openldap-technical

openldap-technical@openldap.org

8 participants
9968 discussions

OpenLDAP crash when defining multiple olcDbURI for chaining
by Khosrow Ebrahimpour 12 Sep '14

12 Sep '14

Hello list, I am trying to setup referral chaining in a multi-master setup. I can setup chaining to one of the masters without any problems. And I can perform a MOD operation that is then referral chased and performed on the master. However, when I define both masters the replica crashes when I do a MOD operation. Snippet of cn=config from the working example: dn: olcDatabase={1}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {1}ldap olcDbStartTLS: start starttls=yes olcDbIDAssertAuthzFrom: {0}* olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbURI: ldap://ldap-m1.example.com olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=com" credentials="secret" keepalive=0:0:0 starttls=yes tls_reqcert=allow If I change olcDbURI to either of the entries below, the replica server crashes * olcDbURI: "ldap://ldap-m1.example.com,ldap://ldap-m2.example.com" * olcDbURI: "ldap://ldap-m1.example.com ldap://ldap-m2.example.com" According to slapd-ldap(5), the URI list can be comma or space separated. I've turned on "args" and "trace" debugging to troubleshoot, but never get any errors in the logs. I only see an attempt to chase the referral followed by an immediate crash (see log snippet at the end of email). Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able to replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. Any help is much appreciated. -- Khosrow Ebrahimpour Crash Log: Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 modifications: Sep 8 21:07:23 ldap-rep1 slapd[20947]: replace: givenName Sep 8 21:07:23 ldap-rep1 slapd[20947]: one value, length 1 Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 MOD dn="uid=user1,ou=people,dc=example,dc=com" Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 MOD attr=givenName Sep 8 21:07:23 ldap-rep1 slapd[20947]: bdb_dn2entry("uid=user1,ou=people,dc=example,dc=com") Sep 8 21:07:23 ldap-rep1 slapd[20947]: => hdb_dn2id("ou=people,dc=example,dc=com") Sep 8 21:07:23 ldap-rep1 slapd[20947]: <= hdb_dn2id: got id=0x6 Sep 8 21:07:23 ldap-rep1 slapd[20947]: => hdb_dn2id("uid=user1,ou=people,dc=example,dc=com") Sep 8 21:07:23 ldap-rep1 slapd[20947]: <= hdb_dn2id: got id=0xe Sep 8 21:07:23 ldap-rep1 slapd[20947]: entry_decode: "" Sep 8 21:07:23 ldap-rep1 slapd[20947]: <= entry_decode() Sep 8 21:07:23 ldap-rep1 slapd[20947]: send_ldap_result: conn=1000 op=1 p=3 Sep 8 21:07:23 ldap-rep1 slapd[20947]: send_ldap_result: err=10 matched="" text="" Sep 8 21:07:23 ldap-rep1 slapd[20947]: send_ldap_result: referral="ldap://ldap-m1.example.com/uid=user1,ou=people,dc=example,dc=com" Sep 8 21:07:23 ldap-rep1 slapd[20947]: >>> dnPrettyNormal: <uid=user1,ou=people,dc=example,dc=com> Sep 8 21:07:23 ldap-rep1 slapd[20947]: <<< dnPrettyNormal: <uid=user1,ou=people,dc=example,dc=com>, <uid=user1,ou=people,dc=example,dc=com> Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 ldap_chain_op: ref="ldap://ldap-m1.example.com/uid=user1,ou=people,dc=example,dc=com" -> "ldap://ldap-m1.example.com" Sep 8 21:09:02 ldap-rep1 slapd[21057]: @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd

2 3

LDAP_OPT_DESC historic
by Michael Ströder 12 Sep '14

12 Sep '14

HI! What does it mean that there's the comment "historic" at constant LDAP_OPT_DESC in ldap.h? Is there another option value one should use to get the file descriptor of a connection? Ciao, Michael.

1 0

difference between configuration file
by Gremaud Cyrill 12 Sep '14

12 Sep '14

Hello List, I don’t understand the difference between /etc/ldap/ldap.conf and /etc/default/slapd For exemple, what is the difference between URI and SLAPD_SERVICES ? I want to authorise LDAP protocol only from localhost and only LDAPS for the external… How can I do this ? thanks

2 1

Multiple threads and mdb_dbi_open
by Harry B 11 Sep '14

11 Sep '14

Hello, As per the documentation here http://symas.com/mdb/doc/group__mdb.html#gac08cad5b096925642ca359a6d6f0562a I see the following, "This function must not be called from multiple concurrent transactions. A transaction that uses this function must finish (either commit or abort) before any other transaction may use this function." This seems to imply that after one txn has begun on an environment, I cannot create another txn or dbi until the first one has finished - that doesn't seem to be right. If I have multi-threaded app, what is the expected sequence for creation of Environment, Transaction, and DBI handles? Any help is appreciated. -- Harry

2 4

Re: Replication breaks and needs restart - version 2.4.30
by Raja T Nair 11 Sep '14

11 Sep '14

Hello Quanah, Thanks for your suggestion. I will seriously consider upgrading my installations. For now, the issue seems resolved by setting TCP keepalive values in my servers. Regards, Raja. On 9 September 2014 22:44, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, September 09, 2014 1:42 PM +0530 Raja T Nair < > rtnair(a)gmail.com> wrote: > > >> >> >> >> Hello All, >> >> >> I am running openldap-2.4.30 in multiple locations, and all are >> replicating from a single Provider. >> > > Upgrade to a current release, to start with. 2.4.30 is ancient, and > numerous replication related bugs have been fixed since that release. > Second, you may want to configure TCP keepalive settings in the syncrepl > setup, as it seems like you have a device between the replicas and master > that is timing out the connections. Hard to really know for sure, however. > > --Quanah > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- :^)

1 0

RE24 testing call (2.4.40)
by Quanah Gibson-Mount 10 Sep '14

10 Sep '14

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.39 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

7 8

question on ldap_unbind_ext_s
by Aditham, Radhakrishna 09 Sep '14

09 Sep '14

Hi, We have a long running server that tries to get a new LDAP handle if the current handle becomes invalid (LDAP_SERVER_DOWN error, etc). However if I call ldap_unbind_ext_s() on the old handle to release it, it hangs with the following stack: (gdb) bt #0 0x000000080166935c in read () at read.S:2 #1 0x00000008014748f0 in __read (fd=68, buf=0x803293003, nbytes=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/freebsd-c/lib/libthr/thread/thr_syscalls.c:384 #2 0x0000000802c715d2 in sb_stream_read (sbiod=0x8088070d0, buf=0x803293003, len=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:493 #3 0x0000000802c7207e in sb_debug_read (sbiod=0x803291220, buf=0x803293003, len=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:827 #4 0x0000000802356971 in tlso_bio_read (b=0x803205400, buf=0x803293003 "\027\003\001", len=5) at tls_o.c:687 #5 0x000000080252c2df in BIO_read () from /usr/lib/libcrypto.so.1.0.0 #6 0x0000000802eb9f01 in ssl3_read_n () from /usr/lib/libssl.so.1.0.0 #7 0x0000000802eba3ce in ssl3_read_bytes () from /usr/lib/libssl.so.1.0.0 #8 0x0000000802eb67ac in ssl3_shutdown () from /usr/lib/libssl.so.1.0.0 #9 0x0000000802356cf6 in tlso_sb_close (sbiod=0x803291250) at tls_o.c:808 #10 0x0000000802c71253 in ber_int_sb_close (sb=0x803291160) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:383 #11 0x000000080233d625 in ldap_free_connection (ld=0x804c48c00, lc=0x8088080f0, force=1, unbind=1) at request.c:769 #12 0x000000080232ffa2 in ldap_ld_free (ld=0x804c48c00, close=1, sctrls=0x0, cctrls=0x0) at unbind.c:93 #13 0x000000080232fe8b in ldap_unbind_ext (ld=0x804c48c00, sctrls=0x0, cctrls=0x0) at unbind.c:52 #14 0x000000080232fec5 in ldap_unbind_ext_s (ld=0x804c48c00, sctrls=0x0, cctrls=0x0) at unbind.c:61 ...... I want to make sure that there are memory leaks etc, hence the attempt to release the invalid handle. Question: What is the best or correct way to release an invalid LDAP handle? Appreciate any help. Thanks R.K. Aditham

2 2

Replication breaks and needs restart - version 2.4.30
by Raja T Nair 09 Sep '14

09 Sep '14

Hello All, I am running openldap-2.4.30 in multiple locations, and all are replicating from a single Provider. Though it seems working fine initially, the replication stops as time progresses. The only way to bring it back is to restart clients. Here are the relevant configuration lines from my provider and consumers: Provider: ----------- overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: ----------------- syncrepl rid=203 provider=ldap://192.168.1.101:389 type=refreshAndPersist searchbase="dc=com" retry="120 3" attrs="*,+" scope=sub bindmethod=simple binddn="cn=user1,ou=people,dc=mydomain,dc=com" credentials="user1pass" It would be great if someone can help me with this situation. Currently I keep restarting every client, and it breaks the respective operation being served by the client every now and then. Thanks in Advance, Raja. -- :^)

2 1

Counting the total number of users in an AD forest
by Sankar P 09 Sep '14

09 Sep '14

Hi, Is there a way to count the total number of user objects in an AD forest. I do not want the names/details of any of these user objects. But I just want a programmatic way of finding the total number of AD users. Is it possible to achieve ? Could not get anything related from Googling. Thanks. -- Sankar P http://psankar.blogspot.com

3 2

Error when trying to setup olcMirrorMode
by Gremaud Cyrill 09 Sep '14

09 Sep '14

Hello, I'm trying to setup N-way multimaster replication for cn=config only (for the moment). I have problem when I try to add olcMirrorMode: TRUE. Here is my ldif file to do this: dn: olcDatabase={0}config,cn=config changetype: modify add: olcMirrorMode olcMirrorMode: TRUE and the error is the following : root@ldap1:~/downloads/ldif/config# ldapmodify -Y EXTERNAL -H ldapi:// -f 7_addMirrorMode.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I have tried a lot of things but nothing working. Please I really need your help. Thanks a lot. Cyrill Gremaud

3 6

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical