openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Re: Replication restores deleted user
by kevin sullivan 09 Nov '14

09 Nov '14

Thank you very much for the advice and the example config! I generally convert my slapd.conf to cn=config, I just find it easier to use the slapd.conf when debugging. But this gives me hope that my problem could be an issue with the conversion of slapd.conf to cn=config or something that I can find in your configuration. Thank you again, and I will let you know what I find! On Fri, Oct 31, 2014 at 3:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, October 31, 2014 4:13 PM -0400 kevin sullivan < > kevin4sullivan(a)gmail.com> wrote: > > >> >> >> >> >> Quanah, >> >> Thank you for the suggestion to move to delta-syncrepl MMR. >> Unfortunately, I am having problems setting this up properly. After >> reading through some documentation, I thought it would be simple but when >> I bring up slapd on my two servers, they both start using around 100% CPU >> and in the debug output the two servers are constantly looping through >> all of the objects in my DIT and saying that the objects have not changed: >> >> 5453d6b5 @(#) $OpenLDAP: slapd 2.4.39 (Jun 18 2014 05:19:18) $ >> >> mockbuild@x86-028.build.eng.bos.redhat.com:/builddir/build/BUILD/openldap >> -2.4.39/openldap-2.4.39/build-servers/servers/slapd >> 5453d6b5 hdb_monitor_db_open: monitoring disabled; configure monitor >> database to enable >> 5453d6b5 slapd starting >> ... >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: dc=example,dc=com, UUID: >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN dc=example,dc=com >> 20141031161001.910968Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (dc=example,dc=com) >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: >> ou=users,dc=example,dc=com, UUID: 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN >> ou=users,dc=example,dc=com 20141031161001.922234Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 ou=users,dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (ou=users,dc=example,dc=com) >> ..... >> 5453d6b5 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT >> 5453d6b5 do_syncrep2: rid=001 cookie= >> ... Repeated forever ... >> >> Am I configuring something incorrectly? >> >> To refresh your memory, I am running 2.4.39-8. I have two servers >> (server1 and server2) that I want to setup in delta-syncrepl MMR >> MirrorMode. >> > > Hi Kevin, > > I stopped using the deprecated slapd.conf format years ago, as it's prone > to misuse and incorrect setup. Your supplied config is an example of why > it's a bad idea to use slapd.conf (For example, you have serverID under the > database section, when it's a global option, etc). I'd strongly advise you > to switch to using cn=config so that you can have an actual validated > configuration. It also makes troubleshooting a lot easier to do. > > Aside from that, your log simply shows the server comparing each entry > between the two servers... Sounds like they didn't start out believing they > were in sync and are trying to get there. > > Here's an example of my config, using cn=config (slapcat export) minus the > schema: > > <http://pastebin.com/nv1WNX2y> > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 10

LDAP Admin updating OpenLDAP and something very odd ...
by Kevin Teague 08 Nov '14

08 Nov '14

I am using the "LDAP Admin” tool to update an OpenLDAP server on Windows. This works just fine. However, when I update members of a group in LDAP with LDAP Admin, those changes are not be seen by another application which queries LDAP (Atlassian's Crowd). Clearly this application is caching results from LDAP and there is a bug in that application's caching where updates don't get detected (I can always see changes made with LDAP Admin with other LDAP). If I update LDAP with other clients (python-ldap, phpldapadmin), then that application has no problem seeing the updates. It’s only when modifications are made with LDAP Admin that updates aren’t seen. Yeah, it's a super weird bug … Is there something on an OpenLDAP server which tells clients if an entry has been modified? And it’s possible to somehow bypass that thing which gets updated? I can modify a group with LDAP Admin and run an LDIF and see that the modifyTimestamp field is being properly updated. I'm totally stumped as to how an OpenLDAP entry can be updated in a way that another client (with possibly aggressive or buggy query result caching) is able to somehow ignore that update.

2 1

Replication : consumer to master server
by Yannick Barbeaux 07 Nov '14

07 Nov '14

Hello all, I asked this question a few days ago but I guess I entered into too many details so did not get any answer. So I will try to be as conscise as possible this time: After configuring and running a replication based on the consumer-producer method (syncrepl), can a consumer become the master ldap server (after shutting down the original master/producer) ? I tried by removing the syncprov module on the consumer but without success. Thanks. Yannick

2 1

Openldap Master Slave configuration
by Elmopi, Stefano 07 Nov '14

07 Nov '14

Hi, I have a configuration with a Master and 4 Slave. Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 and all are configured with olc. All applications that use OpenLDAP for their login are configured to do queries on slave and this creates problems with some options of Ppolicy, Let me explain. I have configured the option that after a user wrong your password 5 times, it is locked. and here lies the problem, because the slave database is read-only and then the block is not reported to the Master and the user does not lock !!! I read that you could do something using the Chain Overlay but I found little documentation and everything I tried did not work. Anyone have any ideas to suggest ?? Thanks Best Regards Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

2 1

LMDB performance tip
by Howard Chu 07 Nov '14

07 Nov '14

Just recently measured: when doing a bulk-load of a DB that's larger than RAM, it's faster to turn off WRITEMAP and just use regular writes. When the DB is much larger than RAM, and LMDB is reusing old pages, most likely the next page to be written will not currently be in memory. If you just access the mapped page (writing to it) the OS will have to page it in first. This is an unnecessary I/O operation since you're simply going to overwrite its contents anyway. If you do a regular write() from a buffer instead, the OS just writes it to the target page, no page-in required. Strangely enough, this performance advantage disappears when under an active random read/write workload. I haven't yet worked out why that is. Perhaps the cost of multiple memcpy's comes into play. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 4

Connecting to LDAPS
by Marian Baskharoun 07 Nov '14

07 Nov '14

Hi, I created an iOS app using xcode version 6.0.1. This app should accept the windows login information from the user. I'm using OpenLDap to do the authentication. This is the code I'm using, works fine with Ldap and port 389 How do I make it work with Ldaps and port 636? # define LDAP_SERVER = "ldap://host:389" - (BOOL)checkValidUser:(NSString *)username password:(NSString *)password { LDAP *ld; int rc; int desired_version = LDAP_VERSION3; struct berval cred; size_t len = strlen([username UTF8String]) + 1; char usr [len]; memcpy(usr, [usernameUTF8String], len); size_t len2 = strlen([password UTF8String]) + 1; char passwd [len2]; memcpy(passwd, [password UTF8String], len2); cred.bv_val = (char *) passwd; cred.bv_len = strlen( passwd ); if( ldap_initialize( &ld, LDAP_SERVER ) ) { return NO; } rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version); if ( rc != LDAP_SUCCESS ) { perror( "ldap_set_option failed" ); exit(EXIT_FAILURE); } else { printf("Set LDAPv3 client version.\n"); } // Simple Authentication rc = ldap_sasl_bind_s( ld, usr, LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL ); if( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_sasl_bind_s: %s\n", ldap_err2string(rc) ); return NO; } else { return YES; } } Thanks, Marian

3 2

Meaning of "ppolicy_bind: Setting warning for password expiry for ... = 0 seconds"?
by Ulrich Windl 06 Nov '14

06 Nov '14

Hi! Can someone explain what this message is actually saying: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=testuser,ou=domain,dc=org = 0 seconds Does this mean a user who mistyped his password before logged in successfully now? I saw no change to the LDAP database after this message, so what is changed, and where is it cahnged? Also those "0 seconds" don't match my password policy, which looks like this (still testing): -- objectClass: namedObject objectClass: pwdPolicy cn: PP-Default pwdAttribute: userPassword pwdMinAge: 30 pwdMaxAge: 86400000 pwdInHistory: 3 pwdCheckQuality: 1 pwdMinLength: 8 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 5 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 10 pwdFailureCountInterval: 1209600 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE -- I'm running SLES11 SP3... Regards, Ulrich

2 3

is there hardware inventory schema?
by Zeus Panchenko 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 greetings, please advise, is there schema or what will it be correct to use, for hardware inventory data to be stored in LDAP (except custom schema)? perhaps I'm not the first who asks that ... - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRXWVUACgkQr3jpPg/3oyo4uwCgxUA5AwR6x2r2idQsAYXZSYgM UHYAoK6uQ87UL2K/k6NlW/1Ns6h1a+Hh =GvDb -----END PGP SIGNATURE-----

3 4

Migrating from BDB to LMDB
by Michael 04 Nov '14

04 Nov '14

Good evening - I would like to upgrade my OpenLDAP servers and migrate from BDB to LMDB. What is the recommended path for doing this? Can I simply take a dump with slapcat while using BDB and then run a slapadd on the resulting LDIF after changing the configuration to MDB? -Mike

2 2

Trying to switch from bdb to mdb
by Jerry 04 Nov '14

04 Nov '14

I am running OpenLDAP on a FreeBSD-10 amd 64 machine. It is installed via the FreeBSD ports system and I compile it on my machine. I recently wanted to switch from BDB since versions greater than 6 are not acceptable to OpenLDAP. I wanted to use "mdb", but I just cannot seem to get it configured correctly. I changed the "database bdb" to "database mdb" but when I try to start openLDAP, I get this error: Starting slapd Unrecognized database type (mdb) Warning: failed to start slapd I removed the existing database, so it should be starting up with a clean environment, but the problem continues. This is probably a problem specific to FreeBSD. If any user of FreeBSD has this working, I would love to see how they configured it. Feel free to contact me off list if it is more convenient. Thanks! -- Jerry

7 21

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical