openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

LMDB master branch
by opensource＠gmx-topmail.de 19 Apr '17

19 Apr '17

Hi there, I am on the mdb.master branch because of MDB_VL32. We updated the LMDB code in January, and before I update to the latest commit I wanted to check with you. Disclaimer: I am aware of being outside of the official release cycles and potential risks. On the other hand, we have a lot of unit tests, and a pretty good installation base. In that way it is also a good test for LMDB. Now to my questions: 1) What are your rough plans with mdb.master in terms of time line and features? (With the 0.9.20 release being delayed, new features may pile up in mdb.master. When will they be merged?) 2) Is mdb.master running on any systems you know of? 3) Recent changes in mdb.master also include format changes for the locking file (e.g. commit "Store lock ID instead of pathname in lockfile"). What are the consequences when updating from an older version? 4) Are the formats for lock & data files considered stable? Thanks, Markus

1 0

Is there anything in LDAP that works similar to HTTP's virtual hosting.
by John Lewis 17 Apr '17

17 Apr '17

I am reading in the LDAP spec https://tools.ietf.org/html/rfc4511 about naming contexts and I am looking at my RootDSE. Since my DIT mirrors DNS https://tools.ietf.org/html/rfc2247, there must be some way to route someone to the correct naming context based on the DNS they were using to access the LDAP server, otherwise I just don't understand the spec.

4 10

this is really good news
by Egidio Melissano 17 Apr '17

17 Apr '17

Greetings, Have you heard the latest news already? I think you'll like it, please read it here http://www.mensworld.center/hospital.php?0002 Very truly yours, Egidio Melissano

1 0

Re: lmdb
by Howard Chu 16 Apr '17

16 Apr '17

Patrick Hawley wrote: > > > I've been puzzled by lmdb's free list use. In some experiments, I've > been seeing that it sometimes grabs pages from the end instead of > using free list pages. This means that the number of pages used > tends to grow until it uses them all. I've tried increasing the map size > (to even quite a large value), and ensuring that write transactions are > not held open long but that doesn't seem to help. Length of write transactions is irrelevant. Nothing in the LMDB documentation talks about length of write transactions; perhaps you need to reread the docs. The issue is keeping a lot of read transactions open when writes are in progress. I've tried with > subdatabases and without subdatabases. It does appear to increase > faster when overflow pages are used, but even without overflow > pages the effect occurs. I can see in the code some places where it > might choose not to use the free list, but I haven't been able to > identify a problem in the code. Wondering whether anyone else > has observed this also. The library otherwise looks quite useful > and performant. Using lmdb via python (0.92). Thanks. > > Patrick -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Slapd authenticating with krb5 localhost principal
by Jaap Winius 15 Apr '17

15 Apr '17

Hi folks, My new Debian stretch slapd consumer configuration is suffering from a Kerberos authentication problem that looks like a bug. It is apparently unable to read the Kerberos keytab file and instead authenticates to its provider as (for my realm) ldap/localhost(a)EXAMPLE.COM. The error I keep getting is: slapd[1668]: GSSAPI Error: Unspecified GSS failure. \ Minor code may provide more information \ (Server ldap/localhost(a)EXAMPLE.COM not found in Kerberos database) The software I'm using is: * Debian stretch * MIT Kerberos 1.15-1 * slapd 2.4.44+dfsg-3 * libsasl2-modules-gssapi-mit 2.1.27~101-g0780600+dfsg-3 The usual way to get slapd to use a Kerberos principal to authenticate to a provider is by telling it where the Kerberos key table file is. On Debian systems, slapd looks in a default location first (/etc/krb5.keytab), but an alternate keytab can be set in /etc/default/slapd with e.g.: export KRB5_KTNAME=/etc/ldap/krb5-ldap.keytab Just ensure that the openldap group can read the keytab file. This works on Debian wheezy with slapd 2.4.31-2+deb7u2, but for some reason it's not working at all on Debian stretch. Other things I have checked are: * /etc/hostname * hostnamectl status * /etc/hosts (contains only '127.0.0.1 localhost' and linklocal addresses) * DNS forward and reverse lookups So, is this a slapd problem, or maybe something to do with a SASL/GSSAPI library, such as libsasl2-modules-gssapi-mit? Thanks, Jaap

2 1

Re: Info Attribute
by Quanah Gibson-Mount 14 Apr '17

14 Apr '17

--On Wednesday, April 12, 2017 11:12 PM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > Tom Jay wrote: >> I'm trying to add the 'info' attribute to an entry and am getting the >> following: >> >> ldap_modify: Object class violation (65) >> additional info: attribute 'info' not allowed >> [..] >> Currently, the only object class assigned to the entry is inetOrgPerson. >> >> Has anyone got any idea why this may be the case? > > In general one would use attribute 'description' for this kind of content > nowadays. In addition, I would note the comments for the "info" attribute even in the RFC say to not use it: 9.3.4. Information The Information attribute type specifies any general information pertinent to an object. It is recommended that specific usage of this attribute type is avoided, and that specific requirements are met by other (possibly additional) attribute types. Reference: <https://www.ietf.org/rfc/rfc1274.txt> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

lmdb
by Patrick Hawley 13 Apr '17

13 Apr '17

I've been puzzled by lmdb's free list use. In some experiments, I've been seeing that it sometimes grabs pages from the end instead of using free list pages. This means that the number of pages used tends to grow until it uses them all. I've tried increasing the map size (to even quite a large value), and ensuring that write transactions are not held open long but that doesn't seem to help. I've tried with subdatabases and without subdatabases. It does appear to increase faster when overflow pages are used, but even without overflow pages the effect occurs. I can see in the code some places where it might choose not to use the free list, but I haven't been able to identify a problem in the code. Wondering whether anyone else has observed this also. The library otherwise looks quite useful and performant. Using lmdb via python (0.92). Thanks. Patrick

1 0

Info Attribute
by Tom Jay 12 Apr '17

12 Apr '17

Hello, I'm trying to add the 'info' attribute to an entry and am getting the following: ldap_modify: Object class violation (65) additional info: attribute 'info' not allowed If you look at the Cosine schema, the info attribute is defined, but with no object class (pilotObject has been commented out). If I try and add the 'top' object class, this is successful, but still prevents me from adding the info attribute. Currently, the only object class assigned to the entry is inetOrgPerson. Has anyone got any idea why this may be the case? Thanks. Tom

2 1

OpenLDAP + MySQL BackEnd
by Alexandre Vilarinho 10 Apr '17

10 Apr '17

Hello all, Recently I've donwload the OpenLDAP 2.4.44 and enable mysql as followed. apt-get install libssl-dev libdb-dev unixodbc-dev time wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.26.tgz tar xvfz openldap-*.tgz cd openldap-* ./configure --enable-sql make depend make make install apt-get install mysql-server libmyodbc # put mysql root password and confirm password that you want mysql -u root -p # put mysql root password CREATE USER 'openldap'@'localhost' IDENTIFIED BY 'yourpassword'; CREATE DATABASE IF NOT EXISTS openldap; GRANT ALL PRIVILEGES ON openldap.* TO 'openldap'@'localhost'; FLUSH PRIVILEGES; exit edit /etc/odbc.ini [openldap] Description = Example for OpenLDAP's back-sql Driver = MySQL Trace = No Database = openldap Servername = localhost UserName = openldap Password = yourpassword ReadOnly = No RowVersioning = No ShowSystemTables = No ShowOidColumn = No FakeOidIndex = No ConnSettings = SOCKET = /var/run/mysqld/mysqld.sock /etc/odbcinst.ini [MySQL] Description = ODBC for MySQL Driver = /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.soo FileUsage = 1 cd servers/slapd/back-sql/rdbms_depend/mysql/ mysql -u openldap -p openldap < backsql_create.sql mysql -u openldap -p openldap < testdb_create.sql mysql -u openldap -p openldap < testdb_data.sql mysql -u openldap -p openldap < testdb_metadata.sql /usr/local/etc/openldap/slapd.conf # $OpenLDAP$ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw rootpassword dbname openldap dbuser openldap dbpasswd yourpassword subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no When I execute the following command /usr/local/libexec/slapd -d 1 I receive the following information 58eba756 backsql_db_open(): entry deletion SQL statement not specified (use "renentry_stmt" directive in slapd.conf)58eba756 backsql_db_open(): setting "UPDATE ldap_entries SET dn=?,parent=?,keyval=? WHERE id=?" by default58eba756 backsql_db_open(): objclasses deletion SQL statement not specified (use "delobjclasses_stmt" directive in slapd.conf)58eba756 backsql_db_open(): setting "DELETE FROM ldap_entry_objclasses WHERE entry_id=?" by default58eba756 ==>backsql_get_db_conn()58eba756 ==>backsql_open_db_handle()Floating point exception (core dumped) Apparently there is no error. When I execute the following command ldapsearch -x -D cn=root,dc=example,dc=com -w rootpassword -s sub -b "dc=example,dc=com" "(objectClass=*)" I receive the following error root@DNS-TESTE:~# ldapsearch -x -D cn=root,dc=example,dc=com -w teste -s sub -b "dc=example,dc=com" "(objectClass=*)"ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Apparently after the installation of the ldap, the sldap demon wasn't created. I'm doing something wrong? Is there another way to configure LDAP to support MySQL? Regards Alex

2 1

Re: Is there directory schema for storing information on States and Corporations?
by John Lewis 09 Apr '17

09 Apr '17

On Fri, 2017-04-07 at 11:29 +1200, Kevin Buckley wrote: > Apologies for replying out of the thread but I had binned the > original one, and then had the thoughts ! > > If you post my content (assuming you want to reply!), in to the > thread then I'll get to see the thread continue, when that messgae > appears. I'm putting this back on the list. > > John Lewis <oflameo2(a)gmail.com> wrote: > > > I am bouncing around a couple of projects that involve collecting and > > storing information about Corporations and States. > > > > Is there a already existing schema that will kind of fit this data in > > general? Of hand, the closest one I can think of is inetOrgPerson is the > > closest thing, but it is probably a stretch. > > > > The kind of data is going to be like taking the the top of of > > Corporations and State's inetOrgPerson data and stuffing it under one > > tree and bundling public data with it such as contracts a company have with a state on record. > Have you considered using a domain component (dc=,dc=) based tree, > using dot-us as the root, and the two-letter states sub-domains below it > > dc=ca,dc=us > > and then putting your corporation in below that, for example > > o=mycorp,dc=ca,dc=us > > for the Californian content, in which you "pretend" that the > Californian "branch" > of your Corporation actually "owns" the mycorp,ca.us domain name? > > I take the point made by other respondents about not replying on geographical > info, however a number of corporations do make use of country-based domain > names, for operationsin various theatres, so there is a kind of > precedent, within > the dc= approach. That is what I am thinking about doing. I can probably get away with just using an ou because it is not necessarily a new directory/database. Alternatively I could just make the whole thing flat and put an entry in to describe where it is to be filtered later but I think I like the former better.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical