openldap-technical

openldap-technical@openldap.org

9897 discussions

In case ldap_install_tls fails, should we call ldap_unbind_ext?
by Simon Pichugin 23 Nov '20

23 Nov '20

Hello, I have a question regarding libldap function ldap_install_tls(). If it fails, is it the right thing to call ldap_unbind_ext() after that? If we call it, does it mean that ldap_install_tls() made a bind? Or do we call ldap_install_tls() on the connection that is already bound? Sorry if the information is available somewhere, but I missed to find it. The only thing I found is that OpenLDAP server calls ldap_unbind_ext() in case of failure but maybe I miss something... https://git.openldap.org/openldap/openldap/-/blob/master/servers/slapd/back… Thank you, Simon

3 2

Antw: [EXT] Re: HAProxy protocol support?
by Ulrich Windl 20 Nov '20

20 Nov '20

>>> "Dr. Ogg" <ogg(a)sr375.com> schrieb am 18.11.2020 um 17:55 in Nachricht <DM5PR06MB32906E48D22C0F65570D9BD0F0E10(a)DM5PR06MB3290.namprd06.prod.outlook.com> > http://www.haproxy.org/download/1.8/doc/proxy‑protocol.txt > > for reference. > > > From: Howard Chu <hyc(a)symas.com> > Date: Wednesday, November 18, 2020 at 8:51 AM > To: Paul B. Henson <henson(a)acm.org>, openldap‑technical(a)openldap.org > <openldap‑technical(a)openldap.org> > Subject: Re: HAProxy protocol support? > Paul B. Henson wrote: >> So management is insisting that we migrate our openLDAP systems from on > premise into the cloud <sigh>. Specifically, AWS behind one of their load > balancers. >> >> However, we currently rely upon some level of IP address based access > control to distinguish between on‑campus and off‑campus clients. The Amazon > load balancers >> do client NAT, so the back end servers have no idea who is connecting at the > TCP/IP level. >> >> They do support the haproxy in band protocol for supplying this information > from the load balancer to the server, but that requires specific support from > the >> server to do. I don't see any such support in openldap or any evidence of > past discussion regarding it. >> >> Is this something that would be considered as a possible feature to be > included at some point, or something not desired as part of the code base? > > Depends on what that feature actually looks like. Feel free to submit a > proposal > on the ‑devel mailing list, including background info on what HAproxy > protocol > looks like, and what exact behaviors you want it to provide. I wonder: Would it be possible to use a specific named bind for on-campus hosts, and use the name used for binding to controll further access? > > ‑‑ > ‑‑ Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

NTLMv2 credentials over ldap
by moore chestnut 19 Nov '20

19 Nov '20

Hello. I have a proxy application acting as a ntlm server, that supports a NTLM handshake between web based clients. If using NTLMv1, sending the NTLM credential blob to an Active Directory over LDAP using openldap client works. openldap client Version. 2.4.32 Basically just taking the ntlm response from the NTLM 3 message from client and sending over LDAP. However using NTLMv2 , the active directory always issues invalid credentials even though the user name and password that the client entered are good. It passes with successful ldap bind with NTLMv1. Can or should this work with ntlmv2? It seems that when EPA and MIC is present from client in the NTLM3, that the ldap exchange does not work. I guess that may be an active directory issue but wanted to check if experts here think it should work. Thanks for your review.

1 0

LMDB alignment
by Alec Matusis 19 Nov '20

19 Nov '20

Our code gets references to 8 or 16 byte structs by casting pointers into LMDB data. 1. In a database with no DUPs and 8 byte (u64) keys, can we expect the corresponding value to have alignment 8? 2. In a database with DUPs and 8 byte (u64) keys, if a DUP value (stored as a key internally) is 16 bytes, does it mean that its alignment is 16? Does the 8 byte key size impact the alignment of its DUPs as it does in 1.?

2 1

how to add group in the slave/consumer node
by 张连生 18 Nov '20

18 Nov '20

Hi， My company maintains an openldap server which stores the information of all the employees. All company internal systems authenticate with it when users login. My department is responsible for software developing/testing and divided into many teams. I want to add the employees of my department to corresponding team in openldap so that I can manage user permission based on teams in jira/confluence/gerrit/gitlab/svn/jenkins and so on. However, I have no permission to add team or group to company openldap server. My plan is to : 1. set up a new openldap server inside my department. 2. synchronize the user data necessary from the company openldap server to my department openldap server. 3. create groups in department openldap server. 4. add users to corresponding group in department openldap server. 5. jira/confluence/gerrit/gitlab/svn/jenkins with authenticate with department openldap server instead of the company one. How to configure openldap to achieve this？I have googled for two days about replication/meta-directory, but still have no idea. BTW, I know Jira have similar functionality and can authenticate for confluence, but Jira can not authenticate for other sofeware such as gerrit/gitlab/svn/jenkins. Any help is appreciated. BRs, Liansheng

2 4

LTB OpenLDAP 2.4.56 (was:OpenLDAP 2.4.56 available)
by Clément OUDOT 16 Nov '20

16 Nov '20

Hello, Debian and RPM packages are now available on LTB repositories.See https://ltb-project.org/download#openldap Clément.

1 0

Connections blocked for some tens of seconds while a single slapd thread running 100%
by Simone Piccardi 11 Nov '20

11 Nov '20

Hi, we got a quite strange behaviour in which a slapd server stops processing connections for some tens of seconds while a single thread is running 100% on a single CPU and all other CPU are almost idle. When the problem arise there is no significant iowait or disk I/O (and no swapping, that's disabled). Context switches just go near zero (from some tens of thousand to some hundreds). Load average is almost always under 2. The server has 32G of RAM and 4 HT processors, is running openldap-2.4.54 in mirror mode (but no delta replication) using the mdb backend. The same behaviour was found also with 2.4.53. OpenLDAP is the only service running on it, apart SSH and some monitoring tools. Database maxsize is 25G around 17G are used. I'm attaching a redacted configuration of the main server (the secondary one is the same, with IDs reverted for mirror mode use) Most of the time it works just fine, processing a up to a few thousand of read query per second while having some tens of write per second. Connections are managed by HA-proxy, sending them to this server by default (used as main node). Many times these stop are short (around 10 second) and we don't lost connections, but when the problem arise and last for enough time, HAproxy switch to the second node, and we got downtimes. Staying with the secondary node we have the same behaviour. The problem manifests itself without periodicity and looking on the number of connection before it we could not see any usage peak. We tried to strace slapd threads during the problem, and they seem blocked on a mutex waiting for the one running at 100% (in a single CPU, user time). I'm attaching a top results during one of these events. From the behaviour I was suspecting (just a wild and uninformated guess) some indexing issue, blocking all access. We tried to change tool-threads to 4 because I found it cited in some example as related to threads used for indexing, but the change has no effect. Re-reading last version of man-page, if I understand it correctly, it's effective only for slapadd etc. So a first question is: there is any other configuration parameter about indexing that I can try? Anyway I'm not sure if there is an effective indexing issue (indexes are quite basic). I was suspecting this because there are lot of writes, and there is no strace activity during the stop. I should look somewhere else? Any suggestion on further checks or configuration changes will be more than appreciated. Regards Simone

5 7

Symas OpenLDAP for Linux 2.4.56-1 released
by Quanah Gibson-Mount 10 Nov '20

10 Nov '20

The latest version of Symas OpenLDAP for Linux, 2.4.56-1, is now available. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

HDB to MDB migration results in higher CPU usage on openldap consumers
by paul.jc＠yahoo.com 09 Nov '20

09 Nov '20

Hello, I have migrated from HDB to MDB backend and I am seeing higher CPU usage on my MDB openldap consumers. Has anyone else seen the same? Testing in my stage environment showed MDB to use less or the same amount of CPU than HDB - but now with real traffic and a large dataset I see sustained high CPU utilization. My production environment has the following specs: 6 consumer servers with 8vCPU x 16G RAM openldap version 2.4.45 Syncrepl enabled (with a single openldap provider server which is also MDB and has no issues and no high cpu). The database has ~230K users. data.mdb is about 1.8G in size. MDB database directives include: olcDbCheckpoint: 102400 10 olcDbNoSync: TRUE The rest are defaults. Indexing includes: olcDbIndex: businessCategory eq olcDbIndex: cn eq,sub olcDbIndex: description eq olcDbIndex: displayName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: gidNumber eq olcDbIndex: givenName eq,sub olcDbIndex: mail eq olcDbIndex: member eq olcDbIndex: memberOf eq olcDbIndex: memberUid eq olcDbIndex: objectClass pres,eq olcDbIndex: sn eq,sub olcDbIndex: uid eq,sub olcDbIndex: uidNumber eq olcDbIndex: uniqueMember eq These consumer servers are used for reads only. The initial sync with the provider is ok but once the consumers are actively handling read requests, CPU jumps to 60% usage on average. Our HDB consumers had half the resources (4vCPU and 8GB RAM) and less than half the CPU usage (average of 25% utilization). I have tested adding other MDB directives (writemap, mapasync, nordahead) but cannot get CPU utilization to come down close to what we see with the HDB backend. I have also load tested in my stage environment and was unable to reproduce (MDB generally utilized the same or less resources than HDB, but never double). There has been no change in the data or traffic between migration. We have also reverted some servers back to HDB and then back to MDB to confirm the high utilization. Has anyone else come across this with MDB and if so, were you able to alleviate CPU utilization? I can provide more details if needed. Any input welcome. Thanks! Paul

4 13

Increasing MDB_MAXKEYSIZE
by Alec Matusis 09 Nov '20

09 Nov '20

We ran into a MDB_BAD_VALSIZE limitation with a value size in a DUP value (which is a key). Can we increase the MDB_MAXKEYSIZE to 100KB or to 1MB without a significant performance penalty?

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical