openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

slap_queue_csn and slap_graduate_commit_csn in log
by Stefano Zanmarchi 03 Sep '14

03 Sep '14

Hi all, I can see thousands of lines like the following in my log: Sep 2 18:16:54 db51 slapd[16511]: slap_queue_csn: queing 0x432f20d0 20140902161654.626905Z#000000#000#000000 Sep 2 18:16:54 db51 slapd[16511]: slap_graduate_commit_csn: removing 0x2aaab801d1c0 20140902161654.626905Z#000000#000#000000 What are they related to? Could it be replication? Hope not because we used to have a syncrepl slave, but it has been turned off time ago and "moduleload syncprov.la" is commented out in slapd.conf. Thank you very much for your help!

3 3

slapd doesn't start with openldap-2.4.39 and cyrus-sasl-2.1.26
by Jeganathan S 03 Sep '14

03 Sep '14

Hi All, I am trying to build openldap 2.4.39 with following dependencies in RHEL 5.5. BerkleyDB-5.1.29, cyrus-sasl-2.1.26 and openssl-1.0.1i. "make test" is failing due to failure in starting the ldap server. The content of the log file is given below. When I disable cyrus-sasl while building openssl, I don't get the issue. Is there any known issue with these combination? The configuration options are: export CPPFLAGS="-I/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/include -I/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/include/openssl -I/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/include/sasl" export LDFLAGS="-L/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib/sasl2" export LD_LIBRARY_PATH=/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib/sasl2 ./configure --prefix=/opt/cars-openldap-building/build_outputs/openldap_binaries/openldap --exec-prefix=/opt/cars-openldap-building/build_outputs/openldap_binaries/openldap --with-tls=openssl --enable-bdb=mod --enable-hdb=mod --enable-mdb=mod Regards, Jeganathan ***************start of log file ********************* ldap_url_parse_ext(ldap://lap_sasl_init: auxprop add plugin failedocalhost/) 5406f5e9 @(#) $OpenLDAP: slapd 2.4.39 (Sep 3 2014 16:35:00) $ root@srv-ind-mdm6l.vanenburg.com:/opt/cars-openldap-building/openldap-2.4.39/servers/slapd ldap_pvt_gethostbyname_a: host=srv-ind-mdm6l.vanenburg.com, r=0 5406f5e9 daemon_init: ldap://localhost:9011/ 5406f5e9 daemon_init: listen on ldap://localhost:9011/ 5406f5e9 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap://localhost:9011/) 5406f5e9 daemon: listener initialized ldap://localhost:9011/ 5406f5e9 daemon_init: 1 listeners opened ldap_create 5406f5e9 slapd init: initiated server. 5406f5e9 slap_sasl_init: auxprop add plugin failed 5406f5e9 slapd destroy: freeing system resources. 5406f5e9 slapd stopped. 5406f5e9 connections_destroy: nothing to destroy. *********************end of logfile***************

1 0

ppolicy and repeated password
by Stefano Zanmarchi 03 Sep '14

03 Sep '14

Hi all, we'd like to use the ppolicy overlay to implement password locking after a certain number of bind failures. Sadly ppolicy does not distinguish between failures with different passwords (probably a dictionary attack) and failures with the same password (a client using an old, expired, password). This would easily lead to locking out users shortly after password change. I read that Zytrax has developed for Mozilla a modified version of ppolicy: http://www.zytrax.com/books/ldap/ch6/ppolicy.html which can distinguish between unique and repeated passwords. The page states the modified mozilla-ppolicy is available for openldap 2.4.11 and 2.4.16. Has anyone tried it with a newer version of openldap? Is it working? Thank you in advance, Stefano

1 0

accesslog-based consumer stuck on objectClass modify on provider
by Francesco Malvezzi 03 Sep '14

03 Sep '14

Hi all, yesterday I changed a structural objectClass for a entry with the relax control (control: 1.3.6.1.4.1.4203.666.5.12): dn: uid=cognos,ou=agents,dc=example,dc=org control: 1.3.6.1.4.1.4203.666.5.12 changetype: modify replace: objectClass objectClass: inetOrgPerson - add: sn sn: cognos On provider all ok. Provider is mirrormode and other mirror side is ok. The accesslog-based syncrepl on a consumer was stuck. Neither the modify nor the other next modifies were propagated. Is relax control unsupported in this scenario? Did I forget something really important? thank you, Francesco PS: I deleted on provider from accesslog db the entry corresponding to the said modify, restarted both consumer and provider and replica started again.

3 3

ACLQuestion
by Karl Heinz Wichmann 01 Sep '14

01 Sep '14

Hallo I have a problem with acl. We have following sturctur. dc=a,dc=b,dc=c | |-ou=ww-a | |-ou=ww-b | |-ou=ww-c | |-ou=ww-x | |-ou=system In each ww-a,b,c...x have we users and groups. In system we have system account (in groups and users) When we search with an ldap client like thunderbird addressbook, the users in system should not be visible. I use follow rule didn't run: olcAccess: {1}to filter="(objectclass=inetOrgperson)" attrs=entry,uid,sn,cn,mail,givenName by dn="cn=ad,ou=sys_ad,ou=people,dc=a,dc=b,dc=c" read by * none the following rule, i found all users (incl. ad, admin and so on) olcAccess: {1}to filter="(objectclass=*)" attrs=entry,uid,sn,cn,mail,givenName by dn="cn=ad,ou=system,dc=a,dc=b,dc=c" read by * none I want to avoid regex when posible. Karl Heinz

1 0

LMDB write/read simultaneously over different threads
by Vasilis Lasdas 29 Aug '14

29 Aug '14

Hi all, I am a new user to LMDB. Please forgive me for my ignorance or mistakes you might encounter. However, I have spent quite some time trying to resolve my issues but without a success. That's why I am writing to you asking for your help to shade some light. To the point: 1) I am having a database where there is only one writer and a few readers(e.g. 4 readers). 2) The database-writer lives on different thread than the database-reader(s). 3) The writer-thread keeps on running/writing all the time to the database. 4) At random intervals readers from different threads will request to extract data from the database. The problem that occurs is the following: If the writer is active( during writing), If I try to fetch any data from the db using the reader, it fails, with error MDB_NOTFOUND. As a remark here, I make sure that the reader-thread is launched AFTER the writer thread to ensure that the data exist in the db. In order to simulate this kind of behaviour(write-read) over different threads, I have written a small test application, that tries to depict my case/usecase. In main() I simply launch two threads/functions, the writer-thread and after some time, the reader thread. The common enviroment is constructed() in main and passed as parameter to the auxilliary functions. If the reader starts reading while writing is not finished, then the application crashes or returns MDB_NOTFOUND. This contradicts with the capabilities of the library, that is, parallel write/read from different threads. If the writer has finished, then the reader works properly. Some general questions. i) How many times do i need to open the database? Currently I open the (unique) database twice: one in the writer and one in the reader. The doc mentions that it has to be opened only one time. Even in that case, my app does not work. ii) What is the practical usage of mdb_txn_reset() and mdb_txn_renew()? Does it need to be used in my case? iii) Since I am only ADDING data in the db and only READING them, what kind of optimizations can be applied? iv) Regarding for-loops, what is a proper way of using the trasnactions and commit/abort/reset/etc of transactions? Please any helpfull information is highly apprecited or if someone can add some examples with different threads that would be awesome. #include <iostream> #include <thread> #include <assert.h> #include <string> #include "lmdb.h" #include <unistd.h> using namespace std; void writeLMDB( MDB_env * env, size_t nrElems ) { cout << "BEGIN WRITING." << endl; MDB_txn *txn; MDB_dbi dbi; MDB_stat status; // create transaction assert( MDB_SUCCESS == mdb_txn_begin( env, NULL, 0, &txn ) ); // open db assert( MDB_SUCCESS == mdb_open( txn, NULL, MDB_DUPSORT , &dbi ) ); // this commit-transaction is needed since we are creating the db for the first time assert( MDB_SUCCESS == mdb_txn_commit( txn ) ); MDB_val key, data; // begin (again a new transaction) assert( MDB_SUCCESS == mdb_txn_begin( env, NULL, 0, &txn ) ); // keep on writing elements in the db for( size_t i = 0; i < nrElems ; ++i ) { key.mv_size = sizeof( size_t ); key.mv_data = &i; string value = "test"; data.mv_size = value.size(); data.mv_data = (void*)value.data(); cout << "WRITER-KEY:" << *(size_t*)key.mv_data << " VALUE:" ; cout.write( (char*)data.mv_data, data.mv_size ); cout << endl; assert( MDB_SUCCESS == mdb_put( txn, dbi, &key, &data, 0 ) ); } assert( MDB_SUCCESS == mdb_txn_commit( txn ) ); assert( MDB_SUCCESS == mdb_env_stat( env, &status ) ); mdb_close( env, dbi ); cout << "FINISHED WRITING." << endl; } void readLMDB( MDB_env * _env, size_t start, size_t end ) { cout << "BEGIN READING.." << endl; MDB_dbi dbi; MDB_txn *txn = NULL; // lmdb operations assert( MDB_SUCCESS == mdb_txn_begin( _env, NULL, MDB_RDONLY, &txn ) ); assert( MDB_SUCCESS == mdb_open( txn, NULL, 0, &dbi ) ); // key+data MDB_val key, data; for ( size_t i = start; i <= end ; i++ ) { key.mv_size = sizeof( size_t ); key.mv_data = &i; int res = mdb_get( txn, dbi , &key, &data ); //cout << "READER-KEY:" << *(size_t*)key.mv_data << " VALUE:" ; cout.write( (char*)data.mv_data, data.mv_size ); cout << endl; if( res != 0 ) cout << "error fetching data" << endl; } // close db mdb_close( _env, dbi ); cout << "FINISHED READING.." << endl; } int main(int argc, char *argv[] ) { // db location(folder must exist) string dbLocation = "/work/vasilis/databases/lmdbtest/"; size_t maxdbSize = 10485760; system( "rm -rf /work/vasilis/databases/lmdbtest/*" ); //create enviroment:ONE enviroment only for one process MDB_env * _env; assert( MDB_SUCCESS == ( mdb_env_create( &_env ) ) ); //set the size of the database assert( MDB_SUCCESS == mdb_env_set_mapsize( _env, maxdbSize ) ); // open the enviroment: ready to be used by everyone else assert( MDB_SUCCESS == mdb_env_open( _env, dbLocation.c_str(), 0 , 0664 ) ); // writer-thread: write 1000 elements in the database thread writethread( writeLMDB, _env, 1000 ); usleep( 1000 * 100 ); // read from - to thread readthread( readLMDB, _env, 0, 20 ); // wait for threads to finish writethread.join(); readthread.join(); cout << "THREADS COMPLETED " << endl; // close the enviroment mdb_env_close( _env ); return 0; } regards, Vasilis

1 0

Passwords, Hashing, and Binds
by Bram Cymet 29 Aug '14

29 Aug '14

Hi, I am storing users passwords in a userPassword attribute. When the passwords are hashed with MD5 I can bind as the user just fine. If I hash the password with sha-256 I get invalid credentials. Is there something I have to change in my client? Is there something I have to change on the server? Is binding a user with a password stored with sha-256 (or at least something better then md5) even possible? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

4 4

keepalive parameter setting in openldap for consumer doesnot work
by pramod kulkarni 29 Aug '14

29 Aug '14

Hi, I unplugged network cable of provider,added new users but it never synchronizes. with the consumer.Consumer never sends the keepalive signals I am using 2.4.39 version of Openldap on windows machine this is my consumer setting olcSyncrepl: {0}rid=002 provider=ldap://ipaddress:389 bindmethod=sasl timeou t=0 network-timeout=0 saslmech=external keepalive=1:1:10 starttls=critical tl s_cert="CN=Consumer3, O=CRAP" tls_cacert="CN=TestCA, O=CRAP" tls_reqcert=demand tls_cipher_suite=HIGH:MEDIUM:-SSLv2 filter="(objectclass=*)" searchbase="dc= crap,dc=com" scope=sub attrs="*,+" schemachecking=off type=refreshAndPersis t retry="60 +" if I make fresh setup of consumer & provider,it works & everything gets replicated properly. In the earlier version of openldap it was based on system setting like I used to get keepalive every 2 hours. What is the minimum value to be set for keepalive parameter in syncrepl? Can you please tell me do I need to make any changes on consumer side or provider ?

3 2

3rd try : Bug ? ldap_start_tls_s successful even after removing ca certificate from ca cert dir
by SOMA SEKHAR 28 Aug '14

28 Aug '14

On Sat, Aug 23, 2014 at 1:08 PM, SOMA SEKHAR <somasekhar44(a)gmail.com> wrote: > link to question on stackoverflow > <http://stackoverflow.com/questions/25457034/starttls-succesful-even-after-d…> > > > I'm having trouble verifying the correct behavior of my software. Here are > the steps I am performing to verify correct operation: > > 1. I have sample code that uses openldap library and doing a start tls > to a ldap server. > 2. I have set the global option for ca cert directory and tlx context > for the first time. > 3. After that I did ldap init and ldap start tls to a server. This is > succesful as expected. > 4. I did an ldap_unbind_s > 5. I deleted the CA cert that signed the ldap server's certificate > from the ca cert directory of the client. > 6. Again did ldap_init and ldap_start_tls_s . > 7. I expected this call to fail , as I have removed the ca cert. But > what I observe is that , server sends the certificate but start_tls is > returning success. > > I am using openldap 2.4 with libssl.0.9.8 > > LDAP *ld;int desired_version=3; > if ((ld = ldap_init(<hostname>, <server_port>)) == NULL ) { > printf("ldap_init failed\n"); > exit(0);} > > ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version); > ldap_set_option(NULL, LDAP_OPT_X_TLS_CTX, NULL); > ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR,"<ca dir>"); > if(ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS){ > printf("start tls failed.\n"); > exit(0);} > ...... <do bind and search>... > > ldap_unbind_s(ld); ... > // DELETE the CA certificate from the ca dir. // Try to do start tls again > if ((ld = ldap_init(hostname, server_port)) == NULL ) { > printf("ldap_init failed , after deleting CA\n"); > exit(0);} > // This goes fine even after deleting the CAif (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS){ > printf("start tls failed after deleting CA.\n"); > exit(0);} > > > -- > Thanks&Regards, > SomaSekhar. > > -- Thanks&Regards, SomaSekhar.

3 5

best practices WRT resizing a MDB backend?
by Brian Reichert 28 Aug '14

28 Aug '14

Other than this thread: http://t23307.network-openldap-technical.opennetworks.info/lmdb-growing-the… I don't see a discussion of changing the 'maxsize' setting after a LMDB database has been generated. This thread includes this response about growing the database: http://www.openldap.org/lists/openldap-technical/201402/msg00302.html On Windows, Linux, and FreeBSD, there's no problem increasing the mapsize and preserving the existing data. (I'm making a wild assumption that 'mapsize' is a typo, and 'maxsize' was intended.) Can 'maxsize' ever be reduced after the fact? If so, is their guidance as to how much it can change (perhaps based on mdb_stat)? The problem I'm trying to solve: For my $job, we provide OpenLDAP-backed clustered appliances to customers. The hardware doesn't vary, but the size of individual customers' databases. - Our strategy for adding members to the cluster involves managing backups (compressed tarballs). Our prior use of the now-ancient bdb backend let these backups be lightweight things to manage for smaller customers, and larger customers would take the hit for having big databases. - Also, upgrading appliances means importing data from the customers' bdb-based server. My naive use of the LDMB backend has me assume the worst case, and now everyone is equally punished for having a 'big' (albeit sparse) database. My hope was to, given awareness of either the data in an LDIF extract, or data about the legacy bdb database itself, we could make a more conservative guess as to a reasonable size for the mdb backend. Has anyone written up some strategies on these topics, or in the position to provide any recommendation? -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

5 11

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical