdn"(?)b Many thanks for any insight on this. -- Chris Paul | Rex Consulting |https://www.rexconsulting.net ParaphraseBasicClose

2 1

Double free in ldap_set_option
by radiatejava 16 Sep '24

16 Sep '24

I am getting double free core from ldap library. We are running this version of the code (2.4.49 with 2 patches). git clone https://github.com/openldap/openldap.git -b OPENLDAP_REL_ENG_2_4_49 git cherry-pick 32e965c27134d3d83adbf471186330e361150491 git cherry-pick 5452fb154eaabc46992402a4f1bb1081bc367157 Any idea what could be going on? I am putting the stack trace below: #2 0x00007a1e506d7590 in DoLiveCoreDump (cause=0x7a1e506df7e2 "DoubleFree") at src/heap-profiler.cc:732 #3 0x00007a1e506bed31 in (anonymous namespace)::do_free_with_callback (ptr=ptr@entry=0x5af3d4216dc8, invalid_free_fn=0x7a1e506bd270 <(anonymous namespace)::InvalidFree(void*)>) at src/tcmalloc.cc:1299 #4 0x00007a1e506dd467 in (anonymous namespace)::do_free (ptr=0x5af3d4216dc8) at src/tcmalloc.cc:1376 #5 tc_free (ptr=0x5af3d4216dc8) at src/tcmalloc.cc:1761 #6 0x00007a1e3f19106b in ldap_pvt_tls_set_option (ld=ld@entry=0x0, option=option@entry=24579, arg=arg@entry=0x7a1e416e2220) at tls2.c:766 #7 0x00007a1e3f186386 in ldap_set_option (ld=0x0, option=24579, invalue=0x7a1e416e2220) at options.c:791 #8 0x00007a1e415e03fd in auth::LdapAuthenticationBroker::connectAndBindLdap(sec::LdapProvider const&) () from /mgmt/usr/lib/x86_64-linux-gnu/libauth.so

2 1

Search callbacks for refreshAndPersist sync searches
by Hawes, David 10 Sep '24

10 Sep '24

I have a custom overlay that registers a callback to rewrite attribute values for searches. I noticed that it was not working for refreshAndPersist sync searches for queued responses, and the reason for this is that there are no callbacks registered in syncprov_qtask() [1]. I'd see the initial responses come through with rewritten attributes, but later responses would not be rewritten. I had some success adding the callbacks back, but it was a bit of a minefield. Before investigating further, I was hoping to understand why the decision was made to not set callbacks in syncprov_qtask(). For now I'm operating under the assumption that this is simply not supported. So, why aren't callbacks supported for queued sync responses? I noticed that valsort doesn't handle syncrepl responses [2], and I wonder if the reason is because the results may be inconsistent, as I am experiencing. [1] https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/serv… [2] https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/serv…

2 3

← Newer
1
...
8
9
10
11
12
13
14
...
986
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical