openldap-technical

openldap-technical@openldap.org

9937 discussions

Re: Syncrepl refreshAndPersist provider reboot
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Wednesday, February 01, 2017 5:04 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: Hi Thomas, > I know. Unfortunately my distro is stuck with this version (though I see > there's a port version update right now). There's nothing that requires anyone to run the 3rd party builds from Redhat. There are significantly better options available if you require pre-built binaries, such as the LTB project builds or the binaries produced by Symas (which also has support options available). If you don't require pre-built binaries, it's also fairly trivial to package up OpenLDAP. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Syncrepl refreshAndPersist provider reboot
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Wednesday, February 01, 2017 2:05 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: > Is this a normal behavior providing I'm using refreshAndPersist mode ? No. > I mean do we have to restart the consumers each time the provider restarts ? No. But there several bugs in OpenLDAP 2.4.40 around replication, and that release should be used with care if replication is involved. The Redhat builds of course have additional issues. YMMV. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Syncrepl refreshAndPersist provider reboot
by Thomas Hummel 01 Feb '17

01 Feb '17

Hello, today, in a simple setup consisting of one provider and 2 syncrepl consumers [openldap-2.4.40-9 on CentOS Linux 7.2, cn=config, mdb backend, refreshAndPersist mode], I noticed that after the provider reboot (the ESX it ran on had some kind of maintenance) : - slapd service was running dans correctly responding (ldapsearch...) on the 3 servers - replication wasn't working anymore (ldapmodify on the provider not sync'ed on the consumers) Rebooting the consumers seemed to fix the problem. Is this a normal behavior providing I'm using refreshAndPersist mode ? I mean do we have to restart the consumers each time the provider restarts ? Thanks -- Thomas HUMMEL

1 0

help troubleshooting
by scar 01 Feb '17

01 Feb '17

I have inherited an LDAP server and admittedly do not have all the technical expertise to troubleshoot the problems we have. We are using slapd 2.4.40. The first problem is nobody but the rootdn can change passwords. We'd like to use "passwd" utility on our servers to change our passwords but the error is "LDAP password information update failed: Insufficient access" In slapd.conf we have (i have removed our dc for privacy): access to attrs=userPassword by self write by anonymous auth by dn="cn=Manager,dc=X,dc=Y,dc=Z" write by * none access to * by self write by dn="cn=Manager,dc=X,dc=Y,dc=Z" write by * read by * auth access to * by dn="uid=ldapadmin,dc=X,dc=Y,dc=Z" read "cn=Manager,dc=X,dc=Y,dc=Z" is our rootdn and i have enabled logleve 128 However, this brings me to the next problem: the contents of slapd.conf do not match the slapd.d/cn\=config.ldif file, so it seems the fixes i am trying to the ACL's don't have any effect, even when i restart slapd. If i try "ldapmodify -nv" it just hangs. When i try to stop slapd and remove slapd.d/* and then start slapd, the contents are recreated according to the config file, but then users can't login (all i see in the logfile is access_allowed and slap_access_allowed but no conn lines) So some basic troubleshooting help would be appreciated! Thanks

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 10:49 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 30.01.2017 um 21:49 schrieb Quanah Gibson-Mount: >> Optionally, cd tests && make its run through the regression suite. > > this set of tests pass, but I noticed one line: > > ./data/regressions/its8521/its8521: 268: test: 1: unexpected operator Thanks, fixed! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 10:21 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 30.01.2017 um 21:49 schrieb Quanah Gibson-Mount: >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=re >> fs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> >> >> Configure & build. > > * I noticed 33x "warning: unused variable" > should I write a patch? Patch + ITS would be best. ;) > * Very interesting to me how you modified my patch > http://www.openldap.org/its/index.cgi?findid=8533 ... Thanks! Thanks go to Howard. ;) > * This (and earlier) openldap-releases do not force server side cipher > preference. there is a technical simple way to achieve this: > > --- a/libraries/libldap/tls_o.c > +++ b/libraries/libldap/tls_o.c > @@ -366,6 +366,8 @@ tlso_ctx_init( struct ldapoptions *lo, s > } > } > #endif > + /* maybe some # ifdef is needed */ > + SSL_CTX_set_options( ctx, SSL_OP_CIPHER_SERVER_PREFERENCE ); > return 0; > } > > As far as I know there is no ITS item opened. It it worth to add one? I would suggest filing an ITS, yes. > * An other point I'm interested is compilation of libraries/liblmdb/mdb_* > tools. While all other binaries are build using external defined CFLAGS > and LDFLAGS "make -C libraries/liblmdb/" use other values. > > Any chance, these tools are integrated in the common build process > maybe enabled/disabled by a ./configure option? LMDB is standalone software, so it's generally designed to be buildable on its own. What CFLAGS/LDFLAGS do you feel would be necessary to pass through? > * compilation against openssl-1.1.0d works without issues and at a first > startup it also work :-) I'll report on further success... > > * but last: make test failed > ( attached make_test_result.txt ) I'll see if I can repo the test058 failure. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 12:05 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: >> ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! >> Error found after 1 of 1 iterations >>>>>>> test061-syncreplication-initiation failed for mdb >> (exit 1) >> Makefile:310: recipe for target 'mdb-yes' failed >> make: *** [mdb-yes] Error 1 > > Interesting -- Can you tar up the testrun directory, ftp it up, and file > an ITS with a pointer to the upload? I was able to reproduce this as well with back-mdb. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 8:35 PM +0100 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Am Mon, 30 Jan 2017 12:49:56 -0800 > schrieb Quanah Gibson-Mount <quanah(a)symas.com>: > [...] > >> Generally, get the code for RE24: >> >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=re >> fs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> >> >> Configure & build. >> >> Execute the test suite (via make test) after it is built. >> Optionally, cd tests && make its run through the regression suite. > > [...] > > Starting test061-syncreplication-initiation for mdb... > Running defines.sh > ... > > ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! > Error found after 1 of 1 iterations >>>>>> test061-syncreplication-initiation failed for mdb > (exit 1) > Makefile:310: recipe for target 'mdb-yes' failed > make: *** [mdb-yes] Error 1 Interesting -- Can you tar up the testrun directory, ftp it up, and file an ITS with a pointer to the upload? Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Mirror Inquiry
by Standalone Admin 31 Jan '17

31 Jan '17

Hi Is there a need for more mirrors for OpenLDAP? If so we can host it on our server in France @1GBPS connection. Thanks, Sam

1 0

How to add index for "member" of ldap groups
by Axel Birndt 27 Jan '17

27 Jan '17

Hi @All, i'am currently searching for a possibility to add an index in openldap (cn=config backend) for the "member" of groups. In my log i got the following message: > 475 admin slapd: <= bdb_equality_candidates: (member) not indexed I found, that "member" is an attribute from an ldap group. > # Entry 1: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de > dn: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de > cn: bind_users > member: cn=apachebind,ou=apache_technical,ou=users,dc=company,dc=de > member: cn=wordpressbind1,ou=wordpress_bind,ou=users,dc=company,dc=de > objectclass: groupOfNames > objectclass: top How could i add an index for this attribute? I searched with google and found: http://www.openldap.org/faq/data/cache/136.html https://wiki.debian.org/LDAP/OpenLDAPSetup http://www.openldap.org/doc/admin24/slapdconf2.html and so on... With this information i already added indices for > # Entry 1: olcDatabase={1}hdb,cn=config > dn: olcDatabase={1}hdb,cn=config > objectclass: olcDatabaseConfig > objectclass: olcHdbConfig > olcdbindex: objectClass eq > olcdbindex: cn pres,sub,eq > olcdbindex: sn pres,sub,eq > olcdbindex: uid pres,sub,eq > olcdbindex: displayName pres,sub,eq > olcdbindex: default sub > olcdbindex: uidNumber eq > olcdbindex: gidNumber eq > olcdbindex: mail,givenName eq,subinitial > olcdbindex: dc eq If i try to add a new index "olcdbindex: member pres,sub,eq" i got an failure Could not perform ldap_modify operation. LDAP said: Other (e.g., implementation specific) error Error number: 0x50 (LDAP_OTHER) Is anyone able to give me a hint, where i could find more information or help me to find the right search key words? -- Gruß/Kind regards Axel ------------------------------

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical