openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Errors building Current Git Version with windows
by Frank Offermanns 02 Feb '15

02 Feb '15

Hello, when building the current GIT Version 2.4.40 with Windows and MinGW/MSYS I get 3 errors: C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:116: undefined reference to `ftello' slapadd.o: In function `slapadd': C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:486: undefined reference to `ftello' libbackends.a(mdbmdb.o): In function `mdb_cursor_push': C:/msys/1.0/openldap-2.4.40git/servers/slapd/back-mdb/./../../../libraries/liblm db/mdb.c:4990: undefined reference to `GetFileSizeEx' collect2: ld returned 1 exit status make[2]: *** [slapd.exp] Error 1 Configure was: configure --prefix=/mingw --enable-accesslog --with-tls --enable-syncprov Regards, Frank

2 3

MatchingRuleUseDescription::APPLIES
by michael-catchall＠mail.stroeder.local (POP3) 31 Jan '15

31 Jan '15

HI! In yet another attempt to make more use of server's subschema in web2ldap I'm looking more closely at matchingRuleUse in OpenLDAP's subschema subentry. What's the base for the matchingRuleUse values generated by slapd? RFC 4512 is pretty terse on this: APPLIES provides a list of attribute types the matching rule applies to Ah, well... :-/ Basically I wonder why I can't use this filter and why caseIgnoreIA5SubstringsMatch is not listed as being applicable to krbPrincipalName: (krbPrincipalName:caseIgnoreIA5SubstringsMatch:=k/m*) Yes, I know: krbPrincipalName is correctly declared with EQUALITY caseExactIA5Match. But what's the reason you cannot override the equality matching with this extensible filter? Normalization issues when indexing? Ciao, Michael. [1] http://tools.ietf.org/html/rfc4512#section-4.1.4

1 0

Large Number of Transactions x Low performance
by Alessandro Lasmar Mourao 30 Jan '15

30 Jan '15

Hi, I work in a company that has 140,000 registered users in OpenLDAP. This OpenLDAP is used for authentication of our internal systems. In our tree of groups we have the systems and below the each system there are the groups' authorization (systems profiles). The user is bound in each group according to position, function and department in the company. When a user replaces another user hierarchically higher, this user is taken from the respective group (that he belonged) and registered in user_group with the highest hierarchy. This movement in the company is very common, and this is the cause of our problems. We have a group with 50,000 registered users, and when we need to delete a user of that group or add a new one, OpenLADP takes up to 6 minute to effect the transaction. We have a tool (BMC Identity Management (formerly Control-SA)) that automates the transactions, but due to delay in the transactions are with a row of 100,000 operations of insert / delete to perform. I wonder if you have any way to improve the performance of OpenLDAP for these write operations. The OpenLDAP version is 2.4.40. Thanks, Alessandro Lasmar Mourão Below is our slapd.conf: ############################################## serverID 2 idletimeout 0 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ldap.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap/ moduleload back_mdb moduleload back_monitor moduleload memberof moduleload ppolicy moduleload syncprov moduleload refint moduleload accesslog sizelimit 250 tool-threads 16 password-hash {SSHA} monitoring true TLSCACertificateFile /etc/ssl/certs/cacert.pem TLSCertificateFile /etc/ssl/certs/servercrt.pem TLSCertificateKeyFile /etc/ssl/certs/serverkey.pem backend mdb database config rootdn "cn=admin,cn=config" rootpw secret monitoring true database monitor rootdn "cn=admin,cn=monitor" rootpw secret monitoring true database mdb suffix "cn=accesslog" rootdn "cn=admin,cn=accesslog" rootpw secret maxsize 1073741824 monitoring true directory "/var/lib/ldap/intranet/log" index default eq,pres,sub index entryCSN eq,pres index objectClass,reqEnd eq,pres index reqResult,reqStart eq,pres limits dn.exact="uid=replication,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE access to * by dn.base="uid=replication,ou=Users,o=company" read by * break database mdb suffix "o=company" rootdn "cn=admin,o=company" rootpw secret maxsize 4294967296 monitoring true overlay ppolicy ppolicy_use_lockout ppolicy_hash_cleartext ppolicy_default "cn=default,ou=policy,o=company" overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true overlay refint refint_attributes uniqueMember overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 limits dn.exact="uid=replication01,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication02,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication03,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication04,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-checkpoint 1000 20 syncprov-sessionlog 10000 syncrepl rid=100 provider=ldap://10.192.184.195:389 searchbase="o=company" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=simple binddn="uid=replication01,ou=Users,o=company" credentials=secret mirrormode true directory "/var/lib/ldap/intranet" directory "/var/lib/ldap/intranet" index objectClass eq,pres index uniqueMember,memberof eq,pres index nu-cpf,nu-cnpj eq,pres index dt-nascimento pres index entryUUID,entryCSN eq,pres index uid,ou,cn,sn,mail eq,pres,sub index default,givenname eq,pres,sub lastmod on checkpoint 1024 10 access to attrs=userPassword,shadowLastChange by dn="cn=admin,o=company" write by dn.exact="uid=replica01,ou=Users,o=company" read by dn.exact="uid=replica02,ou=Users,o=company" read by dn.exact="uid=replica03,ou=Users,o=company" read by dn.exact="uid=replica04,ou=Users,o=company" read by anonymous auth by self write by * none access to * by dn="cn=admin,o=company" write by * read

3 4

LMDB memory location on Android
by Kristoffer Sjögren 30 Jan '15

30 Jan '15

Hi LMDB JNI is a Java wrapper ontop of LMDB which runs on Linux, OSX, Windows and Android (arm-linux-androideabi-4.9 x86_64). At the moment the Android implementation rely on buffer copies and we're trying to implement zero copy using memory addresses provided by LMDB. Zero copy is already working on Linux, OSX and Windows but is not as straight forward on Android since the memory addresses are handled differently? We try to use the memory address of a direct ByteBuffer and hand it over to LMDB (exactly how the PC version works) but something is wrong. The full discussion and code on this can be found here. https://github.com/deephacks/lmdbjni/issues/21 I would greatly appreciate any tips on what might be wrong. Cheers, -Kristoffer

1 0

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema.
by Abhishek koserwal 30 Jan '15

30 Jan '15

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema. Creating new entries on basis of customized schema added into phpldapadmin. Regards Abhishek Koserwal Final year, CSE, IET-DAVV The capacity to learn is a gift; The ability to learn is a skill; The willingness to learn is a choice -- Brian Herbert

2 1

LMDB usage on windows - to much memory needed
by Frank Offermanns 29 Jan '15

29 Jan '15

Hello, we would like to change our backend from hdb to mdb. I did some initial tests and found out the following: When setting maxsize to 1.4 GB, the size of the database on the file system is about 1.4 GB. I thought I read that the maxsize has nothing to do with the actual physical size needed. (If I have only 10 MB of data my database should be about 10 MB). Even worse is the fact, that slapd.exe then needs about 1.5 GB virtual size memory. And if I use 32 Bit slapd.exe the process will crash when reaching 2 GB virtual size. (as every 32 bit process will do) Now my conclusion is, that the things described in the mdb paper are only valid for unix/linux, because windows uses another memory system. Is this correct? Or is there a way I haven't found to configure OpenLDAP on windows so that it does not need so much RAM. The size on the disk does not matter for us, but since we use only 32 bit slapd.exe the RAM does matter. Best regards, Frank

4 5

LDAPCon 2015 Call for Papers
by Andrew Findlay 29 Jan '15

29 Jan '15

LDAPCon 2015 ============ The fifth International Conference on LDAP and Directory Services will be held in the UK at the University of Edinburgh School of Informatics Forum. Tutorials: 11th November 2015 Conference: 12th and 13th November 2015 Call for papers and tutorials ============================= Topics You are using LDAP in interesting projects? You do LDAP client or server development? You have used LDAP in a new way? You do identity and access management on top of LDAP? Why not share your ideas and experiences with others? We are looking for speakers who are willing to talk about any topic related to LDAP and identity management, including: LDAP technology implementation (Servers, API, User interfaces etc.) LDAP Usage (Schema, Security, Operations, Scaling, big data, etc.) LDAP related technologies (PKI, XACML, SAML, etc.) LDAP and Beyond (IAM, Identity Federation, Authentication on the web, etc.) Best Practices for directory services. Accepted talks will be grouped into tracks such as a standards/development and deployment/administration. Deadlines & Important Dates Submission Deadline: 28th June Author Notification: 10th July Final Papers due: 10th October 2015 Tutorials: 11th November 2015 Conference: 12th-13th November 2015 Talk Submissions Main presentations should last about 45 minutes including discussion; we will also provide smaller slots of 15 minutes and 5 minutes for poster presentations or lightning talks. Please tell us which duration you prefer when proposing your talk. The talk must be in English. The one and only way to submit your abstract (approximately 200-800 words, accompanied by your biography of about 100-300 words) is via email to submissions(a)lists.ldapcon.org. Abstracts must reach the Program Committee by 28th June 2015. Early submission is encouraged. All abstracts will be reviewed by the program committee. For accepted talks we expect you to submit slides and/or a paper of approximately 2-10 pages (A4 or US Letter format, 25mm borders, preferably LaTeX source or OpenOffice). For 5-minute talks, a brief abstract is required. A short paper, slides or a poster should be provided for accepted talks. We will provide display boards for posters throughout the conference. By submitting a paper you grant the conference organizers the non-exclusive right to publish your paper in the conference proceedings and on the website; you maintain the right to publish it elsewhere at your discretion. Tutorial Submissions We are looking for high-quality tutorials on LDAP and related subjects, at any level from introductory to advanced. Tutorial length can range from an hour to a full day. Wireless Internet access will be available if required. The purpose of the tutorials is focussed education, so they should cover established topics and best practice rather than presenting new work. Tutorials will be on Wednesday 11th November 2015. The Programme Committee has an open mind about the format of the tutorial day, but has a limited number of rooms available. Make your proposal early and we will aim to build an attractive programme for the day. Expenses Speakers get free access to the conference, including the social event. If requested in advance we will provide accommodation for speakers. Travel expenses might also be covered in special cases. If you need this, please contact us early so we can try to arrange it. Website http://ldapcon.org/2015/ Contacts General enquiries: enquiries(a)lists.ldapcon.org Paper/Tutorial submissions: submissions(a)lists.ldapcon.org -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Search with wildcard
by Alessandro Lasmar Mourao 28 Jan '15

28 Jan '15

I have the following structure in my OpenLDAP: ou = groups |_cn = system1 | | _cn = Group1 | | _cn = Group2 |_cn = system2 | _cn = Group1 | _cn = Group2 I need to perform a search and return only users who are registered on system1, regardless of the registered group. When I use the search with the filter: memberOf=cn=*,cn=system1,ou=groups nothing is returned. How do I perform this search in OpenLDAP? In search Oracle SJDS works!

3 3

Different DIT on separate database
by Maily Peng 28 Jan '15

28 Jan '15

Hello, I'd like to set up a single instance of slapd from two DIT that have been defined in separate mdb databases in order to manage more efficiently indexes. Is-it possible ? thank you ####################################################################### # mdb primary database definitions ####################################################################### backend mdb database mdb suffix "ou=users,dc=domain,dc=net" rootdn "cn=Manager,dc=domain,dc=net" envflags writemap,nometasync lastmod on rootpw directory /usr/local/var/users-data/ ####################################################################### # mdb second database definitions ####################################################################### backend mdb database mdb suffix "ou=profiles,dc=domain,dc=net" rootdn "cn=Manager,dc=domain,dc=net" envflags writemap,nometasync lastmod on rootpw directory /usr/local/var/profile-data/ -- Maï-Ly PENG Database Administrator Keyyo Communications 92-98 bd Victor Hugo 92115 Clichy - France Tél. : 01 72 38 77 87 mpeng(a)keyyo.com <mailto:mpeng@keyyo.com> www.keyyo.com <http://www.keyyo.com/>

4 3

simple authentication
by Bharath K 28 Jan '15

28 Jan '15

env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); what values i have to provide for this parameters?? the code which i am trying is not doing simple authentication > dn: uid=nagios,ou=People,dc= example,dc=com > ... > userPassword:: > dn: uid=test1,ou=People,dc=example,dc=com > ... > userPassword:: > > dn: uid=test2,ou=People,dc=example,dc=com > ... > userPassword:: for above thing i have password... my problem is... it is not doing simple authentication i am expecting to be ask password on output ....but for me its not asking any password it is directly showing output it means it is not doing simple authentication

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical