openldap-technical

openldap-technical@openldap.org

9 participants
9867 discussions

Deprecation of back-bdb
by Clément OUDOT 03 Feb '14

03 Feb '14

Hi, as Howard said in his conference at FOSDEM, back-bdb is deprecated, and is disabled by default. I just downloaded 2.4.39 tarball, and tested the configure script, it seems back-bdb is still activated by default: clement@ader:~/Programmes/openldap-2.4.39$ ./configure --help | grep bdb --enable-bdb enable Berkeley DB backend no|yes|mod [yes] Should I fill an ITS? Clément.

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 03 Feb '14

03 Feb '14

--On Friday, January 31, 2014 4:34 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I have turned off TLS for the time being. > > Now, I think it is an ACLs issue that I need to figure out...seeing the > following: > > ldap_write: want=531 error=Broken pipe > 52ec16ae ber_flush2 failed errno=32 reason="Broken pipe" > 52ec16ae connection_closing: readying conn=1074 sd=22 for close > 52ec16ae send_search_entry: conn 1074 ber write failed. > 52ec16ae connection_resched: attempting closing conn=1074 sd=22 > 52ec16ae connection_close: conn=1074 sd=22 > 52ec16ae daemon: removing 22 > 52ec16ae conn=1074 fd=22 closed (connection lost on write) > 52ec16ae daemon: activity on 1 descriptor > 52ec16ae daemon: activity on:52ec16ae > 52ec16ae daemon: epoll: listen=7 active_threads=0 tvp=zero That would not be an acl issue. broken pipes, flushing problems, etc... I generally see that with firewalls causing problems. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

problem with accessing secure ldap
by c chupela 03 Feb '14

03 Feb '14

I've been tasked with figuring out why a redhat 6.4 server w/openldap v2.4.23 is not accessible. This server is a test server. I have a production server that is working properly, and I've gone thru and compared config files, etc, but haven't found any differences. I'm a newbie with this, so my understanding is still somewhat limited. Here's what I've done or checked so far: - iptables is not running - if I run netstat, I can see port 389/port 636 in listening state: tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 5603/slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 5603/slapd tcp 0 0 :::636 :::* LISTEN 5603/slapd tcp 0 0 :::389 :::* LISTEN 5603/slapd I can telnet to port 389 on this server from another server, but not to port 636 - putty will throw back an immediate 'connection closed by remote host' message. I'm not seeing any slapd related messages in /var/log/messages. What else can I check on here? Thanks Chris

8 16

LMDB database size
by Markus Doppelbauer 01 Feb '14

01 Feb '14

5 6

slapd.d and back-sql
by Robson, Alan 01 Feb '14

01 Feb '14

Hi all, I'm trying to set up back-sql on Ubuntu using openldap version 2.4.39 that uses slapd.d as its configuration store. All of the config examples I can find online use slapd.conf. A 2011 email from this mailing list explains that it simply is not possible to use the slapd.d config method to specify a dbname. Is that still the case ? I am trying to add an entry for my mysql database using ldapadd and the following ldif... # order value not present so entry will be appended # to current children dn: olcDatabase=sql,cn=config objectClass: olcDatabaseConfig olcDatabase: mysql dbName: ldap olcSuffix: dc=nodomain The response I get is... adding new entry "olcDatabase=sql,cn=config" ldap_add: Undefined attribute type (17) additional info: dbName: attribute type undefined I tried dbname (no capital N) as well, but I get the same result. As you may be able to tell, I have a very loose grip on what to do here ! I'd appreciate some guidance. I am confident that I have odbc and the database/user set up as it describes in the manual section on back-sql. My database connection is called "ldap" in odbc.ini. /etc/odbcinst.ini: [mysql] Description = ODBC for MySQL Driver = /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.so Setup = /usr/lib/x86_64-linux-gnu/odbc/libodbcmyS.so FileUsage = 1 /etc/odbc.ini: [ldap] Description = MySQL connection to 'test' database Driver = mysql Database = ldap UserName = ldap Password = ldap Server = localhost Port = 3306 Socket = /var/run/mysqld/mysqld.sock If I need to go back to using slapd.conf, how can I generate one from my slapd.d setup ? Many thanks Alan

2 3

OpenLDAP compatibility between client and server of different versions
by Fabien C. 01 Feb '14

01 Feb '14

Hello, I have a few questions about OpenLDAP versions compatibility: - How to know what version of OpenLDAP client is compatible with what version of the server? - Is there backward or forward compatibility tables from the client and/or server point of view? - For a given version of the server, how to know which clients are compatible, and conversely? - And most important: what about replication? Thank you! Fabien C.

2 3

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 2:37 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I am using OpenSSL 0.9.8 (CentOS rpm version -- CentOS 5.9), > unfortunately and I cannot upgrade it. Oddly it works for all other > connections between these systems and clients...I don't understand why it > isn't for this portion. Well, you're at a point where I don't know how to help you further. Something's definitely wrong with your TLS stack, but I've no idea what. ;) --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Syncrepl and mmr
by Michael Ströder 31 Jan '14

31 Jan '14

Borresen, John - 0442 - MITLL wrote: > I'm not trying to implement partial replication. Missed the smiley? Your *first* ACL should give read access to the whole tree to the group of replicas and then pass on all other access checking to the subsequent ACLs (by * break). Something like: limits group="cn=replicas,dc=example,dc=com" time=unlimited size=unlimited access to dn.subtree="ou=ampua" by group="cn=replicas,dc=example,dc=com" read by * break Ciao, Michael. > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Friday, January 31, 2014 2:15 PM > To: Quanah Gibson-Mount; Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org > Subject: Re: Syncrepl and mmr > > Quanah Gibson-Mount wrote: >> --On Friday, January 31, 2014 1:20 PM -0500 "Borresen, John - 0442 - MITLL" >> <John.Borresen(a)ll.mit.edu> wrote: >> >>> Thanks, Quanah >>> >>> Not sure what you meant by " Well, it may not have been this issue, but >>> it definite would become an issue then." >>> >>> Was what I did a good thing or not? Curious minds want to know. <lol> >> >> The lack of read permissions for the replication user would absolutely be an >> issue at some point. ;) > > To put it the other way round: > It's very hard to implement partial replication correctly. ;-} > > Ciao, Michael.

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 2:25 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > I'm not trying to implement partial replication. Throwing darts from 100 > miles away and trying to hit a penny nailed to the opposite side of > tree...yes that is what I feel like I'm doing. : At this point, I've no idea what you've done to break your servers in relation to TLS. I would ask what SSL implementation you are linked to (Openssl, GnuTLS, or MozNSS). --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

RE: Syncrepl and mmr
by Quanah Gibson-Mount 31 Jan '14

31 Jan '14

--On Friday, January 31, 2014 1:20 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Thanks, Quanah > > Not sure what you meant by " Well, it may not have been this issue, but > it definite would become an issue then." > > Was what I did a good thing or not? Curious minds want to know. <lol> The lack of read permissions for the replication user would absolutely be an issue at some point. ;) > MM Server1: ># ldapsearch -H ldap://mm-server1.example.ldap -d 256 -x -D ># cn=admin,cn=config -W -ZZ -b olcDatabase=\{1\}bdb,cn=config olcSyncrepl What CA cert is your ldapsearch command using? --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical