openldap-technical

openldap-technical@openldap.org

9937 discussions

Re: Constraint violation when swapping two unique attributes
by Howard Chu 19 Dec '16

19 Dec '16

Bannister, Mark wrote: > Hi, > > > > I’m using the unique overlay on OpenLDAP 2.4.30 on Solaris 11.3 like this: > > > > overlay unique > > unique_uri > ldap:///ou=Ethers,dc=mydomain,dc=com?macAddress?sub?objectClass=ieee802Device > > > > to force the macAddress to be unique. > > > > This works well, except if I attempt to swap the macAddress between two > entries in a single LDAP modify operation, like this: > > > > dn: cn=host1-eth0,ou=Ethers,dc=mydomain,dc=com > > changetype: modify > > replace: macAddress > > macAddress: <current host1-eth1 value> > > > > dn: cn=host1-eth1,ou=Ethers,dc=mydomain,dc=com > > changetype: modify > > replace: macAddress > > macAddress: <current host1-eth0 value> That's two separate modify operations, not a single operation. > > > > I get: > > > > ldap_modify: Constraint violation (19) > > additional info: some attributes not unique > > > > Is there a way to swap two values without tripping this error? Seems unlikely. Why don't you rename the entries instead? > > > > Thanks, > > Mark. > > > > ------------------------------------------------------------------------------ > > NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions > or views contained herein are not intended to be, and do not constitute, > advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform > and Consumer Protection Act. If you have received this communication in error, > please destroy all electronic and paper copies and notify the sender > immediately. Mistransmission is not intended to waive confidentiality or > privilege. Morgan Stanley reserves the right, to the extent permitted under > applicable law, to monitor electronic communications. This message is subject > to terms available at the following link: > http://www.morganstanley.com/disclaimers If you cannot access these links, > please notify us by reply message and we will send the contents to you. By > communicating with Morgan Stanley you consent to the foregoing and to the > voice recording of conversations with personnel of Morgan Stanley. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: OpenLDAP ACL causing error code 49
by Matty 19 Dec '16

19 Dec '16

On Mon, Nov 21, 2016 at 12:45 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, November 21, 2016 6:41 PM +0100 Michael Ströder > <michael(a)stroeder.com> wrote: > >> Matty wrote: >>> >>> I am testing some OpenLDAP ACLs and stumbled on a weird issue. My >>> configuration has the following ACL defined: >>> >>> access to * >>> by users read >>> by peername.ip=1.2.3.4 read >>> by * none >> >> ^^^^ >> You probably want "auth" in this last <who> clause. >> >> Ciao, Michael. >> > > or: > by anonymous auth > by * none > > may be closer. That works as well but I'm still not real clear why running: $ ldapsearch -b 'dc=foo,dc=com' -x -h ldap1 -W -D 'uid=bingo,ou=users,dc=foo,dc=com' '(objectClass=*)' Results in an anonymous bind: Nov 16 09:50:02 tulip slapd[17803]: => acl_get: [2] attr userPassword Nov 16 09:50:02 tulip slapd[17803]: => acl_mask: access to entry "uid=bingo,ou=users,dc=foo,dc=com", attr "userPassword" requested Nov 16 09:50:02 tulip slapd[17803]: => acl_mask: to value by "", (=0) Does anyone happen to know why "acl_mask: to value by" shows "" instead of the dn of the user passed to the "-D" option? The suggestions above work but I am still curious why the anonymous bind is occurring. Thanks for the awesome feedback, - Ryan

1 0

Constraint violation when swapping two unique attributes
by Bannister, Mark 19 Dec '16

19 Dec '16

Hi, I'm using the unique overlay on OpenLDAP 2.4.30 on Solaris 11.3 like this: overlay unique unique_uri ldap:///ou=Ethers,dc=mydomain,dc=com?macAddress?sub?objectClass=ieee802Device to force the macAddress to be unique. This works well, except if I attempt to swap the macAddress between two entries in a single LDAP modify operation, like this: dn: cn=host1-eth0,ou=Ethers,dc=mydomain,dc=com changetype: modify replace: macAddress macAddress: <current host1-eth1 value> dn: cn=host1-eth1,ou=Ethers,dc=mydomain,dc=com changetype: modify replace: macAddress macAddress: <current host1-eth0 value> I get: ldap_modify: Constraint violation (19) additional info: some attributes not unique Is there a way to swap two values without tripping this error? Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you consent to the foregoing and to the voice recording of conversations with personnel of Morgan Stanley.

1 0

OpenLDAP performance and slapindex
by Real, Elizabeth (392K) 15 Dec '16

15 Dec '16

Hello, I’m running OpenLDAP 2.4.40 on two multi-master servers with replication enabled. Today we switched over to this instance, imported all users from the old ldap server, and configured an ldap client to use this instance. Everything is working well, users are authenticating and able to access their assigned groups. However, we noticed that while on the ldap client and as a regular user we type “w” to see who is logged on this machine, it takes a while before we get a response with the results. If we type “w” again the response is very fast due to caching. In looking at ways to improve performance of ldap, is slapindex a tool to use? Meaning after importing users accounts from an older ldap, should slapindex be ran? Or is this tool is used when you want to modify/add entries found in the slapd (cn=config.ldif) and database ((olcDatabase={2}hdb.ldif) configuration files not when users are added to the ldap database. If slapindex is not a tool to use to monitor performance, what do you recommend? Thank you, Liz

3 2

Re: OpenLDAP performance and slapindex
by Quanah Gibson-Mount 15 Dec '16

15 Dec '16

--On Thursday, December 15, 2016 8:27 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: ># less /var/log/ldap.log | grep index > > > > Dec 15 12:22:01 slapd[27852]: <= bdb_equality_candidates: (uid) not > indexed Hi Liz, As I noted previously, you need to look at the actual search being executed. This is because, as Michael noted, indexing is not necessarily always the best solution performance wise. I'd guess that you likely need to add indices on those attributes, but I can't say for certain w/o the corresponding log lines that caused those warnings to be generated. And without those log lines, it is not possible to determine what /type/ of indexing should be used if it is proven necessary. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: OpenLDAP performance and slapindex
by Quanah Gibson-Mount 15 Dec '16

15 Dec '16

--On Wednesday, December 14, 2016 9:05 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > Hello, > > > > I'm running OpenLDAP 2.4.40 Upgrade immediately to 2.4.44. The 2.4.40 release was seriously flawed and had numerous critical bugs around replication. > In looking at ways to improve performance of ldap, is slapindex a tool to > use? Meaning after importing users accounts from an older ldap, should > slapindex be ran? Or is this tool is used when you want to modify/add > entries found in the slapd (cn=config.ldif) and database > ((olcDatabase={2}hdb.ldif) configuration files not when users are added > to the ldap database. Stop using back-hdb. Switch to back-mdb. <https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb…> If you already had indices defined for the database when you did the import, there is no reason to run slapindex. Slapindex should only be used if you've added a /new/ index to your database. If you are using cn=config and add a new index, there will be a background thread that will eventually index the entire DB. Whether or not you need to add indexing for given attribute(s) can be discovered by examining the logs generated by slapd, which will file a complaint if there is a search performed on an unindexed attribute. You would need to examine the specific search to see what type(s) of indexing may be required. > If slapindex is not a tool to use to monitor performance, what do you > recommend? slapindex has never been a tool to monitor anything. It is purely for (re)generating indices on an existing DB. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

replica consumers and ppolicy overlay values like PwdFailureTime
by John Jasen 14 Dec '16

14 Dec '16

I'm trying to setup OpenLDAP on CentOS7, in a provider/consumer relationship. In general, provider/consumer is working quite well, except when it comes to password policy. Specifically, I want PwdFailureTime to be written to the provider from one of the front end consumers when appropriate. I'm lead to believe this requires: a) ppolicy_foward_updates TRUE (done) b) an appropriate syncrepl configuration for the consumer (I believe done) c) updateref $LDAP-provider-URI (done) d) an appropriate chain overlay on the provider (I think done) e) appropriate ACLs on the provider to allow the consumer bind-user access to manage PwdFailureTime (I believe done) I've attempted all of the above, but the consumer (when run in debugging mode), does not seem to be trying any updates upon authentication failure. It gives no indication of modifying locally, or of trying to contact the provider at all over this. Any idea whats going wrong?

1 1

Re: OpenLDAP performance and slapindex
by Quanah Gibson-Mount 14 Dec '16

14 Dec '16

--On Wednesday, December 14, 2016 9:36 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > Thank you for the quick response. > > > > I have spent a lot of time configuring version 2.4.40. Is there a guide > on how to upgrade to 2.4.44 and switch to back-mdb? we rolled out 2.4.40 > today and would need to plan the next upgrade. As long as it is linked to the same BDB libraries as your 2.4.40 build, it is simply a drop in binary upgrade. > What tool do you recommend for monitoring ldap performance? I suggest applying the operation duration patch: <https://github.com/Zimbra/packages/blob/master/thirdparty/openldap/patches/…> That will tell you exactly how long each operation is taking in slapd, as long as you have "stats" logging enabled. Then you can tell if the issue is at the slapd server, or if there is something else in between that is causing the delay that you see. My suspicion would be that there is something else interfering. As for migrating from hdb to mdb, it's generally straight forward. You'd need to export your data database to LDIF, and then export cn=config, and change the HDB specific bits to MDB, and drop the parameters specific to HDB that aren't required for MDB. If you want to see a basic cn=config templated configuration, you can look at: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob_plain;f=test…> where @BACKEND@ can be any of bdb/hdb/mdb, and tweak as necessary from there. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Expanding OpenLDAP use
by Quanah Gibson-Mount 10 Dec '16

10 Dec '16

--On Saturday, December 10, 2016 5:15 PM -0200 xsun <matheus.morais(a)gmail.com> wrote: > > Great! > > > Thank you so far lads. > > > > Matheus Morais The Zimbra product uses OpenLDAP to store numerous data, everything from server configurations to user accounts, etc. It is deployed at sites large and small throughout the world, plenty with many millions of accounts. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Expanding OpenLDAP use
by xsun 10 Dec '16

10 Dec '16

Hi, I'm trying to expanding OpenLDAP use where I work. Right now we use it to handle internal users (about 50000 entries) and organizational data and it work superb. I'm trying to convince my colleagues to also store our customers data but they are worried about the performance since this will be much larger as we have about 4 million customers. I'm looking for some public uses cases for large number of users in OpenLDAP to give more support to my arguments. So, can anyone share some history or point out some information on the web on that particular subject? Thanks, Matheus Morais

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical