openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

Search memberOf
by Arianna Milazzo 02 Aug '18

02 Aug '18

Hello! I use OpenLDAP wuth MySQL backend. I added even memberOf and it's all ok on db and I see the correct members (on groups) and memberOf (on people). But I have a problem: I can't search if a user is member of a group. filter: (& (objectClass=inetOrgPerson) (uid=username) (memberOf=cn=test,ou=group,dc=organization,dc=it) ) on the log I read: *get_ava: illegal value for attributeType memberOf* Can someone help me? Thanks, Arianna

2 1

Keeping a new n-master environment in sync with an old single master env during a migration
by Chris Cardone 02 Aug '18

02 Aug '18

Hello all, I have a question I'm sure some folks have already addressed and hope there is a solution for my problem I am in the process of migrating from an old single master --> multiple slave env running on OpenBSD 4.9 openldap-server-2.4.23p2 - configured with slapd.conf over to 4-master (regional) to 4 slaves (now - more to come regionally) running Ubuntu 16.04 and openldap 2.4.42 - configured with a cn=config database I am trying to keep the environments in sync as we migrate dozens of different environments from the old slaves to the new slaves - which may take as long as 4 months :( I started out by using slapcat to export the contents of the old server, then loading them into the new server. I would originally drop all the data on the new servers and reload from the old. this is now no longer an option, as we migrate to the new servers, i cannot be dropping the entire database and replacing it with the new one - the time it takes to execute such a task creates an outage for users as well as applications that rely on the LDAP database. So im looking for some guidance / options to keep my new LDAP environment in sync with my old, without any service disruptions on either set of systems. Any help would be greatly appreciated!! Christopher

2 1

Number of requests served in ideal condition by version 2.4.46 with lmdb backend.
by Saurabh Lahoti 01 Aug '18

01 Aug '18

Dear All, For preparing a technical scope of OpenLDAP; do we have any maximum threshold of requests served per second by single instance of 2.4.46 with lmdb backend..? Thanks & Kind Regards, Saurabh Lahoti.

3 2

how to run script on event (modify/delete/add)?
by Zeus Panchenko 31 Jul '18

31 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 greetings, please advise how can I run external script on event (LDAP operation)? for example: I am generating config files for users from LDAP data with perl script I want to re-generate config files each time LDAP operation (modify, add, delete) performed how to do that and what is the best way to do that? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQQYIXL6FUmD7SUfqoOveOk+D/ejKgUCW18FeQAKCRCveOk+D/ej KtXaAJ949HG/9hwOP9z5RgvSUfjRR27nQQCgljD0MPOTdZevhdBt2u87Oeq1Frk= =NBxz -----END PGP SIGNATURE-----

4 5

python-ldap validate LDAPObject.modify_ext_s
by Sam Culley 31 Jul '18

31 Jul '18

I am trying to research how I can validate/verify executing an LDAPObject.modify_ext_s request in Python. If I print the response of the result it returns (103, [], 3, []) But I can't find much documentation on what that means? Any ideas? Regards, Sam

2 1

Syncrepl + suffixmassage + uniqueMember
by Steffen Kaiser 27 Jul '18

27 Jul '18

Hi, currently we have three OpenLDAP servers in multi-master mode and with MemberOf . Currently, the base DN is dc=oldorgname,dc=de. The name of the organization changed and all entries should be accessable through base dc=neworgname,dc=de and all attributes with DNs as value shall return this new base. First I tried relay with rwm in this configuration: dn: cn=module{1},cn=config changetype: modify add: olcmoduleload olcModuleLoad: back_relay.la dn: olcDatabase={2}relay,cn=config changetype: add objectClass: olcRelayConfig olcSuffix: dc=neworgname,dc=de olcRelay: dc=oldorgname,dc=de dn: olcOverlay=rwm,olcDatabase={2}relay,cn=config changetype: add objectClass: olcRwmConfig olcRwmRewrite: rwm-suffixmassage "dc=oldorgname,dc=de" But this caused slapd to dump core at different entries, when I query the whole database as administrator pulling all attributes. As this module is "experimental", so I went another way. Should I try another config? Second, I tried to create a consumer server with a separate database using and suffixmassage. olcSyncrepl: {2}rid=004 provider=ldap://server:389/ bindmethod=simpl e binddn="cn=dn" credentials="pwd" s earchbase="dc=oldorgname,dc=de" scope=sub schemachecking=on type=re freshAndPersist retry="5 2 30 2 60 +" interval=00:00:00:30 timeout=0 network-time out=0 keepalive=0:0:0 attrs="*,+" suffixmassage="dc=neworgname,dc=de" The sync proceeded, but I ended with uniqueMember attributes with the old base: dn: cn=team,ou=groups,dc=ou,dc=neworgname,dc=de uniqueMember: uid=user,ou=peolple,dc=ou,dc=oldorgname,dc=de The value of the attribute "member" gets rewritten into the new orgname. Ist this a bug or intentional behaviour? Kind regards, -- Steffen Kaiser

2 1

Re: Replication mutli-master via DNS record ?
by Lirien Maxime 27 Jul '18

27 Jul '18

Thanks Quanah. On Thu, Jul 26, 2018 at 10:20 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, July 26, 2018 4:28 PM +0200 Lirien Maxime < > maxime.lirien(a)gmail.com> wrote: > > b) Master to multi-master >> >> Mirrormode is set to TRUE. >> Can I use only one "syncrepl" with the DNS record ldap://master.toto.fr >> Or should I set one "syncrepl" for each master ? >> > > One syncrepl to each master. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

Replication mutli-master via DNS record ?
by Lirien Maxime 26 Jul '18

26 Jul '18

Hi all, I have 3 masters and 3 slaves. Two DNS records : - Masters are recorded under master.toto.fr - Slave are recorded under slave.toto.fr Two type of replication : a) Slave to master Slaves replicate from one of 3 master with this configuration : syncrepl rid=100 provider=ldap://master.toto.fr/ type=refreshAndPersist interval=00:00:30:00 [...] b) Master to multi-master Mirrormode is set to TRUE. Can I use only one "syncrepl" with the DNS record ldap://master.toto.fr Or should I set one "syncrepl" for each master ? I mean , in my master1 conf file can I use this : syncrepl rid=1 provider=ldap://master.toto.fr/ type=refreshAndPersist interval=00:00:30:00 [...] or syncrepl rid=12 provider=ldap://IP_master2.toto.fr/ type=refreshAndPersist interval=00:00:30:00 [...] syncrepl rid=13 provider=ldap://IP_master3.toto.fr/ type=refreshAndPersist interval=00:00:30:00 [...] Thanks guys.

2 1

ldapmodify -Y EXTERNAL failure - Confidentiality required (13)
by Mark Foster 26 Jul '18

26 Jul '18

This used to work... $ sudo ldapmodify -Y EXTERNAL -f 30logging.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Confidentiality required (13) additional info: stronger confidentiality required The log says slapd[1266]: conn=6619437 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71 This is my olcSecurity setting: olcSecurity: ssf=128 simple_bind=128 How would I fix this? It seems to be a catch-22.

3 2

Re: AW:ldap server stops responding periodically?
by John Jasen 23 Jul '18

23 Jul '18

On 07/20/2018 04:41 AM, Ulrich.Windl(a)rz.uni-regensburg.de wrote: > Hi! > > Stupid question: could it be your load-balancer that had a problem? > How does the netstat look like (sockets opened, queued data, etc.?) I do not believe it to be the load-balancer. They log loss of contact with the LDAP servers and drop them from the relay group shortly after one of these events start; and when it gets cleaned up, they're added back in. I also do not suspect network between the load balancers and the LDAP servers. During such an event, ps -efT will usually show slapd running at full thread capacity. Comparing that to threads in cn=monitor is not possible, as those ldap searches fail. Open sockets does not substantially change until after the event subsides. The servers will show 1200-2000 open sockets before an event, and drop lower when it clears up -- to quickly scale back up to pre-event levels. The queues will show data being held until the socket(s) time out. Thanks for the feedback!

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical