openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

LDAP Admin updating OpenLDAP and something very odd ...
by Kevin Teague 08 Nov '14

08 Nov '14

I am using the "LDAP Admin” tool to update an OpenLDAP server on Windows. This works just fine. However, when I update members of a group in LDAP with LDAP Admin, those changes are not be seen by another application which queries LDAP (Atlassian's Crowd). Clearly this application is caching results from LDAP and there is a bug in that application's caching where updates don't get detected (I can always see changes made with LDAP Admin with other LDAP). If I update LDAP with other clients (python-ldap, phpldapadmin), then that application has no problem seeing the updates. It’s only when modifications are made with LDAP Admin that updates aren’t seen. Yeah, it's a super weird bug … Is there something on an OpenLDAP server which tells clients if an entry has been modified? And it’s possible to somehow bypass that thing which gets updated? I can modify a group with LDAP Admin and run an LDIF and see that the modifyTimestamp field is being properly updated. I'm totally stumped as to how an OpenLDAP entry can be updated in a way that another client (with possibly aggressive or buggy query result caching) is able to somehow ignore that update.

2 1

Replication : consumer to master server
by Yannick Barbeaux 07 Nov '14

07 Nov '14

Hello all, I asked this question a few days ago but I guess I entered into too many details so did not get any answer. So I will try to be as conscise as possible this time: After configuring and running a replication based on the consumer-producer method (syncrepl), can a consumer become the master ldap server (after shutting down the original master/producer) ? I tried by removing the syncprov module on the consumer but without success. Thanks. Yannick

2 1

Openldap Master Slave configuration
by Elmopi, Stefano 07 Nov '14

07 Nov '14

Hi, I have a configuration with a Master and 4 Slave. Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 and all are configured with olc. All applications that use OpenLDAP for their login are configured to do queries on slave and this creates problems with some options of Ppolicy, Let me explain. I have configured the option that after a user wrong your password 5 times, it is locked. and here lies the problem, because the slave database is read-only and then the block is not reported to the Master and the user does not lock !!! I read that you could do something using the Chain Overlay but I found little documentation and everything I tried did not work. Anyone have any ideas to suggest ?? Thanks Best Regards Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

2 1

LMDB performance tip
by Howard Chu 07 Nov '14

07 Nov '14

Just recently measured: when doing a bulk-load of a DB that's larger than RAM, it's faster to turn off WRITEMAP and just use regular writes. When the DB is much larger than RAM, and LMDB is reusing old pages, most likely the next page to be written will not currently be in memory. If you just access the mapped page (writing to it) the OS will have to page it in first. This is an unnecessary I/O operation since you're simply going to overwrite its contents anyway. If you do a regular write() from a buffer instead, the OS just writes it to the target page, no page-in required. Strangely enough, this performance advantage disappears when under an active random read/write workload. I haven't yet worked out why that is. Perhaps the cost of multiple memcpy's comes into play. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 4

Connecting to LDAPS
by Marian Baskharoun 07 Nov '14

07 Nov '14

Hi, I created an iOS app using xcode version 6.0.1. This app should accept the windows login information from the user. I'm using OpenLDap to do the authentication. This is the code I'm using, works fine with Ldap and port 389 How do I make it work with Ldaps and port 636? # define LDAP_SERVER = "ldap://host:389" - (BOOL)checkValidUser:(NSString *)username password:(NSString *)password { LDAP *ld; int rc; int desired_version = LDAP_VERSION3; struct berval cred; size_t len = strlen([username UTF8String]) + 1; char usr [len]; memcpy(usr, [usernameUTF8String], len); size_t len2 = strlen([password UTF8String]) + 1; char passwd [len2]; memcpy(passwd, [password UTF8String], len2); cred.bv_val = (char *) passwd; cred.bv_len = strlen( passwd ); if( ldap_initialize( &ld, LDAP_SERVER ) ) { return NO; } rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version); if ( rc != LDAP_SUCCESS ) { perror( "ldap_set_option failed" ); exit(EXIT_FAILURE); } else { printf("Set LDAPv3 client version.\n"); } // Simple Authentication rc = ldap_sasl_bind_s( ld, usr, LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL ); if( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_sasl_bind_s: %s\n", ldap_err2string(rc) ); return NO; } else { return YES; } } Thanks, Marian

3 2

Meaning of "ppolicy_bind: Setting warning for password expiry for ... = 0 seconds"?
by Ulrich Windl 06 Nov '14

06 Nov '14

Hi! Can someone explain what this message is actually saying: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=testuser,ou=domain,dc=org = 0 seconds Does this mean a user who mistyped his password before logged in successfully now? I saw no change to the LDAP database after this message, so what is changed, and where is it cahnged? Also those "0 seconds" don't match my password policy, which looks like this (still testing): -- objectClass: namedObject objectClass: pwdPolicy cn: PP-Default pwdAttribute: userPassword pwdMinAge: 30 pwdMaxAge: 86400000 pwdInHistory: 3 pwdCheckQuality: 1 pwdMinLength: 8 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 5 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 10 pwdFailureCountInterval: 1209600 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE -- I'm running SLES11 SP3... Regards, Ulrich

2 3

is there hardware inventory schema?
by Zeus Panchenko 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 greetings, please advise, is there schema or what will it be correct to use, for hardware inventory data to be stored in LDAP (except custom schema)? perhaps I'm not the first who asks that ... - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRXWVUACgkQr3jpPg/3oyo4uwCgxUA5AwR6x2r2idQsAYXZSYgM UHYAoK6uQ87UL2K/k6NlW/1Ns6h1a+Hh =GvDb -----END PGP SIGNATURE-----

3 4

Migrating from BDB to LMDB
by Michael 05 Nov '14

05 Nov '14

Good evening - I would like to upgrade my OpenLDAP servers and migrate from BDB to LMDB. What is the recommended path for doing this? Can I simply take a dump with slapcat while using BDB and then run a slapadd on the resulting LDIF after changing the configuration to MDB? -Mike

2 2

Trying to switch from bdb to mdb
by Jerry 04 Nov '14

04 Nov '14

I am running OpenLDAP on a FreeBSD-10 amd 64 machine. It is installed via the FreeBSD ports system and I compile it on my machine. I recently wanted to switch from BDB since versions greater than 6 are not acceptable to OpenLDAP. I wanted to use "mdb", but I just cannot seem to get it configured correctly. I changed the "database bdb" to "database mdb" but when I try to start openLDAP, I get this error: Starting slapd Unrecognized database type (mdb) Warning: failed to start slapd I removed the existing database, so it should be starting up with a clean environment, but the problem continues. This is probably a problem specific to FreeBSD. If any user of FreeBSD has this working, I would love to see how they configured it. Feel free to contact me off list if it is more convenient. Thanks! -- Jerry

7 21

Kernel segfault slapd
by Scot Hollingsworth 04 Nov '14

04 Nov '14

Issue: slapd keeps crashing about twice a day on multiple servers. I updated the kernel and openldap but still see the problem. Anyone point me in the right direction? Log: kernel: slapd[4435]: segfault at 4 ip 00d1984f sp acc3d270 error 4 in slapd[bcc000+215000] System: openldap-2.4.39-8.el6.i686 openldap-clients-2.4.39-8.el6.i686 openldap-servers-2.4.39-8.el6.i686 Kernel: 2.6.32-504.el6.i686 -- Thanks. Scot H -- The mission of the Rankin County School District is to prepare every student with the cognitive and social skills necessary to be productive members of an ever-changing global society. -- This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error.

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical