openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

LMDB: question about MDB_RESERVE
by Christian Sell 21 Dec '15

21 Dec '15

Hello all, I have a question about the MDB_RESERVE flag. The documentation in some places says "reserve space for data of the given size, but don't copy the given data. Instead, return a pointer to the reserved space, which the caller can fill in later - before the next update operation or the transaction ends." My question is specifically about the "before the next update operation or the transaction ends" part. Does this mean the reserved buffer becomes unusable as soon as another put is executed? What exactly happens? This statement does not appear consistently, which is why I am doubting.. thanks + happy holidays, Chris

3 3

Regarding Transactions that span Multiple files
by Mohammed Muneer 21 Dec '15

21 Dec '15

Create Env - staff Create Env - payroll Create Txn_staff Create Txn_payroll Begin write transaction for Txn_staff Insert staff data Set Txn_payroll parent to Txn_staff Begin write transaction for Txn_payroll Insert payroll data Commit Txn_payroll Commit Txn_staff ------------------------------------------------------------------ Can the above Pseudocode work in lmdb ? Or in other words can a transactions span multiple env's? Thanks.

2 1

pass-through authentication
by Timothy Keith 21 Dec '15

21 Dec '15

We are attempting to set up an LDAP server which will answer queries from an application. The database will contain metadata on a set of users in the application. The application will also query the server to authenticate the user’s password, however, this server will not house the password. That resides on another server, which our server will query. We do not have administrative rights to the other server. The difficulty we are having now is setting up the pass-through authentication for the passwords. Any pointers in how to proceed with this would be greatly appreciated. Regards, Tim

3 3

Attribute pwdPolicySubentry
by Borresen, John - 0444 - MITLL 19 Dec '15

19 Dec '15

I've been reading the Password Policy section of the Admin Guide. I am currently at this portion of the setup (the default policy is set up) You can create additional policy objects as needed. There are two ways password policy can be applied to individual objects: 1. The pwdPolicySubentry in a user's object - If a user's object has a pwdPolicySubEntry attribute specifying the DN of a policy object, then the policy defined by that object is applied. 2. Default password policy - If there is no specific pwdPolicySubentry set for an object, and the password policy module was configured with the DN of a default policy object and if that object exists, then the policy defined in that object is applied. When trying to add the pwdPolicySubentry attribute, I receive the following: "According to the schema attribute pwdPolicySubentry is not allowed." First, can someone explain the meaning of #2. The way, that I read that is that if the "pwdPolicySubentry" is not available, and the policy was created.then the policy is applied. Is that correct? My policy looks like: dn: cn=default,ou=pwpolicies,dc=example,dc=ldap objectClass: top objectClass: organizationalRole objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdAllowUserChange: TRUE pwdExpireWarning: 14 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 15552000 pwdMaxFailure: 5 pwdFailureCountInterval: 0 pwdMinAge: 1 pwdMinLength: 9 pwdMustChange: TRUE Thanks in advance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

7 15

Re: Attribute pwdPolicySubentry
by Michael Ströder 19 Dec '15

19 Dec '15

Emmanuel Lécharny wrote: > Le 19/12/15 12:44, Michael Ströder a écrit : >> Howard Chu wrote: >>> Michael Ströder wrote: >>>> Borresen, John - 0444 - MITLL wrote: >>>>> Interesting! I was able to add it via command-line with ldapadd. But, when >>>>> viewing it in Apache Directory Studio, it still didn't show up -- that is >>>>> until I enabled Operational Attributes. >>>> Attribute 'pwdPolicySubentry' is somewhat special because it's not referenced by >>>> any object class. You can simply add it to any entry. >>> It is an operational attribute, so by definition, it can be added to any entry. >> But 'pwdPolicySubentry' is the only attribute typically set by a LDAP client in >> opposite to all other operational attributes like 'createTimestamp' etc. >> >> So it's special for schema-aware LDAP GUI clients. > That's irrelevant. > > It's an operational attribute that can be set by the users, which is > perfectly legit. There is nothing 'special' about it. As said: It's not special in regard to RFC 4512. But it's not that easy to implement a generic UI which guides the user to always do the right thing. And obviously there are some generic LDAP UIs out there which prevents the user from setting this attribute by false client-side schema check. > Re-read RFC 4512 section 3.4. Nothing in there describes how a client could find out which operational attribute(s) to always present in an input form. One could display input fields for all operational attrs which does not have NO-USER-MODIFICATION set. But not all servers use that consequently enough. (Not to speak of "experimental" schema used for years being hidden by errornous .666 OID policy making schema look incomplete at the client side.) Ciao, Michael.

1 0

Re: openldap-technical Digest, Vol 97, Issue 15
by Andrei Valoshyn 18 Dec '15

18 Dec '15

>> >Hello guys! >> >I tried to deploy openldap replica on Ubuntu 14.04. I copy database >> >via slapcat(slapadd) and slapd.conf from another replica(Centos 6.7 >> >with OpenLDAP: slapd 2.4.40). >> >After all slaptest errors were fixed slapd service run once, but >> >after 5 minutes without any changes it's failed to start again and >> >currently it's still doesn't work. I can't find any ldap log. >> > >> >May be somebody faced with such kind of the problem. Will be very >> >appreciate for any advices >> > > run both slapd(8) in debugging mode and level stats sync > > -Dieter > > -- Dieter Kl?nter | Systemberatung http://sys4.de GPG Key ID: E9ED159B > 53?37'09,95"N 10?08'02,42"E In debug slapd -d -1 output I saw that ldap is trying to load from /etc/ldap/slap.d/ directory although i had put "SLAPD_CONF=/etc/ldap/slapd.conf" to /etc/default/slapd. After I clean up /etc/ldap/slap.d/ directory ldap starting load db and schema, but still can't start with error: " TLS: could not set cipher list HIGH:+TLSv1:+SSLv2:+SSLv3. 56728db6 main: TLS init def ctx failed: -1 56728db6 slapd destroy: freeing system resources. 56728db6 syncinfo_free: rid=115 56728db6 slapd stopped. 56728db6 connections_destroy: nothing to destroy. " When I try "openssl ciphers -v HIGH:+TLSv1:+SSLv2:+SSLv3" it's work fine without any error On 12/16/2015 03:00 PM, openldap-technical-request(a)openldap.org wrote: -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

3 4

(LMDB) Correct use of mdb_env_sync
by Pierre Chapuis 16 Dec '15

16 Dec '15

I am having a hard time understanding how exactly mdb_env_sync should be used. Suppose I have an environment with MDB_NOSYNC and I do not use MDB_WRITEMAP. I still want to sync at some points, which is why mdb_env_sync exists. But I wonder: - How does it interact with transactions? Is it safe (or necessary) to call it outside of a transaction? During a read-only transaction? During a write transaction? - What about thread safety? Can it be called concurrently with writes? Can it be called concurrently with another mdb_env_sync in another thread? -- Pierre Chapuis

3 2

Ubuntu Server 14.04.3 LTS and openldap-2.4.41 with static slapd.conf configuration
by Andrei Valoshyn 16 Dec '15

16 Dec '15

Hello guys! I tried to deploy openldap replica on Ubuntu 14.04. I copy database via slapcat(slapadd) and slapd.conf from another replica(Centos 6.7 with OpenLDAP: slapd 2.4.40). After all slaptest errors were fixed slapd service run once, but after 5 minutes without any changes it's failed to start again and currently it's still doesn't work. I can't find any ldap log. May be somebody faced with such kind of the problem. Will be very appreciate for any advices -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

Import/include schema file
by David Gabriel 15 Dec '15

15 Dec '15

Hi, I am new to use OpenLdap and I want to import/include new .schema file into my OpenLdap database but I don't how. Could you please point some useful links dealing with this issue or tell me how shall I proceede ? Thanks in advance. Regards

4 6

ldapmodify failing with large attribute
by Geoff Swan 15 Dec '15

15 Dec '15

I have a problem appearing where a large (16.6MB approx) value is to be saved to an attribute (certificateRevocationList). Prior to the value being this large, ldapmodify had no problems updating it. However it appears to have crossed some magic threshold where it will no longer be accepted, and aborts with: ldap_modify: Can't contact LDAP server (-1) The ldapmodify operation is being performed on the ldap host machine using the ldap root user with simple password authentication. Openldap version is 2.4.30 using back-bdb with Linux OS (2.6.32 64 bit). There is no replication configured. It's a fairly simple setup. I've seen a couple of similar threads alluding to the same problme, however without any solution. http://www.openldap.org/lists/openldap-software/200905/msg00062.html http://www.openldap.org/lists/openldap-technical/201501/msg00006.html I'm curious to know where the limit is that is causing the sudden inability for ldapmodify to complete. Nothing was immediately apparent after a quick look through some of the source. Also, if the issue is a known one, was it addressed in a newer release? I can run the same test on a machine with openldap-2.4.40 to see if it persists if that is of any help. Thanks, Geoff

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical