openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Split ldap tree
by Frank Rust 02 May '16

02 May '16

Hi all, I try to create a new ldap-server which shall only store local attributes of global users. There is a company ldap server, say ldap.example.com containing some default user tree with dn: ou=People,dc=example,dc=com containing dn: uid=<login>,ou=People,dc=example,dc=com with all objectClasses of person, inetOrgPerson, posixAccount, sambaAccount I want to create a local ldap server, say ldap.division.example.com which shall use the existing tree of the company server in my local tree with dn: ou=People,dc=division,dc=example,dc=com containing dn: uid=<login>,ou=People,dc=division,dc=example,dc=com with local objectClass of mailRecipient, mailAlias, pkiUser and all information of the company servers uid=<login>,ou=People,dc=example,dc=com This redirection/proxying shall be invisible to connected clients. How could I do this?? Thanks in advance, Frank

1 0

Re: Documentation
by Daniel Howard 30 Apr '16

30 Apr '16

On Apr 30, 2016 1:03 PM, "Quanah Gibson-Mount" <quanah(a)zimbra.com> wrote: > > --On Saturday, April 30, 2016 11:41 AM -0700 Daniel Howard < dannyman(a)toldme.com> wrote: > >> >> My recent experience is OpenLDAP on Ubuntu. I thought I would go with >> OpenLDAP's guide because they should know better, but the quick start was >> for older versions or something and hadn't been updated. > > > Apparently you haven't read the quickstart guide in a while. About March-April, if memory serves. Feels like longer. -Danny

2 1

Documentation
by Gavin Henry 30 Apr '16

30 Apr '16

Hi all, List what you love about our docs: List what you hate: List what you'd love to see: List what you can help with: Thanks. -- Kind Regards, Gavin Henry.

1 0

Re: Export issue after an DN change
by mdii 30 Apr '16

30 Apr '16

Thanks for the reply. The OpenLDAP version is *2.4.35*. For the backend, I'm not really sure where to look at, but I found the attribute *olcDbDirectory *in the *olcDatabase={1}mdb,cn=config* entry. It points at the folder */custom/data/openldap-data-oldschema*, where I saw two .mdb files (*lock.mdb* and *data.mdb*). Is it possible that this two MSAccess (?) files are my OpenLDAP backend ? It is running over a Red Hat 6 system. I did an ldapsearch and a slapcat and both of then returned all entries. When I use the Java unboundID framework, if I do a "large" search, some entries doesn't show up, but if I do a specific search, the missing entry is found. Both queries were made par the same framework method... 2016-04-22 21:33 GMT+02:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Friday, April 22, 2016 4:57 PM +0200 mdii <mdii.alias(a)gmail.com> > wrote: > > >> I'm having a weird issue with my OpenLDAP directory, maybe some of you >> had a similar issue in the past and can point me in the right direction, >> at the moment I have no idea where to start looking... >> > > OpenLDAP version? OpenLDAP backend? What results do you get from slapcat? > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc >

2 1

Q: "dn: cn=Uptime,cn=Time,cn=Monitor" non-monotonic occasionally?
by Ulrich Windl 29 Apr '16

29 Apr '16

Hi! I'm running a NRPE monitor that monitors openLDAP. To compute delta values, the NRPE plugin stores the "dn: cn=Uptime,cn=Time,cn=Monitor" reported by openLDAP to compare it with the current value (to build the time difference). If the time difference is negative, the plugin reports a "server restart" event. So far, so good... However, very rarely (once every few weeks) a false server restart is reported. Viewing the historic logs, I can only assume that openLDAP reports a bad uptime value now and then. Could this be? Example plugin logs: 2016/04/28 10:25:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.246], [3 searches with 12 entries in 0.057s], 2340577, 0.10084, 0.07563, 0.35294, 0, 0, 0, 0, 0, 0, 0.08403, 0.61345 2016/04/28 10:23:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.288], [3 searches with 12 entries in 0.052s], 2340458, 0.09917, 0.08264, 0.32231, 0, 0, 0, 0, 0, 0, 0.08264, 0.58678 2016/04/28 10:21:14 LDAP: Operations Rate UNKNOWN HARD 1 UNKNOWN: [Lock.Delay=0.221], [3 searches with 12 entries in 0.052s], 2340337, [Operations.Bind.i: restart detected (2340337 - 2340341 == -4)], 284553, [Operations.Unbind.i: restart detected (2340337 - 2340341 == -4)], 205927, [Operations.Search.i: restart detected (2340337 - 2340341 == -4)], 985106, [Operations.Compare.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Modify.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Modrdn.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Add.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Delete.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Abandon.i: restart detected (2340337 - 2340341 == -4)], 4, [Operations.Extended.i: restart detected (2340337 - 2340341 == -4)], 245199, [Operations.i: restart detected (2340337 - 2340341 == -4)], 1720790 2016/04/28 10:19:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.501], [3 searches with 12 entries in 0.060s], 2340341, 0.13333, 0.09167, 0.65000, 0, 0, 0, 0, 0, 0, 0.11667, 0.99167 (The first number after the messages in square brackets is the uptime, then come the operations rate for several LDAP operations) At 10:19:14 the uptime was 2340341, and at 10:25:14 the uptime was 2340577. That could be OK, but at 10:21:14 the uptime was reported as 2340337 which is less than reported at 10:19:14. Has there ever been such an issue with uptime? Regards, Ulrich

4 11

ACLs: restrict by IP and user
by Janne Peltonen 28 Apr '16

28 Apr '16

Hi! I was thinking about giving the users a different set of their own attributes, depending on whether they accessed the server from a well-known IP address or not. Is this possible using OpenLDAP? I know how to form a WHO clause to grant access to self; I know how to form a WHO clause to grant access from a certain IP address; what I don't know is how to grant access to "self if and only if it hails from a certain IP address", i.e. so that the given rights would require both that we're considering "self" and "IP address" at the same time, but if either doesn't match, then the clause wouldn't apply. I'be glad if anybody could provide any help upon this. Also a simple "can't be done" would be appreciated. --Janne Peltonen University of Helsinki

2 8

Offline modification in replicated environment
by Ryan Tandy 23 Apr '16

23 Apr '16

When my (Debian's) users upgrade to 2.4.43 or later, if they use the ppolicy overlay and cn=config, I have to add the pwdMaxRecordedFailure attribute to the schema, otherwise slapd can't start. Basic steps: slapcat the config database; a few lines of perl to add the new attribute, update the pwdPolicy object class, and strip out modifiersName and modifyTimestamp so they get regenerated; slapadd it back. No problem for a standalone system. The config database might be replicated, though. For that, I'm also removing entryCSN from the schema entry I modify, and letting slapadd regenerate it. I'm not using -S with slapadd, so the reloaded entry is getting sid 000 every time. I've tested master-slave and master-master setups, and this seems to be working as intended. But I'd like to ask the people here who have more experience with replication than I do: is this a bad plan? What could go wrong? thanks, Ryan

2 1

Export issue after an DN change
by mdii 22 Apr '16

22 Apr '16

I'm having a weird issue with my OpenLDAP directory, maybe some of you had a similar issue in the past and can point me in the right direction, at the moment I have no idea where to start looking... In my directory, the entities are listed in the ou=organisation branch, where the key is the entity label and they have a hierarchic structure, for example: - ou=organisation - ou=entity1,ou=organisation - ou=entity2,ou=entity1,ou=organisation - ou=entity3,ou=entity1,ou=organisation - ou=entity4,=entity3,ou=entity1,ou=organisation - ou=entity5,ou=organisation - ... The issue appears when there is a label change in one of the entities. In this example I will change entity3 by entity33: - ou=organisation - ou=entity1,ou=organisation - ou=entity2,ou=entity1,ou=organisation - ou=entity33,ou=entity1,ou=organisation - ou=entity4,=entity33,ou=entity1,ou=organisation - ou=entity5,ou=organisation - ... When I'm using a directory browser, let's say ApacheDS, I have no trouble, I can see the entire directory tree (as above). My issue is the following: - If I do a LDIF export (using the same ApacheDS), it doesn't export the entity4 entry (or any other entity under entity33) - If I do a Java application that uses a LDAP framework (Spring or UnboundID in my case), I have the same problem, it doesn't see the entity4 entry - I can do an entity4 LDIF export, it works well Meanwhile there is a solution to this issue. If I do the series of operations: - LDIF export of entity4 - LDIF export of entity33 - LDIF export of entity1 - suppression of entity33 (witch includes all entries under it) - Import of entity1 - Import of entity33 - Import of entity4 Once these operations completed, everything goes normal and entity4 will be exported when I do an entity33 LDIF export. One last detail, when I enter the enterprise, the issue was known, and it was told me to export the parent entity of the one that had the label change, that’s why I do the enetity1 export/suppression/import (not only the entity33). Do you have any idea of what's going on? At the moment I have no idea where to start looking at, if I can change some settings or if it's an OpenLDAP know bug. I would like to thank you in advance for any help, Best regards, Marc

2 1

Query regarding Openldap implementation
by Samrin S.N 21 Apr '16

21 Apr '16

Hi There, I have a query on ldap_search_ext_s() API being used. This API is returning operations error and by default the option LDAP_OPT_REFERRALS is default to 1. I feel when we use this API, it tries and finds other referrals present in the AD server configuration forest. Can you please help me in understanding this API behaviour. I have found that even though the requested user is found at one of the referral, again the search is done on other referrals for the same user. What is the significance of trying to search the node in other referrals. Your help is highly appreciated. -- Thanks, Samrin

1 1

How to enable search using wildcard characters
by PRATIK SINGAL 20 Apr '16

20 Apr '16

Hello All, Can any one please help me how can i search using wild card character. My base dn is "dc=example,dc=com" and i want to search all the records having "telephone" attribute whose value is starting from 256* Am using below verion of openldap $OpenLDAP: slapd 2.4.40 Is there any changes which needs to be done in slapd.conf to enable wildcard search Regards, Pratik

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical