openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

cn=config (MMR) replication causes ldapsearch -ZZ to hang on RHEL 6.7
by Frank Crow 22 Mar '16

22 Mar '16

I'm trying to move my OpenLDAP MMR configuration from RHEL 6.5 (OpenLDAP 2.4.23) to RHEL 6.7 (OpenLDAP 2.4.40). On RHEL 6.5 it is working no with no problems. On RHEL 6.7, the configuration causes "ldapsearch -ZZ" to hang indefinitely. The cn=config section in slapd.conf looks like this: # sync provider configuration overlay syncprov syncprov-checkpoint 1 1 syncrepl rid=001 provider=ldap://server1 searchbase="cn=config" filter="(|(objectClass=olcDatabaseConfig)(objectClass=olcOverlayConfig))" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/csa-certs/config.crt tls_key=/etc/openldap/csa-certs/config.key tls_cacert=/etc/openldap/csa-certs/cacert.pem tls_reqcert=demand type=refreshAndPersist retry="5 10 10 10 30 +" timeout=1 syncrepl rid=002 provider=ldap://server2 searchbase="cn=config" filter="(|(objectClass=olcDatabaseConfig)(objectClass=olcOverlayConfig))" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/csa-certs/config.crt tls_key=/etc/openldap/csa-certs/config.key tls_cacert=/etc/openldap/csa-certs/cacert.pem tls_reqcert=demand type=refreshAndPersist retry="5 10 10 10 30 +" timeout=1 mirrormode on If I comment out that section in slapd.conf then "ldapsearch -ZZ" works but (obviously) I don't get cn=config replication. Am I doing something wrong in the configuration? Is it a fluke that it is working on 2.4.23 in the first place? Or does anyone know what may have changed (or is more strict or whatever) in the 2.4.40 release? Should I try to just remove RHEL's version of OpenLDAP and install the latest from openldap.org instead? Any assistance is highly appreciated! Thanks, -- Frank

3 2

how to provide a way to user to change their password
by MichaelLeung 22 Mar '16

22 Mar '16

hi list i am wonder how to provide a way to LDAP user to change their password

3 3

Openldap allows to break schema (and doesn't start ever after)
by Daniel Fenert 21 Mar '16

21 Mar '16

Hi, I've accidentally broken my openldap schema when I've changed one of objectClass definitions. For example I have two objectClasses and one is a parent for second: olcObjectClasses: {0}( 1.2.3.4 NAME 'foo' DESC '' SUP top AUXILIARY X-ORIGIN 'user defined' ) olcObjectClasses: {1}( 1.2.3.5 NAME 'bar' DESC '' SUP foo AUXILIARY X-ORIGIN 'user defined' ) I've changed definition of foo - I've delete this object and (my mistake) put it without any number at bottom of all classes: dn: cn=config changetype: modify delete: olcObjectClasses olcObjectClasses: {0} - add: olcObjectClasses olcObjectClasses: ( 1.2.3.4 NAME 'foo' DESC '' SUP top AUXILIARY X-ORIGIN 'user defined' ) So now I have class bar at top of schema and foo at bottom. After restart slapd won't start. Slapcat says: 56d4678f olcObjectClasses: value #5 olcObjectClasses: ObjectClass not found: "foo" 56d4678f config error processing cn=config: olcObjectClasses: ObjectClass not found: "foo" slapcat: bad configuration file! I know that is my mistake, but I think openldap shouldn't allow to make something that could break schema. I think that there are should constraints that do not allow to remove objectClass which is parent for another class. Is it a known bug, or anyone has stumbled upon this and has a solution to start slapd afterwards? -- Daniel Fenert

1 0

looking for a graphic tool for openldap
by MichaelLeung 21 Mar '16

21 Mar '16

i am wondering is there a graphic openldap admin tool that run under Linux ?

9 12

slapd + bdb backend , some queries failing with "Internal error on get_nextid"
by Tobias Gierke 18 Mar '16

18 Mar '16

Hi, Recently we all of a sudden started getting this error message on certain queries (but not all of them). I had a brief look at back-bdb/search.c but unfortunately there are no comments that point to a possible cause. Does this mean the database is corrupted ? Can this be fixed with db_recover ? Thanks, Tobias P.S. We're running ClearOS 6.7.0 with openldap-servers-2.4.4.0-7-v6 on x64 -- Tobias Gierke Development VOIPFUTURE GmbH Wendenstraße 4 20097 Hamburg, Germany Phone +49 40 688 900 164 Fax +49 40 688 900 199 Email tobias.gierke(a)voipfuture.com Web http://www.voipfuture.com CEO Jan Bastian Commercial Court AG Hamburg HRB 109896, VAT ID DE263738086

2 3

Error with :mozillaOrgPerson removed from template as it is not defined in the schema
by MichaelLeung 18 Mar '16

18 Mar '16

hi list i got these two error, Courier Mail: Account: *courierMailAccount* removed from template as it is not defined in the schema Thunderbird: Address Book Entry: *mozillaOrgPerson* removed from template as it is not defined in the schema seems my phpadminldap lack of the schema. does any one have the schema for openldap ? or give me a link so that i can download it.

3 6

Re: After power reset, LMDB sub-DBs' key-pairs are missing
by Arto Bendiken 16 Mar '16

16 Mar '16

Hi Ulrich, On Tue, Mar 15, 2016 at 9:00 AM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Arto Bendiken <arto(a)bendiken.net> schrieb am 14.03.2016 um 17:30 in Nachricht > <CAE7aNuS4=5ENrgL7w=zDqUe2dE7WH01nkAkAX76Msuw_uj=xug(a)mail.gmail.com>: >> Here's a curious case that I had not encountered with LMDB as yet previously: >> >> 1. There was a power reset of a virtual machine with an active LMDB >> writer process (standalone use, not OpenLDAP) on an LMDB file >> containing three sub-DBs. > [...] > > Hi! > > What is a "power reset of a virtual machine"? A virtual power reset (i.e. reset), or a power reset of the host? > In the latter case some writes that the VM considers done may not be committed on the host, depending on the exact configuration. You didn't give any details on that, so I can only guess... The latter, with the VM's virtio disks being LVM volumes assigned and dedicated to it using libvirt--a run-of-the-mill configuration. -- Arto Bendiken | @bendiken | http://ar.to

2 1

Re: olcAccess/olcLimits modifications
by PenguinWhispererThe . 15 Mar '16

15 Mar '16

It's still weird that adding and deleting works with the index but the replace not. No consistent usage there. Probably the devs had better things to do ;) Anyway. Thanks for clarifying indexes and where I can and can't use them ;) <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 viruses found. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2> 2016-03-15 17:19 GMT+01:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, March 15, 2016 1:58 PM +0200 Cole <cole(a)opteqint.net> wrote: > > To replace the 12th index, you could do: >>> >>> changetype: modify >>> delete: olcAccess >>> olcAccess: {11} >>> >>> ^ deletes the 12th index, since it is ZERO based. If you want the 13th >>> index ({12}), adjust appropriately. >>> >>> changetype: modify >>> add: olcAccess >>> olcAccess: {11} <new rule> >>> >> >> So in order to modify olcAccess: {11}, you first have to delete it and >> then re-add it? There is no way to modify it in place and change its >> contents? >> > > No. What I generally do is read the value, store that, tweak it how I > want, and then write it back (delete, add modified value). What's handed > with the way things are ordered in cn=config is that you don't have to run > the delete command against the full exact value, but only the index. > > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc >

2 1

Re: olcAccess/olcLimits modifications
by Cole 15 Mar '16

15 Mar '16

> The poster who gave you that advice is wrong. "replace" replaces the entire > entry with what you've added. You want add: value, not replace: value, like > you originally had. Thanks Quanah for providing the correct answer. I could not find an example, and did not have a ldap server handy in order to test. > > To replace the 12th index, you could do: > > changetype: modify > delete: olcAccess > olcAccess: {11} > > ^ deletes the 12th index, since it is ZERO based. If you want the 13th > index ({12}), adjust appropriately. > > changetype: modify > add: olcAccess > olcAccess: {11} <new rule> So in order to modify olcAccess: {11}, you first have to delete it and then re-add it? There is no way to modify it in place and change its contents? Thanks /Cole > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc

2 1

Error 80 with ldapmodify
by Christian Schmidt 15 Mar '16

15 Mar '16

Hi all, we're running Debian Jessie with slapd-2.4.40+dfsg-1+deb8u2 and ldap-utils-2.4.40+dfsg-1+deb8u2. No special modifications have been taken to slapd's configuration and/or the directory itself , and trying to add the following ldif file... dn: cn=config changetype: modify add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.gnutls.key - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap.gnutls.crt - add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ldap/ssl/intermediate.pem ...results in error 80: # ldapmodify -Y EXTERNAL -H ldapi:/// -f ./ssl.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) All the files are readable for the user slapd is running as. Invoking slapd with debug level 255 shows: [..] 56e2e677 => slap_access_allowed: add access granted by manage(=mwrscxd) 56e2e677 => access_allowed: add access granted by manage(=mwrscxd) 56e2e677 oc_check_required entry (cn=config), objectClass "olcGlobal" 56e2e677 oc_check_allowed type "objectClass" 56e2e677 oc_check_allowed type "cn" 56e2e677 oc_check_allowed type "olcArgsFile" 56e2e677 oc_check_allowed type "olcLogLevel" 56e2e677 oc_check_allowed type "olcPidFile" 56e2e677 oc_check_allowed type "olcToolThreads" 56e2e677 oc_check_allowed type "structuralObjectClass" 56e2e677 oc_check_allowed type "entryUUID" 56e2e677 oc_check_allowed type "creatorsName" 56e2e677 oc_check_allowed type "createTimestamp" 56e2e677 oc_check_allowed type "olcTLSCertificateKeyFile" 56e2e677 oc_check_allowed type "olcTLSCertificateFile" 56e2e677 oc_check_allowed type "olcTLSCACertificateFile" 56e2e677 oc_check_allowed type "entryCSN" 56e2e677 oc_check_allowed type "modifiersName" 56e2e677 oc_check_allowed type "modifyTimestamp" 56e2e677 send_ldap_result: conn=1002 op=1 p=3 56e2e677 send_ldap_result: err=80 matched="" text="" 56e2e677 send_ldap_response: msgid=2 tag=103 err=80 <---- Error 80 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 02 67 07 0a 01 50 04 00 04 00 0....g...P.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 67 07 0a 01 50 04 00 04 00 0....g...P.... 56e2e677 conn=1002 op=1 RESULT tag=103 err=80 text= [..] What's wrong there? I couldn't find anything useful to feed $SEARCHENGINE with. Thanks & Regards, Christian -- No signature available.

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical