openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

nssov not working after upgrading nss-pam-ldapd
by btb＠bitrate.net 18 Mar '15

18 Mar '15

i use the nss and pam stub libraries from nss-pam-ldapd [no nslcd] with nssov. i've just upgraded nss-pam-ldapd from 0.8.13 to 0.9.4. at the moment, i'm using openldap version 2.4.31. after upgrading nss-pam-ldapd, nss and pam stopped working with ldap, and i see this in slapd's debug log: 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 13r54acaf72 54acaf72 daemon: read active on 13 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 connection_get(13) 54acaf72 connection_get(13): got connid=0 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 nssov: connection from uid=0 gid=0 54acaf72 nssov: wrong nslcd version id (33554432) how can i find out what nslcd version id is required, and what version is present in each of the components? thanks -ben

3 5

Update custom schema
by Gremaud Cyrill 17 Mar '15

17 Mar '15

Hello everybody. I have an openldap 2.4+ and I added a custom schema. In my ldap I have a lot of entries which use this schema. I just want to know how can add fields (update) to this schema ? My first idea is to create a new ldif file containing the new schema description, stopping the server, removing the old schema and replace it by the new one and then try to restart the server but I don't know if there is a better way to do this. Thanks you very much for your help. Cyrill Gremaud

2 2

LMDB sequential read from a ">>RAM" database caffe use case
by Brian 16 Mar '15

16 Mar '15

Hi, all I am a caffe user. In my use case, I am reading from a ~300GB lmdb sequentially, reading one element and never accessing again until I read every other element in the db and loops around again. It seems that lmdb will page cache every element. This becomes a problem as the dataset is read in fairly fast and it takes 1 hour before nearly 60% of the RAM is devoted to my lmdb page caches. Then it runs out of unmapped memory to use, so it starts kicking out the page frames of processes of other users, many of which have not been accessed in the last hour. So the system will prefer to kick out those page frames instead of page frames mapped at the beginning of the run. This behavior is entirely understandable but it causes extremely severe thrashing and unresponsive system, as those page frames of other user's comes into use very soon. Does my diagnosis of the situation seem reasonable? As many of our caffe use case is a similar sequential read of a dataset much greater than available RAM, many other caffe users besides me reports a similar issue. They all report their system becoming unresponsive, presumably due to the same thrashing. "training is freezing for multiple hours" https://github.com/BVLC/caffe/issues/1412 "Caffe memory increases with time(iterations?)" https://github.com/BVLC/caffe/issues/1377 "Random freezes" https://github.com/BVLC/caffe/issues/1807 Is there some option that I missed that can inform lmdb that for a certain read-only transaction is going to be purely sequential, so it shouldn't bother to cache the already read elements? If not, is there a plan to include such a feature? Or is there an option I can limit the maximum memory a single lmdb transaction is going to use to cache? Or is there some other possible solution to this problem? ----- I have been using a hack based on this fork https://github.com/raingo/lmdb-fork/commit/091ff5e8be35c2f2336e37c0db4c392f… to avoid this issue. However, I would love to know if there is any less hacky way to solve this problem. ----- I have seen this thread http://www.openldap.org/lists/openldap-devel/201502/msg00052.html but it looks like it is for multiple readers. ----- Any advice on this will be much appreciated!

2 1

Question about ldap_search_ext_s and memory leak
by Jean-Marc Choulet 16 Mar '15

16 Mar '15

Hello, I have a little with this very simple program : #include <iostream> #include <stdlib.h> #define LDAP_DEPRECATED 1 #include <ldap.h> using namespace std; const char* server = "ldap://ldap.xxxx.fr"; const char* cacert_file = "cacert.pem"; const char* root_dn = "cn=replicator,ou=DSA,dc=xxxx,dc=fr"; const char* root_pw = "xxxx"; const char* aliased_people_dn ="ou=AliasedPeople,dc=xxxx,dc=fr"; int main(int argc, char *argv[]) { if (argc != 3) { cerr << "Usage: " << argv[0] << " username password" << endl; return 1; } LDAP *ld; int version = LDAP_VERSION3; int rc; if ((rc = ldap_initialize(&ld, server)) != LDAP_SUCCESS) { cerr << "ldap_initialize: " << server << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_OPT_SUCCESS) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, cacert_file)) != LDAP_OPT_SUCCESS ) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_start_tls_s(ld, NULL, NULL)) != LDAP_SUCCESS) { cerr << "ldap_start_tls_s error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_bind_s(ld, root_dn, root_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "ldap_bind_s: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } cout << "user replicator authenticated :)." << endl; LDAPMessage *pResult; struct berval cred; char *pDN; std::string filter("uid=" + string(argv[1])); rc = ldap_search_ext_s(ld, aliased_people_dn, LDAP_SCOPE_SUBTREE, filter.c_str(), NULL, 0, NULL, NULL, NULL, LDAP_NO_LIMIT, &pResult); if (rc != LDAP_SUCCESS) { cerr << "ldap_search_ext_s error: " << ldap_err2string(rc) << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } struct berval **vals; LDAPMessage *pEntry; string user_dn; if (ldap_count_entries(ld, pResult) == 1) { pEntry = ldap_first_entry(ld, pResult); pDN = ldap_get_dn(ld, pEntry); vals = ldap_get_values_len(ld, pEntry, "aliasedObjectName"); if (vals) { user_dn = vals[0]->bv_val; ldap_value_free_len(vals); } ldap_memfree(pDN); } else { cout << "aliasedObjectName attribute not found" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } ldap_memfree(pResult); if ((rc = ldap_bind_s(ld, user_dn.c_str(), argv[2], LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "user " << argv[1] << " not authenticated" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } cout << "user " << argv[1] << " (" << user_dn << ") authenticated" << endl; ldap_unbind_s(ld); return EXIT_SUCCESS; } My program works fine but, if I use valgrind, I have memory leaks : valgrind --leak-check=full ./ldapauth.exe toto secret ==13616== Memcheck, a memory error detector ==13616== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==13616== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==13616== Command: ./ldapauth.exe toto secret ==13616== user replicator authenticated :). user toto (uid=toto,ou=People,ou=17,dc=xxxx,dc=fr) authenticated ==13616== Warning: invalid file descriptor -1 in syscall write() ==13616== ==13616== HEAP SUMMARY: ==13616== in use at exit: 260,453 bytes in 1,157 blocks ==13616== total heap usage: 13,835 allocs, 12,678 frees, 2,138,249 bytes allocated ==13616== ==13616== 149 (56 direct, 93 indirect) bytes in 1 blocks are definitely lost in loss record 65 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E48687: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== 271 (80 direct, 191 indirect) bytes in 1 blocks are definitely lost in loss record 69 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x596D031: ber_alloc_t (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E5AA22: ldap_alloc_ber_with_options (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E48BB7: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== LEAK SUMMARY: ==13616== definitely lost: 136 bytes in 2 blocks ==13616== indirectly lost: 284 bytes in 3 blocks ==13616== possibly lost: 0 bytes in 0 blocks ==13616== still reachable: 260,033 bytes in 1,152 blocks ==13616== suppressed: 0 bytes in 0 blocks ==13616== Reachable blocks (those to which a pointer was found) are not shown. ==13616== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==13616== ==13616== For counts of detected and suppressed errors, rerun with: -v ==13616== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0) I don't understand why. Do you have a idea ? I work on Ubuntu 14.04. The OpenLDAP version is 2.4.31. Thanks, Jean-Marc.

2 2

How to use ldapsearch -Esync ?
by Thomas Cort 16 Mar '15

16 Mar '15

Hi, I'm writing a script that acts on changes in LDAP. I want it to watch the stream of changes, and if the script gets restarted, pick up where it left off. I'm hoping to just be able to pipe ldapsearch -Esync into an LDIF parser -- instead of using the C API. I can get all of the changes with the -Esync=ro option and stream the changes with -Esync=rp, but I can't seem to find the magic combination to pick up where it left off. I tried the command mentioned in the "Replication from OpenLDAP to Fedora 389 DS" thread[1], but no matter what cookie I use (the final control value either as a base64 string or decoded) I can't seem to get it to pick up where it left off. Is my understanding wrong or am I missing something? This is how I understand/expect it to work: ldapsearch ... -Esync=ro # get everything, plus a cookie at the end. # feed the cookie to the next command ldapsearch ... -Esync=ro/cookie # get everything since the last search Any help would be greatly appreciated. Thanks, Thomas [1] http://www.openldap.org/lists/openldap-technical/201402/msg00327.html

1 0

external authentication source
by Dieter Klünter 16 Mar '15

16 Mar '15

Hi, rfc-4422 describes an EXTERNAL mechanism. Is there any means of defining and configuring an external authentication and authorization source, like an external sasl server? Or is this just confined to the client to provide an appropriate authorization string? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 3

openldap mirror mode replication does the versions of client matter
by Rakesh Rajasekharan 14 Mar '15

14 Mar '15

Hi, I have set up mirror mode replication with both my masters running 2.4.39 version. I have around 1000 clients connecting. The versions of openldap on these clients varies from 2.3.43( thats really old I know) , 2.4.23 and few have 2.4.39. My problem is the ldap servers almost hangs or freezes when the clients start connecting. In the error logs , I see this pattern " conn=6005 fd=4199 closed (TLS negotiation failure " Is this something to do with the client versions and will upgrading help. I was skeptical as this is in production. One more question, In mirror mode is it ok to have more than 2 masters. Thanks, Rakesh

2 1

Is CA issued certificate using OpenSSL as good as GoDaddy
by jeevan kc 12 Mar '15

12 Mar '15

I followed the below OpenLDAP guide to create CA issued certificate using OpenSSL and was able to enable SSL in the ldap server and applications can connect via ldaps:// port 636. Now I have some questions from the management where this certificate is as safe as the commercial certificates out there. Can someone clarify this? I would appreciate it. I followed the same procedures mentioned in the guide. 4.2 CA Issued CertificateIf you have access to a trusted Certificate Authority (CA), then step through the CA process to get a CA certificate, server certificate and server private key. See section 5.0 for info on how to configure your server with these items.However, if a trusted CA is not available, OpenSSL makes the same process quick and easy.The steps: 1. Create any directory for creating and signing your certificates. For example, /var/myca.% mkdir /var/myca2. Change to /var/myca and run the OpenSSL CA script (in /usr/share/ssl/misc/ on my box):% cd /var/myca/ % /usr/share/ssl/misc/CA.sh -newca CA certificate filename (or enter to create) <enter> Making CA certificate ... Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..........................++++++ .........................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: <ca pass> Verifying password - Enter PEM pass phrase: <ca pass again> ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Unit Common Name (eg, YOUR name) []:example.com Email Address []:. %This creates demoCA/cacert.pem and demoCA/private/cakey.pem (CA cert and private key).3. Make your server certificate signing request (CSR):% openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..............++++++ ..........................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Org Unit Common Name (eg, YOUR name) []:myserver.com Email Address []:ldap@myserver.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: <pass> An optional company name []:. %The result is newreq.pem.4. Have the CA sign the CSR:% /usr/share/ssl/misc/CA.sh -sign Using configuration from /etc/ssl/openssl.cnf Enter PEM pass phrase: <ca pass> Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'US' stateOrProvinceName :PRINTABLE:'Texas' localityName :PRINTABLE:'Austin' organizationName :PRINTABLE:'Example Org' organizationalUnitName:PRINTABLE:'Example Org Unit' commonName :PRINTABLE:'myserver.com' emailAddress :IA5STRING:'ldap(a)myserver.com' Certificate is to be certified until Apr 10 18:58:58 2004 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Unit, CN=example.com Validity Not Before: Apr 11 18:58:58 2003 GMT Not After : Apr 10 18:58:58 2004 GMT Subject: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Org Unit, CN=myserver.com/Email=ldap@myserver.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): < ... > Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: D0:C0:9D:46:30:65:2A:9C:63:63:6A:E6:FE:E4:AC:F7:21:F8:33:61 X509v3 Authority Key Identifier: keyid:31:2E:0D:FB:A0:74:5A:0B:4B:C5:C4:E0:69:7F:32:6D:AF:46:82:F1 DirName:/C=US/ST=Texas/L=Austin/O=Example Org/OU=Example Unit/CN=example.com serial:00 Signature Algorithm: md5WithRSAEncryption < ... > -----BEGIN CERTIFICATE----- < ... > -----END CERTIFICATE----- Signed certificate is in newcert.pem %This creates newcert.pem (server certificate signed by CA) with private key, newreq.pem.5. Now the certificates can be moved to the desired certificate repository and renamed. I prefer /usr/var/openldap-data as my certificate directory.% cp demoCA/cacert.pem /usr/var/openldap-data/cacert.pem % mv newcert.pem /usr/var/openldap-data/servercrt.pem % mv newreq.pem /usr/var/openldap-data/serverkey.pem % chmod 400 /usr/var/openldap-data/serverkey.pem

3 2

Re: external authentication source
by Hallvard Breien Furuseth 12 Mar '15

12 Mar '15

On 12. mars 2015 14:13, Mattes wrote: > Wouldn't "lapwhoami -Y EXTERNAL -H ldapi://" be more usefull? Duh, right. (ldapwhoami) -- Hallvard

1 0

question about binding to our new openldap server
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just upgrade our OS system and installed the most recent openldap version: 2.4.4. I moved the config file and related openldap data files from older version 2.3.4 onto this new server. I can't make successful binding at this moment. The following is from the log file. Should I install the same version of openldap on this new box since I am trying to binding with old data file? Thank you all. Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 fd=10 ACCEPT from IP=130.*.*.*:61404 (IP=0.0.0.0:389) Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 BIND dn="" method=128 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 RESULT tag=97 err=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH attr=1.1 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH base="ou=Auth,o=csun" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 fd=13 ACCEPT from IP=130.*.*.*:62211 (IP=0.0.0.0:389) Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 op=1 UNBIND Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 fd=13 closed Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 fd=13 ACCEPT from IP=130.*.*.*:62213 (IP=0.0.0.0:389) Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 op=1 UNBIND Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 fd=13 closed Hui Wang CSUN IT department

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical