openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

Re: Export issue after an DN change
by mdii 30 Apr '16

30 Apr '16

Thanks for the reply. The OpenLDAP version is *2.4.35*. For the backend, I'm not really sure where to look at, but I found the attribute *olcDbDirectory *in the *olcDatabase={1}mdb,cn=config* entry. It points at the folder */custom/data/openldap-data-oldschema*, where I saw two .mdb files (*lock.mdb* and *data.mdb*). Is it possible that this two MSAccess (?) files are my OpenLDAP backend ? It is running over a Red Hat 6 system. I did an ldapsearch and a slapcat and both of then returned all entries. When I use the Java unboundID framework, if I do a "large" search, some entries doesn't show up, but if I do a specific search, the missing entry is found. Both queries were made par the same framework method... 2016-04-22 21:33 GMT+02:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Friday, April 22, 2016 4:57 PM +0200 mdii <mdii.alias(a)gmail.com> > wrote: > > >> I'm having a weird issue with my OpenLDAP directory, maybe some of you >> had a similar issue in the past and can point me in the right direction, >> at the moment I have no idea where to start looking... >> > > OpenLDAP version? OpenLDAP backend? What results do you get from slapcat? > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc >

2 1

Q: "dn: cn=Uptime,cn=Time,cn=Monitor" non-monotonic occasionally?
by Ulrich Windl 29 Apr '16

29 Apr '16

Hi! I'm running a NRPE monitor that monitors openLDAP. To compute delta values, the NRPE plugin stores the "dn: cn=Uptime,cn=Time,cn=Monitor" reported by openLDAP to compare it with the current value (to build the time difference). If the time difference is negative, the plugin reports a "server restart" event. So far, so good... However, very rarely (once every few weeks) a false server restart is reported. Viewing the historic logs, I can only assume that openLDAP reports a bad uptime value now and then. Could this be? Example plugin logs: 2016/04/28 10:25:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.246], [3 searches with 12 entries in 0.057s], 2340577, 0.10084, 0.07563, 0.35294, 0, 0, 0, 0, 0, 0, 0.08403, 0.61345 2016/04/28 10:23:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.288], [3 searches with 12 entries in 0.052s], 2340458, 0.09917, 0.08264, 0.32231, 0, 0, 0, 0, 0, 0, 0.08264, 0.58678 2016/04/28 10:21:14 LDAP: Operations Rate UNKNOWN HARD 1 UNKNOWN: [Lock.Delay=0.221], [3 searches with 12 entries in 0.052s], 2340337, [Operations.Bind.i: restart detected (2340337 - 2340341 == -4)], 284553, [Operations.Unbind.i: restart detected (2340337 - 2340341 == -4)], 205927, [Operations.Search.i: restart detected (2340337 - 2340341 == -4)], 985106, [Operations.Compare.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Modify.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Modrdn.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Add.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Delete.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Abandon.i: restart detected (2340337 - 2340341 == -4)], 4, [Operations.Extended.i: restart detected (2340337 - 2340341 == -4)], 245199, [Operations.i: restart detected (2340337 - 2340341 == -4)], 1720790 2016/04/28 10:19:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.501], [3 searches with 12 entries in 0.060s], 2340341, 0.13333, 0.09167, 0.65000, 0, 0, 0, 0, 0, 0, 0.11667, 0.99167 (The first number after the messages in square brackets is the uptime, then come the operations rate for several LDAP operations) At 10:19:14 the uptime was 2340341, and at 10:25:14 the uptime was 2340577. That could be OK, but at 10:21:14 the uptime was reported as 2340337 which is less than reported at 10:19:14. Has there ever been such an issue with uptime? Regards, Ulrich

4 11

ACLs: restrict by IP and user
by Janne Peltonen 28 Apr '16

28 Apr '16

Hi! I was thinking about giving the users a different set of their own attributes, depending on whether they accessed the server from a well-known IP address or not. Is this possible using OpenLDAP? I know how to form a WHO clause to grant access to self; I know how to form a WHO clause to grant access from a certain IP address; what I don't know is how to grant access to "self if and only if it hails from a certain IP address", i.e. so that the given rights would require both that we're considering "self" and "IP address" at the same time, but if either doesn't match, then the clause wouldn't apply. I'be glad if anybody could provide any help upon this. Also a simple "can't be done" would be appreciated. --Janne Peltonen University of Helsinki

2 8

Offline modification in replicated environment
by Ryan Tandy 23 Apr '16

23 Apr '16

When my (Debian's) users upgrade to 2.4.43 or later, if they use the ppolicy overlay and cn=config, I have to add the pwdMaxRecordedFailure attribute to the schema, otherwise slapd can't start. Basic steps: slapcat the config database; a few lines of perl to add the new attribute, update the pwdPolicy object class, and strip out modifiersName and modifyTimestamp so they get regenerated; slapadd it back. No problem for a standalone system. The config database might be replicated, though. For that, I'm also removing entryCSN from the schema entry I modify, and letting slapadd regenerate it. I'm not using -S with slapadd, so the reloaded entry is getting sid 000 every time. I've tested master-slave and master-master setups, and this seems to be working as intended. But I'd like to ask the people here who have more experience with replication than I do: is this a bad plan? What could go wrong? thanks, Ryan

2 1

Export issue after an DN change
by mdii 22 Apr '16

22 Apr '16

I'm having a weird issue with my OpenLDAP directory, maybe some of you had a similar issue in the past and can point me in the right direction, at the moment I have no idea where to start looking... In my directory, the entities are listed in the ou=organisation branch, where the key is the entity label and they have a hierarchic structure, for example: - ou=organisation - ou=entity1,ou=organisation - ou=entity2,ou=entity1,ou=organisation - ou=entity3,ou=entity1,ou=organisation - ou=entity4,=entity3,ou=entity1,ou=organisation - ou=entity5,ou=organisation - ... The issue appears when there is a label change in one of the entities. In this example I will change entity3 by entity33: - ou=organisation - ou=entity1,ou=organisation - ou=entity2,ou=entity1,ou=organisation - ou=entity33,ou=entity1,ou=organisation - ou=entity4,=entity33,ou=entity1,ou=organisation - ou=entity5,ou=organisation - ... When I'm using a directory browser, let's say ApacheDS, I have no trouble, I can see the entire directory tree (as above). My issue is the following: - If I do a LDIF export (using the same ApacheDS), it doesn't export the entity4 entry (or any other entity under entity33) - If I do a Java application that uses a LDAP framework (Spring or UnboundID in my case), I have the same problem, it doesn't see the entity4 entry - I can do an entity4 LDIF export, it works well Meanwhile there is a solution to this issue. If I do the series of operations: - LDIF export of entity4 - LDIF export of entity33 - LDIF export of entity1 - suppression of entity33 (witch includes all entries under it) - Import of entity1 - Import of entity33 - Import of entity4 Once these operations completed, everything goes normal and entity4 will be exported when I do an entity33 LDIF export. One last detail, when I enter the enterprise, the issue was known, and it was told me to export the parent entity of the one that had the label change, that’s why I do the enetity1 export/suppression/import (not only the entity33). Do you have any idea of what's going on? At the moment I have no idea where to start looking at, if I can change some settings or if it's an OpenLDAP know bug. I would like to thank you in advance for any help, Best regards, Marc

2 1

Query regarding Openldap implementation
by Samrin S.N 21 Apr '16

21 Apr '16

Hi There, I have a query on ldap_search_ext_s() API being used. This API is returning operations error and by default the option LDAP_OPT_REFERRALS is default to 1. I feel when we use this API, it tries and finds other referrals present in the AD server configuration forest. Can you please help me in understanding this API behaviour. I have found that even though the requested user is found at one of the referral, again the search is done on other referrals for the same user. What is the significance of trying to search the node in other referrals. Your help is highly appreciated. -- Thanks, Samrin

1 1

How to enable search using wildcard characters
by PRATIK SINGAL 20 Apr '16

20 Apr '16

Hello All, Can any one please help me how can i search using wild card character. My base dn is "dc=example,dc=com" and i want to search all the records having "telephone" attribute whose value is starting from 256* Am using below verion of openldap $OpenLDAP: slapd 2.4.40 Is there any changes which needs to be done in slapd.conf to enable wildcard search Regards, Pratik

3 2

Re: Openldap vs 389
by Shawn McKinney 20 Apr '16

20 Apr '16

> On Apr 19, 2016, at 16:34:27,Achilleas Mantzios wrote: > > I admit I haven’t done my homework regarding the standards (the literature is just huge), maybe I was hasty in using the term RBAC above, but anyway what does Fortress/RBAC give out of the box that our solution wouldn’t, I mean you wouldn’t mind giving a very rough overview ? Not knowing what your solution provides it's not possible for me to give you a comparison and in any case that’s a question for you to decide. If you want to understand fortress, first understand its apis, there are links to javadoc descs at the bottom of this page: https://directory.apache.org/fortress/overview.html If after that you are still interested, checkout the tutorials: - http://github.com/shawnmckinney/apache-fortress-demo - http://github.com/shawnmckinney/role-engineering-sample - http://github.com/shawnmckinney/wicket-sample - http://github.com/shawnmckinney/fortress-saml-demo or some of the collateral that is here: - http://iamfortress.net/2015/06/11/what-is-delegated-administration/ - http://iamfortress.net/2015/03/13/enabling-java-ee-and-fortress-security-in… - http://iamfortress.net/2015/03/05/the-seven-steps-of-role-engineering/ - http://iamfortress.net/2015/02/16/apache-fortress-end-to-end-security-tutor… - http://iamfortress.net/2014/11/24/using-role-for-access-control-is-not-rbac/ Shawn

2 1

memberuid value should be DN or RDN or both woks
by scn_73＠yahoo.com 20 Apr '16

20 Apr '16

All, Openldap is complaining invalid dn. I doubt, it's for group members those memberuid don't have have DN and added as RDN. Like to know does memberuid should be DN or RDN works too. slapd[4892]: conn=1629448 op=2180 do_search: invalid dn (member1) slapd[4892]: conn=1629448 op=2181 do_search: invalid dn (memver2) slapd[4892]: conn=1629448 op=2182 do_search: invalid dn (member2) objectClass: posixGroup objectClass: top cn: g1 gidNumber: xxxx memberUid: member1 memberUid: member2 memberUid: member3 - Sachin

2 1

Best method to swap TLS cert/key/CA files
by ML mail 19 Apr '16

19 Apr '16

Hello, I would like to swap my self signed certificate including CA, cert and key with a new set of CA, cert and key files on my OpenLDAP 2.4.31 master and replica servers. What would be the best way to achieve that? Can I simply run an ldapmodify with the new values and then restart slapd? Is it as easy as that or are there any pitfalls I should take care of? Thank you in advance for your comments. Regards ML

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical