openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Replication speed and data sizing (mdb)
by Brian Wright 15 Aug '15

15 Aug '15

We are using 2.4.39. I realize there are newer versions available, but at the time when we started our LDAP project, this was the version available. We are testing n-way master replication along with a large number of records using lmdb. Here's the config: * 8 way replication with 8 nodes (each node having 7 other connections) * 50k records * Inserting the records into one cluster node to replicate to all the rest The problems obvserved: * Some nodes are faster at replication than others. In general, the time to complete replication is slower than expected. In my test environment I found that 50k records can take up to 2 hours for some nodes to complete. The fastest nodes complete in 1.5 hours. Because these records are brand new insertions, delta based replication wouldn't help here. * When the replication is completed, some of the data.mdb files are larger than others (sometimes by an order of magnitude). We would like to understand the reason behind these two problems above. First, the replication system seems unusually slow. Second, we need to understand why the data.mdb file grows sometimes far larger on one node than the rest of the nodes. For example, in our production environment, while most nodes were around 1GB in data size, one node stored in excess of 40GB in data.mdb. In my testing lab, my the 50k record insertion left most nodes with a data.mdb size of 150MB. On one of the nodes, the data size was 262MB. Note that I've also tried alternative replication connectivity approaches to attempt to reduce the number of connections per server, but that did not improve replication performance or the varying data sizes in the end. If updating to a newer version helps resolve the above observed problems, please let me know. Any tuning or debugging advice here would be appreciated. Thanks. -- Signature *Brian Wright* *Sr. UNIX Systems Engineer * 901 Mariners Island Blvd Suite 200 San Mateo, CA 94404 USA *Email *brianw(a)marketo.com <mailto:brianw@marketo.com> *Phone *+1.650.539.3530** *****www.marketo.com <http://www.marketo.com/>* Marketo Logo

4 6

Adding Members to Groups
by Aneela Saleem 12 Aug '15

12 Aug '15

Hi all, I have used 'posixGroup' objectClass for creating groups, and 'posixAccount' object class for creating users, which uses 'gidNumber' property to associate to a specific group (created by posixGroup). I have to sync LDAP users/groups in Apache Ranger, that uses 'groupOfNames' object class and 'member/memberof' property in user object. But in 'groupOfNames' objectClass we have to add members at the time of creation of group. Is there any way that we can add members to already created groups later on?

4 6

Re: LDAP - Unix sync
by Mauricio Tavares 12 Aug '15

12 Aug '15

On Wed, Aug 12, 2015 at 11:31 AM, Aneela Saleem <aneela(a)platalytics.com> wrote: > Yes ldap works. and running ssh in verbose mode gives i.e., ssh -v > admin(a)127.0.0.1 > > OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: /etc/ssh/ssh_config line 19: Applying options for * > debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22. > debug1: Connection established. > debug1: permanently_set_uid: 0/0 > debug1: identity file /root/.ssh/id_rsa type 1 > debug1: identity file /root/.ssh/id_rsa-cert type -1 > debug1: identity file /root/.ssh/id_dsa type 2 > debug1: identity file /root/.ssh/id_dsa-cert type -1 > debug1: identity file /root/.ssh/id_ecdsa type -1 > debug1: identity file /root/.ssh/id_ecdsa-cert type -1 > debug1: identity file /root/.ssh/id_ed25519 type -1 > debug1: identity file /root/.ssh/id_ed25519-cert type -1 > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 > debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 > Ubuntu-2ubuntu2 > debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat > 0x04000000 > debug1: SSH2_MSG_KEXINIT sent > debug1: SSH2_MSG_KEXINIT received > debug1: kex: server->client aes128-ctr hmac-md5-etm(a)openssh.com none > debug1: kex: client->server aes128-ctr hmac-md5-etm(a)openssh.com none > debug1: sending SSH2_MSG_KEX_ECDH_INIT > debug1: expecting SSH2_MSG_KEX_ECDH_REPLY > debug1: Server host key: ECDSA > 8e:24:39:c6:46:e1:03:31:b9:bb:7a:d4:89:16:72:6b > debug1: Host '127.0.0.1' is known and matches the ECDSA host key. > debug1: Found key in /root/.ssh/known_hosts:8 > debug1: ssh_ecdsa_verify: signature correct > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug1: SSH2_MSG_NEWKEYS received > debug1: Roaming not allowed by server > debug1: SSH2_MSG_SERVICE_REQUEST sent > debug1: SSH2_MSG_SERVICE_ACCEPT received > debug1: Authentications that can continue: publickey,password Poor ssh in the machine you are connecting to is completely oblivious to ldap. As of now it only knows about publickey and password. Try setting up sshd to use pam and then get ldap from there > debug1: Next authentication method: publickey > debug1: Offering RSA public key: /root/.ssh/id_rsa > debug1: Authentications that can continue: publickey,password > debug1: Offering DSA public key: /root/.ssh/id_dsa > debug1: Authentications that can continue: publickey,password > debug1: Trying private key: /root/.ssh/id_ecdsa > debug1: Trying private key: /root/.ssh/id_ed25519 > debug1: Next authentication method: password > admin(a)127.0.0.1's password: > debug1: Authentications that can continue: publickey,password > Permission denied, please try again. > admin(a)127.0.0.1's password: > > > On Wed, Aug 12, 2015 at 7:56 PM, Mauricio Tavares <raubvogel(a)gmail.com> > wrote: >> >> On Wed, Aug 12, 2015 at 10:37 AM, Aneela Saleem <aneela(a)platalytics.com> >> wrote: >> > Hi Aaron! >> > >> > Actually i'm trying to login LDAP users as local users from command >> > line. >> > >> > I have followed this guide but unable to perform 'ssh' >> > >> I think we need more than "unable to perform 'ssh'." Have you >> done the usual stuff like ssh in verbose mode and check the logs? Have >> you checked that ldap works in said machine? >> >> > On Wed, Aug 12, 2015 at 7:23 PM, Aaron Richton >> > <richton(a)nbcs.rutgers.edu> >> > wrote: >> >> >> >> On Wed, 12 Aug 2015, Aneela Saleem wrote: >> >> >> >>> Hi all, Can anyone please tell me how can i pull users from LDAP >> >>> server >> >>> and treat them as local users? So that i can login as an ldap user and >> >>> test >> >>> whether particular user have permissions to particular HDFS commands >> >>> or not. >> >> >> >> >> >> I'm not sure what you're referring to by "pull." In a typical *ix >> >> setup, >> >> you'd configure the system name services and/or authentication services >> >> to >> >> include an LDAP backend. >> >> >> >> The precise details and options depend on the exact flavor of the >> >> system >> >> you're using. nss_ldap, nss-pam-ldapd, and nssov are likely candidates >> >> on >> >> the name service side; nss-pam-ldapd also provides a pam_ldap on the >> >> authentication side. But again, this is somewhat system-dependent (no >> >> NSS on >> >> OS X/Darwin, for example). >> >> >> >> For nssov, see the LDAPCon paper >> >> http://ldapcon.org/2011/downloads/cheng-paper.pdf for starters. >> >> >> > > >

1 0

LDAP - Unix sync
by Aneela Saleem 12 Aug '15

12 Aug '15

Hi all, Can anyone please tell me how can i pull users from LDAP server and treat them as local users? So that i can login as an ldap user and test whether particular user have permissions to particular HDFS commands or not.

3 3

Is Openldap a Authorization or Authentication system?
by Kaushal Shriyan 11 Aug '15

11 Aug '15

Hi, I am not sure if i understand the difference between Authorization and Authentication. Does Openldap support both or it supports or configured as Authorization or Authentication server? I will appreciate if somebody can help me understand with some examples. Regards, Kaushal

5 5

When using the rwm, openldap down
by デージーネット大野公善 08 Aug '15

08 Aug '15

Hi. When I changed configuration for openldap, openldap stopped. (Aborted) I was carried out the following operations. (1) I created the following environment. ---- ---- ---- ---- # ldapsearch -LLL -Y EXTERNAL -b 'olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config' -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmRewrite: {0}rwm-rewriteEngine on olcRwmRewrite: {1}rwm-rewriteContext searchFilter olcRwmRewrite: {2}rwm-rewriteRule "aaa" "111" ":@" olcRwmRewrite: {3}rwm-rewriteRule "bbb" "222" ":@" ---- ---- ---- ---- (2) I created the following ldif file. ---- ---- ---- ---- dn: olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config changetype: modify delete: olcRwmRewrite olcRwmRewrite: rwm-rewriteRule "aaa" "111" ":@" - ---- ---- ---- ---- (3) I was carried out ldapmodify. ---- ---- ---- ---- # ldapmodify -Y EXTERNAL -H ldapi:/// -f down.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config" ldap_result: Can't contact LDAP server (-1) ---- ---- ---- ---- In this case, openldap has stopped. : : 55c45c8b connection_get(16) 55c45c8b ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 55c45c8b SASL Canonicalize [conn=1000]: authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" 55c45c8b slap_sasl_getdn: conn 1000 id=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth [len=55] 55c45c8b SASL Canonicalize [conn=1000]: slapAuthcDN="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" 55c45c8b SASL proxy authorize [conn=1000]: authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" 55c45c8b connection_get(16) 55c45c8b conn=1000 op=1 do_modify: dn (olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config) => ldap_bv2dn(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config,0) <= ldap_bv2dn(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config)=0 55c45c8b conn=1000 op=1 modifications: 55c45c8b delete: olcRwmRewrite 55c45c8b one value, length 32 55c45c8b [slapd:0] unknown command '' slapd: rwm.c:2195: rwm_cf_gen: Assertion `rc == 0' failed. Aborted Is this openldap BUG? -- Regards, Kimiyoshi Ohno DesigNET.INC.

3 2

Re: Manager Attribute
by mlstarling31＠hotmail.com 06 Aug '15

06 Aug '15

------ Original message------From: Michael StröderDate: Thu, Aug 6, 2015 2:30 PMTo: mlstarling31@hotmail.com;openldap-technical@openldap.org;Subject:Re: Manager Attribute mlstarling31(a)hotmail.com wrote:> could you expound on your statement below?"Think twice:> - namespace> - obsolete information, referential integrity> etc."Pretty soon free-form text fields tend to contain malformed and obsolete dataand hence are pretty unuseful.Ciao, Michael.I see. Thank you.

1 0

New Listmember with a olcAccess question
by Fischer, Johannes 06 Aug '15

06 Aug '15

Hi @all, I've tried to implement a olcAccess via regex for multiple directory entries. The goal was to group different users in two standard groups. Each group does have other access rules. I didn't what to do such a thing for every entry, so I thought that I'm able to do that with regexes. But my olcAccess rules doesn't work. I've already posted the question to stackoverflow, but no answers till now. Here the link: http://stackoverflow.com/questions/31693040/ldap-olcaccess-regex-are-not-wo… And here the rule for a regex access: olcAccess: {1}to dn.regex="^o(.+),dc=organizations,dc=example,dc=ldap$" attrs=children by group.exact="cn=ADMINS,o=[$1],dc=organizations,dc=example,dc=ldap$" write by group.exact="cn=USER,o=[$1],dc=organizations,dc=example,dc=ldap$" read by * none Does somebody can help me? Or is such a thing not possible to do? Greetings John PS: the content from Stackoverflow: ---------------------------------------------------------------------------------------- I have a LDAP server runnign with the Structure: dc=example,dc=ldap dc=organisations o=orga1 (objectClasses top/organisation/dcObject) cn=ADMINS (objectClasses top/groupOfNames) cn=USER o=orga2 cn=ADMIN cn=USER cn=users (objectClasses top/organisation/dcObject) cn=user1 (objectClasses top/person) cn=user2 Now I whant to add some rules that only the users in the organisation groups are able to see the organisation. the hard coded approach was quite easy to implement: olcAccess: {1}to dn.subtree="o=orga1,dc=organizations,dc=example,dc=ldap" by group.exact="cn=ADMINS,o=orga1,dc=organizations,dc=example,dc=ldap" write by group.exact="cn=USER,o=orga1,dc=organizations,dc=example,dc=ldap" read by * none (It is important to write TWO spaces in front of the 'by' [It was an problem for a long time for me]) But I don't whant to implement these rules for every new organisation, so I tried to implement the rule with some regex magig. But I failed misserably: olcAccess: {1}to dn.regex="^o(.+),dc=organizations,dc=example,dc=ldap$" attrs=children by group.exact="cn=ADMINS,o=[$1],dc=organizations,dc=example,dc=ldap$" write by group.exact="cn=USER,o=[$1],dc=organizations,dc=example,dc=ldap$" read by * none This rule affects nothing. So does someone have some idea to fix my problematic? Or is it not possible to group the members like I did? Thanks again -- Johannes Fischer Research Fellow Fraunhofer Institute for Manufacturing Engineering and Automation IPA Competence Centre Digital Tools for Manufactoring Nobelstrasse 12 │ 70569 Stuttgart | Germany Phone +49 711 970-1217 Johannes.Fischer(a)ipa.fraunhofer.de<mailto:Johannes.Fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image001.png@01D0D01E.D4211AC0]

3 2

build ldap tree with same meta and db suffix
by Aleks 06 Aug '15

06 Aug '15

Hi dear list members. I need to create the following ldap-tree #### dc=example dc=customers-ext,dc=example dc=MetaOrgTree01,dc=customers-ext,dc=example dc=MetaOrgTree02,dc=customers-ext,dc=example ... dc=MetaOrgTree0n dc=customers,dc=example dc=MetaOrgTree01,dc=customers,dc=example dc=MetaOrgTree02,dc=customers,dc=example ... dc=MetaOrgTree0n dc=appuser,dc=example # < this is a mdb uid=bindUser ############### I was able to create the base setup with the following commands. export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/local/BDB/lib /opt/local/openldap-2.4.41/sbin/slapadd -F /opt/local/conf/openldap/ldap.example.at/ -l ldifs/initial_ldap.example.at.ldif -n0 /opt/local/openldap-2.4.41/libexec/slapd -l local5 -F /opt/local/conf/openldap/ldap.example.at/ -h "ldap://0.0.0.0:10689 ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock" /opt/local/openldap-2.4.41/bin/ldapmodify -D 'cn=config' -w <PASSWORD> -H ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock -v -f meta-ldifs/MetaOrgTree01_meta.ldif and now I'm not able to create the dc tree ( add_and_build_root_dc_tree.ldif ) /opt/local/openldap-2.4.41/bin/ldapmodify -D 'cn=config' -w <PASSWORD> -H ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock -v -f add_and_build_root_dc_tree.ldif ldap_initialize( ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock/??base ) add objectClass: top dcObject organization add o: example add description: MyOrg add dc: parent adding new entry "dc=example" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge ################## When I create a "olcDatabase=mdb,cn=config" with olcSuffix: dc=example I'm able to create everything but when I try to add another meta target in the db suffix I get the message following message adding new entry "olcDatabase={5}meta,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcSuffix> namingContext "dc=MetaOrgTree02,dc=customers,dc=example" already served by a preceding mdb database Which is clear as the doc say this. http://www.openldap.org/software/man.cgi?query=slapd-meta&sektion=5&apropos… ######### These slapd.conf options apply to the META backend database. That is, they must follow a "database meta" line and come before any subsequent "backend" or "database" lines. ######### But how was expected to add another meta entry in a running and working system? Please can anyone help me to find a working solution. The used ldifs: http://download.none.at/initial_ldap.example.at.ldif http://download.none.at/MetaOrgTree01_meta.ldif http://download.none.at/add_and_build_root_dc_tree.ldif openldap: ##### openldap-2.4.41 ./configure --enable-bdb --enable-ldap --enable-meta --prefix=/opt/local/openldap-2.4.41 --enable-dynlist --enable-memberof --with-tls=openssl --enable-rwm --enable-accesslog --enable-syncprov LDFLAGS="-L/opt/local/BDB/lib -L/usr/sfw/lib -R/usr/sfw/lib" CPPFLAGS="-I/opt/local/BDB/include -I/opt/local/build/openssl-0.9.7a/include/" SunOS 5.10 sun4v sparc SUNW,Sun-Fire-T200 ########### I hope I have explained the setup and the question understandable. Maybe I think not ldap-isch enough Thanks everybody for help. Best regards Aleks

1 0

Re: Manager Attribute
by mlstarling31＠hotmail.com 06 Aug '15

06 Aug '15

------ Original message------From: Michael StröderDate: Thu, Aug 6, 2015 12:52 PMTo: Michael;openldap;Subject:Re: Manager Attribute Michael wrote:> Looking at the OpenLDAP schema it appears to use the "manager" attribute> the filed requires the dn: of the object.Yes.> Is there another attribute similar to the manager attribute that will take> a simple syntax such as "John Doe".AFAIK not in schema shipped with OpenLDAP.> There are a good deal of managers in our organization that don't have LDAP> accounts and therefore naturally don't have a DN to specify in this field.> I don't want the extra overhead of creating these DN's just for the sake of> using this this attribute if I don't have to.Think twice:- namespace- obsolete information, referential integrityetc.If you really need a freeform text field for arbitrary names then simplydefine your own schema:http://www.openldap.org/faq/data/cache/219.htmlCiao, Michael. Thanks Michael.Could you expound on your statement below?"Think twice: - namespace - obsolete information, referential integrity etc."

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical