openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Tree versus group
by Olivier - 29 Mar '19

29 Mar '19

3 3

Add module crashes slapd
by Gao 29 Mar '19

29 Mar '19

Hi all, I am relatively new to openldap and I am having an issue when I try to setup Master-Slave replication. I don't know how to solve this issue and need your help please. On the master I made a ldif file: [root@test-ldap ldif]# cat syncprov_mod.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: syncprov.la Then I run command: [root@test-ldap ldif]# ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov_mod.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=module,cn=config" The output seems normal. But actually the slapd got messed up. So if I do slapcat I got: [root@test-ldap ldif]# slapcat -n 0 5c9d1323 config error processing cn={0}module,cn=config: slapcat: bad configuration file! And restart slapd failed. journalctl shows: Mar 28 11:40:39 test-ldap systemd[1]: Starting OpenLDAP Server Daemon... -- Subject: Unit slapd.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit slapd.service has begun starting up. Mar 28 11:40:39 test-ldap runuser[3427]: pam_unix(runuser:session): session opened for user ldap by (uid=0) Mar 28 11:40:39 test-ldap runuser[3427]: pam_unix(runuser:session): session closed for user ldap Mar 28 11:40:39 test-ldap check-config.sh[3424]: Checking configuration file failed: Mar 28 11:40:39 test-ldap check-config.sh[3424]: 5c9d1527 config error processing cn={0}module,cn=config: Mar 28 11:40:39 test-ldap check-config.sh[3424]: slaptest: bad configuration file! Mar 28 11:40:39 test-ldap slapd[3438]: @(#) $OpenLDAP: slapd 2.4.40 (Nov 6 2016 01:21:28) $ mockbuild@worker1.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40 Mar 28 11:40:39 test-ldap slapd[3438]: config error processing cn={0}module,cn=config: Mar 28 11:40:39 test-ldap slapd[3438]: slapd stopped. Mar 28 11:40:39 test-ldap slapd[3438]: connections_destroy: nothing to destroy. Mar 28 11:40:39 test-ldap systemd[1]: slapd.service: control process exited, code=exited status=1 Mar 28 11:40:39 test-ldap systemd[1]: Failed to start OpenLDAP Server Daemon. -- Subject: Unit slapd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit slapd.service has failed. -- -- The result is failed. Mar 28 11:40:39 test-ldap systemd[1]: Unit slapd.service entered failed state. Mar 28 11:40:39 test-ldap systemd[1]: slapd.service failed. Thank you for your help. Gao

3 2

LMDB crash after power failure
by Abilio Marques 24 Mar '19

24 Mar '19

Hello, I've successfully ported a particular piece of software from multiple plain files in disk to LMDB. There were multiple reasons to do so (i.e., performance and maintenance). The program is making individual calls to a storage API, that in turn creates files or reads them (through a cache). There is no concept of transaction. For performance and lifetime reasons, the original code avoids to perform a fsync every time it writes to a file by queuing renames (for atomic writes) and deletes, which in turn are executed by a background thread after 2 seconds idling (or a max of 15 sec after first write/delete). Replacing such a monster "files + cache" with LMDB was a breeze. I kept the API intact, and to deal with the price of fsyncs, I thought of opening with MDB_NOSYNC, and sync after 2 seconds of inactivity. I must mention that the software runs on an OpenWRT based board, with a MIPS (big endian 32-bit), using UBIFS as storage (with OverlayFS sitting on top of it). Flash memory is rather slow, peaking at ~350 KiB/sec on sequential writing. Kernel version is 3.18.29. This works perfect, except for power failures. With a USB relay board, I'm cutting the power to the CPU during the sync period. After restart, the test program I'm running with LMDB crashes with a sigbus error. Opening the environment seems to work, but the program crashes as soon as it tries to write to it. The file seems "ok" (no visible garbage or missing parts) when viewed with hexdump (but is a 5 Mb file). Any suggestions on where to start looking for issues? I wanted to congratulate Howard Chu for his work with LMDB, and the OpenLDAP team for a wonderful work during the years. Keep it up! Best, Abilio

2 1

olcDbConnectionPoolMax documentation
by Jongeling, Eric C 21 Mar '19

21 Mar '19

I'm running into what appears to be an issue with my olcDatabase meta configuration that appears to be a bottleneck limiting me to 16 concurrent operations when working through the meta database. This seems suspiciously similar to the olcDbConnectionPoolMax setting I've seen in many examples and the value I usually encounter of 16. The schema definition doesn't clear it up entirely, either: olcAttributeTypes: ( OLcfgDbAt:3.23 NAME 'olcDbConnectionPoolMax' DESC 'Max size of privileged connections pool' SYNTAX OMsInteger SINGLE- VALUE ) While I assume that this sets the maximum size of the backend connection pool, I'm confused by the word "privileged" in this situation. Can someone explain what this setting controls or point me towards documentation? Thanks in advance! ~Eric C. J.

2 1

Replication and pwdAccountLockedTime
by Jochen Keutel 21 Mar '19

21 Mar '19

Hello, we are using OpenLDAP 2.4.44 on Debian 9 in a distributed scenario: push based replication (means: using proxies with ldap backend). All works fine, all attributes (normal and operational) are replicated. Only one problem occurs: - when we set pwdAccountLockedTime on the master it gets replicated without problems. - but if we remove this attribute on the master (means: we unlock the account) this change is NOT replicated: The attribute is still there in all replicas, so the accounts stay locked. Is this by design - or is it a bug? Regards Jochen.

2 1

Discarding unused(?) olcRootPW passwords
by Bob Hund 20 Mar '19

20 Mar '19

Hi, I inherited a slapd deployment which rebuilds instances from scratch via automation. All configuration is done by slapadd'ing ldifs when instances are stood up. We don't make configuration changes at run time. When we need to make a change we modify the automation scripts and standup new instances from scratch. I noticed that there are olcRootPW entries for the "cn=admin,cn=config" and "cn=admin,dc=ourcompany,dc=com" root DNs, in the configuration I inherited, but we don't ever use them explicitly. In fact the entries are hashes, and I can't even find any uses of the cleartext in our code. My gut feeling is that I should reset the hashes and discard the cleartext to prevent misuse of these credentials. Is there any reason not to do this? Thanks in advance for any insight you can provide.

3 2

Configuring Back-LDAP as proxy for MirrorMode nodes to ensure writes are always handled by the designated master
by George Diamantopoulos 20 Mar '19

20 Mar '19

Hello all, I've successfully set-up a 2-node LDAP cluster, where each node is a provider to the other according to section 18.3.4 of the Administrator's Guide. The next logical step is to implement Load-Balancer/Proxy entities, which will ensure that writes always go to the same node. So far my preliminary proxy configuration allows reading from the cluster successfully. Here are the relevant bits (LDIF whitespace manipulated for readability): dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to * by * write olcRootDN: cn=admin,dc=domain,dc=tld olcRootPW: {SSHA}s3krit olcSuffix: olcDbStartTLS: start olcDbURI: ldap://ldap1.domain.tld,ldap://ldap2.domain.tld I understand that this configuration will always use the first URI in olcDbURI unless there is a failure, in which case it will fall back to the second URI (apparently after a timeout, and will then use it for subsequent operations until that fails too). I'm happy with this, although if there were a way to perform round-robin between the two for read operations, it would be ideal (is there?). However, writes to the proxy won't work with this configuration. In the Administrator Manual it is stated that one should use the proxy "as a syncrepl provider", but I am not sure I understand how this is supposed to work. Am I supposed to add another olcSyncrepl attribute (there's already one for syncing the two MirrorMode nodes themselves) to the MirrorMode nodes pointing to the proxy? And if I have more than one proxy, should I add an olcSyncrepl attribute for each? And how do I ensure that only one of the MirrorMode nodes fetches data from the proxy provider(s) at any given time? I've spent quite some time googling this to no avail. Any insight would be greatly appreciated. Thank you! Best regards, George

2 2

Rsyslog stdout and stderr
by Abdelkader Chelouah 17 Mar '19

17 Mar '19

Hi, slapd 2.4.44 OpenLDAP instance configure as a proxy (back-ldap) >From time to time, bind operations can take more than 5 sec. These latencies do not seem to come from a CPU or memory problem. I'm trying to see if the network can be the root cause of the issue. To debug the fonction ldap_sasl_bind (libraries/libldap/sasl.c), I activated trace loglevel (logs are manage by rsyslog). In the definition of ldap_sasl_bind, there is Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 ); A least the message "ldap_sasl_bind" should appear in logs, which is not the case. Actually, Debug (which is first defined in include/ldap_log.h) is redefined in libraries/libldap/ldap-int.h ... #include "ldap_log.h" #undef Debug #ifdef LDAP_DEBUG #define DebugTest( level ) \ ( ldap_debug & level ) #define Debug( level, fmt, arg1, arg2, arg3 ) \ do { if ( ldap_debug & level ) \ ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) ); \ } while ( 0 ) #define LDAP_Debug( subsystem, level, fmt, arg1, arg2, arg3 )\ ldap_log_printf( NULL, (level), (fmt), (arg1), (arg2), (arg3) ) configure #else #define DebugTest( level ) (0 == 1) #define Debug( level, fmt, arg1, arg2, arg3 ) ((void)0) #define LDAP_Debug( subsystem, level, fmt, arg1, arg2, arg3 ) ((void)0) #endif /* LDAP_DEBUG */ ... A a result, the message is send to standard output. By using rsyslog, it is not possible to catch any message inside ldap_sasl_bind. How to get stdout and stderr messages and still use rsyslog to manage openldap logs ? Thanks in advance.

3 3

How do I enable LDAP or OpenLDAP in Windows Server 2019 Active Directory Domain Services Domain Controller?
by Turritopsis Dohrnii Teo En Ming 14 Mar '19

14 Mar '19

Good morning from Singapore, How do I enable LDAP or OpenLDAP in Windows Server 2019 Active Directory Domain Services Domain Controller so that network devices like network security appliances/firewalls and network attached storages (NAS) are able to join the domain and obtain the list of Active Directory Users for authentication purposes? Thank you. ===BEGIN EMAIL SIGNATURE=== The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming ===END EMAIL SIGNATURE===

1 0

On pwdGraceUseTime granularity
by Matus Honek 13 Mar '19

13 Mar '19

Hello, currently, granularity of pwdGraceUseTime is one second. This allows client to successfully bind with old password as many times as they want during N seconds (where N is equal to pwdGraceAuthnLimit) which may be unwanted. Would it be possible to increase the granularity, and if so, what size would make sense? Could it be made configurable? FWIW, I know that basically every major LDAP server has one second granularity, and that this does not mitigate the actual issue (only lowers the time window during which this can be misused). Thanks and regards. -- Matúš Honěk Software Engineer Red Hat Czech

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical