openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Inconsistent answer from LDAP Server
by Yoann Gini 13 Feb '15

13 Feb '15

Hello, I’m working with OS X Server 10.9 who’s using OpenLDAP to provide directory services. I’ve a problem with a simple LDAP request who is not consistent depending of the attribute filter requested. Here are the two commands I’ve used in my CLI: ldapsearch -x -H ldap://192.168.42.10 -b "cn=passwordserver,cn=config,dc=example,dc=com" "(objectclass=*)" and ldapsearch -x -H ldap://192.168.42.10 -b "cn=passwordserver,cn=config,dc=example,dc=com" "(objectclass=*)" apple-xmlplist For each request, the content of apple-xmlplist is different. The problem is the same with ldap_search_ext_s in C. I’ve looked the request with wireshark and the only difference I see is the presence or not of the attribute request. The rest of the request is exactly the same. I don’t understand how is it possible. Do you know this bug? Do you have a way to edit the stored record used for the request with the filter (it’s the one used by Apple internal tools, so it’s not really possible for me to change it). Here are version info: @(#) $OpenLDAP: slapd 2.4.28 (Nov 12 2013 12:02:47) $ root@hikkaduwa.apple.com:/private/var/tmp/OpenLDAP/OpenLDAP-491.1~1/servers/slapd ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.28 (Nov 12 2013 12:04:43) $ root@hikkaduwa.apple.com:/private/var/tmp/OpenLDAP/OpenLDAP-491.1~1/clients/tools (LDAP library: OpenLDAP 20428) Best regards, Yoann Gini

5 18

Re: Inconsistent answer from LDAP Server
by Michael Ströder 13 Feb '15

13 Feb '15

Yoann Gini wrote: > >> Le 13 févr. 2015 à 16:05, Michael Ströder <michael(a)stroeder.com> a écrit : >> You should really remind *Apple* about what is Open Source while they are >> selling it to people like you willing to pay for it. > > If you want Apple contribution to OpenSource software, you can get it here > http://www.opensource.apple.com Just publishing a download page is not how contributing to Open Source projects work, especially when adding proprietary patches not yet proven to be generally useful. Open Source is more than wearing a cool github t-shirt spitting yet another random fork of something into the cyberspace. > I’m wondering what would be this conversation if I’ve never said it was on > Apple OS. This is not the point. *Your* personal attitude is the problem. Ciao, Michael.

1 0

Data is not replicating in other LDAP server in open-ldap mode configuration
by Shashi Ranjan 13 Feb '15

13 Feb '15

Hello, I am new to openldap, facing some issue in replication of data in one instance to other instance of openldap 2.4.11. I have two instance of openldap 2.4.11 and it is configured in multi-master mode. I import the data in one ldap instance using slapadd command(in that time both the instances are down as it ?pre-requisite to run the slapadd command. ). After importing the data, when I start the both ldap instance, data is not replicated to second ldap instance. I check the ldap behavior after restarting the ldap instance but in all cases it failed. Please provide your input so that we can identified the problem. Thanks, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 2

syncrepl multiple providers?
by Mark R Bannister 13 Feb '15

13 Feb '15

We have a multi-master pair and multiple replicas hanging off it. Currently we have to use a physical load balancer between the replicas and the masters so that the replicas can survive if one master goes down. Is it possible to configure syncrepl on the consumer side with a failover policy so that if one provider goes down it can automatically retry against another? That would remove the need for separate load balancers. Or should I be looking at deploying something like HAProxy on each LDAP replica? Thanks, Mark.

1 0

Add subtrees to replica via ACL
by Maily Peng 13 Feb '15

13 Feb '15

Hello, I'd like to manage replica ( read only) via ACL. So all replica servers would have the same config : olcSyncrepl :rid=001 provider=ldap://ip:389 binddn="cn=seruser-test,ou=AppUsers,dc=test,dc=net" bindmethod=simple credentials=secret searchbase="dc=phonesystems,dc=net" type=refreshAndPersist interval=00:00:00:10 retry="60 10 300 12 7200 +" where searchbase is the base entry. If we want to add a subtree to a replica, we'd only have to add rights to the ACL on the master. exple : ...to dn.subtree="ou=customer,ou=suite,dc=test,dc=net" by group/groupOfNames/member.exact="cn=ser-test-write,ou=groups,cn=system" write by group/groupOfNames/member.exact="cn=ser-test-read,ou=groups,cn=system" read by * none adding to dn.subtree="ou=provider,ou=suite,dc=test,dc=net" by group/groupOfNames/member.exact="cn=ser-test-write,ou=groups,cn=system" write by group/groupOfNames/member.exact="cn=ser-test-read,ou=groups,cn=system" read by * none would add the subtree "ou=provider,ou=suite,dc=test,dc=net" to the replica. It would be easier to manage replica. Is it possible to implement this solution ? Thank you

1 0

Re: Is the monitor backend writable?
by Ferenc Wagner 13 Feb '15

13 Feb '15

"Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> writes: > Could it be access problems? No, I used the rootDN. > dn: cn=Total,cn=Connections,cn=Monitor > [...] > Does this help you, or do you want something completely different? I expected to see the current logging configuration in cn=Log,cn=Monitor. -- Feri.

1 0

Is the monitor backend writable?
by Ferenc Wagner 13 Feb '15

13 Feb '15

Hi, >From http://www.openldap.org/faq/data/cache/358.html: dn: cn=Log,cn=Monitor changetype: modify add: managedInfo managedInfo: stats managedInfo: stats2 I'm running 2.4.40 with cn=config, olcLoglevel: stats (thus I can change the log level anyway), but cn=Log,cn=Monitor does not contain any managedInfo attributes (at least $ ldapsearch -x -H ldapi:/// -D cn=monitor -W -b cn=Log,cn=Monitor managedInfo does not return any; cn=monitor is the rootDN of the monitor database). My questions: 1. Is the above FAQ entry outdated? Or is it relevant only when not using cn=config? 2. Are there (other) writeable items under cn=Monitor? -- Thanks, Feri.

2 2

Speed when writing dublicate keys
by Tom Kirchner 13 Feb '15

13 Feb '15

Hi, I have a database with about 1 million integer keys. Now I want to append a lot of small values (each 3 bytes) to random keys very often (tens of millions of times). How do I insert into the database the fastest? Currently I am trying the following setup, but I wonder if that is optimal, because I see a decrease in indexing speed after about 500000 random writes (here appends): - I have split the whole key range into 16 databases (each within a different lmdb environment), so each range-db holds about 65000 keys - I open each range-db with the flags: MDB_APPENDDUP | MDB_INTEGERKEY | MDB_INTEGERDUP | MDB_DUPSORT - then when I want to append 3 bytes to the value of a key, I use the following call: res = mdb_put( txn[dbnumber], db[dbnumber], &k, &v, MDB_APPENDDUP ); Thank you for your help! -Tom

2 2

Re: Is the monitor backend writable?
by Ferenc Wagner 13 Feb '15

13 Feb '15

"Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> writes: > Ferenc Wagner <wferi(a)niif.hu> schrieb am 13.02.2015 um 09:20 in Nachricht <874mqqte84.fsf(a)lant.ki.iif.hu>: > >> From http://www.openldap.org/faq/data/cache/358.html: >> >> dn: cn=Log,cn=Monitor >> changetype: modify >> add: managedInfo >> managedInfo: stats >> managedInfo: stats2 >> >> I'm running 2.4.40 with cn=config, olcLoglevel: stats (thus I can change >> the log level anyway), but cn=Log,cn=Monitor does not contain any >> managedInfo attributes (at least >> >> $ ldapsearch -x -H ldapi:/// -D cn=monitor -W -b cn=Log,cn=Monitor managedInfo > > If the default isn't "-s sub", I'd add it, and did you try "monitoredInfo" instead? Neither makes a difference. Not even -s base. Also consider this: $ ldapsearch -LLL -x -H ldapi:/// -D cn=monitor -W -b cn=Log,cn=Monitor -s sub '*' '+' Enter LDAP Password: dn: cn=Log,cn=Monitor objectClass: monitorContainer structuralObjectClass: monitorContainer cn: Log creatorsName: cn=monitor modifiersName: cn=monitor createTimestamp: 20150128093559Z modifyTimestamp: 20150128093559Z description: This subsystem contains information about logging. description: Set the attribute "managedInfo" to the desired log levels. entryDN: cn=Log,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE -- Feri.

1 0

determining what schema are loaded
by chris c 12 Feb '15

12 Feb '15

I've been tasked with adding a mail attribute for an openldap 2.4.23 installation. I've read enough of the entries on the mailing list that talk about the inability to do so being related to the proper schema not being loaded, and I think that is the issue. What I'm struggling with, is how to determine what schema are loaded and where they are loaded from? In reading the Redhat documentation, they reference Required attributes are specified using the objectClass definition, and can be found in schema files located in the /etc/openldap/slapd.d/cn=config/cn=schema/directory. So does this mean that in the above referenced directory, those schema will be loaded?

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical