openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

Error updating olcDbConfig
by Angel L. Mateo 13 Dec '15

13 Dec '15

Hello, I have a few ubuntu 14.04 servers running slapd 2.4.31 installed from ubuntu packages. Now I want to upgrade these servers to last openldap version, so I I have downloaded 2.4.43 and compiled from myself. Since then, whenever I tri to make a change in the config, slapd crashes with: Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=0 RESULT tag=97 err=0 text= Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=1 MOD dn="olcDatabase={3}hdb,cn=config" Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=1 MOD attr=olcDbcheckpoint olcDbindex olcDbNosync olcDbcachesize olcDbidlcachesize olcDbConfig olcDbNosync olcDbshmkey olcDbcachesize olcDbcheckpoint olcDbidlcachesize olcDbConfig olcDbindex Dec 11 08:34:56 canis30 slapd[9640]: bdb(dc=Telematica): BDB4511 Error: closing the transaction region with active transactions Dec 11 08:34:56 canis30 slapd[9640]: bdb_db_close: database "dc=Telematica": close failed: Invalid argument (22) Dec 11 08:34:56 canis30 slapd[9640]: hdb_cf_cleanup: failed to reopen database, rc=22 Dec 11 08:34:56 canis30 slapd[9640]: daemon: abnormal condition, shutdown initiated. Dec 11 08:34:56 canis30 slapd[9640]: slapd shutdown: waiting for 1 operations/tasks to finish Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=1 RESULT tag=103 err=80 text=failed to reopen database, rc=22 Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 fd=13 closed (slapd shutdown) Dec 11 08:34:56 canis30 kernel: [ 876.777046] slapd[9640]: segfault at e0 ip 00007f7efcd86ac2 sp 00007ffd843c2fe0 error 4 in libdb-5.3.so[7f7efcc39000+19b000] I have tried with my own openldap compilation and with the package installed from rtandy ppa, with the same results. Although the upgrade procedure recreate the databases, I have also tried to completely remove the database (dc=telematica), but it fails too. I have tried with different ldifs, and the problem seems to happen whenever a try to make a modification for the olcDbConfig attributes. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 2

relax control
by Marc Patermann 11 Dec '15

11 Dec '15

Hi, according to this list a change of a structural object class should work with: # ldapmodify -E relax OID of relax control is 1.3.6.1.4.1.4203.666.5.12, right? My servers do not advertise this control, do they? # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectClass=*) # requesting: + # # dn: structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: ou=foo namingContexts: cn=log monitorContext: cn=Monitor supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.1466.20037 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: GSSAPI entryDN: subschemaSubentry: cn=Subschema Do I have to activate the relax control on any way to get this working? Marc

2 2

(LMDB) read-only transactions and DBI handles
by Viacheslav Usov 11 Dec '15

11 Dec '15

I have a question about mdb_dbi_open and the handles it returns. The official documentation suggests to me that mdb_dbi_open is supposed to be called early on and then the obtained handle should just be reused by other transactions without any further calls to mdb_dbi_open and mdb_dbi_close. The code in sample-mdb.txt does that (ignoring the final close-all sequence). The sample also uses mdb_txn_abort to end a read-only transaction, which I take as the recommended way to end read-only transactions. The docs state that if a transaction aborts, then the associated DBI handles are closed, and so mdb_dbi_open must be used again to obtain a valid handle, which, as far as I can tell, requires a process-wide serialization of transactions with calls to mdb_dbi_open. Which feels contrary to the style described above, and, more importantly, just wrong with read-only transactions, because the need to serialize them would negate the benefits of LMDB's lock-free paradigm. Which probably means I misunderstand something. Can read-only transactions keep DBI handles reusable? How? Thanks, V.

3 10

LMDB transcations - how
by Christian Sell 11 Dec '15

11 Dec '15

Hello, I am looking for advice about how to best handle LMDB transactions and to avoid pitfalls. Our application is multi-threaded, with several threads accessing persistent data in a streaming fashion (reading lots of data sequentially). I am also not sure that it will be practical to stick with one transaction per thread, so MDB_NOTLS may be needed. In this scenario, there are few "natural" transaction boundaries, which is why I am asking when or how often a commit/abort (or reset/renew) should be issued. Also, is there any issue with multiple individual read transactions being opened from different places in the application? thanks, Christian

2 1

Ubuntu PPA of OpenLDAP?
by Khitai Pang 10 Dec '15

10 Dec '15

Hi, Is there any well maintained Ubuntu (14.04) PPA for OpenLDAP? I didn't find any. I want the latest stable OpenLDAP server. Thanks Khitai

3 2

Checksum query
by Penza Kenneth at MITA 10 Dec '15

10 Dec '15

Hi, I am configuring an openldap 2.4.40 on RHEL7 x86_64 and want to enable database checksum. Below please find the steps I am following: [root@host01 mail]# cat config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf.bak olcConfigDir: /etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: x-hidden lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: "OpenLDAP Server" olcTLSCertificateKeyFile: /etc/openldap/certs/password olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/inetorgperson.ldif include: file:///etc/openldap/schema/nis.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: TRUE olcAccess: to attrs=name;x-hidden by * =cs olcAccess: to attrs=userPassword by * auth olcAccess: to * by * read olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none olcAddContentAcl: TRUE olcRootPW: {SSHA}C6JfIRI6XajtZcjabtSJZyi1rArPsy1j olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=example,dc=com" read by * none olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=manager,dc=example,dc=com" write by * none olcAccess: {1} to dn.base="" by * read olcAccess: {2} to * by self write by dn="cn=manager,dc=example,dc=com" write by * read olcAddContentAcl: FALSE olcDatabase: {2}hdb olcDbCacheFree: 1 olcDbCacheSize: 1000 olcDbCheckpoint: 512 15 olcDbChecksum: true olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 3000 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbDirectory: /var/lib/ldap olcDbDirtyRead: FALSE olcDbDNcacheSize: 0 olcDbIDLcacheSize: 3000 olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbSearchStack: 16 olcDbShmKey: 0 olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=manager,dc=example,dc=com olcRootPW: {SSHA}C6JfIRI6XajtZcjabtSJZyi1rArPsy1j olcSuffix: dc=example,dc=com structuralObjectClass: olcHdbConfig [root@host01 mail]# [root@host01 mail]# slapadd -v -F slapd.d -n 0 -l config.ldif added: "cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}nis,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) added: "olcDatabase={0}config,cn=config" (00000001) added: "olcDatabase={1}monitor,cn=config" (00000001) 56617865 Entry (olcDatabase={2}hdb,cn=config), attribute 'olcDbChecksum' not allowed slapadd: dn="olcDatabase={2}hdb,cn=config" (line=1079): (65) attribute 'olcDbChecksum' not allowed _#################### 100.00% eta none elapsed none fast! Closing DB... [root@host01 mail]# >From the github sources back-bdb/config.c 78 { "checksum", NULL, 1, 2, 0, ARG_ON_OFF|ARG_MAGIC|BDB_CHECKSUM, 79 bdb_cf_gen, "( OLcfgDbAt:1.16 NAME 'olcDbChecksum' " 80 "DESC 'Enable database checksum validation' " I tried olcDbChecksum: true, olcDbChecksum: TRUE, olcDbChecksum: 1, olcDbChecksum: ON without any success. Do you have any ideas on how I get around this ? Regards Kenneth

2 2

providers in mirror mode replication issue
by Jean-Luc Bourguignon 09 Dec '15

09 Dec '15

Hi all, I've 2 ldap instance in mirror mode which each one has its consumer. Since a few days, even if contextCSN attributs gave me the info that all instance are in sync (as shown below), this is not the case !! I did ldapsearch against the 2 provider for one branch and I found difference in number of entries. I also did it against consumer and I saw a difference between consumer/provider for sys1 but not for consumer/provider for sys2 which were in sync. !! very strange ... sys1 - 389 (consumer) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys1 - 3892 (provider) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys2 - 389 (consumer) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys2 - 3892 (provider) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 I also did a stop/start of providers to force the replication process from difference because of the stop, but even they have done some replication between them, the difference in that concerned branch doesn't disappeared. Can you help me to find out the root cause of this unsync mirrored systems ? How can I check it deeper ? Where do have I to check why I get this difference ? Can It be related to system performance ? (memory ..) Thx in advance for your help. Brgds, J-L. PS. We use openldap version 2.4.35 under solaris 5.10 (zone systems) ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally http://tim.techmahindra.com/tim/disclaimer.html internally within TechMahindra. ============================================================================================================================

1 0

disable TLS compression with openssl?
by Paul B. Henson 08 Dec '15

08 Dec '15

We're currently running through all of our SSL/TLS using apps to disable SSLv3 and update the accepted ciphers list, as well as other current best practices. I don't see any way to disable SSL compression in openldap? Does SSL compression with ldap traffic not lead to the same issue as it does in web traffic? Also, are there any plans to support ECDHE ciphers in openldap? I see there's an ITS ticket about it, it's rather old and the last update questioned whether those ciphers should be avoided due to potential NSA meddling in their design. Thanks...

4 5

Binding through a chaining. It's possible?
by Maximiliano Boscovich 08 Dec '15

08 Dec '15

Hello, I'm having trouble making binding through a chaining. I have 2 servers, server 1 has a referral ou pointing to a another server (server2). Server1 has the following configuration: dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig objectClass: top olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: "ldap://server2" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=ar" credentials="password" keepalive=0:0:0 olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE >From the server1 I can make changes and searches without problems to entries on server2 (the chaining works fine for this), but when I want to make a binding, it gives me invalid credentials. For instance: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server1 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server1:389 ) Enter LDAP Password: ldap_bind: Invalid credentials (49) If I make the same query but to the server2 where is hosted the entry (so not the chaining is used) the binding runs smoothly: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server2 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server2:389 ) Enter LDAP Password: dn:uid=useronserver02,ou=users,dc=example,dc=ar" Result: Success (0) The logs on server1 when it's fail, show this: Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 ACCEPT from IP= 10.0.2.2:52358 (IP=0.0.0.0:389) Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 BIND dn="uid=useronserver2,dc=example,dc=ar" method=128 Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 RESULT tag=97 err=49 text= Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=1 UNBIND Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 closed and on the server02 i couldn't see any log in this case. What am I doing wrong?. Regards Maximiliano Boscovich

1 0

Samba auth on replicated LDAP: no admin user
by Paul van der Vlis 08 Dec '15

08 Dec '15

Hello, I have a replicated LDAP and a few Windows PC's what want to authenticate using Samba. Normally I use "smbpasswd -w" to give the ldap admin dn, but because it's replicated there is no ldap admin! Is there a way to authenticate using a replicated LDAP? The users are created on the master. I am using the "refreshAndPersist" type of replication. With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

5 13

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical