openldap-technical

openldap-technical@openldap.org

9897 discussions

replicating central NSS data (was: DBIS - new IETF drafts)
by Michael Ströder 08 Jan '14

08 Jan '14

(I take this point to openldap-technical(a)openldap.org since it discusses OpenLDAP-specific things.) Howard Chu wrote: > The discussion of caching here > http://www.ietf.org/id/draft-bannister-dbis-mapping-02.txt is one such example > - this is purely a client-side implementation issue. Also you give nscd as an > example, and nscd has been thoroughly discredited and is well known to be > unsuitable for real use. Critical deployments can use a local LDAP server with > a replica of the central data, to avoid error-prone caching implementations. > This is a commonly recommended approach when using OpenLDAP nssov, for example. I really wonder how this replication approach works in practice without disclosing too much data on a system more exposed to attacks from the outside. In theory one could implement partial replication based on systems's bind identity. But in practice I have some doubts because in a really paranoid setup you don't even want to disclose replication meta data and intermediate entries of the tree structure. Ciao, Michael.

2 1

Problem with back-mdb
by Grégory T 08 Jan '14

08 Jan '14

Hello, before starting, we wish a happy new year to the community ! Now, we start with presentation. We have compiled the Openldap build version 2.4.38 on a ubuntu 12.04. This openldap server is a dual processor Intel Xeon with 4 Gb Memory. This machine is virtualized (vmware). Openldap is configured with back-mdb, overlays memberof and syncprov, and envflags writemap and nosync. We encounter a problem with a callback procedure in a perl script. This script have to remove a couple of attributes for each entry (~120 000). In order to save memory consumption, we use a callback function to treat each entry one after one. Everything works with back-bdb but ... there are mistakes with back-mdb. In ldap.log, this kind of message appears many times : ldapserver slapd[7264]: connection_input: conn=1014 deferring operation: awaiting write ldapserver last message repeated 55 times And suddenly, ldapserver slapd[7264]: conn=1014 fd=14 closed (connection lost) Our script result in "connection reset by peer" message. The script stop around the 1040 entry. Although the connection was closed by server, it still continue to run. However, no explicit message in ldap.log. If we run the script once again, the next ~1040 entries will be treated and the script stop. We have try with envflags writemap and nosync deactivated ... but unsuccessful. This is the ldapsearch request : my $result=$ldapMaster->search(base=>$baseDN,scope=>'sub',filter=>$filter,typesonly=>'1',callback=>\&callback); And this is the callback function : sub callback{ my ($search,$ent)=@_; return unless defined $ent; my $entry = $search->shift_entry(); my @tabAttribToDel=(); if (defined $entry){ my $dn=$entry->dn(); $countDN++; foreach my $attrib($entry->attributes){ if ($attrib ~~ @tabOldAttrib){ $countAttrib++; push (@tabAttribToDel,$attrib); } } if (($SUPPR==1) && (@tabAttribToDel)) { $countTrace++; my $result = $ldapMaster->modify($dn,delete => \@tabAttribToDel); warn "(nbEntry:$countTrace, nbAttr:$countAttrib) Error with $dn: ".$result->error."\n" if $result->code; } } } Why is this script working well with back-bdb but not with back-mdb ? Thanks, -- Grégory Trucy Ingénieur système et réseau Aix-Marseille Université

3 2

replication of databases with different backends???
by lux-integ 08 Jan '14

08 Jan '14

Greetings, I have two computers with these:- host 1: --cpu amd64 3 cores --os blfs linux-3.10.24, openldap-2.4.33 with bdb backend host 2: --cpu amd64 3 cores --os blfs linux-3.10.24, openldap-2.4.33 with sql backend QUESTION: can I replicate these databases over each host (in other words can I for example do N-ray multimaster syncrepl ( http://www.openldap.org/doc/admin24/replication.html ) or another type of replication in view of the different backends ? thanks in advance sincerely luxnteg

4 3

Search filter for ou=Groups
by jupiter 07 Jan '14

07 Jan '14

Hi, How can I search for displaying all members in ou=Groups only? I added a filter (&(objectClass=posixGroup)(ou=Groups)), but nothing displayed (I can get every entries if the filter is not used) ldapsearch -x -W -D cn=insecure,dc=ldap,dc=hce,dc=org "(&(objectClass=posixGroup)(ou=Groups)" # extended LDIF # # LDAPv3 # base <dc=ldap,dc=hce,dc=org> (default) with scope subtree # filter: (&(objectClass=posixGroup)(ou=Groups)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Thanks. jupiter

2 1

openldap problem with synchronization
by Robert Mach 07 Jan '14

07 Jan '14

Hello, I have troubles using openldap replication in Centos 6.4. and Centos 5.3 I have two server with following version of openldap from centos repository configures as multimaster replication (internal servers): openldap-servers-2.4.23-32.el6_4.1.x86_64 openldap-clients-2.4.23-32.el6_4.1.x86_64 openldap-2.4.23-32.el6_4.1.x86_64 Then I have one external server with following products: openldap-servers-2.3.43-12.el5_5.3 openldap-clients-2.3.43-12.el5_5.3 openldap-2.3.43-12.el5_5.3 Then two internal servers are configured as multi-master replication and everything is working fine. The external server is configures as slave replication from one of those internal servers using the following configuration: CODE: SELECT ALL database bdb suffix "o=test,c=cz" rootdn "cn=Manager,o=test,c=cz" directory /var/local/ldap/test.cz index entryCSN,entryUUID eq index objectClass eq,pres index ou,cn,mail eq,pres,sub syncrepl rid=132 provider=ldaps://xxxxx.xxx.xxx type=refreshOnly interval=00:00:01:00 searchbase="o=test,c=cz" filter="(!(objectclass=simpleSecurityObject))" scope=sub updatedn="cn=SyncMaster,o=test,c=cz" bindmethod=sasl saslmech=external attrs="objectClass,cn,sn,ou,o,mail,serialNumber,userCertificate,cACertificate,certificateRevocationList,authorityRevocationList,entrustPolicyCertificate,crossCertificatePair" schemachecking=on There is a problem with replication from internal server to external. If I delete the database of external server and start the consumer, everything is correctly replicated from the provider (internal server) to the consumer. Therefore I assume, that the replication is configured correctly. But if the servers are running for a while and changes are made on the Provider (internal server) some data are not replicated to the consumer. More precisely the contextCSN of the root of the tree of consumer (external server) is updated and is the same as on the Provider(internal server), but some entries lower in the three are not replicated correctly, both the entry entryCSN and the entry data itself are not updated on the Consumer. Do you have any idea where could be the problem? Thank you, Rob

6 8

OpenLDAP can manage IP/MAC/Assets and other information?
by Tian Zhiying 07 Jan '14

07 Jan '14

Hi OpenLDAP can manage IP/MAC/Assets and other information? If it can, what schema I need to add ? Thanks. Tian Zhiying

2 1

"ber write failed", followed by slapd not responding
by Chris Down 07 Jan '14

07 Jan '14

Hello, I am having a small problem with an OpenLDAP master at work. Twice today, at seemingly random intervals, it has stopped responding to all queries, and all clients lose connection to the master, immediately after printing the following message in the debug log: Jan 7 10:04:58 ldap slapd[20310]: send_search_entry: conn 1851 ber write failed. There are no more messages printed before or after this for hours. I looked at the source, but it didn't seem particularly illuminating (it looks like this happens when send_ldap_ber() doesn't write anything and returns 0 bytes, but I don't know how to debug that, since there are a lot of conditions there that return 0). I saw this[0] thread, but we are already using 2.4.23 on Debian Squeeze, so it appears to not be the same problem: @(#) $OpenLDAP: slapd 2.4.23 (Dec 16 2012 11:48:44) $ root@carillon:/tmp/buildd/openldap-2.4.23/debian/build/servers/slapd I am not aware of performing any changes to our LDAP configuration recently. How should I go about debugging this? Is this a known issue? I searched openldap-bugs, but I didn't find anything recent that seemed related. Thanks. 0: http://www.openldap.org/lists/openldap-technical/200907/msg00199.html

1 0

Re: Search in Active Directory Proxy with multiple level of OU
by Michael Lois 07 Jan '14

07 Jan '14

Thank you for the reply, Dieter. I tried the following config: rwm-suffixmassage "ou=user,dc=company,dc=com" "OU=All Users,dc=internal,dc=company,dc=com" rwm-map attribute uid sAMAccountName Simple searches work ( ldapsearch -W -x -b "ou=user,dc=company,dc=com" uid=michael), but some of our application needs to specify the binding of which OU the user belongs to. From the above example, if we do a search on proxy with "ldapsearch -xW -b "cn=Michael Lois,ou=user,dc=company,dc=com", the proxy would need to translate it into "cn=Michael Lois,ou=Accounting,OU=All Users,dc=internal,dc=company,dc=com" on AD, without the need for user to provide that Michael Lois on the Accounting OU. Is this possible? I think my problem is similar to this one in the older thread in 2009, but seems like this quesiton was still open: http://www.openldap.org/lists/openldap-technical/200902/msg00090.html

2 1

DBIS - new IETF drafts to replace NIS and RFC2307
by Mark R Bannister 06 Jan '14

06 Jan '14

In August this year, I submitted some new IETF drafts with the intent that they would replace NIS and RFC2307. It introduces Directory Based Information Services (DBIS). Michael Ströder suggested I post a link to this mailing list. The following article (and further articles on my blog) discuss some of the aspects of DBIS, and link to all of the relevant internet drafts: http://technicalprose.blogspot.co.uk/2013/08/introducing-dbis.html I am currently working on a reference implementation here: http://sourceforge.net/projects/dbis/ This may be coming out of the blue for many of you, and I appreciate you may need some time to read and digest my drafts, and then ask me lots of questions. But my first question to you is, where is the best place for discussion related to these drafts? Is this the mailing list to use? Best regards, Mark Bannister. e: dbis(a)proseconsulting.co.uk

3 2

mod_athnz_ldap module for Fedora 19
by Tharmakulasingam Jeyjenthan 06 Jan '14

06 Jan '14

Hi, I am trying to get mod_athnz_ldap module to connect apache server with openldap server in Fedora 19. But there are RPM modules for fedora except for Fedora 19. How can i achieve this? Any Suggestion. Thanks in advance. Regards, T.Jeyjenthan

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical