openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

OpenLDAP Tutorial on YouTube Channel
by Rajesh R 01 Apr '17

01 Apr '17

Hello, At the outset, thank you to each member of the OpenLDAP project for all the hard work in developing a great LDAP Server. I'm Rajesh Rajasekharan, and have spent a great deal of my time in various Organizations teaching several Products, including their LDAP Servers. While searching for good OpenLDAP resources, I couldn't really find a systematic tutorial for the same, so thought of making one myself. As a result, I have a playlist of 19 vidoes on OpenLDAP on my YouTube channel. If/when you've some time to spare, request you to please take a look at it and kindly advise if I could contribute in any other ways to this great Project. https://www.youtube.com/playlist?list=PLfO6SFqcY2PrDR5yct96n4qfgMmh6g0eP kind regards, --R Rajesh Sent from my iPhone

4 5

Re: Multiple olcDbIndex for the same attribute
by Quanah Gibson-Mount 31 Mar '17

31 Mar '17

--On Friday, March 31, 2017 12:24 PM +0200 "PenguinWhispererThe ." <th3penguinwhisperer(a)gmail.com> wrote: > So for example: > olcDbIndex: objectClass pres,eq > olcDbIndex: objectClass eq > > Is this the same as if you'd only have: > olcDbIndex: objectClass pres,eq > ? > > Or does it really make a difference? > > > > I've checked http://www.openldap.org/doc/admin24/slapdconf2.html but I > couldn't find an answer to this. I'm not really sure it's the job of the admin guide or the man pages to cover all the multitudes of ways in which one can misconfigure the server, or what the results of such a misconfiguration will be. My *guess* is that the end result will be that it will have both a "pres" and an "eq" index. YMMV. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: "Dynamic" authentication passthrough?
by Quanah Gibson-Mount 31 Mar '17

31 Mar '17

--On Friday, March 31, 2017 1:52 PM -0400 Curtiss Howard <curtiss.howard(a)gmail.com> wrote: > Is there a way to do this? > > > Just use slapo-pbind. > > > > > > Ah nice, this sounds more like it. However, I have two AD servers that > I'm proxying -- is there a concept of using this overlay multiple times? Doesn't seem like it, but I've never set it up. I suppose if each AD server had a different base for its DIT, it would be possible to add an option to direct auth requests to different AD servers based off of that. But that would be an enhancement to the existing functionality. May be worth filing an ITS to request it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: "Dynamic" authentication passthrough?
by Howard Chu 31 Mar '17

31 Mar '17

Curtiss Howard wrote: > Hi, > > I've got two Active Directory servers that are being proxied through OpenLDAP > and their respective trees are being merged into one. So far, so good. > > Now I want to allow users to bind to the OpenLDAP server and pass the > authentication through to the appropriate AD and let it do the password checking. > > I see a lot of documentation on using SASL for passthrough, but where I'm > stuck is that this requires every user to have an account in the OpenLDAP > server in order to see if the userPassword attribute is specially formatted. > In my case, this isn't really a palatable solution because I'm using the > OpenLDAP server with the meta backend and using it as a "live view" into the > data contained in the ADs. Other applications can talk directly to the ADs > and in order to do the SASL approach there'd have to be some syncing from the > ADs to the OpenLDAP server every time a user is created/deleted. > > I would think that surely there must be some way to pass through the > authentication in a more obvious manner -- i.e., if the user doesn't exist > locally, try to bind against each proxied server in succession. But I can't > seem to find a way to do this, all references point to the SASL approach. > > Is there a way to do this? Just use slapo-pbind. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

"Dynamic" authentication passthrough?
by Curtiss Howard 31 Mar '17

31 Mar '17

Hi, I've got two Active Directory servers that are being proxied through OpenLDAP and their respective trees are being merged into one. So far, so good. Now I want to allow users to bind to the OpenLDAP server and pass the authentication through to the appropriate AD and let it do the password checking. I see a lot of documentation on using SASL for passthrough, but where I'm stuck is that this requires every user to have an account in the OpenLDAP server in order to see if the userPassword attribute is specially formatted. In my case, this isn't really a palatable solution because I'm using the OpenLDAP server with the meta backend and using it as a "live view" into the data contained in the ADs. Other applications can talk directly to the ADs and in order to do the SASL approach there'd have to be some syncing from the ADs to the OpenLDAP server every time a user is created/deleted. I would think that surely there must be some way to pass through the authentication in a more obvious manner -- i.e., if the user doesn't exist locally, try to bind against each proxied server in succession. But I can't seem to find a way to do this, all references point to the SASL approach. Is there a way to do this? Thanks in advance.

2 1

Multiple olcDbIndex for the same attribute
by PenguinWhispererThe . 31 Mar '17

31 Mar '17

Hello, I'm wondering what happens when you add multiple indexes for the same attribute with the same keyword occuring in each of them but with a different set. So for example: olcDbIndex: objectClass pres,eq olcDbIndex: objectClass eq Is this the same as if you'd only have: olcDbIndex: objectClass pres,eq ? Or does it really make a difference? I've checked http://www.openldap.org/doc/admin24/slapdconf2.html but I couldn't find an answer to this. Thanks in advance!

1 0

Re: Import data from hdb to bdb
by Jai Bheemsen Rao Dhanwada 30 Mar '17

30 Mar '17

Hello Quanah, Thanks for the Info. this helps :) On Thu, Mar 30, 2017 at 2:48 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, March 30, 2017 3:38 PM -0700 Jai Bheemsen Rao Dhanwada < > jaibheemsen(a)gmail.com> wrote: > > >> Hello, >> >> >> We have N way master openldap replication with hdb backend for the data. >> Now we would like to slapcat the data from this cluster and slapadd to >> another cluster which is backed by bdb. >> > > Both back-hdb and back-bdb (which both use BDB underneath) are deprecated > backends. You should not be using either one. Instead, examine migrating > to back-mdb, which is backed by LMDB: <https://en.wikipedia.org/wiki > /Lightning_Memory-Mapped_Database> > > Regardless, LDIF exports are usable regardless of backend (bdb, hdb, mdb). > The "DIF" stands for "Data Interchange Format". You might be best served > by first learning more about LDIF: <https://en.wikipedia.org/wiki > /LDAP_Data_Interchange_Format> > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

Re: Import data from hdb to bdb
by Quanah Gibson-Mount 30 Mar '17

30 Mar '17

--On Thursday, March 30, 2017 3:38 PM -0700 Jai Bheemsen Rao Dhanwada <jaibheemsen(a)gmail.com> wrote: > > Hello, > > > We have N way master openldap replication with hdb backend for the data. > Now we would like to slapcat the data from this cluster and slapadd to > another cluster which is backed by bdb. Both back-hdb and back-bdb (which both use BDB underneath) are deprecated backends. You should not be using either one. Instead, examine migrating to back-mdb, which is backed by LMDB: <https://en.wikipedia.org/wiki/Lightning_Memory-Mapped_Database> Regardless, LDIF exports are usable regardless of backend (bdb, hdb, mdb). The "DIF" stands for "Data Interchange Format". You might be best served by first learning more about LDIF: <https://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Import data from hdb to bdb
by Jai Bheemsen Rao Dhanwada 30 Mar '17

30 Mar '17

Hello, We have N way master openldap replication with hdb backend for the data. Now we would like to slapcat the data from this cluster and slapadd to another cluster which is backed by bdb. Any idea does this work as I am trying to slapcat from hdb and slapadd to bdb? if anyone has done this, please share some details.

1 0

Parallel traversal
by Gabriel Tanase 30 Mar '17

30 Mar '17

Assuming I have an LMDB database: to traverse all data in a table I open a cursor and go over each element in a loop using MDB_NEXT or MDB_NEXT_DUP : :mdb_cursor_get (cur, &_entry.first, &_entry.second, MDB_NEXT_DUP); How can one traverse the data in an LMDB table using multiple threads for a faster overall traversal? I am assuming a read only transaction and I would like each thread to work on distinct entries; Like if there are 100 [key, value] and I use 4 threads, thread zero will work on first 25 elements, thread one will work on the next 25 and so on. 25 doesn't have to be exactly 25 but ideally the partitioned should be balanced. A simple solution I designed is to read all keys into a vector first and then subsequently parallelize with each thread working on a subset of key from this vector. Each thread will traverse a subset of keys, and for each key we find the corresponding [key, value] and work on the value. Is there an alternative ? Thx, Gabriel

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical