openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

ldapadd(1) second DIT
by Igor Shmukler 04 Feb '15

04 Feb '15

Hello, I am having a problem executing the ldapadd(1) through ldapi for the below LDIF: dn: olcDatabase=hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap/example.com olcSuffix: dc=example,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW:: e1NTSEF9NlZSbnN2bkJEWVdSbFFoS1ZWOE1TckxTdWhsc0NvSVg= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq The error is below: ldapadd: invalid format (line 12) entry: "olcDatabase=hdb" The line 12 contains: olcRootDN, it seems. I successfully tried a similar setup earlier. Please advise what should I check for clues. Sincerely, Igor Shmukler

2 2

bind UID in DN instead of CN
by Dennis 04 Feb '15

04 Feb '15

Hi everyone, I'm new to the ldap stuff, therefore sorry if this is a silly question. My openldap (slapd) version is 2.4.28. To manage openldap I'm using phpldapadmin. I'm using a third party software which relies on ldap to manage users. I've added a test user to ldap via phpldapadmin. The 3rd party software tries to modify/add an object via the following bind: slapd[19030]: conn=1435 fd=18 ACCEPT from IP=X.X.X.X:35541 (IP=0.0.0.0:389) slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." method=128 slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." mech=SIMPLE ssf=0 slapd[19030]: conn=1435 op=0 RESULT tag=97 err=0 text= slapd[19030]: conn=1435 op=1 MOD dn="uid=test1003,ou=users,dc=dmp,dc=..." slapd[19030]: conn=1435 op=1 MOD attr=objectclass slapd[19030]: conn=1435 op=1 RESULT tag=103 err=32 text= slapd[19030]: conn=1435 fd=18 closed (connection lost) This fails because it tries to accomplish this by using dn="uid=...", but as shown in phpldapadmin the dn is cn=Test Testuser,ou=users,dc=dmp,dc=... Therefore the distinguished name for dn="uid=...,ou=users,dc=dmp,dc=..." doesn't exist (the user has a uid of course). Therefore my question is, is there a possibility to change / to configure openldap to use / allow the uid instead of the cn? Or did I something wrong? So far I couldn't find any information about this. Any help is welcome and I would really appreciate this :) Best regards and have a nice weekend! Dennis Wehrle

3 2

Invalid credentials after moving to a new server
by ... 04 Feb '15

04 Feb '15

Hi all, I have running OpenLDAP on a virtual Ubuntu 12.04 32bit. Now I am trying to move with my data to a newer Debian 7 64bit. So I installed OpenLDAP and rsynced /var/lib/ldap and /etc/ldap tot he new machine. When I try to login with the root-bind-dn credentials working on the Ubuntu machine I get the error that I have invalid credentials. Slapcat on the Debian is working and giving out the total database, what can I do to get the login into OpenLDAP working again? Best regards! Andy

2 1

LMDB : mdb_drop is slow
by Venkat Murty 03 Feb '15

03 Feb '15

I have a lmdb environment in linux with 4K (MDB_dbi) databases. The size of the whole lmdb file is around 500G. foreach (MDB_dbi db in databases) { mdb_drop (txn, db, 0); } This process takes more that 10 hours. Is it reasonable ? Thanks, Venkat Murty _______________________ Cogito ergo sum

2 1

Errors building Current Git Version with windows
by Frank Offermanns 02 Feb '15

02 Feb '15

Hello, when building the current GIT Version 2.4.40 with Windows and MinGW/MSYS I get 3 errors: C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:116: undefined reference to `ftello' slapadd.o: In function `slapadd': C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:486: undefined reference to `ftello' libbackends.a(mdbmdb.o): In function `mdb_cursor_push': C:/msys/1.0/openldap-2.4.40git/servers/slapd/back-mdb/./../../../libraries/liblm db/mdb.c:4990: undefined reference to `GetFileSizeEx' collect2: ld returned 1 exit status make[2]: *** [slapd.exp] Error 1 Configure was: configure --prefix=/mingw --enable-accesslog --with-tls --enable-syncprov Regards, Frank

2 3

MatchingRuleUseDescription::APPLIES
by michael-catchall＠mail.stroeder.local (POP3) 31 Jan '15

31 Jan '15

HI! In yet another attempt to make more use of server's subschema in web2ldap I'm looking more closely at matchingRuleUse in OpenLDAP's subschema subentry. What's the base for the matchingRuleUse values generated by slapd? RFC 4512 is pretty terse on this: APPLIES provides a list of attribute types the matching rule applies to Ah, well... :-/ Basically I wonder why I can't use this filter and why caseIgnoreIA5SubstringsMatch is not listed as being applicable to krbPrincipalName: (krbPrincipalName:caseIgnoreIA5SubstringsMatch:=k/m*) Yes, I know: krbPrincipalName is correctly declared with EQUALITY caseExactIA5Match. But what's the reason you cannot override the equality matching with this extensible filter? Normalization issues when indexing? Ciao, Michael. [1] http://tools.ietf.org/html/rfc4512#section-4.1.4

1 0

Large Number of Transactions x Low performance
by Alessandro Lasmar Mourao 30 Jan '15

30 Jan '15

Hi, I work in a company that has 140,000 registered users in OpenLDAP. This OpenLDAP is used for authentication of our internal systems. In our tree of groups we have the systems and below the each system there are the groups' authorization (systems profiles). The user is bound in each group according to position, function and department in the company. When a user replaces another user hierarchically higher, this user is taken from the respective group (that he belonged) and registered in user_group with the highest hierarchy. This movement in the company is very common, and this is the cause of our problems. We have a group with 50,000 registered users, and when we need to delete a user of that group or add a new one, OpenLADP takes up to 6 minute to effect the transaction. We have a tool (BMC Identity Management (formerly Control-SA)) that automates the transactions, but due to delay in the transactions are with a row of 100,000 operations of insert / delete to perform. I wonder if you have any way to improve the performance of OpenLDAP for these write operations. The OpenLDAP version is 2.4.40. Thanks, Alessandro Lasmar Mourão Below is our slapd.conf: ############################################## serverID 2 idletimeout 0 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ldap.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap/ moduleload back_mdb moduleload back_monitor moduleload memberof moduleload ppolicy moduleload syncprov moduleload refint moduleload accesslog sizelimit 250 tool-threads 16 password-hash {SSHA} monitoring true TLSCACertificateFile /etc/ssl/certs/cacert.pem TLSCertificateFile /etc/ssl/certs/servercrt.pem TLSCertificateKeyFile /etc/ssl/certs/serverkey.pem backend mdb database config rootdn "cn=admin,cn=config" rootpw secret monitoring true database monitor rootdn "cn=admin,cn=monitor" rootpw secret monitoring true database mdb suffix "cn=accesslog" rootdn "cn=admin,cn=accesslog" rootpw secret maxsize 1073741824 monitoring true directory "/var/lib/ldap/intranet/log" index default eq,pres,sub index entryCSN eq,pres index objectClass,reqEnd eq,pres index reqResult,reqStart eq,pres limits dn.exact="uid=replication,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE access to * by dn.base="uid=replication,ou=Users,o=company" read by * break database mdb suffix "o=company" rootdn "cn=admin,o=company" rootpw secret maxsize 4294967296 monitoring true overlay ppolicy ppolicy_use_lockout ppolicy_hash_cleartext ppolicy_default "cn=default,ou=policy,o=company" overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true overlay refint refint_attributes uniqueMember overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 limits dn.exact="uid=replication01,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication02,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication03,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication04,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-checkpoint 1000 20 syncprov-sessionlog 10000 syncrepl rid=100 provider=ldap://10.192.184.195:389 searchbase="o=company" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=simple binddn="uid=replication01,ou=Users,o=company" credentials=secret mirrormode true directory "/var/lib/ldap/intranet" directory "/var/lib/ldap/intranet" index objectClass eq,pres index uniqueMember,memberof eq,pres index nu-cpf,nu-cnpj eq,pres index dt-nascimento pres index entryUUID,entryCSN eq,pres index uid,ou,cn,sn,mail eq,pres,sub index default,givenname eq,pres,sub lastmod on checkpoint 1024 10 access to attrs=userPassword,shadowLastChange by dn="cn=admin,o=company" write by dn.exact="uid=replica01,ou=Users,o=company" read by dn.exact="uid=replica02,ou=Users,o=company" read by dn.exact="uid=replica03,ou=Users,o=company" read by dn.exact="uid=replica04,ou=Users,o=company" read by anonymous auth by self write by * none access to * by dn="cn=admin,o=company" write by * read

3 4

LMDB memory location on Android
by Kristoffer Sjögren 30 Jan '15

30 Jan '15

Hi LMDB JNI is a Java wrapper ontop of LMDB which runs on Linux, OSX, Windows and Android (arm-linux-androideabi-4.9 x86_64). At the moment the Android implementation rely on buffer copies and we're trying to implement zero copy using memory addresses provided by LMDB. Zero copy is already working on Linux, OSX and Windows but is not as straight forward on Android since the memory addresses are handled differently? We try to use the memory address of a direct ByteBuffer and hand it over to LMDB (exactly how the PC version works) but something is wrong. The full discussion and code on this can be found here. https://github.com/deephacks/lmdbjni/issues/21 I would greatly appreciate any tips on what might be wrong. Cheers, -Kristoffer

1 0

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema.
by Abhishek koserwal 29 Jan '15

29 Jan '15

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema. Creating new entries on basis of customized schema added into phpldapadmin. Regards Abhishek Koserwal Final year, CSE, IET-DAVV The capacity to learn is a gift; The ability to learn is a skill; The willingness to learn is a choice -- Brian Herbert

2 1

LMDB usage on windows - to much memory needed
by Frank Offermanns 29 Jan '15

29 Jan '15

Hello, we would like to change our backend from hdb to mdb. I did some initial tests and found out the following: When setting maxsize to 1.4 GB, the size of the database on the file system is about 1.4 GB. I thought I read that the maxsize has nothing to do with the actual physical size needed. (If I have only 10 MB of data my database should be about 10 MB). Even worse is the fact, that slapd.exe then needs about 1.5 GB virtual size memory. And if I use 32 Bit slapd.exe the process will crash when reaching 2 GB virtual size. (as every 32 bit process will do) Now my conclusion is, that the things described in the mdb paper are only valid for unix/linux, because windows uses another memory system. Is this correct? Or is there a way I haven't found to configure OpenLDAP on windows so that it does not need so much RAM. The size on the disk does not matter for us, but since we use only 32 bit slapd.exe the RAM does matter. Best regards, Frank

4 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical