openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

NEW LDAP PROJECT
by Borresen, John - 0442 - MITLL 04 Mar '14

04 Mar '14

All, There is a new project; a group that I support will be using OpenAM to manage single sign-on (SSO). The environment is outward facing, where multiple entities (outside users) will log on to a web portal via openam/opensso. The OpenAM will query the OpenLDAP (currently it is an embedded OpenDJ implementation) for user information. Based on their user credentials they will, hopefully, be forwarded to either a Production, Development or a Demonstration environment. The group wants to migrate to OpenLDAP as OpenDJ is 1) not friendly 2) very slow. I've been looking around at the OpenAM/OpenDJ configuration and most of the schemas are specifically legacy Sun Microsystems & Java specific. Basically, the OpenLDAP will be the User-store for OpenAM. 1) Should I migrate those schemas and everything else currently in OpenDJ over to OpenLDAP and import them? 2) What is the recommended methodology that I should follow to best implement the above scenario? Any pointers are much appreciated. Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu

3 2

Troubleshooting OpenLDAP replication
by Igor Zinovik 03 Mar '14

03 Mar '14

Hello, list. I'm experiencing synchronization problem with my ldap provider-consumer setup. Both nodes are running OpenLDAP 2.4.38 (using mdb backend) at x86_64 under Linux 3.7.10. Both servers synchronize their time with one NTP server, so clocks are in sync. I have cn=dhcp,dc=my,dc=org containter which I would like to replicate to openldap consumer. Consumer uses old-fasioned slapd.conf file: # [... include, acl and logging settings skipped ...] rootdn "cn=root,dc=my,dc=org" rootpw [ skipped ] index objectClass eq index entryCSN eq index entryUUID eq index dlzHostname eq index dlzZoneName eq index dlzIPAddr eq index dlzType eq index dhcpHWAddress eq index cn eq,approx,sub syncrepl rid=1 ... syncrepl rid=2 provider=ldap://172.20.20.207 type=refreshAndPersist interval=00:00:01:00 retry="60 +" searchbase="cn=dhcp,dc=my,dc=org" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=dhcpd,ou=services,dc=my,dc=org" credentials="[ skipped ]" Problem is that not all changes (adding new objects and changing attributes of existing objects) are replicated from master to consumer. I make change on master by hand, but I do not see log entries on consumer that changed attribute was replicated. LDAP provider setup (uses online configuartion): dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" size=unlimited olcLimits: {1}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" time=unlimited olcLimits: {2}group/groupOfNames/member="cn=admins,ou=mail,ou=groups,dc=my,dc=org" size=unlimited olcLimits: {3}group/groupOfNames/member="cn=replicators,ou=groups,dc=my,dc=org" size=unlimited time=unlimited User uid=dhcpd,ou=services,dc=my,dc=org is member of group cn=replicators,ou=groups,dc=my,dc=org. dn: cn=Replicators,ou=Groups,dc=my,dc=org cn: Replicators member: uid=dhcpd,ou=services,dc=my,dc=org Indices on master server: olcDbIndex: dhcpHWAddress,dhcpClassData eq ACL for cn=dhcp,dc=my,dc=org container (I have only one ACL entry, that mentions cn=dhcp,dc=my,dc=org): ... olcAccess: {15}to dn.subtree="cn=dhcp,dc=my,dc=org" by group/groupOfNames/member.exact="cn=dhcp readers,ou=dhcp,ou=groups,dc=my,dc=org" read by group/groupOfNames/member.exact="cn=dhcp writers,ou=dhcp,ou=groups,dc=my,dc=org" write ... dn: cn=dhcp readers,ou=dhcp,ou=Groups,dc=my,dc=org cn: dhcp readers objectClass: groupOfNames objectClass: top member: uid=dhcpd,ou=Services,dc=my,dc=org So for now I checked following: 1. Clocks on both server (both are in sync) 2. ACL for replication DN (replication user is able to read all needed data). 3. Size and time limits for replication DN (replication user has no limits on operations). 4. Schema (objectClasses and attrubutes) on both servers (both nodes use same schemas). 5. Disable indices on consumer server for replicated attributes from cn=dhcp,dc=my,dc=org container (not helped) What else I can check? BTW, I would be pleased if someone give somekind of systematic approach for troubleshooting OpenLDAP replication issues.

1 0

OpenLDAP: slapi & contrib overlays
by Sergio NNX 03 Mar '14

03 Mar '14

Hi, I'm building OpenLDAP 2.4.39 from source under MinGW. A couple of questions: a) I added '--enable-slapi' to configure. I got a few compilation errors. Is slapi Windows ready? b) I added some contrib modules (e.g. allop, lastbind, etc) and tried to link them statically. Compilation and linking worked OK. Then, I type: slapd -VVV and I expect to see those contrib modules listed under the overlay section. None of them appear. I added 'overlay allop' to slapd.conf, but when slapd starts, I get: 5314932d overlay "allop" not found 5314932d ..\etc\openldap\slapd.conf: line 30: <overlay> handler exited with 1! Can anyone point me to the right direction? Thanks in advance. Ciao, Sergio.

2 2

back-sql mysql and multiple DITs
by Robson, Alan 03 Mar '14

03 Mar '14

Hi, I have tried to set up a single instance of slapd serving information from two DITs that have been defined in separate mysql databases. I can comment out the database entries for either DIT, and everything works for the other DIT. But it won't support the two DITs simultaneously (it seems random which DIT will return results and which returns "no such object" when I restart slapd with both DITs configured). All the odbc stuff for both backends seems fine, isql runs and of course either database can be accessed through ldapsearch if it is the only one slapd serves. I can even run two instances of slapd, one with each DIT and successfully query them separately with ldapsearch, but I'd prefer one instance with the two DITs if possible. Could you please help me get this running, or is it just the law that only one sql backend can be used per server ? Many thanks Alan Slaptest says (when both DITs are defined in one slapd.conf)... WARNING: No dynamic config support for database sql. WARNING: No dynamic config support for database sql. config file testing succeeded slapd.conf (with both backends/DITs) is: # $OpenLDAP$ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # loglevel 64 moduleload /usr/lib64/openldap/back_sql.la include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/farm.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org #pidfile /usr/local/var/slapd.pid #pidfile /var/run/openldap/slapd.pid #argsfile /usr/local/var/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=server,dc=farm" rootdn "cn=root,dc=server,dc=farm" rootpw *********** dbname openldap dbuser openldap dbpasswd *************** subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no database sql suffix "dc=lab,dc=farm" rootdn "cn=root,dc=lab,dc=farm" rootpw ********** dbname lab dbuser ldap dbpasswd ******** subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no

2 3

replication delay problem
by Cyril Grosjean 02 Mar '14

02 Mar '14

I use a couple of OpenLDAP 2.4.36 servers in a multi-master replication setup. Write operations are sent to a single server, and then replicated to the second one. I sometimes have write operations "peaks" of about 900 operations (modifications of the pwdFailureTime attribute mainly) per hour. The number of bind failures per user is neither limited nor reset yet and I especially noticed a script that connects to the directory with the same service account and (wrong) password. So, until this script is modified with the right password (which will take time, unfortunately), it can generate tons of failures, and thus tons of replications. I noticed a several minutes replication delay between the directories, at peak time, when comparing the contextCSN attributes. It looks to me a big delay with regards to the number of modifications. Anything I could do to limit that delay ?

4 11

Dell Inspiron B130 repair
by Michael 01 Mar '14

01 Mar '14

Good evening. I’d like to have my DC power jack repaired on my Dell Inspiron B130 as well as have the keyboard replaced if possible. Please let me know what the additional costs would be for the keyboard. Thanks Michael Starling 860.381.9284

1 1

Fwd: Re: Aw: Re: LMDB get value
by Howard Chu 01 Mar '14

01 Mar '14

-------- Original Message -------- Subject: Re: Aw: Re: LMDB get value Date: Sat, 01 Mar 2014 13:39:47 -0800 From: Howard Chu <hyc(a)symas.com> To: Markus Doppelbauer <doppelbauer(a)gmx.net> CC: Markus Doppelbauer wrote: > You are right. Thanks a lot! > An other question. Is there a "define"-option to compile LMDB without a > dependency to "libpthread"? (We will replace Daniel Bernsteins "CDB" for > performance reasons with LMDB - so locking is not required). No, nor is such a flag needed. LMDB readers do no locking anyway. If you're replacing CDB, then none of this matters. > Thanks a lot > Markus > *Gesendet:* Samstag, 01. März 2014 um 17:04 Uhr > *Von:* "Howard Chu" <hyc(a)symas.com> > *An:* "Markus Doppelbauer" <doppelbauer(a)gmx.net>, openldap-technical(a)openldap.org > *Betreff:* Re: LMDB get value > Markus Doppelbauer wrote: > > Hello, > > Test case (modified sample-mdb.c): > > http://doppelbauer.name/bug.c.txt > > If I run this proram the first time, LMDB finds the key. The second time, > > mdb_cursor_get() returns NOTFOUND. > > How to fix this issue? > > You're using an invalid dbi the second time, you didn't call mdb_dbi_open(). > > > Thanks a lot > > Markus > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

LMDB get value
by Markus Doppelbauer 01 Mar '14

01 Mar '14

2 1

slapd.ldif beginner
by Sonny Taberman 01 Mar '14

01 Mar '14

Hi all ldap people. I have been trying this new way of configuring a slapd server from scratch. Sorry to say total failure on my side. I'm not sure where to begin. I have built a linux system from LFS Linux from scratch. So I want to install openldap from source, so far no problems. When my installation is done i have a directory in /etc/ named openldap and the content inside is this: DB_CONFIG.example ldap.conf ldap.conf.default schema slapd.conf slapd.conf.default slapd.ldif slapd.ldif.default To start configure my slapd using slapd.conf there is no problem. Actually I'm beginning to think I'm pretty good att this. :-) But then I try to read all I can find about configure a new slapd using slapd.ldif, not that easy. I understand that I need a new directory named slapd.d. After that I have no clue. I guess something is hardcoded in slapd but what am I supposed to do next? How can i communicate with slapd ? I guess I have to define a password somewhere for a manager or administrator but how and where? Is there a tutorial somwhere ? All I need is how to start. :-) best regards Sonny

3 3

Re: ldap_add: Object class violation (65), additional info: attribute 'host' not allowed
by W Forum W 27 Feb '14

27 Feb '14

Thanks!!! I found the same solution just before, it saved my day :-) Kind Regards On 02/27/2014 05:20 PM, Harry Jede wrote: > W Forum W wrote: >> Hi I tried to create a custom auxiliary class but I get this error >> >> attributetype: Inconsistent duplicate attributeType: "host" >> >> If I change the attributeType: "host" to attributeType: "hosts" >> it works. But I need the 'host' attribute.not 'hosts' > Its simple. "host" is defined in "account". So dont declare it twice, > just use it. > > # exists already in account > #attributetype ( 1.3.6.1.4.1.9554.1 > # NAME 'host' > # DESC 'host computer' > # EQUALITY caseIgnoreMatch > # SUBSTR caseIgnoreSubstringsMatch > # SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} > # ) > > objectclass ( 1.3.6.1.4.1.9554.0 > NAME 'teststuff' > SUP top > AUXILIARY > DESC 'Abstraction of an account with extra attributes' > MAY ( host ) > ) > >> How can I solve this? >> >> My schema looks like >> >> attributetype ( 1.3.6.1.4.1.9554.1 >> NAME 'host' >> DESC 'host computer' >> EQUALITY caseIgnoreMatch >> SUBSTR caseIgnoreSubstringsMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} >> ) >> >> objectclass ( 1.3.6.1.4.1.9554.0 >> NAME 'teststuff' >> SUP top >> AUXILIARY >> DESC 'Abstraction of an account with extra attributes' >> MAY ( host ) >> ) >> >> Thanks

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical