openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Re: About issues with syncprov configuration
by Édnei Rodrigues 06 Aug '15

06 Aug '15

Ahh, right. Understood. Thank you for your explanation. Good day. Em 06/08/2015 13:59, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, August 06, 2015 2:01 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Thank you for your answer. >> >> So, I need to enable the lastmod overlay in the primary db? Why? >> > > Lastmod overlay? no. > > Lastmod? yes > > olcLastMod: TRUE | FALSE > Controls whether slapd will automatically maintain > the > modifiersName, modifyTimestamp, creatorsName, and > createTimestamp attributes for entries. It also controls > the > entryCSN and entryUUID attributes, which are needed by > the > syncrepl provider. By default, olcLastMod is TRUE. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: About issues with syncprov configuration
by Édnei Rodrigues 06 Aug '15

06 Aug '15

Thank you for your answer. So, I need to enable the lastmod overlay in the primary db? Why? Em 06/08/2015 12:44, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, August 06, 2015 9:40 AM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > 55c25369 syncprov_db_open: invalid config, lastmod must be enabled >> 55c25369 backend_startup_one (type=mdb, suffix="dc=br"): bi_db_open >> failed! (-1) >> slap_startup failed (test would succeed using the -u switch) >> >> >> >> What is wrong ? >> > > It says you need to enable lastmod, that seems fairly plain? > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Manager Attribute
by Michael 06 Aug '15

06 Aug '15

Looking at the OpenLDAP schema it appears to use the "manager" attribute the filed requires the dn: of the object. Is there another attribute similar to the manager attribute that will take a simple syntax such as "John Doe". There are a good deal of managers in our organization that don't have LDAP accounts and therefore naturally don't have a DN to specify in this field. I don't want the extra overhead of creating these DN's just for the sake of using this this attribute if I don't have to. Thanks.

2 1

ldap proxy to AD with local ACLs
by Meike Stone 06 Aug '15

06 Aug '15

Hello, it is me again regarding the ldap-backend. As told, I've installed a openldap as proxy in a DMZ for authentication forwarding to an Active Directoy. The Proxy is used by a VPN gateway. That all works very well. But now, I want to protect the AD from modifying. Only password changes from the user by self should be allowed. But as I see or understand, ACLs from a backend are used, AFTER the result from remote LDAP (AD) are coming back?! See second sentence from http://www.openldap.org/faq/data/cache/532.html: "It allows the common configuration directives as suffix, which is used to select it when a request is received by the server, *ACLs, which are applied to search results*, size and time limits, and so on. " So is it (and how is it) possible, to "switch" the ldap-backend in "read only mode" and only pass the the password change (modify: DEL/ADD)? Thanks Meike

2 3

About issues with syncprov configuration
by Édnei Rodrigues 06 Aug '15

06 Aug '15

Hey Guys, how are you doing ? Well, I have the follow environment: **Server 1: /etc/openldap/slapd.conf ( Port 389 ) modulepath /usr/local/openldap/lib64/ moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn database mdb directory /usr/local/openldap/var/openldap-translucent suffix "dc=br" rootdn "ZZZZZZ" rootpw ZZZZZZZ maxsize 4294967296 sizelimit 100000 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local XXXXX idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember In the port 1389: /etc/openldap/slapd-syncrepl.conf # syncrepl directives syncrepl rid=0 provider=ldap://Production_Server:389 bindmethod=simple binddn="ZZZZZZZZZZZZZZZ" credentials=XXXXXXXXX searchbase="dc=br" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://Production_Server:389 **Server 2: Same Configuration Now, I need to add a new server, but without a translucent configuration, only a consumer. So, I tried this: modulepath /usr/local/openldap/lib64/ moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn # Modulos para Delta-syncrepl modulepath /usr/local/openldap/lib64 moduleload accesslog moduleload syncprov moduleload dynlist moduleload back_hdb database hdb suffix cn=accesslog directory /usr/local/openldap/var/openldap-accesslog rootdn cn=accesslog rootpw XXXXXXXXXXXXXXXXXXXXXXXXX checkpoint 256 30 index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart # Replication overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="XXXXXXXX" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database mdb directory /usr/local/openldap/var/openldap-translucent suffix "dc=br" rootdn "XXXXXXXXXXXXX" rootpw XXXXXXXXXXXXXXXXXXXXX maxsize 4294967296 sizelimit 100000 checkpoint 256 30 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local XXXXXXXXXXXXXXXXXXXXXXXXX idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 But, I got this error: 55c25369 hdb_db_open: "cn=accesslog" 55c25369 hdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. 55c25369 hdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/openldap/var/openldap-accesslog: (2). Expect poor performance for suffix "cn=accesslog". 55c25369 hdb_db_open: database "cn=accesslog": recovery skipped in read-only mode. Run manual recovery if errors are encountered. 55c25369 mdb_db_open: "dc=br" 55c25369 syncprov_db_open: invalid config, lastmod must be enabled 55c25369 backend_startup_one (type=mdb, suffix="dc=br"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) What is wrong ?

2 1

Issues about replication
by Édnei Rodrigues 05 Aug '15

05 Aug '15

1 0

search with a wildcard works, with exactly matching string it doesn't
by Gregory House 05 Aug '15

05 Aug '15

Hi If I run a query against my directory with this filter: "(myDeviceId=ZZZ-07430.08.12345678*)" it returns a match showing precisely that myDeviceId = "ZZZ-07430.08.12345678" If I use this filter, without the wildcard and just the actual value "(myDeviceId=ZZZ-07430.08.12345678)" it returns no match. Even if I change the attribute value to something very simple like "x" I still need to include a wildcard in my filter to get any match. This works however: "(myDeviceId:caseExactMatch:=ZZZ-07430.08.12345678)" What gives here? The specific attribute is defined in the schema file as follows: attributetype ( 1.3.6.1.4.1.36200.255.0.17 NAME 'myDeviceId' DESC 'Identifies a device' SUP uid EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) I am no expert, but this makes no sense to me? I feel I am missing something, but what? I am using openldap on CentOS 6 and workign via command-line tools (e.g. ldapsearch). The backend is mdb if that matters. # rpm -qa | grep openldap openldap-clients-2.4.39-8.el6.x86_64 openldap-2.4.39-8.el6.x86_64 openldap-servers-2.4.39-8.el6.x86_64 Thanks for any ideas/suggestions. Best, GH

2 2

question on write transaction
by Shu, Xinxin 04 Aug '15

04 Aug '15

Hi list, recently I wrote app on LMDB, found that for every write , lmdb lock a global lock when transaction is created , and release this lock in mdb_txn_commit, on Ubuntu, this lock is implemented by pthread_mutext_t. in my app, I create write transaction in a thread, then commit this write transaction in another thread, since lmdb use pthread_mutex_unlock to release this lock, according to manual , attempting to unlock the mutex if it was not locked by the calling thread results in undefined behavior, then my app cannot create write transaction . So does this issue known to community or is there any way to work around? Cheers, xinxin

2 2

I want to use memberof overlay but I do not have a clue on how to even look at it.
by Eliezer Croitoru 01 Aug '15

01 Aug '15

I want to use memberof overlay but I do not have a clue on how to even look at it. I have tried to use this: http://www.schenkels.nl/2013/03/how-to-setup-openldap-with-memberof-overlay… which kind of worked and it has added something to my database. Now I have tried to run some search but either I am doing something wrong or the memberof is not loaded. So first, how do check that it is loaded? I was thinking about : ldapsearch -x -H ldap:/// -b cn=module but again I am unsure since it won't give results. I am trying to use memberof for squid to match a group membership. Any hints? directions to understand? I understand the basics of LDAP but this is something above basic LDAP. Thanks, Eliezer

2 1

Increasing memory usage on successive LMDB reads
by Rohit Girdhar 31 Jul '15

31 Jul '15

Hi I'm using LMDB (original C interface) to store and read some data. However, I notice that my resident memory usage (RES in `htop`) keeps rising with each call to mdb_get with unique keys. It does not change if I do a repeated call to mdb_get with a key I've used before. It looks like mdb_get is caching the reads, but I want to make sure what effect it is really having on my system. Is there some way to limit the amount of memory lmdb can use for this? Or is it something strange and should not be happening? Thanks Rohit

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical