openldap-technical

openldap-technical@openldap.org

3 participants
9898 discussions

Replication problem with attributes
by Dennis Meyer 09 Nov '17

09 Nov '17

Hi, i have setup a new multimaster with mirrormode = true cluster with Debian 9 and openldap 2.4.44. There are two Servers ldap1 and ldap2. As its just a lab Environment there is no need to hide passwords and stuff: /etc/ldap/slapd.d/cn=config/olcDatabase={1}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 8fb04e78 dn: olcDatabase={1}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=localdomain olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * non e olcAccess: {1}to attrs=loginShell,gecos by dn="cn=admin,dc=localdomain" writ e by self write by * read olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to * by * read olcAccess: {4}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=localdomain" write by dn="cn=mirrormode,dc=loca ldomain" read by * none olcLastMod: TRUE olcRootDN: cn=admin,dc=localdomain olcRootPW:: e1NTSEF9Z05GbEJIRHE1aTNpa0ZsYVk0WVh3VTM4SkF0VkF0b3Q= olcDbCheckpoint: 512 30 olcDbIndex: member,memberUid eq olcDbIndex: cn pres,sub,eq olcDbIndex: uid pres,sub,eq olcDbIndex: displayName pres,sub,eq olcDbIndex: default sub olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: mail,givenName eq,subinitial olcDbIndex: dc eq olcDbIndex: objectClass,entryCSN,entryUUID eq olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: e9f1dcca-5978-1037-8f17-b1d4dc2a991d creatorsName: cn=admin,cn=config createTimestamp: 20171109090544Z olcMirrorMode: TRUE olcSyncrepl: {0}rid=001 provider=ldap://10.211.55.20:389 bindmethod=simple b inddn="cn=mirrormode,dc=localdomain" credentials=iechi1Eid_ie:quu searchbas e="dc=localdomain" schemachecking=on type=refreshAndPersist retry="60 +" entryCSN: 20171109101419.176516Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20171109101419Z Here is my Database, its on both ldap servers identical - i dumped this on both servers and ran a diff slapcat: dn: dc=localdomain objectClass: top objectClass: dcObject objectClass: organization o: localdomain dc: localdomain structuralObjectClass: organization creatorsName: cn=admin,dc=localdomain entryUUID: 1854fd30-597f-1037-9872-eb46faf4f5e0 createTimestamp: 20171109094959Z entryCSN: 20171109094959.802699Z#000000#000#000000 modifiersName: cn=admin,dc=localdomain modifyTimestamp: 20171109094959Z contextCSN: 20171109100725.365127Z#000000#000#000000 dn: cn=admin,dc=localdomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9Z05GbEJIRHE1aTNpa0ZsYVk0WVh3VTM4SkF0VkF0b3Q= structuralObjectClass: organizationalRole entryUUID: e9f75c72-5978-1037-8289-d381257e6532 creatorsName: cn=admin,dc=localdomain createTimestamp: 20171109090545Z entryCSN: 20171109090545.033599Z#000000#000#000000 modifiersName: cn=admin,dc=localdomain modifyTimestamp: 20171109090545Z dn: cn=mirrormode,dc=localdomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: mirrormode description: Syncrepl user for mirrormode operation structuralObjectClass: organizationalRole entryUUID: 49734c42-5979-1037-9e9b-d338d82a2242 creatorsName: cn=admin,dc=localdomain createTimestamp: 20171109090825Z userPassword:: e1NTSEF9T3hzeUVnanhLTThZSDJjK3JweG1sM2pWOG5USEkwS1c= entryCSN: 20171109100725.365127Z#000000#000#000000 modifiersName: cn=admin,dc=localdomain modifyTimestamp: 20171109100725Z And this is the error i get only on ldap1 after setting up replication on both servers: Nov 9 12:36:16 ldap1 slapd[17296]: Entry (cn=admin,dc=localdomain): object class 'simpleSecurityObject' requires attribute 'userPassword' Nov 9 12:36:16 ldap1 slapd[17296]: null_callback : error code 0x41 Nov 9 12:36:16 ldap1 slapd[17296]: syncrepl_entry: rid=001 be_add cn=admin,dc=localdomain failed (65) Nov 9 12:36:16 ldap1 slapd[17296]: do_syncrepl: rid=001 rc 65 retrying Any Ideas how could solve this? Best regards Dennis

1 0

Re: disk write on old 2.4.9
by Howard Chu 08 Nov '17

08 Nov '17

richard lucassen wrote: > On Wed, 8 Nov 2017 11:35:40 +0100 > richard lucassen <mailinglists(a)lucassen.org> wrote: > >> Is there a way to limit these disk writes? I didn't touch the standard >> Ubuntu settings, except for the usual settings like SSL. > > I found an old setting that seems to do the job: > > shm_key 100 > > In that old setting it was set to 100, the man page says: > > shm_key _integer_ > Specify a key for a shared memory BDB environment. By default the BDB > environment uses memory mapped files. If a non-zero value is > specified, it will be used as the key to identify a shared memory > region that will house the environment. > > Is that integer a sort of label or does it mean something else? It means what it says - it is a shared memory key. Read the ipcs(1) manpage. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

disk write on old 2.4.9
by richard lucassen 08 Nov '17

08 Nov '17

Hello list, I have an ***old*** Ubuntu-8.04 running 2.4.9. I know, this is old, but there are no security issues here. This slapd contains a small database which is modified rarely. OTOH, there are many read operations. The backend is hdb. As these boxes are running on a CF-disk I'd like to limit disk writes, but when the database is queried, the backend is being updated (slapd started at 11:25, read operation at 11:31): # ls -altr /var/lib/ldap/ total 768 drwxr-xr-x 3 root root 4096 2013-11-11 20:28 .. -rw-r--r-- 1 openldap openldap 96 2017-11-08 09:36 DB_CONFIG -rw------- 1 openldap openldap 8192 2017-11-08 11:25 objectClass.bdb -rw------- 1 openldap openldap 8192 2017-11-08 11:25 dn2id.bdb -rw------- 1 openldap openldap 123193 2017-11-08 11:25 log.0000000001 -rw------- 1 openldap openldap 65536 2017-11-08 11:25 id2entry.bdb drwx------ 2 openldap openldap 4096 2017-11-08 11:25 . -rw-r--r-- 1 openldap openldap 2048 2017-11-08 11:25 alock -rw------- 1 openldap openldap 24576 2017-11-08 11:31 __db.005 -rw------- 1 openldap openldap 565248 2017-11-08 11:31 __db.004 -rw------- 1 openldap openldap 98304 2017-11-08 11:31 __db.003 -rw------- 1 openldap openldap 2629632 2017-11-08 11:31 __db.002 -rw------- 1 openldap openldap 8192 2017-11-08 11:31 __db.001 Is there a way to limit these disk writes? I didn't touch the standard Ubuntu settings, except for the usual settings like SSL. Richard. -- richard lucassen http://contact.xaq.nl/

1 1

Re: NO-USER-MODIFICATION and USAGE dSAOperation in custom schema
by Howard Chu 06 Nov '17

06 Nov '17

Michael Ströder wrote: > HI! > > Why is it not allowed to use > > NO-USER-MODIFICATION > USAGE dSAOperation > > in an attribute type declaration? Because such an operational attribute requires server-side code to actually implement it, and you haven't got any means to provide that code. Custom operational attributes must be defined using code loaded in a module. > > For OATH-LDAP I'd like to define a "virtual" attribute (actually to be > processed by back-sock listener) without having to write a slapd overlay. > > attributetype ( oath-ldap-at:16 > NAME 'oathOTPValue' > DESC 'OATH-LDAP: currently valid OTP value of a token' > X-ORIGIN 'OATH-LDAP' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 > EQUALITY integerMatch > SINGLE-VALUE ) > NO-USER-MODIFICATION > USAGE dSAOperation ) > > But slapd refuses to start: > > 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 > (attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: > currently valid OTP value of a token or associated user entry (not > directly used)' X-ORIGIN 'OATH-LDAP' SYNTAX > 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE > NO-USER-MODIFICATION USAGE dSAOperation )) > 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 > attributetype: "oath-ldap-at:16" is operational > > Ciao, Michael. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 3

NO-USER-MODIFICATION and USAGE dSAOperation in custom schema
by Michael Ströder 06 Nov '17

06 Nov '17

HI! Why is it not allowed to use NO-USER-MODIFICATION USAGE dSAOperation in an attribute type declaration? For OATH-LDAP I'd like to define a "virtual" attribute (actually to be processed by back-sock listener) without having to write a slapd overlay. attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: currently valid OTP value of a token' X-ORIGIN 'OATH-LDAP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE ) NO-USER-MODIFICATION USAGE dSAOperation ) But slapd refuses to start: 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 (attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: currently valid OTP value of a token or associated user entry (not directly used)' X-ORIGIN 'OATH-LDAP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )) 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 attributetype: "oath-ldap-at:16" is operational Ciao, Michael.

1 0

Re: Load testing bind performance
by Tim 03 Nov '17

03 Nov '17

No.. unfortunately not... :) I was/am grasping at straws a little bit currently and just tweaking things one setting at a time to see if I can see any difference - admittedly, increasing threads has not improved the situation at all. -- Tim On Fri, Nov 3, 2017 at 3:44 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Friday, November 03, 2017 1:11 PM +0000 Tim <tim(a)yetanother.net> > wrote: > > olcThreads: 512 >> > > You have 128 cores on your box? More threads != better performance. In > fact, it will cause significant problems if it is set beyond what your > system can handle. > > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > > -- Tim tim(a)yetanother.net

2 1

Load testing bind performance
by Tim 03 Nov '17

03 Nov '17

Heya, Could anyone recommend a quick and dirty way in which to load test an OpenLDAP service to get an indication as to the potential capacity for the platform to handle bind requests? I've used the python-ldap library to simulate other varieties of interactions successfully, but when it comes to binds, each interaction seems to generate a substantial amount of traffic behind the scenes, so suspect that *things* are happening that is artificially limiting the bind rate/s. I've seen some links to people using JMeter to perform this sort of load testing, but thought there may be other (quicker to implement) tools also? Thanks in advance, -- Tim tim(a)yetanother.net

4 8

Re: Load testing bind performance
by Quanah Gibson-Mount 03 Nov '17

03 Nov '17

--On Friday, November 03, 2017 1:11 PM +0000 Tim <tim(a)yetanother.net> wrote: > olcThreads: 512 You have 128 cores on your box? More threads != better performance. In fact, it will cause significant problems if it is set beyond what your system can handle. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Load testing bind performance
by Howard Chu 01 Nov '17

01 Nov '17

Tim wrote: > Heya, > > Could anyone recommend a quick and dirty way in which to load test an OpenLDAP > service to get an indication as to the potential capacity for the platform to > handle bind requests? > > I've used the python-ldap library to simulate other varieties of interactions > successfully, but when it comes to binds, each interaction seems to generate a > substantial amount of traffic behind the scenes, so suspect that *things* are > happening that is artificially limiting the bind rate/s. > > I've seen some links to people using JMeter to perform this sort of load > testing, but thought there may be other (quicker to implement) tools also? You can look at slapd-bind and slapd-auth in the OpenLDAP test suite, that's what they're for. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

uidNumber for Service Accounts?
by Douglas Duckworth 26 Oct '17

26 Oct '17

Hi Do I need uidNumber for Service Accounts used for application / server binding if this user won't actually be resolved by sssd or nslcd? I set a very high uidNumber but eventually this will conflict with users as in my ignorance I didn't put this in a lower range. Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical