openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

OpenLDAP 2.3 to 2.4 Migration Question
by Razi Ahmad 20 Aug '19

20 Aug '19

Hi, I'm working on migrating from OpenLDAP 2.3 to 2.4. I've got my 2.4 provider set up and customized and have a copy of production data to load. I'd like to know if there's any way to have the memberof attribute populated during the process of loading the data. I used slapadd but when I searched for a user, I didn't see the memberOf attribute. Prior to running the slapadd command, I replaced the groupOfUniqueNames objectClass with groupOfNames and the uniqueMember attribute with member inside my LDIF file. Thanks. -- Razi Ahmad Director, IT Infrastructure Services NYU Stern School of Business 14 East 4th Street, Room 327, New York, NY 10012 Phone: 212-998-0172 | Email: razi(a)stern.nyu.edu Follow us on Twitter: @nyustern An Education in *Possible*

2 1

mdb index reporting available?
by Marc Roos 20 Aug '19

20 Aug '19

I used to have some help with what and how I should add indexes, but it looks like the new mdb backend is not telling me anymore. Is this correct? Anyway to get a warning when some index needs to be set? bdb_equality_candidates: (xxxx) not indexed bdb_inequality_candidates: (createTimestamp) not indexed etc https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb…

4 16

PPolicy: Multiple pwdGraceUseTime attributes
by Ulrich Windl 19 Aug '19

19 Aug '19

Hi! I noticed that one user has multiple pwdGraceUseTime attributes like this: pwdGraceUseTime: 20190409095627Z pwdGraceUseTime: 20190605063107Z pwdGraceUseTime: 20190614121258Z pwdGraceUseTime: 20190723062401Z I don't understand: Doesn't the pwdGraceUseTime record how long/often the user may login despite of an expired password? For the example given, I assume the user has changed the password a few time since the inital grace login. So aren't the older pwdGraceUseTime attributes removed after the password was changed? Or can this happen if some admin chnages the password using some plain replace operation? Regards, Ulrich

2 1

Re: Multi-master replication : read_config: no serverID / URL match found. Check slapd -h arguments.
by HG 19 Aug '19

19 Aug '19

Hi, It is not as easy as you state it. I have a 2nd set up olcServerID: 1 ldap://abc1prdp01.abcgroup.com:1600 olcServerID: 2 ldap://abc2prdp01.abcgroup.com:1600 and SLAPD_URLS="ldapi:/// ldap://:1600/" This works too. Op wo 14 aug. 2019 om 17:03 schreef Quanah Gibson-Mount <quanah(a)symas.com>: > > > --On Wednesday, August 14, 2019 11:23 AM +0200 HG > <hanspeter.sloot(a)gmail.com> wrote: > > > > > olcServerID: 1 ldap://linux1014.ts.aa-srv.com > > olcServerID: 2 ldap://linux1015.ts.aa-srv.com > > Neither of those has a trailing slash. You noted: > > SLAPD_URLS="ldapi:/// ldap://linux1014.ts.aa-srv.com/" > > doesn't start, but > > SLAPD_URLS="ldapi:/// ldap://linux1014.ts.aa-srv.com" > > starts. > > I would expect this. As I said before, it's a MATCH between what's > provided in the olcServerID field and the -h option to slapd (SLAPD_URLS > in > your case). I.e., the software is functioning as documented. If you want > it to match on the trailing slash, adjust your olcServerID values to > include a trailing slash. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 4

use-case for arg const char *dn of ldap_sasl_bind_s()
by Michael Ströder 18 Aug '19

18 Aug '19

HI! It seems I've never passed a DN to SASL bind functions. Could someone please elaborate on a valid use-case for argument dn of libldap function ldap_sasl_bind_s()? Thanks in advance. Ciao, Michael.

2 5

LDAPCon 2019 CFP closimg today
by Howard Chu 18 Aug '19

18 Aug '19

Just a reminder that the Call for Papers is closing today. If you've been thinking about submitting a talk, this is your last chance! https://ldapcon.org/2019 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 1

Fresh install changing the hdb to mdb
by Marc Roos 18 Aug '19

18 Aug '19

This is the default file that rhel/centos have in their slapd.d dir for the database. I thought I would just remove this one and place the one for mdb, seems to work, don't know about this entryUUID? Or can I do this with ldapmodify? [@53386e4b0025 cn=config]# cat /tmp/olcDatabase\=\{2\}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 4f2ac1fc dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 537b0adc-5476-1039-9bf9-1dc025e1859d creatorsName: cn=config createTimestamp: 20190816133433Z entryCSN: 20190816133433.095410Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20190816133433Z [@53386e4b0025 cn=config]# cat olcDatabase\=\{2\}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 b6a274bd dn: olcDatabase={2}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcMdbConfig entryUUID: 537b0adc-5476-1039-9bf9-1dc025e1859d creatorsName: cn=config createTimestamp: 20190816133433Z entryCSN: 20190816133433.095410Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20190816133433Z

4 4

Initial syncreplication details
by Marc Roos 17 Aug '19

17 Aug '19

Am I correct to understand from this page[0] that the consumer gets its 'new' contextCSN from the slapcat import. (I saw it in the file). And will get all data since that date at startup? The replication id is of no influence. So if I would stop slapd import again the same old slapcat file. It would again receive all new data since that contextCSN? Regardless of the same rid being used with the provider. The idea behind this is that if you create a container with a default imported slapcat/slapadd file. Every time the task is stopped and started. It will go back to it initial container state. (unless you make it statefull of course) I am not adding that much data so I could make a new default image every week or so, this would be used every time a container is launched. (which only happens in a failover situation) [0] https://www.openldap.org/doc/admin24/replication.html

2 2

Environment variable in slapd config
by Marc Roos 16 Aug '19

16 Aug '19

Is it possible to reference an environment variable in olcSyncrepl: {0}rid= ? --On Saturday, August 10, 2019 6:54 PM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > Are you talking about the serverID? > > serverID is not needed on a read-only consumer. Just leave it out. He's talking about replication ID (rid), and it's clearly out of bounds in his post. The slapd.conf/slapd-config man pages clearly document the allowed range that can be used for a RID. rid identifies the current syncrepl directive within the replication consumer site. It is a non-negative integer not greater than 999 (limited to three decimal digits --Quanah --

6 16

RE: Environment variable in slapd config
by Marc Roos 16 Aug '19

16 Aug '19

I guess I am missing some info??? Is there any animosity between openldap and redhat? My general perspective is RedHat has made a core business of supporting a linux enterprise os. So I do hope that, if the shit hits the fan, you can rely on the paid services based on the knowledge of their 10k+ employees or so? These guys that work on ceph are doing a great job, looks like very competent people. And now they are owned by IBM I like them even more. :) Always have had IBM in high regards with their r&d. -----Original Message----- Subject: RE: Environment variable in slapd config --On Friday, August 16, 2019 5:17 PM +0200 Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > I am more fan of Centos because then I can fall back on RedHat > support, especially for production environments. That's the most laughable statement (in relation to OpenLDAP at least) that I've heard in years. Thanks for the morning chuckle. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical