openldap-technical

openldap-technical@openldap.org

9 participants
9867 discussions

Q: "deferring operation: too many executing" / "deferring operation: pending operations"
by Ulrich Windl 17 Dec '18

17 Dec '18

Hi! I have a question for the following log messages: slapd[2215]: connection_input: conn=144871 deferring operation: too many executing slapd[2215]: connection_input: conn=144871 deferring operation: pending operations slapd[2215]: connection_input: conn=144871 deferring operation: pending operations What is "too many", i.e. where is that limit configured? Is it possible to tell how many "pending operations" there are? Finally: It seems slapd "drives against the wall hard", meaning it runs at full speed until the limit is reached, the refuses any more connection/operation. Is it possible to activate (configure) a "soft knee" behavior, where after reaching a specified limit of connections or operations rate slapd starts responding increasingly slower? That would help load balancers to select a different server in time... Regards, Ulrich

3 3

ldap_oc_mappings | keycol of type varchar
by Thangavel, Parameswaran 16 Dec '18

16 Dec '18

Hi, While exploring the OpenLDAP's backend-sql package, I found below behavior. The ldap_oc_mappings expects the keycol to be of type integer. For example, if I change the datatype of the identifier (id) of persons table to of type varchar then I am not able to retrieve the persons record during LDAP requests. However, if the column "id" is of type Integer then I am able to view the persons record as part of LDAP search requests. insert into ldap_oc_mappings (id,name,keytbl,keycol,create_proc,delete_proc,expect_return) values (2,'inetOrgPerson','persons','id',NULL,NULL,0); insert into persons (id,name,surname,password) values ('a21qec','Mitya','Kovalev','mit'); Question: 1) Is my observation correct? i.e the keycol used to map the LDAP entries to SQL data expects the primary key (id) to be of type integer. 2) If #1 is correct, do we have a way to support VARCHAR datatype for the primary key? In my application, we use GUID (alpha-numeric characters) as the primary key. Please advise. Thanks Param

2 1

fast delete a lot of entries
by Derek Zhou 14 Dec '18

14 Dec '18

dear list, I was experimenting with slapd by adding a lot of entries then deleting them. What I found is adding speed is not bad but deletion speed is lacking. With or without dbsync, delete speed is around half of that of adding. Naively, I thought deleting should be easier than adding, because in adding you actually need to pass and write whole entry of data, while in delete you can just mark the database page as free? The DB file did not shrink after massive deletion; which kind of suggest that deleting is only marking page as free, not really return them to the OS. I am using the latest git tree and the mdb backend. Another related idea is delete a whole branch from the DIT. LDAP is already hierarchical, to delete all entries under a branch, one would assume that there must be an better way than deleting entries with a client side script, like what I am doing? With SQL you can drop a table. With LDAP, can I delete a whole branch? -- Derek Zhou Shannon Systems http://www.shannon-sys.com

3 6

Please help on Openldap issue
by Eggo why 13 Dec '18

13 Dec '18

Hi All, I have install openldap, openldap-servers and openldap-clients and systemctl start slapd without anyproblem but when try ti do an initial ldapadd I got error. My slapd.conf and oidbase.ldif as below. Please help and thank you very much Garry slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/oidschema/oidbase.schema include /etc/openldap/oidschema/oidnet.schema include /etc/openldap/oidschema/oidrdbms.schema include /etc/openldap/oidschema/alias.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #default searchbase defaultsearchbase "dc=cornell,dc=edu" ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=cornell,dc=edu" rootdn "cn=admin,dc=cornell,dc=edu" rootpw {SSHA}gZp2hnEA/xq/FfxMgPTjDmSPo78PuZAs # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/cornell # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub ### for root oraclecontext # database bdb suffix "" rootdn "cn=admin" rootpw {SSHA}gZp2hnEA/xq/FfxMgPTjDmSPo78PuZAs # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/rootoraclecontext # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub oidbase.ldif dn: dc=cornell,dc=edu objectClass: top objectClass: dcObject objectClass: organization o: cornell.edu dc: cornell dn: cn=OracleContext,dc=cornell,dc=edu objectclass: orclContext cn: OracleContext l$ ldapadd -vc -x -D “cn=admin,dc=cornell,dc=edu” -w $passwd -f oidbase.ldif ldap_initialize( <DEFAULT> ) ldap_bind: Invalid DN syntax (34) additional info: invalid DN

3 6

speed up parallel add/delete
by Derek Zhou 11 Dec '18

11 Dec '18

all I have a patch that can speed up parallel ldap add/delete a lot; in my testing about 2.5X. The idea is described here: the mdb backend does not really support parallelism in rw transactions, so add/delete are serialized by a mutex inside the mdb backend as small transactions. In my patch, all add/delete are put in a queue and executed in a dedicated worker thread. It may seem pointless at first, but by doing them all in the same thread, now I can merge concurrent ops from different clients into larger transactions, and reduce the number of expensive txn_commit calls (fsyncs). my test results are ( your mileage may vary) 10 thread parallel add: 1, unpatched slapd + default config, ~ 2800 op/s (performance stable over time) 2, unpatched slapd + dbnosync ~9000 op/s (lots of fluctuation due to background dirty page flush) 3, unpatched slapd + dpnosync + checkpoint every minute ~8000 op/s, with reduced fluctuation 4, patched slapd ~7300 op/s (fluctuation nearly gone) 2 is not a recommended config, because crashing or power lost will cause massive data lost. 3 is better, but still up to 1 minutes of data can be lost at crash. With this patch, I can achieve >90% of the performance of 3, with data durability as good as 1; or 2.5X performance of 1 with same data durability guaranty. The patch still need some tidy up; is this email list the place to send patches? -- Derek Zhou Shannon Systems http://www.shannon-sys.com

2 1

not be able to initialize ldap
by Eggo why 05 Dec '18

05 Dec '18

3 3

Re: On removing a duplicated ppolicy overlay
by Derek Zhou 05 Dec '18

05 Dec '18

On Monday, December 03, 2018 02:11:27 PM Quanah Gibson-Mount wrote: > --On Monday, December 03, 2018 1:57 PM -0800 Daniel Howard > <dannyman(a)toldme.com> wrote: > > > > A potentially minor improvement along these lines could be a very nice > > feature enhancement for OpenLDAP. Thank you for your consideration. > > You're talking about two things: a) slapmodify, which is slated for > release with OpenLDAP 2.5, which allows offline modifications of cn=config, > and b) delete support in cn=config, also slated for release with OpenLDAP > 2.5. slapmodify is nice, however modifying schema is still hard. The old schema file format is still much better than the ldif format for viewing and editing. It would be a nice to have a tool that can parse and diff schemas in the old format and generate ldif modifications for slapmodify or ldapmodify to handle. -- Derek Zhou Shannon Systems http://www.shannon-sys.com

1 0

Re: On removing a duplicated ppolicy overlay
by Daniel Howard 04 Dec '18

04 Dec '18

On Wed, Nov 28, 2018 at 11:05 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, November 28, 2018 10:16 AM -0800 Daniel Howard > <dannyman(a)toldme.com> wrote: > > ># This file MUST be edited with the 'visudo' command as root. > > > > Perhaps this is a consideration that is already on the roadmap? > > You mean like it already does? :) > > head -1 cn\=config.ldif > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. > Quanah, (and Howard) That is certainly a warning. It would be more easily noticed with a bit more whitespace around it, as you find in the sudoers file. This warning is not as helpful as the visudo warning, as it does not give the user a way to edit the file. A wrapper script, or a link to a good document on managing configurations, would be more useful. For example, if I follow the advice in sudoers, and I type "visudo" then I get to edit /etc/sudoers, with a validation before the file can go live. This is fantastic! If I follow the advice here, and type "ldapmodify" then I get an error message. If I research the correct command line, then, in my experience, I manage to import multiple conflicting configs into the system that crash the server. I then research some more, and find that ldapmodify can not delete the conflicting configs. I research some more, and learn that I could just remove them from the filesystem. As I wish to be a good citizen, I share this knowledge, and I am told that this is wrong, and I need to use slapcat to export, delete my config files, then slapadd to import, using a different set of flags than ldapmodify. Perhaps, you can spare a moment of empathy to acknowledge how frustrating this must be for a user. I appreciate your warnings, but given the cumbersome and, in my experience, dangerous nature of managing config files through ldapmodify, I am inclined to very carefully tweak the config files in the config directory. If, however, there was a convenient, safe wrapper, like visudo, or a reference to a reassuring doc that explains the right way to do things, then I would preach the good news. A potentially minor improvement along these lines could be a very nice feature enhancement for OpenLDAP. Thank you for your consideration. Sincerely, -danny -- http://dannyman.toldme.com

3 2

Re: On removing a duplicated ppolicy overlay
by Daniel Howard 04 Dec '18

04 Dec '18

On Mon, Dec 3, 2018 at 2:11 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, December 03, 2018 1:57 PM -0800 Daniel Howard > <dannyman(a)toldme.com> wrote: > > > > A potentially minor improvement along these lines could be a very nice > > feature enhancement for OpenLDAP. Thank you for your consideration. > > You're talking about two things: a) slapmodify, which is slated for > release with OpenLDAP 2.5, which allows offline modifications of > cn=config, > and b) delete support in cn=config, also slated for release with OpenLDAP > 2.5. > I love these features already. ;) -- http://dannyman.toldme.com

1 0

syncrepl + rid
by A. Schulze 28 Nov '18

28 Nov '18

Hello, I run a N-Way Multi-Master setup (N=4) and multiple read-only syncrepl. I like to make sure I understand the "rid" correct. According to http://www.openldap.org/doc/admin24/guide.html#olcSyncrepl, the "rid" has to be unique per "slapd" So I would configure on /every host/ (4x Multi-Master and multiple read-only syncrepl) rid=1..4 to identify the other servers. The 4 Multi-Master server get 4 additional "ServerID 1..4 ldaps://multimaster1..4.example" Is that right? Thanks for clarification. Andreas

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical