openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Multi-master replication (ldap_sasl_bind_s failed)
by Artur Nike 16 Dec '13

16 Dec '13

Hi all, My adventure with LDAP lasts a few months, and I came to the topic of replication, namely multiple-master replication. cn = config is replicated perfectly, but the schema, say, dc = example, dc = com does not want to: (. I have two servers slap1 and slap2 I have a standard installation ##Server slap1 whezzy debian 64bit apt-get install-y slapd ldap-utils added my scheme ldapadd-Y EXTERNAL-H ldapi :///-f $ CURRENT / memberof.ldif ldapadd-Y EXTERNAL-H ldapi :///-f $ CURRENT / refint.ldif # Add "ldap :/ / ldap1 / in /etc/default/slapd sed-i "/^ SLAPD_SERVICES/s/=[^]*/=\"ldap:\/\/slap1\//'/etc/default/slapd ldapmodify-Y EXTERNAL-H ldapi :/ / /-f replica1.ldif where replica1.ldif (replication configuration):: dn: cn=config changetype: modify add: olcServerID olcServerID: 1 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}syncprov.la dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW #only for tests olcRootPW: 123 dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://slap1/ olcServerID: 2 ldap://slap2/ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://slap1/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://slap2/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE This same scenario takes on a server slap2 (the name change slap1 -> slap2) where replica2.ldif (replication configuration only servers slap2) : dn: cn=config changetype: modify add: olcServerID olcServerID: 2 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}syncprov.la dn: olcDatabase={0}config,cn=config changetype: modify #only for tests add: olcRootPW olcRootPW: 123 dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://slap1/ olcServerID: 2 ldap://slap2/ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://slap1/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://slap2/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE and it works , the whole configuration is replicated . Now I want ( I'm trying to add a replication scheme . ) Adds only one server , eg slap2 : ldapmodify - Y EXTERNAL -H ldapi :/ / / -f rep_schema.ldif where rep_schema.ldif : # add replica schema dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: 123 - replace: olcRootDN olcRootDN: cn=admin,dc=example,dc=com dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcLimits olcLimits: dn.exact="cn=admin,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited - add: olcSyncRepl olcSyncRepl: rid=004 provider=ldap://ldap1/ binddn="cn=admin,dc=example,dc=com" bindmethod=simple credentials="123" searchbase="dc=example,dc=com" starttls=no filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=of type=refreshAndPersist interval=00:00:00:10 retry="5 5 10 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://ldap2/ binddn="cn=admin,dc=example,dc=com" bindmethod=simple credentials="123" searchbase="dc=example,dc=com" starttls=no filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=off type=refreshAndPersist interval=00:00:00:10 retry="5 5 10 5" timeout=1 - add: olcDbIndex olcDbIndex: entryUUID eq - add: olcDbIndex olcDbIndex: entryCSN eq - add: olcMirrorMode olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Configuration replicates and the end, schema does not replicate. If you try to replicate one of the servers are in the logs I see: Dec 15 23:44:48 slap1 slapd[4496]: do_syncrepl: rid=004 rc -1 quitting Dec 15 23:44:48 slap1 slapd[4496]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:48 slap1 slapd[4496]: do_syncrepl: rid=005 rc -1 retrying Dec 15 23:44:58 slap1 slapd[4496]: =>do_syncrepl rid=005 Dec 15 23:44:58 slap1 slapd[4496]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:50 slap2 slapd[4456]: do_syncrepl: rid=004 rc -1 retrying Dec 15 23:44:54 slap2 slapd[4456]: =>do_syncrepl rid=005 Dec 15 23:44:54 slap2 slapd[4456]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:54 slap2 slapd[4456]: do_syncrepl: rid=005 rc -1 quitting Dec 15 23:45:00 slap2 slapd[4456]: =>do_syncrepl rid=004 Dec 15 23:45:00 slap2 slapd[4456]: slap_client_connect: URI=ldap://ldap1/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) from server slap2 to search slap1: ldapsearch -x -D cn=admin,dc=example,dc=com-H ldap://slap1/ -b dc=example,dc=com -w 123 (working) from server slap1 to search slap2: ldapsearch -x -D cn=admin,dc=example,dc=com-H ldap://slap2/ -b dc=example,dc=com -w 123 (working) I'm out of ideas... user : DN="cn=admin,dc=example,dc=com" is created automatically when I install slapd Can anyone have any suggestions or experience with this problem. For all, thank you in advance. Muniek

1 1

RE24 testing call (OpenLDAP 2.4.37)
by Quanah Gibson-Mount 15 Dec '13

15 Dec '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.37 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

12 32

2.4.36 : too many open files
by Aaron Bennett 14 Dec '13

14 Dec '13

Just to clarify - subject on original post was wrong - version is 2.4.36. From: Aaron Bennett Sent: Tuesday, December 3, 2013 9:58 AM To: 'openldap-technical(a)openldap.org' Subject: 2.4.26 : too many open files Hi, I just ran into this yesterday on CentOS 6 / OpenLdap 2.4.36, my own build against bdb 5.1.29 and OpenSSL. Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): /var/lib/ldap/log.0000032796: log file unreadable: Too many open files Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: Too many open files Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: fatal region error detected; run recovery Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: fatal region error detected; run recovery Dec 2 16:55:40 animal slapd[13735]: null_callback : error code 0x50 I never did anything to change the default process limit, looks like it's set to 1024 in /proc/$(pidof slapd)/limits. Is there anything I can do short of an automatic restart to prevent that from cropping up again? I have an MMR via Syncrepl setup with nothing too complicated; can't think of any reason offhand that slapd would need to have more than 1024 files open. Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS W:508.793.7315

4 3

Max length allowed for a password
by Rob Tanner 13 Dec '13

13 Dec '13

Hi, We are looking at extending the allowed length of passwords we allow people to use (the theory being that a short phrase is easier to remember than a shorter, but arbitrary string of characters). But since we use our ldap server for authentication to a whole host of online tools, including several portals, I need to know the max length of the source password when doing a bind. Thanks, Rob Rob Tanner UNIX Services Manager Linfield College, McMinnville Oregon ITS will never ask you for your password. Please don’t share yours with anyone!

4 7

Re: Upgrading from Ubuntu-packaged 2.4.28 to self-built 2.4.38
by Philip Colmer 12 Dec '13

12 Dec '13

> You only responded about one My second paragraph addressed the second suggestion. I did *try* to edit the LDIF file and then use slapadd but it wasn't working. In retrospect, the reason it wasn't working was because I didn't have the correct slapadd command-line options. Therefore, I think that I didn't need to sym-link and that slapcat/slapadd was the appropriate way to go. On 12 December 2013 16:54, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 12, 2013 4:20 PM +0000 Philip Colmer > <philip.colmer(a)linaro.org> wrote: > >>> Huh? Why didn't you just use ldapmodify to modify it? Or, slapcat your >>> cn=config db, fix it in the LDIF, and reload it? >> >> >> Couldn't use ldapmodify to modify it because slapd wasn't running. >> Couldn't use ldapmodify to modify it whilst Ubuntu version was >> installed because that would break *that* version. Couldn't use >> ldapmodify to modify it whilst new version was installed because new >> version wouldn't start. > > > I listed two options. The other works when slapd is offline. You only > responded about one. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Upgrading from Ubuntu-packaged 2.4.28 to self-built 2.4.38
by Philip Colmer 12 Dec '13

12 Dec '13

> Huh? Why didn't you just use ldapmodify to modify it? Or, slapcat your cn=config db, fix it in the LDIF, and reload it? Couldn't use ldapmodify to modify it because slapd wasn't running. Couldn't use ldapmodify to modify it whilst Ubuntu version was installed because that would break *that* version. Couldn't use ldapmodify to modify it whilst new version was installed because new version wouldn't start. I think, in retrospect, that I was hitting two problems - the wrong path in cn=config and the wrong command to try and build a new cn=config from LDIF. It is possible that the correct command (which I eventually found in another mail thread) avoids this whole issue. On 12 December 2013 16:14, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 12, 2013 1:40 PM +0000 Philip Colmer > <philip.colmer(a)linaro.org> wrote: > >> dn: cn=module{0} >> objectClass: olcModuleList >> cn: module{0} >> olcModulePath: /usr/lib/ldap >> olcModuleLoad: {0}back_hdb >> >> olcModulePath, if defined, is referenced INSTEAD OF any environment >> variables like PATH or LD_LIBRARY_PATH. >> >> /usr/lib/ldap is the Ubuntu path. The new location is >> /usr/local/libexec/ldap. Since I can't edit the ldif file, I put in a >> symbolic link. > > > Huh? Why didn't you just use ldapmodify to modify it? Or, slapcat your > cn=config db, fix it in the LDIF, and reload it? > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

Upgrading from Ubuntu-packaged 2.4.28 to self-built 2.4.38
by Philip Colmer 12 Dec '13

12 Dec '13

Our current implementation of OpenLDAP is Ubuntu 12.04 running version 2.4.28 which has been installed as a package. To upgrade to 2.4.38, it looks like I need to remove that package and then install my own built binaries. Has anyone gone through this process before and got any tips/notes to share? I'm particularly thinking that there will be some path changes to contend with. For example, my main HDB database seems to be in /var/lib/ldap but the migration steps suggest that everything is in /usr/local/var/openldap-data/. Clearly I can work through this but if someone has already done it and can share lessons learnt, that would be much appreciated. Philip

4 5

Running slapcat and slapd at the same time
by Chris Card 12 Dec '13

12 Dec '13

Hi all, I am running openldap 2.4.36 with Berkeley DB 4.6.21 under centos 6.3 64 bit on a Dell 710 with 96 Gb RAM. My slapd configuration sets the BDB cachesize to use a shared memory segment of 47 Gb (id2entry.bdb is about 40 Gb currently). I use slapcat to take regular backups using the same configuration as slapd, running in parallel with slapd, and the backup works successfully, but uses a lot of memory when it is running. I would like to be able to run slapcat with a smaller memory requirement, and to this end I have experimented with running slapcat with a different configuration as follows: 1. create a work directory 2. create links in the work directory to the .bdb files 3. slapcat cn=config to an ldif file 4. edit the ldif file to change the db data directory to the work directory and change the olcDbConfig settings to use less memory 5. slapadd the ldif file to create a new slapd.d config directory in the work directory 6. run slapcat with the new slapd.d config The reason for this approach is to allow slapcat to run with a different DB_CONFIG file to slapd. This appeared to work in testing, but in the production environment produced backups with data missing, while outputting no error messages. Is there a way to run slapcat with a different memory configuration to slapd? Chris

2 1

please fix ITS#6825
by Michael Ströder 12 Dec '13

12 Dec '13

HI! I have a setup where I cannot work around ITS#6825 by putting posixGroup entries in a single container. So I hit this bug again where slapo-unique does not behave as documented: http://www.openldap.org/its/index.cgi?findid=6825 Is there a chance to get this fixed soon? Ciao, Michael.

1 0

OPENLDAP BUILD/CONFIGURE
by Borresen, John - 0442 - MITLL 11 Dec '13

11 Dec '13

Attempting to upgrade to OpenLDAP 2.4.38 Receiving the following output : Configuring OpenLDAP 2.4.38-Release ... checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking target system type... x86_64-unknown-linux-gnu checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking configure arguments... done checking for ar... ar checking for style of include used by make... GNU checking for gcc... gcc checking whether the C compiler works... no configure: error: in `/opt/rpmbuild/BUILD/openldap-2.4.38': configure: error: C compiler cannot create executables See `config.log' for more details. Using the following options with ./configure: $ ./configure --disable-dependency-tracking --enable-ldap --enable-debug --prefix=/usr/local/openldap --libdir=/usr/local/openldap/lib64 --with-tls --with-cyrus-sasl --enable-spasswd --enable-overlays --enable-modules --enable-dynamic=no --enable-slapi --enable-meta --enable-crypt In the config.log seeing the following: configure:5744: $? = 127 configure:5764: checking whether the C compiler works configure:5786: gcc -DOPENLDAP_FD_SETSIZE=4096 -O2 -g -I/usr/local/berkeleydb/include -I/usr/kerberos/include -L/usr/local/berkeleydb/lib64 conftest.c -ldb -ldb-4.6 -ldb46 -ldb-4 -ldb-4-6 -lgcc_s >&5 ./configure: line 5788: gcc: command not found configure:5790: $? = 127 configure:5828: result: no configure: failed program was: | /* confdefs.h */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define PACKAGE_URL "" | #define OPENLDAP_PACKAGE "OpenLDAP" | #define OPENLDAP_VERSION "2.4.38" | #define LDAP_VENDOR_VERSION 20438 | #define LDAP_VENDOR_VERSION_MAJOR 2 | #define LDAP_VENDOR_VERSION_MINOR 4 | #define LDAP_VENDOR_VERSION_PATCH 38 | #define HAVE_MKVERSION 1 | /* end confdefs.h. */ ... configure:5833: error: in `/opt/rpmbuild/BUILD/openldap-2.4.38': configure:5837: error: C compiler cannot create executables See `config.log' for more details. Note: gcc is installed (/usr/bin/gcc) and is version 4.4.7 John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical