openldap-technical

openldap-technical@openldap.org

12 participants
9794 discussions

NO-USER-MODIFICATION and USAGE dSAOperation in custom schema
by Michael Ströder 06 Nov '17

06 Nov '17

HI! Why is it not allowed to use NO-USER-MODIFICATION USAGE dSAOperation in an attribute type declaration? For OATH-LDAP I'd like to define a "virtual" attribute (actually to be processed by back-sock listener) without having to write a slapd overlay. attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: currently valid OTP value of a token' X-ORIGIN 'OATH-LDAP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE ) NO-USER-MODIFICATION USAGE dSAOperation ) But slapd refuses to start: 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 (attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: currently valid OTP value of a token or associated user entry (not directly used)' X-ORIGIN 'OATH-LDAP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )) 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 attributetype: "oath-ldap-at:16" is operational Ciao, Michael.

1 0

Re: Load testing bind performance
by Tim 03 Nov '17

03 Nov '17

No.. unfortunately not... :) I was/am grasping at straws a little bit currently and just tweaking things one setting at a time to see if I can see any difference - admittedly, increasing threads has not improved the situation at all. -- Tim On Fri, Nov 3, 2017 at 3:44 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Friday, November 03, 2017 1:11 PM +0000 Tim <tim(a)yetanother.net> > wrote: > > olcThreads: 512 >> > > You have 128 cores on your box? More threads != better performance. In > fact, it will cause significant problems if it is set beyond what your > system can handle. > > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > > -- Tim tim(a)yetanother.net

2 1

Load testing bind performance
by Tim 03 Nov '17

03 Nov '17

Heya, Could anyone recommend a quick and dirty way in which to load test an OpenLDAP service to get an indication as to the potential capacity for the platform to handle bind requests? I've used the python-ldap library to simulate other varieties of interactions successfully, but when it comes to binds, each interaction seems to generate a substantial amount of traffic behind the scenes, so suspect that *things* are happening that is artificially limiting the bind rate/s. I've seen some links to people using JMeter to perform this sort of load testing, but thought there may be other (quicker to implement) tools also? Thanks in advance, -- Tim tim(a)yetanother.net

4 8

Re: Load testing bind performance
by Quanah Gibson-Mount 03 Nov '17

03 Nov '17

--On Friday, November 03, 2017 1:11 PM +0000 Tim <tim(a)yetanother.net> wrote: > olcThreads: 512 You have 128 cores on your box? More threads != better performance. In fact, it will cause significant problems if it is set beyond what your system can handle. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Load testing bind performance
by Howard Chu 01 Nov '17

01 Nov '17

Tim wrote: > Heya, > > Could anyone recommend a quick and dirty way in which to load test an OpenLDAP > service to get an indication as to the potential capacity for the platform to > handle bind requests? > > I've used the python-ldap library to simulate other varieties of interactions > successfully, but when it comes to binds, each interaction seems to generate a > substantial amount of traffic behind the scenes, so suspect that *things* are > happening that is artificially limiting the bind rate/s. > > I've seen some links to people using JMeter to perform this sort of load > testing, but thought there may be other (quicker to implement) tools also? You can look at slapd-bind and slapd-auth in the OpenLDAP test suite, that's what they're for. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

uidNumber for Service Accounts?
by Douglas Duckworth 26 Oct '17

26 Oct '17

Hi Do I need uidNumber for Service Accounts used for application / server binding if this user won't actually be resolved by sssd or nslcd? I set a very high uidNumber but eventually this will conflict with users as in my ignorance I didn't put this in a lower range. Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

3 2

Help wanted - LDAP deployment for NTP and Network Time Foundation
by Harlan Stenn 26 Oct '17

26 Oct '17

Hi folks, The NTP Project has an ancient LDAP deployment that needs to be upgraded. We've started a re-deployment that includes both ntp.org and nwtime.org, and have the server side of that mostly finished. The volunteers who have been doing this don't have the time to get it done soon enough. We could really use some more help to get the deployment finished and installed. This includes a reality check on our replicated server setup, the schema, and then getting various "services" (login/ssh, some web apps, etc) hooked in. If you're up for lending a hand on this, please let me know. -- Harlan Stenn <stenn(a)nwtime.org> http://networktimefoundation.org - be a member!

1 0

Re: uidNumber for Service Accounts?
by Douglas Duckworth 25 Oct '17

25 Oct '17

Thanks Michael! No, we do not have uidNumber-based ACLs only DN based. I will remove the uidNumber. Thanks Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Oct 25, 2017 at 9:55 AM, Michael Ströder <michael(a)stroeder.com> wrote: > Douglas Duckworth wrote: > > Do I need uidNumber for Service Accounts used for application / server > > binding if this user won't actually be resolved by sssd or nslcd? > > In general if your client only binds to the LDAP server it doesn't need > 'uidNumber' attribute. It just needs a bind-DN and a password in its > config. I assume though that your LDAP server does not have ACLs based > uidNumber-based filter affecting your client. > > And I don't know whether something else in your deployment needs it. > This only you can find out. > > Ciao, Michael. > >

1 0

Re: [EXTERNAL] pwdPolicySubentry: value #0 already exists
by Douglas Duckworth 25 Oct '17

25 Oct '17

Thanks so much, Jon! I can see it clearly now! # Service Accounts, domain dn: ou=Service Accounts,domain # g14classified, Service Accounts, domain dn: uid=g14classified,ou=Service Accounts,domain pwdPolicySubentry: cn=CustomBindAccountPolicy,ou=Policies,domain Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Oct 25, 2017 at 9:34 AM, Jon C Kidder <jckidder(a)aep.com> wrote: > pwdPolicySubentry is an operational attribute. It will not be returned in > search results unless you explicitly request it or use + in your requested > attribute list. > > > > If you change the add to a replace in your ldif file your modify operation > should succeed. > > > > > <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.aep.com_&d=DwMGaQ&c…> > > *JON C KIDDER* | *MIDDLEWARE ADMINISTRATOR LEAD* > JCKIDDER(a)AEP.COM | D:614.716.4970 <(614)%20716-4970> > 1 RIVERSIDE PLAZA, COLUMBUS, OH 43215 > <https://maps.google.com/?q=1+RIVERSIDE+PLAZA,+COLUMBUS,+OH+43215&entry=gmai…> > > > > *From:* openldap-technical [mailto:openldap-technical-bounces@openldap.org] > *On Behalf Of *Douglas Duckworth > *Sent:* Wednesday, October 25, 2017 9:24 AM > *To:* Openldap Technical > *Subject:* [EXTERNAL] pwdPolicySubentry: value #0 already exists > > > > This is an EXTERNAL email. STOP. THINK before you CLICK links or OPEN > attachments. If suspicious please forward to incidents(a)aep.com for review. > ------------------------------ > > Hi > > > > I am trying to make sure my bind Service Account's password does not > expire. I set this in ou=Policies with the intention that the policy would > only be applied to this user: > > > > # Policies, domain > > dn: ou=Policies,domain > > ou: Policies > > objectClass: organizationalUnit > > > > # CustomBindAccountPolicy, Policies, domain > > dn: cn=CustomBindAccountPolicy,ou=Policies,domain > > objectClass: person > > objectClass: top > > cn: passwordDefault > > cn: CustomBindAccountPolicy > > sn: passwordDefault > > pwdAttribute: userPassword > > pwdMinAge: 0 > > pwdMaxAge: 0 > > pwdLockout: FALSE > > > > However, I do not see this dn referenced on the user: > > > > # importantuser, Service Accounts, domain > > dn: uid=importantuser,ou=Service Accounts,domain > > objectClass: top > > objectClass: account > > objectClass: posixAccount > > objectClass: extensibleObject > > uid: binduser > > cn: bind > > sn: user > > givenName: binduser > > title: Account > > loginShell: /dev/null > > uidNumber: 123 > > gidNumber: 456 > > homeDirectory: /dev/null > > description: Service Account > > userPassword:: password123 > > > > When I try to add using ldapadd and this ldif: > > > > dn: uid=importantuser,ou=Service Accounts,domain > > changetype: modify > > add: pwdPolicySubentry > > pwdPolicySubentry: cn=CustomBindAccountPolicy,ou= > Policies,dc=davinci,dc=med,dc=cornell,dc=edu > > > > I get this error: > > me@nsa[~/ldap]$ ladd server.ldif > > > > Enter LDAP Password: > > modifying entry "uid=importantuser,ou=Service Accounts,domain" > > ldap_modify: Type or value exists (20) > > additional info: modify/add: pwdPolicySubentry: value #0 already > exists > > > > Do you have any idea what could be happening? My ACL's allow the binduser > to see everything so I don't understand what's happening. > > > > Thank you very much! > > > > > Thanks, > > > Douglas Duckworth, MSc, LFCS > HPC System Administrator > Scientific Computing Unit > > Physiology and Biophysics > > Weill Cornell Medicine > > E: doug(a)med.cornell.edu > O: 212-746-6305 <(212)%20746-6305> > F: 212-746-8690 <(212)%20746-8690> >

1 0

pwdPolicySubentry: value #0 already exists
by Douglas Duckworth 25 Oct '17

25 Oct '17

Hi I am trying to make sure my bind Service Account's password does not expire. I set this in ou=Policies with the intention that the policy would only be applied to this user: # Policies, domain dn: ou=Policies,domain ou: Policies objectClass: organizationalUnit # CustomBindAccountPolicy, Policies, domain dn: cn=CustomBindAccountPolicy,ou=Policies,domain objectClass: person objectClass: top cn: passwordDefault cn: CustomBindAccountPolicy sn: passwordDefault pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 0 pwdLockout: FALSE However, I do not see this dn referenced on the user: # importantuser, Service Accounts, domain dn: uid=importantuser,ou=Service Accounts,domain objectClass: top objectClass: account objectClass: posixAccount objectClass: extensibleObject uid: binduser cn: bind sn: user givenName: binduser title: Account loginShell: /dev/null uidNumber: 123 gidNumber: 456 homeDirectory: /dev/null description: Service Account userPassword:: password123 When I try to add using ldapadd and this ldif: dn: uid=importantuser,ou=Service Accounts,domain changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=CustomBindAccountPolicy,ou=Policies,dc=davinci,dc=med,dc=cornell,dc=edu I get this error: me@nsa[~/ldap]$ ladd server.ldif Enter LDAP Password: modifying entry "uid=importantuser,ou=Service Accounts,domain" ldap_modify: Type or value exists (20) additional info: modify/add: pwdPolicySubentry: value #0 already exists Do you have any idea what could be happening? My ACL's allow the binduser to see everything so I don't understand what's happening. Thank you very much! Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical