openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

0.9.16 build problems for android
by Kristoffer Sjögren 18 Aug '15

18 Aug '15

Hi This is a long shot. Just upgraded LMDB to 0.9.16 for lmdbjni (Java bindings for LMDB) and when building for android-ndk-r10e I get a build error complaing about undeclared PTHREAD_MUTEX_ROBUST [1]. The build procedure uses automake and is quite complex because of Java JNI bindings but maybe the build error/output rings a bell anyway? The build works fine with LMDB 0.9.15. Cheers, -Kristoffer [1] src/mdb.c:4636:49: error: 'PTHREAD_MUTEX_ROBUST' undeclared (first use in this function) [2] Full build output - http://pastebin.com/JwreP0dZ [3] agcc #!/bin/bash $NDK/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-gcc --sysroot=$NDK/platforms/android-19/arch-arm -DMDB_DSYNC=O_SYNC $@

2 2

Upgrading OpenLDAP from 2.4.39 to 2.4.41
by Brian Wright 17 Aug '15

17 Aug '15

We have a 2-way master production cluster actively running 2.4.39. We are wanting to upgrade to 2.4.41 (we haven't yet internally certified 42). What is the best practices around upgrading this cluster while keeping at least one of the servers online? Is it replication-safe to have one node on 2.4.39 and one on 2.4.41 for a short period? If not, I can temporarily comment out the syncrepl statements until both servers are on 2.4.41 and then reenable replication after both are upgraded. We can live with short inconsistency period between the servers during the upgrade of the servers until we can resume replication. Also, is the DB format fully compatible between these two versions or would it be better to reload the DB new from an LDIF backup on 2.4.41? Is there an upgrade doc somewhere that discusses these issues? Thanks. -- Signature *Brian Wright* *Sr. UNIX Systems Engineer * 901 Mariners Island Blvd Suite 200 San Mateo, CA 94404 USA *Email *brianw(a)marketo.com <mailto:brianw@marketo.com> *Phone *+1.650.539.3530** *****www.marketo.com <http://www.marketo.com/>* Marketo Logo

3 4

OpenLDAP proxy referral via SSL
by Declan O'Doherty 17 Aug '15

17 Aug '15

I am trying to set up an OpenLDAP server (2.40) on CentOS 6 that uses a proxy referral to another LDAP server (OpenDJ) , all via SSL/TLS The referral works if I do not use SSL but when I configure slapd.conf to require certs, I get an invalid password error: res_errno: 49, res_error: <Invalid password.>, res_matched: <> The proxy is configured to use SASL EXTERNAL binding but when connecting to the OpenDJ service, it binds anonymously: ldap_back_dobind_int: DN="<certificate DN>" without creds, binding anonymouslyldap_sasl_bind The same configuration works on Windows using OpenLDAP 2.38 Here is the configuration for the ldap backend in slapd.conf: database ldap suffix "ou=organization unit, o=organization" uri "ldaps://test.ldap.com:636/" chase-referrals yes idassert-bind bindmethod=sasl saslmech=EXTERNAL binddn="O=ORG,OU=ORGUNIT,C=US" tls_cacert="/path/to/ca cert.pem" tls_cert="/path/to/server cert.pem" tls_key="/path/to/server key.pem" tls_reqcert=demand mode=self Thank you

1 0

LMDB docs unavailable: 403
by Kristoffer Sjögren 17 Aug '15

17 Aug '15

Hi The link to the documentation for LMDB is broken. http://symas.com/mdb/doc Cheers, -Kristoffer

2 1

LMDB docs refresh?
by Arto Bendiken 17 Aug '15

17 Aug '15

Perhaps the generated Doxygen output at http://symas.com/mdb/doc/ might use a refresh for the latest LMDB release? The docs currently published there are 11 months old, and do not include e.g. any information on the recently-added mdb_txn_id() function--a good function to have, by the way. -- Arto Bendiken | @bendiken | http://ar.to

2 3

ACL to allow all but one OU
by Olaf Hopp 17 Aug '15

17 Aug '15

Hi listers, I have ~40 departments in several ou's and I need an ACL to allow access for one user to all but one OU. I do not want to forbid that ou in question and thus implicitly allowing all the others. I want to formulate this explicitly, so I can directly see what is allowed. Moreover the names of the ou's are very similar to each other, something like: ou=aaaa,dc=... ou=abaa,dc=... ou=bbaa,dc=... ou=bbbb,dc=... and suppose I want to disallow access to the ou=abaa. I ended up with two ACLs: the first one to forbid ou=abaa: access to dn.sub=ou=abaa,dc=.... \ attrs=entry by dn=uid=foo,dc=.... none by * break and then allowing access to all ou's with access to dn.regex=ou=[^,]+,dc=... \ attrs=.... by dn=uid=foo,dc=... by * break Is it possible to formulate this with just one ACL ? I tried something like "ou=!abaa" with just the second ACL but failed. Then I tried ou=[^a][^b][^a][^a] but this matches also the ou=bbbb to wich the uid=foo should have access. Thanks, Olaf -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT - Universität des Landes Baden-Württemberg und nationales Forschungszentrum in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

1 1

Replication speed and data sizing (mdb)
by Brian Wright 14 Aug '15

14 Aug '15

We are using 2.4.39. I realize there are newer versions available, but at the time when we started our LDAP project, this was the version available. We are testing n-way master replication along with a large number of records using lmdb. Here's the config: * 8 way replication with 8 nodes (each node having 7 other connections) * 50k records * Inserting the records into one cluster node to replicate to all the rest The problems obvserved: * Some nodes are faster at replication than others. In general, the time to complete replication is slower than expected. In my test environment I found that 50k records can take up to 2 hours for some nodes to complete. The fastest nodes complete in 1.5 hours. Because these records are brand new insertions, delta based replication wouldn't help here. * When the replication is completed, some of the data.mdb files are larger than others (sometimes by an order of magnitude). We would like to understand the reason behind these two problems above. First, the replication system seems unusually slow. Second, we need to understand why the data.mdb file grows sometimes far larger on one node than the rest of the nodes. For example, in our production environment, while most nodes were around 1GB in data size, one node stored in excess of 40GB in data.mdb. In my testing lab, my the 50k record insertion left most nodes with a data.mdb size of 150MB. On one of the nodes, the data size was 262MB. Note that I've also tried alternative replication connectivity approaches to attempt to reduce the number of connections per server, but that did not improve replication performance or the varying data sizes in the end. If updating to a newer version helps resolve the above observed problems, please let me know. Any tuning or debugging advice here would be appreciated. Thanks. -- Signature *Brian Wright* *Sr. UNIX Systems Engineer * 901 Mariners Island Blvd Suite 200 San Mateo, CA 94404 USA *Email *brianw(a)marketo.com <mailto:brianw@marketo.com> *Phone *+1.650.539.3530** *****www.marketo.com <http://www.marketo.com/>* Marketo Logo

4 6

Adding Members to Groups
by Aneela Saleem 12 Aug '15

12 Aug '15

Hi all, I have used 'posixGroup' objectClass for creating groups, and 'posixAccount' object class for creating users, which uses 'gidNumber' property to associate to a specific group (created by posixGroup). I have to sync LDAP users/groups in Apache Ranger, that uses 'groupOfNames' object class and 'member/memberof' property in user object. But in 'groupOfNames' objectClass we have to add members at the time of creation of group. Is there any way that we can add members to already created groups later on?

4 6

Re: LDAP - Unix sync
by Mauricio Tavares 12 Aug '15

12 Aug '15

On Wed, Aug 12, 2015 at 11:31 AM, Aneela Saleem <aneela(a)platalytics.com> wrote: > Yes ldap works. and running ssh in verbose mode gives i.e., ssh -v > admin(a)127.0.0.1 > > OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: /etc/ssh/ssh_config line 19: Applying options for * > debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22. > debug1: Connection established. > debug1: permanently_set_uid: 0/0 > debug1: identity file /root/.ssh/id_rsa type 1 > debug1: identity file /root/.ssh/id_rsa-cert type -1 > debug1: identity file /root/.ssh/id_dsa type 2 > debug1: identity file /root/.ssh/id_dsa-cert type -1 > debug1: identity file /root/.ssh/id_ecdsa type -1 > debug1: identity file /root/.ssh/id_ecdsa-cert type -1 > debug1: identity file /root/.ssh/id_ed25519 type -1 > debug1: identity file /root/.ssh/id_ed25519-cert type -1 > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 > debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 > Ubuntu-2ubuntu2 > debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat > 0x04000000 > debug1: SSH2_MSG_KEXINIT sent > debug1: SSH2_MSG_KEXINIT received > debug1: kex: server->client aes128-ctr hmac-md5-etm(a)openssh.com none > debug1: kex: client->server aes128-ctr hmac-md5-etm(a)openssh.com none > debug1: sending SSH2_MSG_KEX_ECDH_INIT > debug1: expecting SSH2_MSG_KEX_ECDH_REPLY > debug1: Server host key: ECDSA > 8e:24:39:c6:46:e1:03:31:b9:bb:7a:d4:89:16:72:6b > debug1: Host '127.0.0.1' is known and matches the ECDSA host key. > debug1: Found key in /root/.ssh/known_hosts:8 > debug1: ssh_ecdsa_verify: signature correct > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug1: SSH2_MSG_NEWKEYS received > debug1: Roaming not allowed by server > debug1: SSH2_MSG_SERVICE_REQUEST sent > debug1: SSH2_MSG_SERVICE_ACCEPT received > debug1: Authentications that can continue: publickey,password Poor ssh in the machine you are connecting to is completely oblivious to ldap. As of now it only knows about publickey and password. Try setting up sshd to use pam and then get ldap from there > debug1: Next authentication method: publickey > debug1: Offering RSA public key: /root/.ssh/id_rsa > debug1: Authentications that can continue: publickey,password > debug1: Offering DSA public key: /root/.ssh/id_dsa > debug1: Authentications that can continue: publickey,password > debug1: Trying private key: /root/.ssh/id_ecdsa > debug1: Trying private key: /root/.ssh/id_ed25519 > debug1: Next authentication method: password > admin(a)127.0.0.1's password: > debug1: Authentications that can continue: publickey,password > Permission denied, please try again. > admin(a)127.0.0.1's password: > > > On Wed, Aug 12, 2015 at 7:56 PM, Mauricio Tavares <raubvogel(a)gmail.com> > wrote: >> >> On Wed, Aug 12, 2015 at 10:37 AM, Aneela Saleem <aneela(a)platalytics.com> >> wrote: >> > Hi Aaron! >> > >> > Actually i'm trying to login LDAP users as local users from command >> > line. >> > >> > I have followed this guide but unable to perform 'ssh' >> > >> I think we need more than "unable to perform 'ssh'." Have you >> done the usual stuff like ssh in verbose mode and check the logs? Have >> you checked that ldap works in said machine? >> >> > On Wed, Aug 12, 2015 at 7:23 PM, Aaron Richton >> > <richton(a)nbcs.rutgers.edu> >> > wrote: >> >> >> >> On Wed, 12 Aug 2015, Aneela Saleem wrote: >> >> >> >>> Hi all, Can anyone please tell me how can i pull users from LDAP >> >>> server >> >>> and treat them as local users? So that i can login as an ldap user and >> >>> test >> >>> whether particular user have permissions to particular HDFS commands >> >>> or not. >> >> >> >> >> >> I'm not sure what you're referring to by "pull." In a typical *ix >> >> setup, >> >> you'd configure the system name services and/or authentication services >> >> to >> >> include an LDAP backend. >> >> >> >> The precise details and options depend on the exact flavor of the >> >> system >> >> you're using. nss_ldap, nss-pam-ldapd, and nssov are likely candidates >> >> on >> >> the name service side; nss-pam-ldapd also provides a pam_ldap on the >> >> authentication side. But again, this is somewhat system-dependent (no >> >> NSS on >> >> OS X/Darwin, for example). >> >> >> >> For nssov, see the LDAPCon paper >> >> http://ldapcon.org/2011/downloads/cheng-paper.pdf for starters. >> >> >> > > >

1 0

LDAP - Unix sync
by Aneela Saleem 12 Aug '15

12 Aug '15

Hi all, Can anyone please tell me how can i pull users from LDAP server and treat them as local users? So that i can login as an ldap user and test whether particular user have permissions to particular HDFS commands or not.

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical