openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Trying to Mirror 2 OpenLDAP servers
by Sterling Sahaydak 04 Sep '14

04 Sep '14

Just updated slapd.conf with CA Certs and trying to get mirroring synchronization to work. Running into the following: slapd -d sync @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild@c6b10.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd /etc/openldap/slapd.conf: line 163: warning, destination attributeType 'sAMAccountName' is not defined in schema PROXIED attributeDescription "SAMACCOUNTNAME" inserted. /etc/openldap/slapd.conf: line 213: rootdn is always granted unlimited privileges. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting TLS: error: the certificate '/etc/openldap/certs/ldap_example_net.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/certs/ldap_example_net.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.example.net,O="xx-xxxxxxx, INC.",L=xxxx,ST=xxxxxx,C=US'. do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE In my slapd.conf I have setup (Provider setup): TLSCertificateFile /etc/openldap/certs/ldap_example_net.crt TLSCertificateKeyFile /etc/openldap/certs/ldap_example_net.key TLSCACertificateFile /etc/openldap/certs/CAcompany.crt serverID 1 overlay syncprov #syncprov-checkpoint 100 10 syncprov-checkpoint 100 2 syncprov-sessionlog 100 #LDAP Sync - Slave - Consumer syncrepl rid=001 provider=ldaps://ldap-west.examplel.net bindmethod=simple binddn="cn=xxxxx,ou=Roles,dc=pcoral,dc=net" credentials=xxxxxxxxxxxx searchbase="dc=example,dc=net" filter="(objectclass=*)" attrs="*" schemachecking=on type=refreshAndPersist interval=00.00.00:30 retry="60 +" mirrormode on So, not sure why the synchronization isn't working? Thanks!!!

2 2

Re: slap_queue_csn and slap_graduate_commit_csn in log
by Stefano Zanmarchi 04 Sep '14

04 Sep '14

Thank you Quanah, it works, but now my doubt is: do the log lines containing slap_queue_csn and slap_graduate_commit_csn mean that replication is on and that a slave is syncing? On Wed, Sep 3, 2014 at 7:09 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, September 03, 2014 10:55 AM +0200 Stefano Zanmarchi < > zanmarchi(a)gmail.com> wrote: > > >> Thank you very much for the hint Ulrich, >> does anyone else know if it is normal to have thousands of lines like >> these in the log: >> > > You will have one per commit as long as you have "sync" logging enabled in > your loglevel. If you don't want to see them, remove "sync" from your > loglevel. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

FW: Openldap search results varies with search base
by Jeganathan S 03 Sep '14

03 Sep '14

Hi All, We are searching with same filter but with two different search bases and we are seeing results to be different. Case1: (working case) Search filter: (cn=monitorsoapnode*) Search base: o=itsmydomain.com Search result: cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com> cn=monitorsoapnode@ np-m910-87-8,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com Case2: (not working case) Search filter: (cn=monitorsoapnode*) Search base: cn=ucloud,o=itsmydomain.com Search result: cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com> It is observed that with search base "o=system,cn=cordys,cn=ucloud,o=itsmydomain.com" we are getting the expected results. We are seeing this behaviour with hdb database, but not with bdb. But we want to stick to hdb only. Is there any workaround to fix the issue(something like changing the configuration settings)? It is also observed that in both cases bdb_substring_candidates value is 2 but bdb_search_candidates value is different. I am not sure if this observation is relevant or not. You can check the logs for working and not working cases below. Please help. ########Not working case log ################## <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=8 p=3 send_ldap_response: msgid=9 tag=101 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 118 contents: op tag 0x63, time 1409136356 ber_get_next conn=1000 op=9 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=ucloud,o=itsmydomain.com> <<< dnPrettyNormal: <cn=ucloud,o=itsmydomain.com>, <cn=ucloud,o=itsmydomain.com> ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" => hdb_search bdb_dn2entry("cn=ucloud,o=itsmydomain.com") search_candidates: base="cn=ucloud,o=itsmydomain.com" (0x00000002) scope=2 => hdb_dn2idl("cn=ucloud,o=itsmydomain.com") => bdb_substring_candidates (cn) => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 33 candidates => key_read <= bdb_index_read 3 candidates => key_read <= bdb_index_read 17 candidates => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 18 candidates <= bdb_substring_candidates: 2, first=267, last=198029 bdb_search_candidates: id=1 first=267 last=267 => send_search_entry: conn 1000 dn="cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com>" ber_flush2: 140 bytes to sd 12 <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=9 p=3 send_ldap_response: msgid=10 tag=101 err=0 ber_flush2: 14 bytes to sd 12 ########Working case log ################## <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=9 p=3 send_ldap_response: msgid=10 tag=101 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 108 contents: op tag 0x63, time 1409136444 ber_get_next conn=1000 op=10 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <o=itsmydomain.com> <<< dnPrettyNormal: <o=itsmydomain.com>, <o=itsmydomain.com> ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" => hdb_search bdb_dn2entry("o=itsmydomain.com") search_candidates: base="o=itsmydomain.com" (0x00000001) scope=2 => hdb_dn2idl("o=itsmydomain.com") => bdb_substring_candidates (cn) => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 33 candidates => key_read <= bdb_index_read 3 candidates => key_read <= bdb_index_read 17 candidates => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 18 candidates <= bdb_substring_candidates: 2, first=267, last=198029 bdb_search_candidates: id=2 first=267 last=198029 => send_search_entry: conn 1000 dn="cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com>" ber_flush2: 140 bytes to sd 12 <= send_search_entry: conn 1000 exit. => send_search_entry: conn 1000 dn="cn=monitorsoapnode@np-m910-87-8,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-87-8,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com>" ber_flush2: 140 bytes to sd 12 <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=10 p=3 send_ldap_response: msgid=11 tag=101 err=0 ber_flush2: 14 bytes to sd 12 Slapd config details you may be interested in are as follows ####### Config details start ###### database hdb suffix "o= itsmydomain.com" rootdn "cn=Directory Manager,o= itsmydomain.com" rootpw {SSHA}4tqAhskuvQm3wFz9EI3lqLI8pRRs6IfI sizelimit 2000 index default pres,eq index cn pres,eq,sub index objectClass eq index entryCSN,entryUUID eq index authenticationuser pres,eq,sub index osidentity pres,eq,sub cachesize 5000 checkpoint 1024 10 ####### Config details end ###### Regards, Jegan.

2 4

slap_queue_csn and slap_graduate_commit_csn in log
by Stefano Zanmarchi 03 Sep '14

03 Sep '14

Hi all, I can see thousands of lines like the following in my log: Sep 2 18:16:54 db51 slapd[16511]: slap_queue_csn: queing 0x432f20d0 20140902161654.626905Z#000000#000#000000 Sep 2 18:16:54 db51 slapd[16511]: slap_graduate_commit_csn: removing 0x2aaab801d1c0 20140902161654.626905Z#000000#000#000000 What are they related to? Could it be replication? Hope not because we used to have a syncrepl slave, but it has been turned off time ago and "moduleload syncprov.la" is commented out in slapd.conf. Thank you very much for your help!

3 3

slapd doesn't start with openldap-2.4.39 and cyrus-sasl-2.1.26
by Jeganathan S 03 Sep '14

03 Sep '14

Hi All, I am trying to build openldap 2.4.39 with following dependencies in RHEL 5.5. BerkleyDB-5.1.29, cyrus-sasl-2.1.26 and openssl-1.0.1i. "make test" is failing due to failure in starting the ldap server. The content of the log file is given below. When I disable cyrus-sasl while building openssl, I don't get the issue. Is there any known issue with these combination? The configuration options are: export CPPFLAGS="-I/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/include -I/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/include/openssl -I/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/include/sasl" export LDFLAGS="-L/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib/sasl2" export LD_LIBRARY_PATH=/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib/sasl2 ./configure --prefix=/opt/cars-openldap-building/build_outputs/openldap_binaries/openldap --exec-prefix=/opt/cars-openldap-building/build_outputs/openldap_binaries/openldap --with-tls=openssl --enable-bdb=mod --enable-hdb=mod --enable-mdb=mod Regards, Jeganathan ***************start of log file ********************* ldap_url_parse_ext(ldap://lap_sasl_init: auxprop add plugin failedocalhost/) 5406f5e9 @(#) $OpenLDAP: slapd 2.4.39 (Sep 3 2014 16:35:00) $ root@srv-ind-mdm6l.vanenburg.com:/opt/cars-openldap-building/openldap-2.4.39/servers/slapd ldap_pvt_gethostbyname_a: host=srv-ind-mdm6l.vanenburg.com, r=0 5406f5e9 daemon_init: ldap://localhost:9011/ 5406f5e9 daemon_init: listen on ldap://localhost:9011/ 5406f5e9 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap://localhost:9011/) 5406f5e9 daemon: listener initialized ldap://localhost:9011/ 5406f5e9 daemon_init: 1 listeners opened ldap_create 5406f5e9 slapd init: initiated server. 5406f5e9 slap_sasl_init: auxprop add plugin failed 5406f5e9 slapd destroy: freeing system resources. 5406f5e9 slapd stopped. 5406f5e9 connections_destroy: nothing to destroy. *********************end of logfile***************

1 0

ppolicy and repeated password
by Stefano Zanmarchi 03 Sep '14

03 Sep '14

Hi all, we'd like to use the ppolicy overlay to implement password locking after a certain number of bind failures. Sadly ppolicy does not distinguish between failures with different passwords (probably a dictionary attack) and failures with the same password (a client using an old, expired, password). This would easily lead to locking out users shortly after password change. I read that Zytrax has developed for Mozilla a modified version of ppolicy: http://www.zytrax.com/books/ldap/ch6/ppolicy.html which can distinguish between unique and repeated passwords. The page states the modified mozilla-ppolicy is available for openldap 2.4.11 and 2.4.16. Has anyone tried it with a newer version of openldap? Is it working? Thank you in advance, Stefano

1 0

accesslog-based consumer stuck on objectClass modify on provider
by Francesco Malvezzi 02 Sep '14

02 Sep '14

Hi all, yesterday I changed a structural objectClass for a entry with the relax control (control: 1.3.6.1.4.1.4203.666.5.12): dn: uid=cognos,ou=agents,dc=example,dc=org control: 1.3.6.1.4.1.4203.666.5.12 changetype: modify replace: objectClass objectClass: inetOrgPerson - add: sn sn: cognos On provider all ok. Provider is mirrormode and other mirror side is ok. The accesslog-based syncrepl on a consumer was stuck. Neither the modify nor the other next modifies were propagated. Is relax control unsupported in this scenario? Did I forget something really important? thank you, Francesco PS: I deleted on provider from accesslog db the entry corresponding to the said modify, restarted both consumer and provider and replica started again.

3 3

ACLQuestion
by Karl Heinz Wichmann 01 Sep '14

01 Sep '14

Hallo I have a problem with acl. We have following sturctur. dc=a,dc=b,dc=c | |-ou=ww-a | |-ou=ww-b | |-ou=ww-c | |-ou=ww-x | |-ou=system In each ww-a,b,c...x have we users and groups. In system we have system account (in groups and users) When we search with an ldap client like thunderbird addressbook, the users in system should not be visible. I use follow rule didn't run: olcAccess: {1}to filter="(objectclass=inetOrgperson)" attrs=entry,uid,sn,cn,mail,givenName by dn="cn=ad,ou=sys_ad,ou=people,dc=a,dc=b,dc=c" read by * none the following rule, i found all users (incl. ad, admin and so on) olcAccess: {1}to filter="(objectclass=*)" attrs=entry,uid,sn,cn,mail,givenName by dn="cn=ad,ou=system,dc=a,dc=b,dc=c" read by * none I want to avoid regex when posible. Karl Heinz

1 0

LMDB write/read simultaneously over different threads
by Vasilis Lasdas 29 Aug '14

29 Aug '14

Hi all, I am a new user to LMDB. Please forgive me for my ignorance or mistakes you might encounter. However, I have spent quite some time trying to resolve my issues but without a success. That's why I am writing to you asking for your help to shade some light. To the point: 1) I am having a database where there is only one writer and a few readers(e.g. 4 readers). 2) The database-writer lives on different thread than the database-reader(s). 3) The writer-thread keeps on running/writing all the time to the database. 4) At random intervals readers from different threads will request to extract data from the database. The problem that occurs is the following: If the writer is active( during writing), If I try to fetch any data from the db using the reader, it fails, with error MDB_NOTFOUND. As a remark here, I make sure that the reader-thread is launched AFTER the writer thread to ensure that the data exist in the db. In order to simulate this kind of behaviour(write-read) over different threads, I have written a small test application, that tries to depict my case/usecase. In main() I simply launch two threads/functions, the writer-thread and after some time, the reader thread. The common enviroment is constructed() in main and passed as parameter to the auxilliary functions. If the reader starts reading while writing is not finished, then the application crashes or returns MDB_NOTFOUND. This contradicts with the capabilities of the library, that is, parallel write/read from different threads. If the writer has finished, then the reader works properly. Some general questions. i) How many times do i need to open the database? Currently I open the (unique) database twice: one in the writer and one in the reader. The doc mentions that it has to be opened only one time. Even in that case, my app does not work. ii) What is the practical usage of mdb_txn_reset() and mdb_txn_renew()? Does it need to be used in my case? iii) Since I am only ADDING data in the db and only READING them, what kind of optimizations can be applied? iv) Regarding for-loops, what is a proper way of using the trasnactions and commit/abort/reset/etc of transactions? Please any helpfull information is highly apprecited or if someone can add some examples with different threads that would be awesome. #include <iostream> #include <thread> #include <assert.h> #include <string> #include "lmdb.h" #include <unistd.h> using namespace std; void writeLMDB( MDB_env * env, size_t nrElems ) { cout << "BEGIN WRITING." << endl; MDB_txn *txn; MDB_dbi dbi; MDB_stat status; // create transaction assert( MDB_SUCCESS == mdb_txn_begin( env, NULL, 0, &txn ) ); // open db assert( MDB_SUCCESS == mdb_open( txn, NULL, MDB_DUPSORT , &dbi ) ); // this commit-transaction is needed since we are creating the db for the first time assert( MDB_SUCCESS == mdb_txn_commit( txn ) ); MDB_val key, data; // begin (again a new transaction) assert( MDB_SUCCESS == mdb_txn_begin( env, NULL, 0, &txn ) ); // keep on writing elements in the db for( size_t i = 0; i < nrElems ; ++i ) { key.mv_size = sizeof( size_t ); key.mv_data = &i; string value = "test"; data.mv_size = value.size(); data.mv_data = (void*)value.data(); cout << "WRITER-KEY:" << *(size_t*)key.mv_data << " VALUE:" ; cout.write( (char*)data.mv_data, data.mv_size ); cout << endl; assert( MDB_SUCCESS == mdb_put( txn, dbi, &key, &data, 0 ) ); } assert( MDB_SUCCESS == mdb_txn_commit( txn ) ); assert( MDB_SUCCESS == mdb_env_stat( env, &status ) ); mdb_close( env, dbi ); cout << "FINISHED WRITING." << endl; } void readLMDB( MDB_env * _env, size_t start, size_t end ) { cout << "BEGIN READING.." << endl; MDB_dbi dbi; MDB_txn *txn = NULL; // lmdb operations assert( MDB_SUCCESS == mdb_txn_begin( _env, NULL, MDB_RDONLY, &txn ) ); assert( MDB_SUCCESS == mdb_open( txn, NULL, 0, &dbi ) ); // key+data MDB_val key, data; for ( size_t i = start; i <= end ; i++ ) { key.mv_size = sizeof( size_t ); key.mv_data = &i; int res = mdb_get( txn, dbi , &key, &data ); //cout << "READER-KEY:" << *(size_t*)key.mv_data << " VALUE:" ; cout.write( (char*)data.mv_data, data.mv_size ); cout << endl; if( res != 0 ) cout << "error fetching data" << endl; } // close db mdb_close( _env, dbi ); cout << "FINISHED READING.." << endl; } int main(int argc, char *argv[] ) { // db location(folder must exist) string dbLocation = "/work/vasilis/databases/lmdbtest/"; size_t maxdbSize = 10485760; system( "rm -rf /work/vasilis/databases/lmdbtest/*" ); //create enviroment:ONE enviroment only for one process MDB_env * _env; assert( MDB_SUCCESS == ( mdb_env_create( &_env ) ) ); //set the size of the database assert( MDB_SUCCESS == mdb_env_set_mapsize( _env, maxdbSize ) ); // open the enviroment: ready to be used by everyone else assert( MDB_SUCCESS == mdb_env_open( _env, dbLocation.c_str(), 0 , 0664 ) ); // writer-thread: write 1000 elements in the database thread writethread( writeLMDB, _env, 1000 ); usleep( 1000 * 100 ); // read from - to thread readthread( readLMDB, _env, 0, 20 ); // wait for threads to finish writethread.join(); readthread.join(); cout << "THREADS COMPLETED " << endl; // close the enviroment mdb_env_close( _env ); return 0; } regards, Vasilis

1 0

Passwords, Hashing, and Binds
by Bram Cymet 29 Aug '14

29 Aug '14

Hi, I am storing users passwords in a userPassword attribute. When the passwords are hashed with MD5 I can bind as the user just fine. If I hash the password with sha-256 I get invalid credentials. Is there something I have to change in my client? Is there something I have to change on the server? Is binding a user with a password stored with sha-256 (or at least something better then md5) even possible? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical