openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

ldap_result timeout not working?
by Ilja Maki 17 Sep '15

17 Sep '15

Hi, What am I missing as the ldap_result function does not seem to care at all about the timeout value given to it? I would need polling behavior and I have tried to give it a timeval of zero, 2 seconds and other small values but often it does not return until over a minute has passed. I have also tried to call ldap_set_option( m_ldap, LDAP_OPT_TIMEOUT, &timeout ) first where the timeout has been zero, 2 seconds etc. but it does not have any effect either. Sometimes ldap_result takes very long also after a call to ldap_simple_bind but usually this happens after a call to ldap_search_ext. Also abandoning a lengthy ldap_result operation is not an option as ldap_result will throw an access violation if it is given an abandoned message identifier. And without access to the internals of the ldap library I cannot synchronize the abandoning so that it would take place only after ldap_result has proceeded so far that it is ok for it to abandon the identifier. My code used OpenLDAP version 1.168.2.16 where this issue occurred, then I upgraded it to version 2.4.42 to see if it behaves differently (with #define LDAP_DEPRECATED 1 for now for simplicity) but the same issue seems to be there. I am developing and testing with Windows 8.1 but the same issue is also at least in Mac OS. Any help will be greatly appreciated. Thanks! - Ilja -- Learn why you should attend BroadSoft Connections 2015 <http://www.broadsoftconnections.com> This email is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient and have received this email in error, please notify BroadSoft, Inc. immediately by replying to this message, and destroy all copies of this message, along with any attachment, prior to reading, distributing or copying it.

1 0

Strange aliases behavior
by Karol Chrapek 17 Sep '15

17 Sep '15

I have a problem with Slapd and Alias dereferencing. In the ldap we have created a special subtree that allocate logical structure for our application. For this purpose we use the aliases. They allow us in one subtree have normal structure used by our internal services and for second subtree has a dedicate logical structure for special apps. Currently we tested different version of ldap: - 2.4.28 with HDB - 2.4.31 with HDB and MBD - 2.4.41 with mdb - 2.4.42 with MDB <--- this version we are currently using On all version the dereferencing aliases is works very fast when we have about 2000 aliases and about 200000 entries in the Database. When we add additional 2000 aliases each search with aliases dereferencing hangs for 3 second. When we add additional 2000 (so 6000 alieases in DB) the search time increase for next 3 seconds. I.E. search time for filter objectclass=user with -a always for: -2000 aliases in DB is about 0,031s -4000 aliases in DB is about 3,031s -6000 aliases in DB is about 6,123s And this search time was increase even if we add additional 2000 aliases outside the search base dn. We observed that during this 3, 6 second hangs one CPU core is about 100%, system does not wait for resources, memory is on the same level. In the log I saw that slapd very fast dereferencing all aliases in subtree, hang for 3,6,9 seconds depends of aliases count and after that I saw: mdb_dn2entry("cn=.....") Sep 4 14:53:50 ds1 slapd[4280]: => mdb_dn2id("cn=....") Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_dn2id: got id=0x231 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_entry_decode: Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_entry_decode Sep 4 14:53:50 ds1 slapd[4280]: => mdb_filter_candidates Sep 4 14:53:50 ds1 slapd[4280]: #011OR Sep 4 14:53:50 ds1 slapd[4280]: => mdb_list_candidates 0xa1 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_filter_candidates Sep 4 14:53:50 ds1 slapd[4280]: #011EQUALITY Sep 4 14:53:50 ds1 slapd[4280]: => mdb_equality_candidates (objectClass) Sep 4 14:53:50 ds1 slapd[4280]: => key_read Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_index_read: failed (-30798) Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_equality_candidates: id=0, first=0, last=0 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_filter_candidates: id=0 first=0 last=0 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_filter_candidates Sep 4 14:53:50 ds1 slapd[4280]: #011EQUALITY Sep 4 14:53:50 ds1 slapd[4280]: => mdb_equality_candidates (objectClass) Sep 4 14:53:50 ds1 slapd[4280]: => key_read Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_index_read 3585 candidates Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_equality_candidates: id=3585, first=18960, last=239706 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_filter_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_list_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_filter_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: mdb_search_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_entry_decode: Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_entry_decode Sep 4 14:53:50 ds1 slapd[4280]: => test_filter Sep 4 14:53:50 ds1 slapd[4280]: EQUALITY Sep 4 14:53:50 ds1 slapd[4280]: => access_allowed: search access to "cn......." "objectClass" requested Sep 4 14:53:50 ds1 slapd[4280]: <= root access granted After that ldap start return object that is also very fast. When the query was finished I saw in log this info: Sep 4 14:53:50 ds1 slapd[4280]: mdb_search: 18985 scope not okay Sep 4 14:53:50 ds1 slapd[4280]: mdb_search: 18986 scope not okay All other query that not derf. aliases are processed very fast. Search time about 32k entries in subtree without aliases is about 0,526s. Our server DB and indexing settings: maxsize 10737418240 checkpoint 1024 10 sizelimit 100000 maxderefdepth 2 searchstack 10 index accountid eq index objectClass eq index cn eq index id eq index name eq index entryCSN eq index entryUUID eq Do you have any idea how we can tune search with aliases? Regards Karol

3 3

OpenLDAP wildcard searches.
by Michael 16 Sep '15

16 Sep '15

Hello all, I've come across an issue where java developers using one of our LDAP environments want to be able to do wildcard searches on non-standard LDAP attributes. They are using a custom schema in the LDAP environment which contains the following attributes for example. retailerId:jurisdictionID: They want to be able to perform the following search filter to pull all entries with 21 as the jurisdictionID and any wildcard for the retailerID. '(&(retailerId=*)(jurisdictionID=21))' works as expected but of course this returns all objects with any retailerID. They would like to narrow the search results using the filters below. Is there something that needs to be added to the custom schema to allow this to work like it does for the standard LDAP attributes like cn,sn,mail etc? '(&(retailerId=177*)(jurisdictionID=21))' returns zero results'(&(retailerId=*389)(jurisdictionID=21))' returns zero results'(&(retailerId=1*389)(jurisdictionID=21))' returns zero results

5 9

Configuring OpenLDAP server with Linux groups information
by JC 15 Sep '15

15 Sep '15

I have a CentOS system where authentication over the SSH interface is delegated to an OpenLDAP server by means of PAM. This works fine. However, when the authentication succeeds, I would like for the OpenLDAP server to send back group information as well to the CentOS system. That is, the OpenLDAP server should send back a list of groups that the authenticated user will belong to when a shell is created for it in the CentOS box. This information should supersede what groups information local to the CentOS box. I have an LDAP schema in the OpenLDAP server system that almost achieves what I want - but not quite. In the CentOS system I currently have a file named mysite.ldif with the following contents: # extended LDIF## LDAPv3# base <dc=mysite,dc=com> with scope subtree# filter: (objectclass=*)# requesting: ALL# # mysite.comdn: dc=mysite,dc=comobjectClass: topobjectClass: dcObjectobjectClass: organizationo: MySitedc: mysite # People, mysite.comdn: ou=People,dc=mysite,dc=comou: PeopleobjectClass: organizationalUnit # Group, mysite.comdn: ou=Group,dc=mysite,dc=comou: GroupobjectClass: organizationalUnit # firstgroup, Group, mysite.comdn: cn=firstgroup,ou=Group,dc=mysite,dc=comobjectClass: posixGroupobjectClass: topcn: onegroupuserPassword:: e2NyeXB0fXg=gidNumber: 1001memberUid: FirstUsermemberUid: SecondUser # secondgroup, Group, mysite.comdn: cn=secondgroup,ou=Group,dc=mysite,dc=comobjectClass: posixGroupobjectClass: topcn: twogroupuserPassword:: e2NyeXB0fXg=gidNumber: 1002memberUid: FirstUser # FirstUser, People, mysite.comdn: uid=FirstUser,ou=People,dc=mysite,dc=comuid: FirstUsercn: FirstUserobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountshadowLastChange: 14250shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 1014gidNumber: 1014homeDirectory: /home/FirstUsergecos: ,,,userPassword:: TXlQYXNzd29yZAo= # SecondUser, People, mysite.comdn: uid=SecondUser,ou=People,dc=mysite,dc=comuid: SecondUsercn: SecondUserobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountshadowLastChange: 14002shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 1005gidNumber: 1005homeDirectory: /home/SecondUsergecos: ,,,userPassword:: T3RoZXJQYXNzd29yZAo= After starting my OpenLDAP server, I load this information into the OpenLDAP server's database with ldapadd -D uid=root,ou=People,dc=mysite,dc=com -x -w ThePassword -f mysite.ldif Now assuming that LDAP authentication is enabled in the Linux server, and that PAM in this system will delegate its authentication to the OpenLDAP server above, the authentication works fine (assuming the correct password is entered, of course) but the groups information does not seem to be extracted correctly. After successfully logging in as users FirstUser, if from the command line I invoke groups FirstUser I get the following output: FirstUser : user onegroup onegroup twogroup twogroup I do not understand why 'onegroup' and 'twogroup' are repeated. For completeness, the /etc/nsswitch.conf file in the CentOS system contains (among other things) the following line: group: ldap [SUCCESS=return] files Any feedback on this issue will be welcome. It should be clear by now that I am not, by any means, an expert on things LDAP; my apologies if I am doing something stupid or misguided.

2 1

Re: ldapmodrdn accented characters with windows client
by Michael Ströder 14 Sep '15

14 Sep '15

LAROCHETTE Philippe wrote: > i don't know if it is a utf8 problem because i make several tests with some utf8 conversion with notepad++ of the .bat script file or of the ldiff file and nothing work exept the replacement of the character by the escape sequence \c3\a9 > > The problem is the same in windows Seven... > > The application is an access process that produce some ldif files that are launched with a .bat file, a solution is to move the script process of the ldif files on the linux plateform but other process are managed with windows server planified tasks.. but it is a solution... > > I found a solution, it's working if i use ldapmodify with -f and use "newrdn" and "new superior" in the ldif file... i encode the ldif file in UTF-8 without BOM > > Thank you for the idea of iconv, i try the same thing with notepad++ and now it's working, the problem was the difference between UTF8 withous BOM and UTF8 for the encoding. > > UTF8 without BOM it's ok but the native format UTF8 of the basic windows notepad don't work. The best solution for such issues is not to muck around with command-line tools but to use a full-blown scripting language with a decent LDAP module. Ciao, Michael.

1 0

OpenLDAP error - ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by Varadi, Louis - 0442 - MITLL 14 Sep '15

14 Sep '15

Hello, I am new to OpenLDAP and could please use your help. I just created a brand new install of the latest OpenLDAP server - openldap-ltb.x86_64 0:2.4.42-1.el6 on Centos 6.7 There are no entries in the bdb database as this is a new install. I am getting the error when running to following command. ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) # ldapsearch -x -d 1 -LLL ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect errno: 111 ldap_close_socket: 3 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect errno: 110 ldap_close_socket: 3 ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Any help would be greatly appreciated. I came up very short with my google searches. Thank you - Lou

3 4

uniqueness unique_uri specification help
by Peter Heinemann 14 Sep '15

14 Sep '15

Good Day, openldap 2.4.39 RHEL 6.5 Working with an ldap implementation that builds the dit from scratch daily using extracts from an RDBMS. The nature of the source data/tables and the code that creates the extracts builds an ldif (imported via slapadd) that has some multi-value attributes, specifically cn, sn, and givenName because the RDBMS does no case checking. Stanzas like this can occur in the ldif: dn: uid=aperson,ou=people,dc=school,dc=edu cn: Andrew Person cn: ANDREW PERSON sn: Person sn: PERSON givenName: Andrew givenName: ANDREW and slapadd will happily write them all, but ldapmodify etc. can (and do) return errors when encountering these entries. What I'd like to do is use ldapadd under the uniqueness overlay instead of slapadd. But I'm unsure of the specific syntax for the unique_uri specification so that that cn, sn, and givenName attributes are unique under/in each DN. Most of the examples I've found are how to enforce uniqueness over an entire branch. Still reading the specifics about uri specification but would appreciate any assistance. Peter

2 1

Building OpenLDAP for Windows
by Ilja Maki 13 Sep '15

13 Sep '15

Hi, I have googled and browsed your mailing list archives for instructions on how to build OpenLDAP for Windows but haven’t found any up-to-date information on it. Is such a thing still supported? I found out that at least Visual Studio workspace files were dropped away some years and versions ago. I would need an OpenLDAP lib that can be linked by Visual Studio 2013 (and probably by later VS versions in the future). I have Windows 8.1, Cygwin 1.7.35(0.287/5/3) and MinGW. I have tried to do according to this: http://www.openldap.org/faq/data/cache/897.html but ran into issues already in the ./configure phase (btw, it says “WARNING: unrecognized options: --disable-slurpd”). The final error in running that is this: configure: error: select() required. I’m not familiar with Unixes but Google told me that select() is a native Unix command. Is that correct and if so, what should I do with a Windows machine to handle that? Or should I do the whole building task according to some completely different instructions? I need only the client side of OpenLDAP. Thanks for any help in advance! Ps. Just in case it matters, this is the corresponding part extracted from my config.log: | /* Override any GCC internal prototype to avoid an error. | Use char because int might match the return type of a GCC | builtin and then its argument prototype would still apply. */ | #ifdef __cplusplus | extern "C" | #endif | char select (); | /* The GNU C library defines this for functions which it implements | to always fail with ENOSYS. Some functions are actually named | something starting with __ and the normal name is an alias. */ | #if defined __stub_select || defined __stub___select | choke me | #endif | | int | main () | { | return select (); | ; | return 0; | } configure:14150: result: no configure:14154: error: select() required. -- Learn why you should attend BroadSoft Connections 2015 <http://www.broadsoftconnections.com> This email is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient and have received this email in error, please notify BroadSoft, Inc. immediately by replying to this message, and destroy all copies of this message, along with any attachment, prior to reading, distributing or copying it.

4 5

Re: send_search_entry: conn xxx ber write failed
by Édnei Rodrigues 10 Sep '15

10 Sep '15

Hey Quanah, thank you for your answer. I will ask to application team to update openldap client. Regards. Em 10/09/2015 15:19, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, September 10, 2015 1:04 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Good morning. How are you doing ? >> >> Guys, I have a application that do many connections to my ldap server and >> I am getting the error "send_search_entry: conn xxx ber write failed." >> and "(connection lost on write)". >> >> This error occur only with that application, but The noise is large, >> because this one is very importante. >> >> > So, Do this message mean a problem with my LDAP Server? Will I need >> deploy a other LDAP server and balance these connections ? >> > > IIRC, this generally occurs when a client has disconnected w/o telling the > server it has done so. I.e., this is caused by the client, not the server. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

2.4.42 RPMs for openSUSE
by Michael Ströder 10 Sep '15

10 Sep '15

HI! I've updated my OpenLDAP builds for openSUSE and SLES12 to release 2.4.42. Build status and files: <https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap…> Important note: If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. As usual I've tested the packages openSUSE Tumbleweed x86_64 and Factory_ARM on rasperry pi. The download repos are here: <http://download.opensuse.org/repositories/home:/stroeder:/branches:/network…> Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.2 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. Compared to stock SUSE packages there are two additional packages: 1. openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory: allop, allowed, autogroup, cloak, denyop, lastbind, noopsrch, nops, pw-sha2, pw-pbkdf2, smbk5pwd 2. openldap2-back-sock (see http://www.openldap.org/software/man.cgi?query=slapd-sock) Ciao, Michael.

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical