openldap-technical

openldap-technical@openldap.org

9897 discussions

Re: Missing structural object, ldapadd says it's there,
by Ole Nomann Thomsen 07 May '18

07 May '18

Oh. Answering my own question: The "missing" entry had turned into a glue entry, don't know how. I can modify it with "ldapmodify ... -M ..." (or maybe -MM), to turn it into a regular entry and make dotnet default auth work. Thanks for your time :-] - Ole. > Hi list, I am running @(#) $OpenLDAP: slapd 2.4.45 (Jan 23 2018 08:50:30) $ for > authentication. > > I can authenticate most of my clients, but some of them fail. It seems to be > the .net ones, not using fastbind: > One client tries to authenticate from .net, but can't bind. This is in the log: > > conn=12475338 fd=15 ACCEPT from IP=192.168.252.131:36473 > (IP=0.0.0.0:3890) > conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI- > C,c=DK" method=128 > conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI- > C,c=DK" mech=SIMPLE ssf=0 > conn=12475338 op=0 RESULT tag=97 err=0 text= > conn=12475338 op=1 srch base="ou=authentication,o=uni-c,c=dk" scope=0 > deref=0 filter="(objectclass=*)" > conn=12475338 op=1 srch attr=objectclass > conn=12475338 op=1 search result tag=101 err=0 nentries=0 text= > > Aha, "ou=authentication,o=uni-c,c=dk" (that default .net auth seems to > require) must be missing. Verify that: > > ldapsearch -x -H ldaps://host:3891/ -D "..." -w "..." -s base -b > ou=Authentication,o=UNI-C,c=DK objectClass=* + \* > > Gives me: > > # extended LDIF > # > # LDAPv3 > # base <ou=Authentication,o=UNI-C,c=DK> with scope baseObject > # filter: entryUUID=* > # requesting: + * > # > > # search result > search: 2 > result: 0 Success > > # numResponses: 1 > > With this log-entry: > > conn=10181 fd=14 ACCEPT from IP=10.54.43.87:54312 (IP=0.0.0.0:3891) > conn=10181 fd=14 TLS established tls_ssf=256 ssf=256 > conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI- > C,c=DK" method=128 > conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI- > C,c=DK" mech=SIMPLE ssf=0 > conn=10181 op=0 RESULT tag=97 err=0 text= > conn=10181 op=1 SRCH base="ou=Authentication,o=UNI-C,c=DK" scope=0 > deref=0 filter="( objectClass=*)" > conn=10181 op=1 SRCH attr=+ * > conn=10181 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=10181 op=2 UNBIND > > That is "nentries=0", yup it is missing. > > I decide to add the missing structural object: > > ldapadd -h localhost -p 3890 -f missing.ldif -D "..." -w "..." > > with missing.ldif: > > dn: ou=Authentication,o=UNI-C,c=DK > ou: Authentication > objectClass: organizationalUnit > > Result: > > adding new entry "ou=Authentication,o=UNI-C,c=DK" > ldap_add: Already exists (68) > > And this log-entry: > > conn=10182 op=1 ADD dn="ou=Authentication,o=UNI-C,c=DK" > slap_queue_csn: queueing 0x7f63c811e390 > 20180501061454.852525Z#000000#000#000000 > conn=10182 op=1 RESULT tag=105 err=68 text= > > There or not? I try to delete it: > > ldapdelete -h localhost -p 3890 -f missing-delete.ldif -D "..." -w "..." > > missing-delete.ldif: > > ou=Authentication,o=UNI-C,c=DK > > Result: > > ldap_delete: No such object (32) > matched DN: ou=Authentication,o=UNI-C,c=DK > > Log: > > conn=10184 op=1 DEL dn="ou=Authentication,o=UNI-C,c=DK" > conn=10184 op=1 RESULT tag=107 err=32 text= > > I can't add it, beacause it's already there, and I can't delete it, because it isn't > there... > I can't figure out what the problem is; maybe som subtle difference between > what is in the base and what I am searching for? > I've a feeling that there is a face-palm answer, if so please bear with me.

3 2

MDB questions
by William Brown 07 May '18

07 May '18

Hi there, I have a few questions about MDB, and I have some things I'd like to work on. In the docs there are a few references that reference binary searching. It's not 100% clear but I assume this is a binary search of the keys in a BTree node, not that MDB is a bst. How does MDB provide crash resilience on the free pages? According to man, free() should only be called on memory from malloc but I see that you use free on mmaped pages in mdb_dpage_free. There must be something I'm missing here about this. Anyway, I have two things I want to work on. The simple one is when pages are moved from the txn free list to the env free list (I hope that's correct), it would be good to call madvise(MADV_REMOVE) on the data section. The reason for this is that the madvise call will allow supported filesystems to hole punch the sparse file, allowing space reclamation - without MDB needing to worry about it! The much more invasive change I want to work on is page checksumming. Basically there are 4 cases I have in mind * No checksumming (today) * Metadata checksumming only * Metadata and data checksumming These could be used in these scenarios: * write checksums but don't verify them at run time * write checksums, and only verify metadata on read (possibly a good default option) * write checksums, and verify metadata and data on read (slowest, but has strong integrity properties for some applications) And in all cases I want to add an "mdb_verify" command that would assert all of these are also correct offline. There are a few reasons for this * Hardware is unreliable. Ram, disk, cables, even cpu cache memory can all exhibt bit flips and other data loss. Changing a bit in a pointer can cause damage to any datastructure, and flows on to crashes or silent corruption * Software is never perfect - checksumming allows detection of over- writes of data from overflow or other mistakes that we as humans all make. I'd opt to use something fast like crc32c (intel provides hardware to accelerate this with -march=native). The only issue I see is that this would require an ondisk structure change because the current structs don't have space for this -and the csums have to be *first*. http://www.lmdb.tech/doc/group__internal.html#structMDB__page The checksum would have to be the first value *or* the last value of the page header, (so that it can be updated without affecting the result of the checksum). The checksum for the data would have to be within the header so that this is asserted as correct. Is this something I should pursue? Would this require a ondisk format change? Is there something that could be done to avoid this? Thanks, William

2 1

Missing structural object, ldapadd says it's there, ldapdelete says it isn't
by Ole Nomann Thomsen 02 May '18

02 May '18

Hi list, I am running @(#) $OpenLDAP: slapd 2.4.45 (Jan 23 2018 08:50:30) $ for authentication. I can authenticate most of my clients, but some of them fail. It seems to be the .net ones, not using fastbind: One client tries to authenticate from .net, but can't bind. This is in the log: conn=12475338 fd=15 ACCEPT from IP=192.168.252.131:36473 (IP=0.0.0.0:3890) conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI-C,c=DK" method=128 conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI-C,c=DK" mech=SIMPLE ssf=0 conn=12475338 op=0 RESULT tag=97 err=0 text= conn=12475338 op=1 srch base="ou=authentication,o=uni-c,c=dk" scope=0 deref=0 filter="(objectclass=*)" conn=12475338 op=1 srch attr=objectclass conn=12475338 op=1 search result tag=101 err=0 nentries=0 text= Aha, "ou=authentication,o=uni-c,c=dk" (that default .net auth seems to require) must be missing. Verify that: ldapsearch -x -H ldaps://host:3891/ -D "..." -w "..." -s base -b ou=Authentication,o=UNI-C,c=DK objectClass=* + \* Gives me: # extended LDIF # # LDAPv3 # base <ou=Authentication,o=UNI-C,c=DK> with scope baseObject # filter: entryUUID=* # requesting: + * # # search result search: 2 result: 0 Success # numResponses: 1 With this log-entry: conn=10181 fd=14 ACCEPT from IP=10.54.43.87:54312 (IP=0.0.0.0:3891) conn=10181 fd=14 TLS established tls_ssf=256 ssf=256 conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI-C,c=DK" method=128 conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI-C,c=DK" mech=SIMPLE ssf=0 conn=10181 op=0 RESULT tag=97 err=0 text= conn=10181 op=1 SRCH base="ou=Authentication,o=UNI-C,c=DK" scope=0 deref=0 filter="( objectClass=*)" conn=10181 op=1 SRCH attr=+ * conn=10181 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=10181 op=2 UNBIND That is "nentries=0", yup it is missing. I decide to add the missing structural object: ldapadd -h localhost -p 3890 -f missing.ldif -D "..." -w "..." with missing.ldif: dn: ou=Authentication,o=UNI-C,c=DK ou: Authentication objectClass: organizationalUnit Result: adding new entry "ou=Authentication,o=UNI-C,c=DK" ldap_add: Already exists (68) And this log-entry: conn=10182 op=1 ADD dn="ou=Authentication,o=UNI-C,c=DK" slap_queue_csn: queueing 0x7f63c811e390 20180501061454.852525Z#000000#000#000000 conn=10182 op=1 RESULT tag=105 err=68 text= There or not? I try to delete it: ldapdelete -h localhost -p 3890 -f missing-delete.ldif -D "..." -w "..." missing-delete.ldif: ou=Authentication,o=UNI-C,c=DK Result: ldap_delete: No such object (32) matched DN: ou=Authentication,o=UNI-C,c=DK Log: conn=10184 op=1 DEL dn="ou=Authentication,o=UNI-C,c=DK" conn=10184 op=1 RESULT tag=107 err=32 text= I can't add it, beacause it's already there, and I can't delete it, because it isn't there... I can't figure out what the problem is; maybe som subtle difference between what is in the base and what I am searching for? I've a feeling that there is a face-palm answer, if so please bear with me. Med venlig hilsen Ole Nomann Thomsen Seniorkonsulent [https://www.uvm.dk/-/media/Billeder/Mailsignatur/UVM_STIL_DK.png] Undervisningsministeriet Styrelsen for It og Læring Center for Digitale Overgange og it-styring Vester Voldgade 123 1552 København V Tlf.: 3587 8889 Direkte tlf.: +45 35 87 85 35 E-mail: ole.nomann(a)stil.dk

3 3

Separate trees openldap
by seguranca informacao 01 May '18

01 May '18

Hi guys, I'm trying to accomplish a configuration that I'm not aware of. I need to replicate several directories (AD, openldap, etc) to a unique repository (my openldap). The thing is I need to have completely separate trees for each domain (client). Any ideas in how to do that? bellow is an example what I'm thinking of: dc=example,dc=com cn=users cn=groups ------------------------------ complete separation dc=domain,dc=com cn=users cn=groups ------------------------------ complete separation dc=test,dc=ca cn=users cn=groups ------------------------------ complete separation thx, sergio

3 2

(no subject)
by Chris Cardone 01 May '18

01 May '18

Hello All! I have started building a large scale OpenLDAP infrastructure for the company I work for and Im running into one issue i cant seem to resolve. The final architecture is 4 Master servers (each one in its own data center across the USA) We also want to have 2 slaves tied to each master. We deal with an incredibly high amount of authentication traffic. I currently have the 4 masters configured (n-master - using syncrepl) that is functioning as designed, cn=config and user databases are successfully replicated across the 4 servers no matter which server you use to update. What I am having issues with is getting the slaves to sync to the masters. I have the rpuser set up, the machines can talk to each other. I can run queries using the rpuser from any slave to any master and get data back. I can see the rpuser connecting to the master, and showing successful authentication in an attempt to replicate back to the slave. But this error comes up do_syncrep2: rid=010 got search entry without Sync State control and user data is not replicated back to the slave. some additional notes: On the slaves, i did NOT replicate the cn=config db {0) only the here is the LDIF file (with hostnames/passwd removed) dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=010 provider=ldap://master-1.example.com:389/ bindmethod=simple binddn="uid=rpuser,dc=example,dc=com" credentials=banana searchbase="dc=example,dc=com" type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 here is the applied config on the slave server # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=squaretrade,dc=com olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcSyncrepl: {0}rid=010 provider=ldap://master-1.example.com :389/ bindmethod=simple binddn="uid=rpuser,dc=example,dc=com" credentials =banana searchbase="dc=example,dc=com" type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbMaxSize: 1073741824 here is the syncprov config on the master it is communicating with # {0}syncprov, {1}mdb, config dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov My questions 1> does the slave also require the cn=config database replication? 2> do the masters need similar configs (i.e. like the n-master config) does RID=010 also need to be configured on the master? here is a section of logs from a sync attempt Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: =>do_syncrepl rid=010 Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=12 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=13 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: =>do_syncrep2 rid=010 Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: do_syncrep2: rid=010 got search entry without Sync State control (dc=example,dc=com) Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: do_syncrepl: rid=010 rc -1 retrying (1 retries left) Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: activity on 1 descriptor Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: activity on: Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=12 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=13 active_threads=0 tvp=zero any assistance would be greatly appreciated! and if there is additional information that will help just ask! Christopher

2 1

OpenLDAP & Mysql backend
by Arianna Milazzo 01 May '18

01 May '18

Hello! I installed openLDAP on Debian 9 with mysql backend. I followed the guide and I used example database (http://www.openldap.org/faq/data/cache/978.html ) Now, I can connect to openldap with root credential (in slapd.conf) or with a "person" present in ldap_entries, but I don't see nothing: no search result. With Apache Directory Studio I see only organization. Even it's impossible add something: ldap_add: Server is unwilling to perform (53) additional info: operation not permitted within namingContext Please, someone can tell me why? Thanks, Arianna

2 3

mdb_del: MDB_MAP_FULL: Environment mapsize limit reached
by James Anderson 26 Apr '18

26 Apr '18

good morning; we recently observed a call to mdb_del had returned a mdb_map_full error for an environment which i believe to be configured when opened to permit 40G, while, currently stat indicates a size of roughly 1.7G on disk. i find no bug reports related to this. are there any secondary factors which would lead to this result? this is using the lmdb library at 0.9.21 --- james anderson | james(a)dydra.com | http://dydra.com

1 0

Re: slapadd not adding some of the roleoccupent entries
by Quanah Gibson-Mount 24 Apr '18

24 Apr '18

--On Tuesday, April 24, 2018 1:05 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Thank you for clarification, is it possible to share what are the missing > attributes? There are a number of them (such as entryUUID, entryCSN, etc). Regardless, for replication to work, the operational attr values must be the same across servers. This is generally why if you're bringing up replication in an environment where you already have an existing DB, you slapcat the DB off your "golden" master, and then use slapadd to import it to the other servers. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Migration Task from 2.3.x to 2.4.x
by Periko Support 24 Apr '18

24 Apr '18

Hi people. I got a centos 6.x server running openldap 2.3.x as backend or our samba domain. I need to move to centos 7 which came with openldap 2.4.x. I had read that the files settings change and need to upgrade to the new format for 2.4.x I got my ldap backups, is this the right way to do it? 1) Move my backup to the new server. 2) Remove slapd.d dir from /etc/openldap in the new installation. 3) Copy my openldap settings from the old server (/etc/openldap/) 4) run slapadd -l ldap.backup 5) create a empty directory called slapd.d /etc/openldap 6) convert to new format: slaptest -f ldap.backup -F /etc/openldap/slapd.d This is correct guys or I miss something? Thanks for your help and time!!!

2 1

Re: slapadd not adding some of the roleoccupent entries
by Quanah Gibson-Mount 24 Apr '18

24 Apr '18

--On Wednesday, April 11, 2018 1:31 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > for the same scenario where i have a old server with data and trying to > replicate that data to new server with default skeleton created as below. This will not work, because your skeleton is missing the required operational attrs. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical