openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Syncrepl Error : critical extension is not recognized
by David Gabriel 13 Nov '15

13 Nov '15

Dears, I am new in OpenLDAP world ! I want to use syncrepl in order to synchronize my consumer which is a Python application. I configured the server side based on this tutorial <http://www.openldap.org/doc/admin24/replication.html>, I restart my server but I get the following error when I run my python application <https://github.com/rbarrois/python-ldap/blob/master/Demo/pyasn1/syncrepl.py> : 'info': 'critical extension is not recognized', 'desc': 'Critical extension is unavailable' NB: I didn't consider the "Set up the consumer slapd" section because I am relying on the python consumer application <https://github.com/rbarrois/python-ldap/blob/master/Demo/pyasn1/syncrepl.py> . Please tell me what shall I do ? Any help from your side is welcome ? Thanks in advance. Regards

1 0

startup failed
by BÖSCH Christian 11 Nov '15

11 Nov '15

Hi, I set up an openldap server with all desired configs (cn=config, mmr, etc etc) as node 1. Then I start it up, which is quite slow (I think it waits on node 2 which is not available yet). Then I add an empty base tree: dn: dc=example,dc=net objectClass: dcObject objectClass: organization o: ORG1 o: ORG2 dc: example dn: cn=admin,dc=example,dc=net objectClass: organizationalRole cn: LDAP Admin cn: admin dn: o=org1,dc=example,dc=net o: ORG1 objectClass: organization objectClass: top dn: o=org2,dc=example,dc=net o: ORG2 objectClass: organization objectClass: top After that restarting slapd always fails. That’s in debug log: Nov 11 08:35:00 openldap1 slapd[27812]: slapd startup: initiated. Nov 11 08:35:00 openldap1 slapd[27812]: backend_startup_one: starting "cn=config" Nov 11 08:35:00 openldap1 slapd[27812]: config_back_db_open Nov 11 08:35:00 openldap1 slapd[27812]: backend_startup_one: starting "dc=example,dc=net" Nov 11 08:35:00 openldap1 slapd[27812]: mdb_db_open: database "dc=example,dc=net": dbenv_open(/var/db/openldap-data). Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_search Nov 11 08:35:00 openldap1 slapd[27812]: mdb_dn2entry("dc=example,dc=net") Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_dn2id("dc=example,dc=net") Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_dn2id: got id=0x1 Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_entry_decode: Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_entry_decode Nov 11 08:35:00 openldap1 slapd[27812]: search_candidates: base="dc=example,dc=net" (0x00000001) scope=2 Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_equality_candidates (objectClass) Nov 11 08:35:00 openldap1 slapd[27812]: => key_read Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_index_read: failed (-30798) Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_equality_candidates: id=0, first=0, last=0 Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_equality_candidates (objectClass) Nov 11 08:35:00 openldap1 slapd[27812]: => key_read Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_index_read: failed (-30798) Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_equality_candidates: id=0, first=0, last=0 Nov 11 08:35:00 openldap1 slapd[27812]: mdb_search_candidates: id=0 first=0 last=0 Nov 11 08:35:00 openldap1 slapd[27812]: mdb_search: no candidates Nov 11 08:35:00 openldap1 slapd[27812]: send_ldap_result: conn=-1 op=0 p=0 Does anybody see the problem? King regards, Chris

3 4

Re: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17)
by Howard Chu 11 Nov '15

11 Nov '15

Volker Lendecke wrote: > On Wed, Nov 11, 2015 at 09:49:49AM +0000, Howard Chu wrote: >> Volker Lendecke wrote: >>> On Wed, Nov 11, 2015 at 12:09:51AM +0000, Howard Chu wrote: >>>> Unfortunately, PTHREAD_MUTEX_ROBUST_NP is an enum, not a macro, so >>>> #ifdef won't work to detect it. >>>> >>>> The attached patch should work. Please report back; I won't merge it >>>> unless we know it actually helps. >>> >>> Not sure you're aware, but there's RHEL5 (and thus Centos5 I >>> believe) versions where glibc announces robust mutexes but >>> the kernel is buggy: They are just not robust. tdb has a >>> runtime check for this. Are you interested? >> >> Sure, post a link to more info. >> >> I found this since you mentioned it. >> >> https://bugzilla.redhat.com/show_bug.cgi?id=628608 >> >> But it only affects a mutex that was locked in a process that >> subsequently forks a child. The LMDB docs already say explicitly >> that a process must not fork with an open LMDB environment so this >> particular issue doesn't affect us. > > Nope, this was properly ordered. Fork, then lock, then > exit, and the subsequent locker did not get EOWNERDEAD. Not > sure about the exact behavior anymore though. > > https://git.samba.org/?p=samba.git;a=blob;f=lib/tdb/common/mutex.c;h=fae43d… > > has the tdb_runtime_check_for_robust_mutexes that verifies > we're in a sane environment. Thanks. I still see your test doing a fork after init'ing the mutex. That's the condition that triggered the above bug - not the timing of the actual mutex_lock. This was fixed in June 2011, glibc 2.15. And as before, it doesn't affect LMDB. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17)
by Howard Chu 11 Nov '15

11 Nov '15

Volker Lendecke wrote: > On Wed, Nov 11, 2015 at 12:09:51AM +0000, Howard Chu wrote: >> Unfortunately, PTHREAD_MUTEX_ROBUST_NP is an enum, not a macro, so >> #ifdef won't work to detect it. >> >> The attached patch should work. Please report back; I won't merge it >> unless we know it actually helps. > > Not sure you're aware, but there's RHEL5 (and thus Centos5 I > believe) versions where glibc announces robust mutexes but > the kernel is buggy: They are just not robust. tdb has a > runtime check for this. Are you interested? Sure, post a link to more info. I found this since you mentioned it. https://bugzilla.redhat.com/show_bug.cgi?id=628608 But it only affects a mutex that was locked in a process that subsequently forks a child. The LMDB docs already say explicitly that a process must not fork with an open LMDB environment so this particular issue doesn't affect us. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

LMDB physical file size
by Christian Sell 10 Nov '15

10 Nov '15

Hello, we are using LMDB as the underlying storage engine for a lightweight + high performance special-purpose object + mass data database. I have 2 questions about the size of the physical file used by LMDB: To create the environment, we are using a mapsize of 1 GiB and the flags MDB_NOSUBDIR | MDB_NOLOCK. Under Linux, this results in one file with a size that seems to correspond to the size of the data actually stored. However, under Windows, the file size is the same as the mapsize, namely 1 GiB. We are currently using env_copy2 and MDB_COMPACT to push this down every time the env is closed, but I fear that this will become very slow with large databases. The same issue surfaced under Linux when we were recently experimenting with the MDB_WRITEMAP option to improve performance when dealing with very large data sets. This option caused also the Linux file size to go up to 1 GiB, even though the actual data was < 50 K. We'd like to hear if there are ways to improve this. thanks, Christian

5 5

PPolicy, syncrepl
by RDSYS 10 Nov '15

10 Nov '15

Hello, I am new to this list and more or less to OpenLdap also. We use OpenLdap $OpenLDAP: slapd (Sep 11 2015 15:11:55) $#012#011buildd@babin:/build/openldap-nFTO9j/openldap-2.4.40+dfsg/debian/build/servers/slapd on the master running DEBIAN "jessie" and $OpenLDAP: slapd (Sep 11 2015 15:18:38) $#012#011buildd@binet:/build/openldap-kFav7u/openldap-2.4.31/debian/build/servers/slapd on the consumer running DEBIAN "wheezy" I had a working Master-Slave sync up to the moment when I configured PPolicy on master and slave. From that time on the sync to the consumer did not work any more. The log on the consumer say: syncrepl_message_to_op: rid=001 mods check (pwdChangedTime: multiple values provided) do_syncrepl: rid=001 rc 19 retrying The log on the master state: send_search_entry: conn 1654 ber write failed. What can be the reason? Any help would be appreciated. Thanks Reiner

2 1

Controlling rootdn access
by Michael Hierweck 10 Nov '15

10 Nov '15

Hi all, I'm trying to improve security by restricting rootdn access to localhost. See: http://www.openldap.org/doc/admin24/access-control.html#Controlling%20rootd… But I can't delete the olcRootPW attribute from the olcDatabase object: ldap_modify: Inappropriate matching (18) additional info: modify/delete: olcRootPW: no equality matching rule I suppose the access restriction to the rootdn's userPassword attribute does not take effect as the provided password will be compared against the olcRootPW attribute (directly). Thanks in advance Michael

4 7

modify ldap conn=-1
by Daniel Jung 10 Nov '15

10 Nov '15

Hi, Typically conn represents external connection number? Sometimes i see conn=-1. Does this mean this is local or sycnrepl connection modification? thanks

2 1

Synchronization/replication and testing with ldapsearch
by Rebecka Gulliksson 10 Nov '15

10 Nov '15

Hi! I’m trying to setup an instance of slapd that supports RFC4533 (Content Synchronization Operation) for use with a consumer that is *not* another slapd instance. So right now I want to test my slapd instance with ‘ldapsearch' instead of in an master-slave setup. I’m on Mac OS X with the following in my slapd.conf: overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 Then I use ldapsearch ldapsearch -x -h localhost -Esync=ro but I get no syncCookie. Essentially I want to achieve what has been asked (but not answered) here: http://www.openldap.org/lists/openldap-software/200907/msg00045.html. Is there anything else I need to add to slapd.conf or is my ldapsearch command missing something? Any pointers to documentation of how to set it up? Regards, --- Rebecka Gulliksson ICT Services and System Development (ITS) Umeå University SE-901 87 Umeå, Sweden rebecka.gulliksson(a)umu.se www.its.umu.se

2 2

OTP broken?
by Emmanuel Dreyfus 09 Nov '15

09 Nov '15

Hello It seems OTP was broken at some time, I wonder if it is just me (and why), or if it is more genral. I have a user with: cmusaslsecretOTP: sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000 slapd.conf contains: access to dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP by anonymous auth stop by self write stop by * none stop I try: $ ldapwhomai -Y OTP -X dn:${user_dn} SASL/OTP authentication started (delay) ldap_sasl_interactive_bind_s: Server is unavailable (52) additional info: SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted This is: OpenLDAP 2.4.42 Cyrusl SASL 2.1.26 While there, this uses sha1. Is there some new specs about doing it with sha256? Patching cyrus-sasl to add a new hashing algorithme is just a one liner. -- Emmanuel Dreyfus manu(a)netbsd.org

7 15

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical