openldap-technical

openldap-technical@openldap.org

12 participants
9980 discussions

OpenLDAP Self Registration/Password Reset Portal
by killian.greig＠gmail.com 11 Feb '25

11 Feb '25

I have been working on an OpenLDAP Self Registration/Password Reset Portal in Go that I will be releasing under a BSD license. Its still very much embryonic but if you are interested in taking an early look, please let me know. I'd love to get feedback on it. Kind regards, Killian

8 14

ldap acl matching
by Marc 09 Feb '25

09 Feb '25

olcAccess: {9} to dn.subtree="...... by ssf=256 set="([ldap:///o=XXXX,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=YYYY,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=ZZZZ,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search Currenlty I have the above rules which seem to work. But for every entry in ou=aaaa I need to manually add an acl line. How can I rewrite this to 1 line that matches XXX, YYYY, ZZZZ and anything else I add in ou=aaaa?

1 0

Re: OpenLDAP 2.6 Long Term Support Announcement
by Geert Hendrickx 06 Feb '25

06 Feb '25

Hi What is now the status of OpenLDAP 2.5 / 2.6 / 2.7 ? The website still lists 2.5.x as the current LTS release, and 2.6.x as the Feature Release. Has the below plan been delayed, or is the website just not up to date? Thanks for any clarification Geert On Sat, Aug 10, 2024 at 15:24:56 +0000, project(a)openldap.org wrote: > The OpenLDAP Project is pleased to announce the promotion of OpenLDAP > 2.6 from Feature Release to Long Term Support (LTS) Release, effective > January, 2025. It is now the recommended OpenLDAP version for > deployments that prioritize stability over features. The projected > lifespan for OpenLDAP 2.6 as the LTS release is five years. > > OpenLDAP 2.5 is now in its end of life stage and, at the discretion of > the Project, will receive critical fixes until January 15, 2027. After > that it will be designated as a historical release and no longer > supported or maintained by the Project. Users are encouraged to develop > a plan that will help them upgrade quickly to the new LTS version so > that they can continue on a supported release. > > OpenLDAP 2.7 is the new Feature Release and will see its first public > availability in the fall of 2024. > > ------------- > Compatibility > ------------- > > Replication: > Replication compatibility between OpenLDAP 2.5 and 2.6 is excellent. > The Project expects this to remain the case throughout the remaining > end-of-life stage of OpenLDAP 2.5. > > Configuration Files: > Configuration file compatibility between OpenLDAP 2.5 and 2.6 is > excellent, but may require some manual intervention at upgrade time, > particularly if you are using the OpenLDAP Load Balancer daemon. > > > ---------------------- > Additional Information > ---------------------- > > * The OpenLDAP Release Maintenance Policy can be found at > https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/t… > > * Notes covering upgrading from OpenLDAP 2.5 to 2.6 can be found at > https://www.openldap.org/doc/admin26/appendix-upgrading.html >

2 1

ldap vs db auth
by Marc 06 Feb '25

06 Feb '25

I was actually wondering how ldap compares to mariadb or other databases for authentication. Has anyone actually tested this?

2 1

Re: consumer replication net recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

Ok. I will send you the conf files (minus creds). Can I send them directly to you? Thanks, Suresh On Fri, Jan 17, 2025 at 3:01 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 17, 2025 2:45 PM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > Hi Quanah, > > > > > > Understood. Unfortunately, we are experiencing the issue. Here is my > > configuration. > > > > > > On Master: > > database mdb > > suffix "dc=georgetown,dc=edu" > > . > > dbnosync FALSE > > checkpoint 128 5 > > maxsize 108993459200 > > > > > > > ># Replication > > overlay syncprov > > syncprov-checkpoint 10 5 > > syncprov-sessionlog 100 > > > > > > > > On the Replica: > > syncrepl rid=132 > > provider=ldaps://aaa-master-1.uis.georgetown.edu:636/ > > type=refreshAndPersist > > > > keepalive=300:5:5 > > retry="5 5 300 +" > > > > > > How do we go about fixing this? > > Looks like you're using the deprecated slapd.conf files, which can have > interesting issues because they may not properly order directives. > Without > the full slapd.conf for both provider and consumer (minus sensitive data > like passwords), there's not a lot for me to go off of here. > > --Quanah > > > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

Re: consumer replication net recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

Hi Quanah, Understood. Unfortunately, we are experiencing the issue. Here is my configuration. *On Master:* database mdb suffix "dc=georgetown,dc=edu" . dbnosync FALSE checkpoint 128 5 maxsize 108993459200 # Replication overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 *On the Replica:* syncrepl rid=132 provider=ldaps://aaa-master-1.uis.georgetown.edu:636/ type=refreshAndPersist keepalive=300:5:5 retry="5 5 300 +" How do we go about fixing this? Thanks, Suresh On Fri, Jan 17, 2025 at 2:30 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 17, 2025 10:51 AM -0700 Thomas Pritchard > <pritchardtw(a)gmail.com> wrote: > > > > > I have not experienced the master crashing but I have also experienced > > stalled replication regularly over the last 2 years. We've been on 2.46 > > and have keep alive enabled. We were hoping an upgrade would resolve the > > problem but it seems to exist on latest versions as well. I am also on > > aws ec2 instances. > > > I've been running OpenLDAP in AWS on EC2 instances for the last 3 years at > two different companies, and have never encountered this behavior. > > --Quanah > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

Re: consumer replication not recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

Hi Quanah, You are correct. I misspoke. We ran "bdb" in OpenLDAP: slapd 2.4.50 (Aug 6 2020 11:11:46). We switched to "mdb" when we went from 2.4.50 to 2.6.x version. The upgrade path, as mentioned, was a clean install of 2.6.x and export of db (slapcat) and import(slapadd). Regards, Suresh On Fri, Jan 17, 2025 at 12:48 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, January 6, 2025 6:47 PM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > It was "bdb". For migration, we did a clean install, used "slapcat" to > > export the db and "slapadd" to import. We used this procedure a > > number of times in the past when we switched OS, for upgrades etc. Do > > you have a recommended procedure in mind? > > >> We did an upgrade from 2.6.3 to 2.6.7 at the same time, changing the > >> backend db to "mdb". I think that's when we started to notice that > >> consumer replication is not recovering. So we upgraded again to 2.6.8 to > >> now 2.6.9. > > > There was no bdb backend in the 2.6 series. It was removed after the 2.4 > series, so the upgrade route you describe is not feasible. > > > --Quanah > > > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

1 0

Re: consumer replication not recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

It was "bdb". For migration, we did a clean install, used "slapcat" to export the db and "slapadd" to import. We used this procedure a number of times in the past when we switched OS, for upgrades etc. Do you have a recommended procedure in mind? Regards, Suresh On Mon, Jan 6, 2025 at 6:36 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, January 6, 2025 10:33 AM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > We just had another instance like this. Any suggestions? > > > > > > Thanks, > > Suresh > > > > > > On Fri, Jan 3, 2025 at 4:52 PM Suresh Veliveli > > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > > > > We did an upgrade from 2.6.3 to 2.6.7 at the same time, changing the > > backend db to "mdb". I think that's when we started to notice that > > consumer replication is not recovering. So we upgraded again to 2.6.8 to > > now 2.6.9. > > What backend were you using on 2.6.3 before migrating to mdb? At this > point, I'd suspect your migration may not have been executed correctly. > > --Quanah > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

question regarding olcAccess peername.ip="0.0.0.0%0.0.0.0"
by cyril＠stoll.info 17 Jan '25

17 Jan '25

Hi there My predecessor created a couple of ACLs that are IP based. For example this one: olcAccess: {10}to dn.subtree="ou=something,dc=domain,dc=tld" by peername.ip="0.0.0.0%0.0.0.0" none by * +0 break Unfortunately I can't find any hints what "0.0.0.0%0.0.0.0" means. Can anyone explain that? The only part of the documentation where 0.0.0.0 occurs is in "20.4.4. Listener". In that case it looks to me like 0.0.0.0 is actually the localhost. In other areas (e.g. some Firewalls) 0.0.0.0 is the WAN/Internet which is pretty much the opposite of localhost. Since the subnetmask in the ACL is also 0.0.0.0 I assume that the whole construct peername.ip="0.0.0.0%0.0.0.0" means basically "any" IP. But in that case it does not make a lot of sense to me to even have that in the ACL. However there are a lot of configs leftover from my predecessor that don't make a lot of sense to me, so there's that. Thanks for any hints/explanations and best regards, Cyril

4 7

LMDB: Questions about the MDB_NOSYNC and MDB_MAPASYNC flags
by chris＠christrenkamp.com 16 Jan '25

16 Jan '25

Hi, I have several questions about the environment options in mdb_env_open. * MDB_NOSYNC states that as long as the filesystem preserves the write order, the database will lose durability, but preserve ACI. If we're using EXT4, does that mean we must mount the filesystem with "data=ordered" so LMDB will preserve ACI when used in combination with MDB_NOSYNC? Are there any other mount options we should use so we don't lose ACI? * MDB_MAPASYNC states it has the same corruption potential as MDB_NOSYNC. Does it preserve ACI if the filesystem preserves the write order like MDB_NOSYNC? * The docs states that (MDB_MAPASYNC | MDB_WRITEMAP) may be preferable over MDB_NOSYNC. When would you want to use one over the other? Is there a good rule of thumb to follow if you have to use one of these options? Thanks

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical