openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

Re: Creating suffix aliases with OpenLDAP
by Howard Chu 15 Sep '16

15 Sep '16

Ralf Mattes wrote: > First, juat to be clear: thank you for your valuable help and please don't take my comments personally. > > Am Donnerstag, 15. September 2016 09:46 CEST, Dieter Klünter <dieter(a)dkluenter.de> schrieb: > >>> >>> I _knew_ I read about that at some time. This (slapd-relay) looks >>> exactly like what I need. Unfortunately this means I need to to dive >>> down into the labyrinth of (not existing) dosumentation. >> >> Just read manual pages slapd-relay(5) and slapo-rwm(5) that is all the >> documentation you should need. > > That's how it should be, but in reality: > > - non of the documentation even mentions the "new" live configuration. > Ironically, every time someone postsher/his old-style slapd configuration > on this very list she/he's told "use the online configuration". > > Oh, and changing from the old style configuration to the new one is _not_ > just an "add 'olc' in front of the parameters". For example I can't find > the rwm-suffixmassage parameter in the olc-Attributes. Online configuration is self-documenting. You are expected to read the objectclass definition from the config schema. > > - The documentation fails to mention some rather important prerequisits: > the need to load 'back_relay', the need to load 'rwm'. Module loading is not specific to back-relay, rwm, or any other backend or overlay, so there is no reason to mention it in their specific documentation. Whether or not your build supports modules is a compile-time decision, made by whoever built your binaries. Module loading is documented in the general slapd config documentation, since it applies to anything, not just specific backends or overlays. > > - The documentation really should mention that a (miss-)configured database > can't be removed from the server. Better get it right the first time ... :-) Never test new configs on a production server. Always use a throwaway test server. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

How to configure Oracle database user authentication using openldap?
by Reddy, Sudheer (CORP) 15 Sep '16

15 Sep '16

Hi: Currently we use oracle OID/LDAP to setup Oracle Database Enterprise User Security. Our management decided to retire oracle OID/LDAP, and enable database authentication using openldap on SUSE linux 11. I am new to LDAP and open LDAP. I greatly appreciate if you can help me understand the process to get this configured. Thanks, Sudheer Reddy ---------------------------------------------------------------------- This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.

1 0

Re: Ldap Replication getting delayed for 20 seconds.
by Prashanth P.Nair 15 Sep '16

15 Sep '16

Thank you. 3.Any other parameter needs to be added to fasten this replication? This settings are in place already .But still delay happening. backend hdb database hdb Any other parameter needs to be modified for fastening the replication ? On Tue, Sep 13, 2016 at 3:19 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, September 12, 2016 3:50 PM +0200 "Prashanth P.Nair" < > prashanthppp(a)gmail.com> wrote: > > When i create new record ,its taking 18-20 second to replicate on other >> node. So the application which is reading the records from the second >> node is unable to find those records. >> >> >> 1.Is this normal behavior? >> > > Yes. > > 2.Is there any way to findout how much time took a record to be >> replicated? >> > > Read the information on "loglevel" in the slapd.conf(5) man page. > > 3.Any other paramter needs to be added to fasten this replication? >> >> > backend hdb >> database hdb >> > > Replication is particularly slowed if using back-hdb vs back-mdb. See < > https://mishikal.wordpress.com/2013/05/16/openldap-a-compar > ison-of-back-mdb-and-back-hdb-performance/> and < > https://wiki.zimbra.com/wiki/OpenLDAP_MDB_vs_HDB_performance>. > > --Quanah > > > -- > > Quanah Gibson-Mount >

2 1

How to block bind requests on openLDAP proxy, after number of failed authentication requests?
by Pocoto 14 Sep '16

14 Sep '16

Hi everyone, i am looking for a way an openLDAP proxy can temporarily block bind attempts (by bind-dn), after a number of consecutive failed authentication requests. The solution should work independent from the remote server configuration and with the client request and remote server response information on the proxy only. Is there a working solution or what could be a possible way to accomplish the needs - maybe develop an custom overlay? Thanx in advance, Rüdiger

1 0

enforce TLS 1.2 in OpenLDAP server side
by Steve Zeng 13 Sep '16

13 Sep '16

Hi, all What is the best settings to enforce TLS 1.2 in OpenLDAP server side (openldap-2.4.44-1.el6)? I make the change below: From: olcTLSProtocolMin: 0.0 To: olcTLSProtocolMin: 3.3 However, TLS1.0 still shows up in a lot of tcpdump packets: Secure Sockets Layer TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 70 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 66 Version: TLS 1.0 (0x0301) Random Session ID Length: 0 Cipher Suites Length: 20 Cipher Suites (10 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 5 Extension: renegotiation_info Secure Sockets Layer TLSv1 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 1704 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 77 Version: TLS 1.0 (0x0301) Random Session ID Length: 32 Session ID: 39c37acec27b5f497c3bf4a4c694c4a9cc03ed6371e0fee0... Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Compression Method: null (0) Extensions Length: 5 Extension: renegotiation_info Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 1499 Certificates Length: 1496 Certificates (1496 bytes) Handshake Protocol: Certificate Request Handshake Type: Certificate Request (13) Length: 112 Certificate types count: 3 Certificate types (3 types) Distinguished Names Length: 106 Distinguished Names (106 bytes) Handshake Protocol: Server Hello Done Handshake Type: Server Hello Done (14) Length: 0 Thanks, Steve

5 8

Ldap Replication getting delayed for 20 seconds.
by Prashanth P.Nair 13 Sep '16

13 Sep '16

Hello All I am facing a performance issue on my LDAP nodes. I have two LDAP nodes ,which is syncrepl enabled. When i create new record ,its taking 18-20 second to replicate on other node. So the application which is reading the records from the second node is unable to find those records. 1.Is this normal behavior? 2.Is there any way to findout how much time took a record to be replicated? 3.Any other paramter needs to be added to fasten this replication? Below is my configuration details. ------------------------------------------------------------------------- # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 TLSCACertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile /etc/ssl/ldap.pem TLSCertificateFile /etc/ssl/ldap.pem include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/sncds.schema pidfile /var/run/slapd/slapd.pid Server 002 argsfile /var/run/slapd/slapd.args loglevel sync stats modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov SizeLimit 500 tool-threads 8 threads 16 backend hdb database hdb monitoring on cachesize 50000 idlcachesize 50000 suffix "dc=xx,dc=xxx,dc=xx" rootdn "cn=xx,dc=xx,dc=xx,dc=xx" rootpw xx directory "/var/lib/ldap/account" dbconfig set_cachesize 0 167772160 0 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass, snAccount, snEnabled, entryCSN, entryUUID eq index cn eq,pres,subany lastmod on checkpoint 5120 30 access to attrs=userPassword,shadowLastChange by dn="cn=xx,ou=xx,dc=xx,dc=xx" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=xx,ou=xx,dc=xx,dc=xx" write by self read by * none limits dn.exact="cn=xx,ou=xx,dc=xx,dc=xx" size=unlimited syncrepl rid=001 provider=ldap://IP bindmethod=simple binddn="cn=xx,ou=xx,dc=xx,dc=xx" credentials=xx searchbase="dc=xx,dc=xx,dc=xx" schemachecking=on type=refreshAndPersist retry="10 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 10000

2 1

LMDB: Ignore SIGPIPE in mdb_env_copythr
by Lorenz Bauer 07 Sep '16

07 Sep '16

Hello Hallvard, List, I'd like to propose explicitly ignoring SIGPIPE in the copy thread via pthread_sigmask, and returning EPIPE to the caller instead. This is a change that makes little sense in the C world, since the caller can simply adjust the sigmask before calling the function (which is indeed what the utilities do). However, this amount of control is not always given, e.g. when using LMDB from Go (which is what I am doing). Due to the way the Go runtime works, using mdb_env_copyfd2 with CP_COMPACT on a pipe or a network connection will abort the whole process with SIGPIPE if the reading end of the fd is closed prematurely. The details why this happens are in [1]. Go has some additional trickery when dealing with stdin and stdout, so ignoring SIGPIPE for the whole process is undesirable (details in [2]). I understand that you might be reluctant to change the behaviour due to the constraints of a different runtime. However, I think that even in the C world it is surprising that calling a library function can abort your process. What are your thoughts regarding this? I think the code changes would be small, and the API would not change for consumers of the library. 1: https://golang.org/pkg/os/signal/#hdr-Go_programs_that_use_cgo_or_SWIG 2: https://golang.org/pkg/os/signal/#hdr-SIGPIPE Best, Lorenz

1 0

UNKNOWN attributeDescription "ATTRIBUTE1" inserted
by PenguinWhispererThe 07 Sep '16

07 Sep '16

Hi all, I've been trying to update a schema with new olcAttributeTypes and modified an existing objectClass (X) so these attributesTypes may be used with it. However after adding these attributes to objectClass X I did a "rollback" (replacing the current olcObjectClasses (replace: olcObjectClasses) with the old definition and the same for the olcAttributes (replace: olcAttributeTypes). I think somewhere along the way something wasn't cleaned up properly. Now when I start slapd service I get: slapd[21335]: UNKNOWN attributeDescription "ATTRIBUTE1 " inserted. slapd[21335]: UNKNOWN attributeDescription "ATTRIBUTE2" inserted. slapd[21335]: [66B blob data] With slapschema: UNKNOWN attributeDescription "ATTRIBUTE1 " inserted. UNKNOWN attributeDescription "ATTRIBUTE2" inserted. UNKNOWN attributeDescription "ATTRIBUTE3 With slapcat I can't find anything that's matching these names. When I grep in the mdb file grep says the binary file is matching. However when I ldapsearch for the attribute I can't find it. Neither with slapcat. Note that I replaced the actual attribute names in the posted output. So I think I might have some data in that mdb that's not linked to anything anymore. So my question is: how can I clean this up? And/or what did/went wrong? Thanks in advance for your help.

3 8

Default LDIF Configuration
by Trent Dierking 07 Sep '16

07 Sep '16

When running slapd with -f etc/openldap/slapd.ldif, I receive the following line 5: unknown directive <dn:> outside backend info and database definitions. By default slapd is using the .conf file instead, which works fine. This is the default ldif file, and line 5 seems to be the same as line 2 (first relevant line) from the configuration guide. I have tried using no options to configure ldap, with the same issues. I understand what the message is saying, but why does this conflict with the guide/default ldif file?

2 1

Re: UNKNOWN attributeDescription "ATTRIBUTE1" inserted
by Howard Chu 07 Sep '16

07 Sep '16

PenguinWhispererThe . wrote: > Once again thanks for taking your time to followup on this. > > I've tried slapcat before to dump to a file and couldn't find the attributes > that were mentioned. > So today I did it again (just to make sure) and the dump doesn't seem to hold > the attributes. You're still not paying attention to Michael's advice. Wipe out your original DB and feed the slapcat output to slapadd. Your current DB files still contain entries with the offending attributes. > What I did get is : The first database does not allow slapcat; using the first > available one (2). Apparently you have more than one database configured. You're probably not slapcat'ing the DB with the offending attributes. > > So then I went to the directory and just grepped for the attribute name and it > seems that it's matching on a binary file: cn=accesslog/log.000000123123 > (changed the number to post). > > This seems a good and a bad thing: good as in the actual data has no issues. > Bad as in when I restart the service we get the message about the attributes. > Is there something slapd does with those log files when it starts that > explains it being printed on the screen/syslog? > > I only have some "spare" time once in a while to further investigate this as > it's not a high priority but I'd like to get rid of it. > > > > 2016-09-04 14:07 GMT+02:00 Michael Ströder <michael(a)stroeder.com > <mailto:michael@stroeder.com>>: > > PenguinWhispererThe . wrote: > > Is "cleaning" my data somewhere like a slapcat and slapadd? This is a > > replicated environment. Will those changes be propagated? I'd think not as > > the import probably keeps the same timestamps. > > You have to start from scratch like after a full restore (cleaning the > databases > before slapadd-ing the sanitized data). > > Ciao, Michael. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical