openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Overlay ppolicy not found
by Rodrigo Coutinho 30 Jan '14

30 Jan '14

Hi, I'm new to LDAP and have searched your site and others, but have found nothing. I've installed OpenLdap 2.4.35 on a Red Hat Linux 5.9, following the instructions on this site. I've migrated the users and groups from the production database (Oracle). Now, I would like to set Password policies and have altered the slapd.conf accordingly. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/ppolicy.schema # Load dynamic backend modules: modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la moduleload ppolicy.la ####################################################################### # BDB database definitions ####################################################################### overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,ou=config,dc=ifap,dc=local" However, when I execute slapd, I get the following error message: 52ea27a8 @(#) $OpenLDAP: slapd 2.4.35 (Oct 21 2013 16:37:56) $ root@abc00102:/u01/ldap/openldap-2.4.35/servers/slapd 52ea27a8 overlay "ppolicy" not found 52ea27a8 slapd stopped. 52ea27a8 connections_destroy: nothing to destroy. So, can I install the policy after installing OpenLdap or must I reinstall everything again ? Should I use the ppolicy.la or the ppolicy.so as stated in http://www.zytrax.com/books/ldap/ch6/ppolicy.html <http://www.zytrax.com/books/ldap/ch6/ppolicy.html> ? # required if the overlay is built dynamically loadmodule ppolicy.la # OR loadmodule ppolicy.so Thank you in advance Rodrigo Coutinho A transmiss�o de mensagens por e-mail n�o � absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destru�da, chegar ao destinat�rio com atraso, ou mesmo com v�rus, n�o obstante o IFAP utilizar software anti-v�rus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informa��o confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinat�rios. Se n�o for o destinat�rio pretendido, informamos que a recebeu por engano, pelo que, qualquer utiliza��o, distribui��o, reencaminhamento ou outra forma de revela��o a terceiros, impress�o ou c�pia s�o expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema inform�tico. O IFAP declina qualquer responsabilidade por erros ou omiss�es na presente mensagem e eventuais consequ�ncias, que resultem das situa��es referidas.

2 1

Re: [LMDB] Error 87 followed by MDB_PAGE_NOTFOUND
by Hallvard Breien Furuseth 29 Jan '14

29 Jan '14

On 2014-01-29 23:10, Alain wrote: > On Wed, Jan 29, 2014 at 4:36 PM, Hallvard Breien Furuseth > <h.b.furuseth(a)usit.uio.no> wrote: > >> On 2014-01-29 16:58, Alain wrote: >> >>> While running our app (which seemed to be running slow on this last >>> job), I ended up receiving an rc:87 on a commit, which my app >>> couldn't >>> recover from. I have verified that I have free disk space, free RAM. >> >> Error numbers are OS-dependent. What's errno 87? >> E.g. what does this say: perl -le '$! = 87; print $!' > > I'm running under Windows and have perl only under Cygwin, so not > sure if the results are meaningful, but I get: > $ perl -le '$! = 87; print $!' > Cannot exec a shared library directly Not meaningful, no. Google(windows error 87) says ERROR_INVALID_PARAMETER, which ought to mean a programmer error in your application. If this is code which worked previously, then maybe it lacks error checking. E.g. you're doing mdb_txn_begin() which fails and you use the resulting txn anyway. >> Which LMDB version and operating system do you use? > > I am at commit 5bda356, from 23 days ago and this is running under > Windows 7. > >> If the latest commit was bad, maybe previous one is >> OK. We need to give mdb_copy an option to make a >> backup using the oldest instead of youngest commit. >> Then you'll lose just the last commit instead of >> everything. >> >> That sounds good, as I'm thinking that this is the 2nd copy that >> Howard described during one of his presentation. Yes. -- Hallvard

1 0

[LMDB] Error 87 followed by MDB_PAGE_NOTFOUND
by Alain 29 Jan '14

29 Jan '14

While running our app (which seemed to be running slow on this last job), I ended up receiving an rc:87 on a commit, which my app couldn't recover from. I have verified that I have free disk space, free RAM. Upon restart, after the db was opened, the first process started and quickly reported an MDB_PAGE_NOTFOUND on a call to mdb_cursor_get For your info, here the db info as reported during the restart: Env Stats:{ms_branch_pages=0, ms_psize=4096, ms_depth=1, ms_leaf_pages=1, ms_overflow_pages=0, ms_entries=23} Info:{me_last_pgno=678442, me_mapaddr=0, me_mapsize=4194304000, me_last_txnid=112652, me_maxreaders=300, me_numreaders=0} Data Db Stats:{ms_branch_pages=315, ms_psize=4096, ms_depth=4, ms_leaf_pages=71375, ms_overflow_pages=25, ms_entries=7768832} Primitive Db Stats:{ms_branch_pages=990, ms_psize=4096, ms_depth=4, ms_leaf_pages=183396, ms_overflow_pages=17263, ms_entries=3537190} Incidence Db Stats:{ms_branch_pages=516, ms_psize=4096, ms_depth=4, ms_leaf_pages=86349, ms_overflow_pages=0, ms_entries=11534223} % Full:66.254105% 1- What could have caused this error 87, which seems to be related to some arguments issue? 2- More importantly, what can be done to avoid getting a db in a state like this which seems to me to be corrupted (and that's also what the doc says)? I am keeping the db should it be required for forensic analysis. Thanks Alain

2 1

MDB_BAD_VALSIZE error
by Chris Card 29 Jan '14

29 Jan '14

Hi All, I'm running openldap 2.4.36 on centos 6.3, 64 bit. I'm finally trying out MDB as a replacement for BDB in our openldap setup, and I've noticed that I'm getting MDB_BAD_VALSIZE errors when adding some DNs, which could be added without error when using BDB as the backend: 52e9170b <= mdb_dn2id_add 0x5da55e: -30781 52e9170b mdb_add: dn2id_add failed: MDB_BAD_VALSIZE: Too big key/data, key is empty, or wrong DUPFIXED size (-30781) Looking at the code, it seems that this error happens when MDB_MAXKEYSIZE is exceeded and MDB_MAXKEYSIZE is set to 511 as far as I can see. The DNs which are giving this error are between 232 and 255 characters long. Does the MDB backend have an implicit limit on the length of valid DNs? Can this be increased (by changing MDB_MAXKEYSIZE) and if so, what is the longest DN which can be supported by the MDB backend? Chris

3 5

Ldapdelete
by Borresen, John - 0442 - MITLL 28 Jan '14

28 Jan '14

All, Attempting to backtrack a bit by deleting an overlay using the following (have tried both with & without the escape character with the same error "Invalid DN": # ldapdelete -W -x -ZZ -D cn=admin,cn=config -v -d 9 "olcOverlay=\{0\}syncprov,olcDatabase=\{0\}config,cn=config" And receiving the following error: ... read1msg: ld 0xb749c40 0 new referrals read1msg: mark request completed, ld 0xb749c40 msgid 3 request done: ld 0xb749c40 msgid 3 res_errno: 34, res_error: <invalid DN>, res_matched: <> ldap_free_request (origid 3, msgid 3) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_delete: Invalid DN syntax (34) additional info: invalid DN ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 TLS trace: SSL3 alert write:warning:close notify ldap_free_connection: actually freed Here is a slapcat of that "olcDatabase". # slapcat -s olcDatabase=\{0\}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: _________________________________= olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 4354a8b6-8a36-4804-81f8-14a8550aef74 creatorsName: cn=config createTimestamp: 20131218155313Z entryCSN: 20131218155313.477459Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20131218155313Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 644d3984-d125-446e-aae2-1ddc541f4661 creatorsName: cn=admin,cn=config createTimestamp: 20140121191314Z entryCSN: 20140121191314.076259Z#000000#004#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20140121191314Z Thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 0

indexing warning considered harmful
by Michael Ströder 28 Jan '14

28 Jan '14

HI! We all know the following messages in syslog (loglevel stats): mdb_equality_candidates: (foo) not indexed At first glance this seems helpful to find indexing issues. But IMO 1. this is somewhat mis-leading. regarding performance tuning and 2. if internal searches are conducted (e.g. by set-based ACLs) the amount of the very same indexing warnings is really annoying and costs performance due to excessive logging. AFAIK a set of search candidates is derived from filter assertions by first searching the indexed attributes. Then the non-indexed assertions are tested but only on the search candidate set. Is this correct? If yes, then indexing an attribute which is present in many entries can lead to large search candidate set even though the amount of final search results are small. Consider the following simple example: (&(objectClass=posixAccount)(uid=foo)) With lots of user accounts this would lead to two search candidate sets, one very large and one with one entry (assuming uid values are unique). Not indexing objectClass would one result in *one* search candidate. So indexing objectClass might not be very wise. What do you think about this? Ciao, Michael.

3 4

slapadd question
by Mundry, Marvin 27 Jan '14

27 Jan '14

hi, when I use slapadd to setup cn=config I get > slapadd: warning, missing attrs entryUUID,entryCSN from entry dn="olcDatabase=bdb,cn=config" warnings (one for each database and overlay that is configured) as soon as I add an olcSyncrepl attribute to "dn: olcDatabase=config,cn=config" should I be worried about these warnings? what I am doing: slapadd -S 1 -bcn=config -l slapd.ldif -F slapd.d/ with slapd.ldif having the following content: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /usr/local/openldap/var/run/slapd.args olcPidFile: /usr/local/openldap/var/run/slapd.pid dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/openldap/libexec/openldap olcModuleload: back_bdb.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap/etc/openldap/schema/core.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=admin,cn=config olcRootPW:: e1NTSEF9L1Q1US9ibUl0V3pYRnpOUG9iajdsbk5IVVJmS2E5Ykk= olcSyncrepl: rid=001 provider=ldap://someldapserver/ binddn="cn=acme" credentials=secret bindmethod=simple searchbase="cn=config" type=refreshAndPersist dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcRootPW: secret olcDbDirectory: /usr/local/openldap/var/openldap-data Best regards, Marvin

2 1

Ldap Autofs Connection Issue
by Borresen, John - 0442 - MITLL 27 Jan '14

27 Jan '14

All, Here is an interesting dilemma that we are trying to figure out. server1.example.ldap server2.example.ldap client1.example.ldap All running 2.4.38, this is a test environment. Server1 is a client to itself, server2 is a client to itself, and client1 is a client to server2. client1's LDAP Autofs (in the /etc/nsswitch.conf) is pointing to server2...and it works fine. In the /etc/sysconfig/autofs file on the client (client1) the URI entry indicates: "ldap://server2.example.ldap"; and the /etc/nsswitch.conf file shows "ldap" On both server1 and server2, for now -- because if fails otherwise, the URI in the /etc/sysconfig/autofs shows "ldaps://server1.production.ldap"; and the /etc/nsswitch.conf file shows "ldap". As you can see, the production server is using port 636 (SSL), the test environment is using TLS over port 389. Neither test environment server holds the production certificates, and the production side is not holding the test environment certs. Another interesting tidbit, is all the Automount/NFS servers are NetApp filers and they hold certs for the Production Environment, except one which is a Test Filer (in the Test Environment). Sorry if this sounds like an old "Abbott & Costello" routine from the 30's... If anyone can shed some light on what to look for. That would be great. By the way, permission is not an issue. I can explicitly mount all mountpoints to all three in the test environment. The issue is LDAP and Autofs in the Test environment. Thanks, in advance. -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Dieter Klünter Sent: Friday, January 24, 2014 4:09 PM To: openldap-technical(a)openldap.org Subject: Re: Ldap Connection Issue Am Fri, 24 Jan 2014 14:45:25 -0500 schrieb "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu>: > All, > > Very similar issue that Warron was/is having. > > Server1: # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Server1: # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > These commands work (they returns the dbase as expect & desired), both > servers are clients to themselves and the other server (using > self-signed wildcard certificates) Both ldap.confs are identical, the > one on server1 was used on server2. The URI directive looks like: > > uri ldap://server1.example.ldap ldap://server1.<FQDN> > ldap://server2.example.ldap ldap://server2.<FQDN> > > Server2: > > a) # ldapsearch -W -x -ZZ -b cn=config -v -D cn=admin,cn=config > Fails with: > ldap_initialize( <DEFAULT> ) > ldap_start_tls: Connect error (-11) > > > b) # ldapsearch -W -x -ZZ -H ldap://server2.example.ldap -b > cn=config -v -D cn=admin,cn=config > > ldap_initialize( ldap://server2.example.ldap:389/??base ) > > ldap_start_tls: Connect error (-11) > > > c) # ldapsearch -W -x -ZZ -h ldap://server1.example.ldap -b > cn=config -v -D cn=admin,cn=config > > d) ldap_initialize( ldap://ldap:%2F%2Fserver1.example.ldap) > > e) Could not create LDAP session handle for > URI=ldap://ldap:%2F%2Fgp42-admin4.llan.ll.mit.edu (-9): Bad parameter > to an ldap routine > > There is one other client that like server1 can search the dbase(s) on > both servers (it too is a client of both servers). > > Any ideas at what to look for? read on ldapsearch(1) and distinction of -h and -H parameters. furthermore read on LDAP URL and escape sequences (RFC-4516). -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Question about olcServerID
by Philip Colmer 27 Jan '14

27 Jan '14

If I extend my existing OpenLDAP implementation to support N-way multi-master, is it acceptable for the first server to retain an olcServerID of 0 (the default when OpenLDAP gets installed) or do I need to change it to a non-zero value? Probably a stupid question but I thought I better ask before making any changes :-) Thanks. Philip

1 0

Re: SLAPD Proxy and AD backend - Binding by UPN.
by egidiomelissano＠libero.it 25 Jan '14

25 Jan '14

> You can configure dovecot to use any (unique) user record attribute for authentication Could you give me an example, please? Regards, Egidio.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical