openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

All entries belong to the top object class?
by dE 28 Apr '15

28 Apr '15

As per https://tools.ietf.org/html/rfc4512#section-3.3 When creating an entry or adding an 'objectClass' value to an entry, all superclasses of the named classes SHALL be implicitly added as well if not already present. That means the top object class will always be there. Or is it that only the most subordinate object class in the multivalued attribute is considered by the client and server?

6 11

uidNumber=4294967295 is being appearing in the log frequently
by Majid Khan 28 Apr '15

28 Apr '15

Dear Techies, I'm not sure if this is the right forum to discuss this but I am getting the following from some of the clients machine I'm not sure why some of them sending this info otherwise my authentication and login all is working fine but I'm concern why its happening and my log is full of the following kind of message: If this is not the right forum then I apologies and please direct me to that right group: Apr 28 05:58:44 server1 slapd[23003]: conn=5235 op=22 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(&(uidNumber=4294967295)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"Apr 28 05:58:44 server1 slapd[23003]: conn=5235 op=22 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap Server info: CentOS release 6.6LDAP version: openldap-2.4.40 Client info: CentOS release 6.2Client using SSSD: sssd-1.11.6 Thanks. Best regards, Majid.

2 2

top object class contains all possible attributes?
by dE 28 Apr '15

28 Apr '15

From https://tools.ietf.org/html/rfc4512 it can be said that an object class inherits the sets of *allowed* and required attributes from its superclasses Therefore the top object class contains all possible attributes? OR A subclasses cannot contain any attribute which is not included in it's superclass? I'm running Apache directory studio, and I don't see that happening.

4 4

Re: All entries belong to the top object class?
by dE 28 Apr '15

28 Apr '15

On 04/20/15 22:56, Michael Ströder wrote: > dE wrote: >> Does adding of the top object class (or >> person) add all attributes to the entry? > > Nope. Which text in RFC 4512 leads to your presumption? > > Ciao, Michael. > > Sorry for the late response. I was out of town. From the responses, it appears the question has not been understood correctly, I what I meant to ask was -- Does adding of the top object class (implicitly) make it possible to add all attributes in the DIT to the entry? I'm talking about attributes which are out of the 'MAY' in the most subordinate object class the entry belong to.

7 15

LMDB:Transaction across multiple enviroments
by Daniel, Sabu 28 Apr '15

28 Apr '15

Hi, I am trying to use LMDB and I would like to know if there a way to define a transaction across multiple environments? Thanks, Sabu Daniel

2 1

separate loglevels for different databases?
by Meike Stone 27 Apr '15

27 Apr '15

Hello, I've configured two different databases (one ldap, one bdb) in openLDAP. Is it possible, to configure separate loglevels for each database? Thanks Meike

3 4

LMDB space amplification
by Shu, Xinxin 26 Apr '15

26 Apr '15

Hi list, Recently I have integrated lmdb into ceph , got intial results , I dump all records of lmdb, there are several different size key-value pairs, 1. key size : 45 byte, value size = 124 byte 2. key size : 85 byte, value size = 1187 byte 3. key size : 57 byte, value size = 135 byte 4. key size : 64 byte, value size = 182 byte 5. key size : 33 byte, value size = 4096 byte (used for real data, about 80 %) this db contains about ~ 10000000 records, about 80 percent of records are the last key-value pairs (key size 33 byte, value size 4096 byte), I calculate size of all key-value pairs, about 33GB , but on-disk size is about 63GB, so space amplification is ~ 2, is this amplification reasonable ? In which situation can lmdb get such large space amplification? How can I reduce this amplification? If you need any other details , please email me , any tips will be appreciate. Cheers, xinxin

2 3

[WIP] WiredTiger Backend
by HAMANO Tsukasa 26 Apr '15

26 Apr '15

Hi, I'm writing OpenLDAP WiredTiger backend. It will get high write throughput and high concurrency performance. Now this backend module is incomplete but basic feature is working, So I publish the code. https://www.osstech.co.jp/download/hamano/openldap/0001-OpenLDAP-WiredTiger… Some note: * slapadd, slapcat, slapindex will works. * LDAP BIND, ADD, DELETE, SEARCH will works. * MODIFY, MODRDN does not implement yet. * deref search does not implement yet. * WiredTiger is not support multiprocess access yet. It mean that we can't to do slatcat while running slapd. It will be supported in the future. * This backend module may have a issue about licensing when distributing whole binary under OpenLDAP Public Licence. Now WiredTiger, Inc are working cooperatively toward a resolve the issue. I'm glad if you get to try it and give me advice. Thank you. -- Open Source Solution Technology Corporation HAMANO Tsukasa <hamano(a)osstech.co.jp> fingerprint = 2285 2111 6D34 3816 3C2E A5B9 16BE D101 6069 BE55

2 1

modifying cn=config with ldapmodify
by Robert Munn 26 Apr '15

26 Apr '15

I have been trying to replace the SSL cert settings on my OpenLDAP instance running on Ubuntu using ldapmodify. I followed directions on the Ubuntu wiki: https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-tls using a modified ldif file for the replace: dn: cn=config changetype: modify replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem When it didn’t work on my existing instance I built a new instance in a new Ubuntu VM (14.04) and tried the original directions from Ubuntu. That did not work either. The ldapmodify command executes correctly but it seems that the change is not registered by the server. This is the case in both the new instance and the old instance of OpenLDAP. I ended up replacing the values (or adding them in the new instance) in the /etc/ldap/slapd.d/cn=config.ldif file manually. Making the changes manually and restarting slapd works, but my understanding was that changes to cn=config should be made through ldapmodify. I also found a tech note at CentOS: https://www.centos.org/docs/5/html/CDS/cli/8.0/Configuration_Command_File_R… in section 2.2.2.2 that indicates changes to cn=config will be ignored: "If an attribute is added to cn=config, the server ignores it." So am I mistaken? Do I need to do something different? I would prefer to manage the config with ldapmodify, but since I don’t change cn=config that often, I can change it manually. Robert

2 1

EXOP patches for PHP LDAP module
by Emmanuel Dreyfus 25 Apr '15

25 Apr '15

Hello For whoever is interested, I updated Pierangelo Masarati's patch to support EXOP in PHP LDAP module. Patches for PHP 5.4, 5.5 and 5.6 can be found here: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/databases/php-ldap/files/ Previous patch for PHP 5.3 and PHP 5.2 is in the Attic. -- Emmanuel Dreyfus manu(a)netbsd.org

3 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical