openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Re: Olc deployment vs slapd.conf based deployment
by Quanah Gibson-Mount 15 Sep '17

15 Sep '17

--On Friday, September 15, 2017 10:01 AM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > And the upgrade issue with 'pwdMaxRecordedFailure' (see other mail > thread) serves as good example how easy it is to run into a operational > dead-end with cn=config. There's no easy way to fix this afterwards > without violating what's considered best practice for maintaining > cn=config. I could give several other examples for this kind of > operational dead-ends. In retrospect, I think the ITS that introduced that change should not have gone into RE24. ;) Unfortunately, one thing that people seldom test in testing calls is upgrade scenarios from older versions of OpenLDAP to a current release, with a variety of configurations, so it was not caught as an issue prior to release. Certainly another reason as to why we need 2.5 out with slapmodify (and possibly a flag to disable loading some modules in that scenario). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Upgrade from 2.4.40 to 2.4.44
by Quanah Gibson-Mount 15 Sep '17

15 Sep '17

--On Friday, September 15, 2017 9:23 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > I manually updated the ppolicy.ldif and restarted slapd and it seems > working fine, can i do that way? Not recommended, but yes. > So the idle processed wold be slapcat cm=config from 2.4.40 and add new > attribute, upgrade ldap to 2.4.44 and slapadd back? well, slapcat cn=config from 2.4.40, add the attribute to the LDIF, slapadd it back, and then upgrade to 2.4.44. > Is it possible to do ldapmodify 2.4.40 schema with new attribute? yes. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Upgrade from 2.4.40 to 2.4.44
by rammohan ganapavarapu 15 Sep '17

15 Sep '17

I manually updated the ppolicy.ldif and restarted slapd and it seems working fine, can i do that way? So the idle processed wold be slapcat cm=config from 2.4.40 and add new attribute, upgrade ldap to 2.4.44 and slapadd back? Is it possible to do ldapmodify 2.4.40 schema with new attribute? Thanks On Sep 15, 2017 8:10 AM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: > --On Thursday, September 14, 2017 9:30 PM -0700 rammohan ganapavarapu < > rammohanganap(a)gmail.com> wrote: > > >> If i accident allt upgrade rpm to 2.4.44 is there any way to fix this >> issue? >> > > Use slapcat to export the cn=config database, modify the schema to add the > attribute, and use slapadd to restore it. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

Re: Upgrade from 2.4.40 to 2.4.44
by Quanah Gibson-Mount 15 Sep '17

15 Sep '17

--On Thursday, September 14, 2017 9:30 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > If i accident allt upgrade rpm to 2.4.44 is there any way to fix this > issue? Use slapcat to export the cn=config database, modify the schema to add the attribute, and use slapadd to restore it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Olc deployment vs slapd.conf based deployment
by Quanah Gibson-Mount 15 Sep '17

15 Sep '17

--On Friday, September 15, 2017 10:09 AM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > Quanah Gibson-Mount wrote: >> I think it's a strong plus to be able to reconfigure a >> standalone server into an MMR cluster with zero downtime, > > I don't buy this argument. If you're really eager reaching high > availability you have to implement a decent load-balancer and test > correct fail-over anyway. And then your MMR cluster will have zero > down-time (seen from the LDAP clients) during re-configuration even when > restarting the replicas one after another. I'm talking about the process of taking a single provider + multiple replica environment and trivially transitioning that to an MMR environment, where it can either be a mix of providers and replicas, or all providers, etc. With the replicas configured to pull from 1+ providers. You can do that entire transition via cn=config with no downtime. With slapd.conf, you will have to stop the provider (outage) to reconfigure it into an MMR capable scenario. And I've never needed a load balancer with properly written software that understands how to parse multiple LDAP URI's for failover. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Antw: Re: Olc deployment vs slapd.conf based deployment
by Michael Ströder 15 Sep '17

15 Sep '17

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb: >> Personally I would never replicate cn=config. > > You mean "via LDAP"? Yes. > I think the best way for an unreliable MMR LDAP server is > to run it with different configs on each node ;-) Yes. >> Use a decent config management system instead. > > to replicate the config, right? No, to *install* a specific config for the target system. Ciao, Michael.

1 0

Upgrade from 2.4.40 to 2.4.44
by rammohan ganapavarapu 15 Sep '17

15 Sep '17

Hi, I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of yum upgrade, now I am not able to bring up ldap server , i am getting some ppolicy maxrecord failure attribute error, we are using ppolicy overlay, any advice how to fix this issue? Thanks

2 1

Re: Upgrade from 2.4.40 to 2.4.44
by rammohan ganapavarapu 15 Sep '17

15 Sep '17

Quanah, Thank you ,is there any thing else do i have to take care to upgrade from <=2.4.40 to 2.4.44? is there any upgrade doc that i can use? Ram On Thu, Sep 14, 2017 at 6:50 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, September 14, 2017 7:24 PM -0700 rammohan ganapavarapu < > rammohanganap(a)gmail.com> wrote: > > I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of >> yum upgrade, now I am not able to bring up ldap server , i am getting >> some ppolicy maxrecord failure attribute error, we are using ppolicy >> overlay, any advice how to fix this issue? >> > > > The schema for ppolicy was changed in 2.4.43. You have to add the the > following attribute to ppolicy.ldif: > > olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME > 'pwdMaxRecordedFailure' EQUALITY integerMatch ORDERING integerOrderingMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) > > This should be done *prior* to upgrading. Unfortunately, it appears this > requirement was not well communicated. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 1

Re: Upgrade from 2.4.40 to 2.4.44
by rammohan ganapavarapu 15 Sep '17

15 Sep '17

If i accident allt upgrade rpm to 2.4.44 is there any way to fix this issue? On Sep 14, 2017 6:50 PM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: --On Thursday, September 14, 2017 7:24 PM -0700 rammohan ganapavarapu < rammohanganap(a)gmail.com> wrote: I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of > yum upgrade, now I am not able to bring up ldap server , i am getting > some ppolicy maxrecord failure attribute error, we are using ppolicy > overlay, any advice how to fix this issue? > The schema for ppolicy was changed in 2.4.43. You have to add the the following attribute to ppolicy.ldif: olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailure' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) This should be done *prior* to upgrading. Unfortunately, it appears this requirement was not well communicated. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Upgrade from 2.4.40 to 2.4.44
by Quanah Gibson-Mount 15 Sep '17

15 Sep '17

--On Thursday, September 14, 2017 7:24 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of > yum upgrade, now I am not able to bring up ldap server , i am getting > some ppolicy maxrecord failure attribute error, we are using ppolicy > overlay, any advice how to fix this issue? The schema for ppolicy was changed in 2.4.43. You have to add the the following attribute to ppolicy.ldif: olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailure' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) This should be done *prior* to upgrading. Unfortunately, it appears this requirement was not well communicated. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical