openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

search on multimaster gives 2 different results
by Gare Calhoun 19 Dec '13

19 Dec '13

Hello, We are running 2 servers in multimaster mode ; openldap-2.4.35 on CentOS 6.6 using the autogroup overlay. I have a search filter (APersonCategory=*ADJ*) that returns different numbers of records when queried against each server. The actual records exist on both servers. 1 server is not returning all expected records. The other server returns records as expected. There is no index defined for this attribute in slapd.conf on either server. schema definition of attribute is same on each server: attributetype ( 1.3.6.1.4.1.5923.1.1.1.23 NAME 'APersonCategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Would someone suggest what to look at to troubleshoot this? Thank you very much for your assistance. -Gare Calhoun -- . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gare Calhoun Antioch University IT Services, Software Developer

1 0

Fw: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 19 Dec '13

19 Dec '13

Low Sensitivity/Aerospace Internal Use Only Quanah, I downloaded the RPMs for OpenLDAP-LTB, but I didn't see anything that looked like my prior OpenLDAP (original) files. With my prior set, I was doing configuration changes in the /etc/openldap/slapd.d/cn=config directory's files. I didn't feel comfortable with moving forward because I found no README file or Getting Started or whatever. I was also looking for such documentation on the www.ltb-project.org website so that I could get a preliminary idea of what I was going to do, before I executed the installation and configuration steps. One of my major concerns is the ability to update the binaries on a regular basis for security purposes. I need to do it very easily and without re-engineering a yum repository every time there is an update. I am going to be building this LDAP system on a totally isolated environment, NO internet access at all. Can you (or anyone else) tell me, do I need to register with the LTB-Project.org website in order to find good, solid, installation and configuration instructions for what I need to accomplish? I am a newbie at OpenLDAP, I am senior in UNIX skills. I just have never had a single successful implementation of OpenLDAP. Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/19/2013 01:04 PM ----- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Warron S French <Warron.S.French(a)aero.org>, openldap-technical(a)openldap.org, Date: 12/18/2013 01:06 PM Subject: Re: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only Sent by: openldap-technical-bounces(a)OpenLDAP.org --On Wednesday, December 18, 2013 12:38 PM -0500 Warron S French <Warron.S.French(a)aero.org> wrote: > Low Sensitivity/Aerospace Internal Use Only > > Sorry, I thought I had replied back to the list. Apparently I have to > forward my responses to the list. > > I am checking into the options you suggested. I will probably pursue the > LTB Project, would you agree that's the better course of action? It's magnitudes better than what ships with RHEL/CentOS. Plenty of people use it with success. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration Low Sensitivity/Aerospace Internal Use Only

2 1

Monitoring back-mdb's olcDbMaxSize
by Michael Ströder 19 Dec '13

19 Dec '13

HI! Using back-mdb there's one thing which could cause trouble: One has to configure olcDbMaxSize which cannot be changed later. So when monitoring OpenLDAP with back-mdb it would be interesting to see how much space of configured olcDbMaxSize is already occupied. Does it make sense to compare the real file size shown by du -h /path/to/data.mdb to configured olcDbMaxSize? Ciao, Michael.

4 5

Fw: Fw: LDAP ERROR 19 CONTRAINT VIOLATION --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 19 Dec '13

19 Dec '13

Low Sensitivity/Aerospace Internal Use Only John, what was your solution? Was it a syntax error? Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/19/2013 09:41 AM ----- From: "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> To: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org>, Date: 12/19/2013 09:06 AM Subject: RE: LDAP ERROR 19 CONTRAINT VIOLATION Sent by: openldap-technical-bounces(a)OpenLDAP.org Nevermind, resolved it. From: openldap-technical-bounces(a)OpenLDAP.org [ mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, John - 0442 - MITLL Sent: Thursday, December 19, 2013 8:36 AM To: openldap-technical(a)openldap.org Subject: LDAP ERROR 19 CONTRAINT VIOLATION Adding sudo.schema (sudo.ldif) to cn=schema,cn=config: # ldapadd -H ldap:/// -x -D cn=admin,cn=config -W -f /usr/local/openldap/etc/openldap/schema/sudo.ldif Enter LDAP Password: adding new entry "cn=sudo,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Currently, my schema?s are: cn={0}core cn={1}cosine cn={2}inetorgperson cn={3}java cn={4}misc cn={5}nis cn={6}openldap cn={7}policy cn={8}2307bis cn={9}printers John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu Low Sensitivity/Aerospace Internal Use Only

1 0

LDAP ERROR 19 CONTRAINT VIOLATION
by Borresen, John - 0442 - MITLL 19 Dec '13

19 Dec '13

Adding sudo.schema (sudo.ldif) to cn=schema,cn=config: # ldapadd -H ldap:/// -x -D cn=admin,cn=config -W -f /usr/local/openldap/etc/openldap/schema/sudo.ldif Enter LDAP Password: adding new entry "cn=sudo,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Currently, my schema's are: cn={0}core cn={1}cosine cn={2}inetorgperson cn={3}java cn={4}misc cn={5}nis cn={6}openldap cn={7}policy cn={8}2307bis cn={9}printers John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 1

TLS: peer cert untrusted or revoked (0x42)
by Kumar, Amit 18 Dec '13

18 Dec '13

Dear All, We have installed a newer version of Ubuntu 13.10 and trying to setup LDAP client. Context: Self signed server CA certificate in pem format installed on the client with a hashed symbolic link pointing to it. We have other clients that are able to validate and are working great, hence I do not think this is a certificate issue, and also it is not expired. And I get this legendary error "TLS: peer cert untrusted or revoked (0x42)" for which number of recommendation have been made online, to set TLS_REQCERT & TLS_CACERT in the /etc/ldap.conf Although this did not work for me. While openssl and gnutls command can successfully connect and validate the certificate, ldapsearch and getent miserably fails. Any insight into this error and an approach to fix this will be greatly appreciated. Best Regards, Amit

1 1

Syncrepl on glued databases only replicates the superior and the first subordinate
by Robert Minsk 18 Dec '13

18 Dec '13

Openldap version 2.4.35 Our global ldap server has the following naming contexts: namingContexts: o=global,ou=studios,dc=methodstudios,dc=net namingContexts: o=chi01,ou=studios,dc=methodstudios,dc=net namingContexts: o=det01,ou=studios,dc=methodstudios,dc=net namingContexts: o=la01,ou=studios,dc=methodstudios,dc=net namingContexts: o=ny01,ou=studios,dc=methodstudios,dc=net namingContexts: o=lon01,ou=studios,dc=methodstudios,dc=net namingContexts: o=van01,ou=studios,dc=methodstudios,dc=net namingContexts: ou=studios,dc=methodstudios,dc=net namingContexts: ou=login,dc=methodstudios,dc=net ou=studio,dc=methodstudios,dc=net is the superior database and global, chi01, det01, la01, ny01, lon01, van01 are all have "subordinate advertise" and are all sync providers. The sync provider: database mdb suffix "ou=studios,dc=methodstudios,dc=net" rootdn ... rootpw ... directory /var/lib/ldap/studios.methodstudios.net maxsize 17179869184 serverID 201 overlay glue overlay syncprov syncprov-reloadhint TRUE syncprov-checkpoint 100 5 sync_use_subentry true ... The sync consumer only has a database for ou=studios,dc=methodstudios,dc=net. database mdb suffix "ou=studios,dc=methodstudios,dc=net" rootdn ... rootpw ... directory /var/lib/ldap/studios.methodstudios.net maxsize 17179869184 serverID 202 syncrepl rid=201 provider=ldap://<providor host name> type=refreshAndPersist retry="60 10 300 +" searchbase="ou=studios,dc=methodstudios,dc=net" bindmethod=simple starttls=yes binddn="..." credentials=... schemachecking=off sizelimit=unlimited timelimit=unlimited updateref ldap://<providor host name> It seems to be only syncing ou=studios,dc=methodstudios,dc=net and o=global,ou=studios,dc=methodstudios,dc=net. If I change the order of the provider server so that chi01 comes before global then only syncing ou=studios,dc=methodstudios,dc=net and o=chi01,ou=studios,dc=methodstudios,dc=net get sync. Am I doing anything obviously wrong? -- Robert Minsk Systems and Software Engineer WWW.METHODSTUDIOS.COM <http://www.methodstudios.com> 730 Arizona Ave, Santa Monica, CA 90401 O:+1 310 434 6500 <tel:+13104346500> // F:+1 310 434 6501 <tel:+13104346501> Los Angeles <http://www.methodstudios.com/signature/url/los-angeles><http://www.methodstudios.com/signature/url/los-angeles> This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.

1 1

Oracle OpenLDAP 2.4.30 add on PPOLICY
by David Barr 18 Dec '13

18 Dec '13

Thank you, Perfec, Dieter. I cannot compile the OpenLDAP.org version. I have tried several suggested methods from internet to test the policy, none work as I get syntax error. Suggestions? Example: openldapwhoami -e ppolicy -X -D "cn=Manager,dc=$DC1,dc=$DC2" "uid=$U" ldapsearch -e ppolicy -D "uid=user02,ou=People,dc=training,dc=com" -W Is there a command to see what policies are loaded via slapd.conf ? - David. --------------------------------------------------------- Am Tue, 17 Dec 2013 18:35:10 +0000 schrieb David Barr <David.Barr2(a)mclaneat.com>: > I am trying to get policy to work in an Oracle Solaris 11 environment. > Trouble is it is pre-compiled, anyone know how I can use a policy > that didn't come with the OpenLDAP 2.4.30-0.175.1.0.0.24.0 ? Run slapd -VVV in order to check the build in modules of slapd. -Dieter -- Dieter KlÃnter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53Â37'09,95"N 10Â08'02,42"E ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

3 2

Re: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Quanah Gibson-Mount 18 Dec '13

18 Dec '13

--On Wednesday, December 18, 2013 11:21 AM -0500 Warron S French <Warron.S.French(a)aero.org> wrote: > Low Sensitivity/Aerospace Internal Use Only > > Quanah, thank you for responding. Please keep replies on the list. > I have since my email updated all of my servers using yum > kernel-<whatever> update, and gotten my three virtual systems updated all > to CentOS-6.4, and on the same kernel. So, can we agree I have addressed > situation-A? Or do I need to update further? Yes, 6.4 is fine. > As for situation-B, thank you for filling me in. I was getting really > frustrated and was starting to think I was doing something wrong. But, > can you tell me, does symas or LTB come in a CentOS package format? > Something I can maintain easily instead of building from source code? Yes, I suggest you follow the links I provided. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: OPENLDAP UPGRADE
by Quanah Gibson-Mount 18 Dec '13

18 Dec '13

--On Wednesday, December 18, 2013 11:33 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Yea, that's is what I was thinking, too. Ran netstat: > ># netstat -tulpn | grep ':389' | grep 'LISTEN' > tcp 0 0 :::389 :::* > LISTEN 25516/java > > Why java is LISTENING on port 389...I have no idea! I am thinking since > someone (not me) tried to build OpenDJ, it still has some fingers out > there holding onto resources. Time to use "kill -9". --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical