openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Critical Issue : Openldap Slave Performance Issue of high recq
by keerthi krishnan 19 Feb '20

19 Feb '20

Hi , We have environment of multi-master and slave replication . master1 < =====> master 2 | | | | Slave 1 Slave 1 & & slave 2 slave 2 Now we are facing issue in all slaves, where replication from master is very slow. All slaves are single threaded. We are seeing High RECQ and sometimes server goes unavailable, untill we restart the slapd service. tcp 757967 0 ****:36340 <http://10.8.234.141:36340/> *****:636 <http://10.8.241.41:636/> ESTABLISHED 22160/slapd Could someone tell me, what kind of tuning we can perform?. If we make multi threaded, it will not have much performance. Kindly help .. Production servers are having this issue. Other system configuration like (Memory, load, disk) everything looks okay. I checked this kernel parameters as well. net.core.rmem_max = 4194304 net.ipv4.tcp_rmem = 4096 65536 4194304 Regards K.Keerthiga

2 1

Re: Urgent: New User with context CSN permission
by keerthi krishnan 16 Feb '20

16 Feb '20

hi Quanah, Thanks for guiding me. I have figured it out. It is working now. On Sun, 16 Feb 2020 at 01:22, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, February 15, 2020 9:21 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > Hi Quanah, > > > Now the user replmonitor has admin privilege, where it can list all cn > > ,. I have tried adding attrs=contextcsn , but no luck. Could you please > > guide me, how can i restrict this. > > contextcsn is an internally managed operational attribute, which means you > need to explicilty request it as a part of your search operation, or > request that all operational attrs be returned. How are you testing > whether or not the bind DN has the ability to read the attribute? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Urgent: New User with context CSN permission
by keerthi krishnan 16 Feb '20

16 Feb '20

Hi Quanah, Let me explain in detail. Now I can search the entire OU and contextCSN as below . I am searching with bind dn. ++ olcAccess: {1}to dn.subtree="dc=ldapprod,dc=com" by dn="cn=a dmin,dc=ldapprod,dc=com" write by dn="uid=authuser, dc=ldapprod,dc=com" write by dn="uid=repluser, dc=ldapprod,dc=com" read by dn="uid=replmonitor, dc=ldapprod,dc=com" read by * none ++ ldapsearch -x -H ldaps://IP address -D "uid=replmonitor,dc=ldapprod,dc=com" -W -b "dc=ldapprod,dc=com" contextCSN +++++ # ldapprod.com dn: dc=ldapprod,dc=com contextCSN: 20200212065804.242207Z#000000#000#000000 contextCSN: 20200213163933.076777Z#000000#001#000000 # admin, ldapprod.com dn: cn=admin,dc=ldapprod,dc=com # group, ldapprod.com dn: ou=group,dc=ldapprod,dc=com # people, ldapprod.com dn: ou=people,dc=ldapprod,dc=com # repluser, ldapprod.com dn: uid=repluser,dc=ldapprod,dc=com # authuser, ldapprod.com dn: uid=authuser,dc=ldapprod,dc=com # monitor, ldapprod.com dn: cn=monitor,dc=ldapprod,dc=com # replmonitor, ldapprod.com dn: uid=replmonitor,dc=ldapprod,dc=com +++++ Now replmonitor, got full access like admin where it can do all operation like cn=admin user. Now I want to restrict the user replmonitor only it can search and query contextcsn attr not any other dn. How can i achieve this?. Kindly guide me. On Sun, 16 Feb 2020 at 01:22, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, February 15, 2020 9:21 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > Hi Quanah, > > > Now the user replmonitor has admin privilege, where it can list all cn > > ,. I have tried adding attrs=contextcsn , but no luck. Could you please > > guide me, how can i restrict this. > > contextcsn is an internally managed operational attribute, which means you > need to explicilty request it as a part of your search operation, or > request that all operational attrs be returned. How are you testing > whether or not the bind DN has the ability to read the attribute? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Urgent: New User with context CSN permission
by keerthi krishnan 15 Feb '20

15 Feb '20

> > Hi Quanah, > > Thanks for the clarification. > > I have added as below > > +++ > olcAccess: {1}to dn.subtree="dc=ldapprod,dc=com" by dn="cn=a > dmin,dc=ldapprod,dc=com" write by dn="uid=authuser, > dc=ldapprod,dc=com" write by dn="uid=repluser, > dc=ldapprod,dc=com" read by dn="uid=replmonitor, > dc=ldapprod,dc=com" read by * none > +++ > > Now the user replmonitor has admin privilege, where it can list all cn ,. > I have tried adding attrs=contextcsn , but no luck. Could you please guide > me, how can i restrict this. > > Regards > K.Keerthiga > > > > On Fri, 14 Feb 2020 at 09:12, Quanah Gibson-Mount <quanah(a)symas.com> > wrote: > >> >> >> --On Friday, February 14, 2020 8:03 AM +0530 keerthi krishnan >> <keerthikrishnan1369(a)gmail.com> wrote: >> >> >> > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by >> > anonym >> > >> > ous auth by dn="cn=admin,dc=ldapprod,dc=com" write by dn="u >> > >> > id=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,d >> > >> > c=ldapprod,dc=com" read by * none >> > >> > olcAccess: {1}to dn.subtree="dc=ldappro,dc=com" by dn="cn=a >> > >> > dmin,dc=ldapprod,dc=com" write by dn="uid=authuser,dc=ldapprod,dc=com" >> > write by >> > >> > dn="uid=repluser,dc=ldapprod,dc=com" read by * none >> > >> > olcAccess: {2} to dn.subtree="dc=ldapprod,dc=com" attrs=contextCSN by >> > dn="uid=replmonitor,dc=ldapprod,dc=com" read by * none >> > =======> newly added >> >> Hi, >> >> As documented in the slapd.access(5) man page, ACL processing stops on >> the >> first matching rule. Since rule {1} covers access to all attributes >> except >> userPassword, your query for contextCSN matches rule {1} and rule {2} >> never >> fires. >> >> You probably want to move access rule {2} to be in front of {1}, and add >> additional "by" clauses to the rule to allow the admin, authuser, and >> repluser access to the attr. >> >> Regards, >> Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Product Architect >> Symas Corporation >> Packaged, certified, and supported LDAP solutions powered by OpenLDAP: >> <http://www.symas.com> > >

2 1

syncrepl syncing but not updating, contextCNS missing and schemacheck off
by jehan.procaccia＠imtbs-tsp.eu 15 Feb '20

15 Feb '20

Hello my syncrepl consumer does get initial synchronisation, but then is never updated I struggled a lot , to finally discover that contextCNS is not created on that replica, that might explain why it is not updated after initial sync . after different "try and catch" (ACLs, checpoint values etc ...) I finally discovered that setting schemachecking to *Off* (cf full syncrepl config below) on the consumer syncrepl config corrected the pb, contextCNS is then finally created after inital sync (after few dozen of seconds ...) and subsequent updated on master does get replicated on consumer. Shemas a stricly the same on provider (master) end consumer (replica) what would explain that schemachecking directive to break syncrepl contextCNS to be created ? is it wrong to run replicas with schemacheck Off ? maybe related , but no real solution to me : https://stackoverflow.com/questions/6525984/syncrepl-syncing-but-not-updati… regards syncrepl rid=081 provider=ldaps://master.int.fr type=refreshAndPersist searchbase="dc=int,dc=fr" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=*off* bindmethod=simple retry="60 10 300 +" binddn="cn=rep,ou=dsa,dc=int,dc=fr" credentials="secret" updateref ldaps://master.int.fr:636

3 6

LDAPS and ssh public key
by Клеусов Владимир Сергеевич 14 Feb '20

14 Feb '20

Hi I use ldaps . Will I be able to set up authentication using the SSH public key ? I use LDAP account Manager (https://www.ldap-account-manager.org/lamcms/) Here https://www.ldap-account-manager.org/static/doc/manual/ch04s02.html now You can manage your public keys for SSH in Lam if you have installed the LPK patch for SSH or configured AUTHORIZEDKEYSCOMMAND& What does OR mean ? Google says that i need to download the scheme for SSH keys and add the script to AUTHORIZEDKEYSCOMMAND. But in https://code.google.com/archive/p/openssh-lpk/wikis/Main.wiki written To use lpk you must either use standard ldap (not recommended) or LDAP + TLS. ldaps:// URLs will not work. So in the end ssh key +LDAPS will not work ? Or is there a way to use ssh key +LDAPS ?

2 1

Re: Urgent: New User with context CSN permission
by keerthi krishnan 14 Feb '20

14 Feb '20

Hi Quanah, Thanks for your reply. Please find the requirements and permission ++++++++++++++++++++ We have setup of master and slave replication, where we have two users admin(default), authuser and repluser for replication which has full admin privilege. I am trying to create a new user “replmonitor” which I want to give access only to attribute contextCSN . Replmonitor user ++++ # replmonitor, ldapprod.com dn: uid=replmonitor,dc=ldapprod,dc=com objectClass: simpleSecurityObject objectClass: account uid: replmonitor description: LDAP rreplication monitor userPassword:: ###################### ++++ This is the complete olcaccess for the users in olcDatabase={3}mdb. ++ olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=ldapprod,dc=com" write by dn="u id=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,d c=ldapprod,dc=com" read by * none olcAccess: {1}to dn.subtree="dc=ldappro,dc=com" by dn="cn=a dmin,dc=ldapprod,dc=com" write by dn="uid=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,dc=ldapprod,dc=com" read by * none olcAccess: {2} to dn.subtree="dc=ldapprod,dc=com" attrs=contextCSN by dn="uid=replmonitor,dc=ldapprod,dc=com" read by * none =======> newly added olcLimits: {0}dn.exact="uid=repluser,dc=ldapprod,dc=com" tim e.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimite d olcLimits: {1}dn.exact="uid=authuser,dc=ldapprod,dc=com" tim e.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimite d olcSecurity: tls=1 ++ ++++++++++++++++++ [root@devldap cn=config]# ldapsearch -x -H ldaps://10.0.0.1 -D "uid=replmonitor,dc=ldapprod,dc=com" -W -b "ldapprod,dc=com" contextCSN Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=ldapprod,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object Please help me, what I am missing here that I am not able to query the ContextCSN . Got struck for a complete day. On Fri, 14 Feb 2020 at 03:21, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, February 13, 2020 5:50 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > > > access to dn.base="dc=domain,dc=com" attrs=entry,children,contextcsn by > > dn.exact="uid=replmonitor,dc=domain,dc=com" read by * none > > Access statements without the context of the full configuration provide no > real information that can be acted upon the majority of the time. I would > also note that "by * none" at the end of an ACL is implicit, as discussed > in the slapd.access(5) man page, so there is no reason to explicitly list > it. > > If you want help with your ACLs, you need to provide your configuration > (minus passwords). > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Urgent: New User with context CSN permission
by keerthi krishnan 13 Feb '20

13 Feb '20

Hi Team, Requirements: I want to create user and provide only access to contextCSN. I have tried to create user and gave privilege as below. access to dn.base="dc=domain,dc=com" attrs=entry,children,contextcsn by dn.exact="uid=replmonitor,dc=domain,dc=com" read by * none But it results as ldapsearch -x -H ldaps:// -D "uid=replmonitor,dc=domain,dc=com" -W -b "dc=domain,dc=com" Enter LDAP Password: search: 2 result: 32 No such object Please someone help me with the acl for the new user where it can list the contextCSN Regards K.Keerthiga

3 3

proxy ldap (back_ldap) with group ACL?
by brent s. 13 Feb '20

13 Feb '20

Hey, all! First, a BIG thank you to both JoBbZ and tarpman in #openldap, they've got me this far (p.s. JoBbZ- switched over to the symas packages for my test env, replacement was more or less seamless. need to schedule some downtime for prod, but thanks for passing that along!) However, I'm not at a standstill. I'm using the OLC config (...I guess that's like saying "PIN number"). I have two servers, foo.domain.tld and bar.domain.tld. foo.domain.tld has DSA of dc=domain,dc=com and bar.domain.tld has a DSA of dc=domain,dc=net. I can successfully auth as e.g. cn=username,dc=domain,dc=net to foo.domain.tld using the following configuration (at olcDatabase={3}ldap,cn=config): dn: olcDatabase={3}ldap,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig olcDatabase: {3}ldap olcDbIDAssertAuthzFrom: {0}"dn:*" olcDbIDAssertBind: mode=self olcDbRebindAsUser: TRUE olcDbSessionTrackingRequest: TRUE olcDbStartTLS: start olcDbURI: ldap://bar.domain.tld olcReadOnly: TRUE olcSuffix: dc=domain,dc=net However, when I attempt to e.g. implement the following ACL on foo.domain.tld: {2}to dn.exact="ou=groupname,dc=domain,dc=com" attrs=children (...) by group.exact="cn=GroupAdmins,dc=domain,dc=net" manage by * none I get the error: Feb 08 00:32:19 foo slapd[17600]: => acl_mask: access to entry "ou=groupname,dc=domain,dc=com", attr "entry" requested Feb 08 00:32:19 foo slapd[17600]: => acl_mask: to all values by "cn=username,dc=domain,dc=net", (=0) Feb 08 00:32:19 foo slapd[17600]: <= check a_group_pat: cn=groupadmins,ou=groups,dc=domain,dc=net Feb 08 00:32:19 foo slapd[17600]: =>ldap_back_getconn: conn 0x7f7700009ef0 fetched refcnt=1. Feb 08 00:32:19 foo slapd[17600]: Error: ldap_back_is_proxy_authz returned 0, misconfigured URI? (it is a given that cn=username,dc=domain,dc=net is indeed a member ("member" attribute) of the groupOfNames object cn=GroupAdmins,dc=domain,dc=net and additionally, the cn=username,dc=domain,dc=net object has the "memberOf" attribute "cn=GroupAdmins,dc=domain,dc=net") I'm fairly certain this is PEBKAC, but I'm unclear what's going on. Do I need to reference the group in the ACL explicitly with the LDAP URI prefixed or something? -- brent saner https://square-r00t.net/ GPG info: https://square-r00t.net/gpg-info

1 2

Antw: [EXT] Re: Q: "5e43b796 PROXIED attributeDescription "DC" inserted."
by Ulrich Windl 13 Feb '20

13 Feb '20

>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 12.02.2020 um 23:53 in Nachricht <28602_1581548017_5E4481F1_28602_870_1_DDCC864DABD8E91E4DE841F1(a)[192.168.1.144]> > > ‑‑On Wednesday, February 12, 2020 9:33 AM +0100 Ulrich Windl > <Ulrich.Windl(a)rz.xn--uniregensburg-dm6g.de> wrote: > >> Hi! >> >> While trying to slapadd a dumped config database in "‑u" mode, I see this: >> 5e43b796 PROXIED attributeDescription "DC" inserted. >> >> What does it mean? There is no "DC" in the LDIF file being imported. > > It has to do with attributes existing in cn=config (such as modifiersName > or creatorsName usually) where the DN that modified the entry has a "dc" > component. You can safely ignore it. This is one of the reasons I'm not > fond of the default way in which Debian/Ubuntu/RH (mis)configured their > default access setup for cn=config. Thanks a lot! First I only had been searching it in upper case, but it's there in lower case at various places: olcAccess, olcLimits, olcSuffix, olcRootDN, olcPPolicyDefault. Also as database #0 was the first one to import, those dc= names were missing at that point in time. That would explain the message. However the message by itself is of little usefulness: The only context is 5e43b796, and it's hard to relate that to some object or line in LDIF... Regards, Ulrich > > Regards, > Quanah > > > > ‑‑ > > Quanah Gibson‑Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical