openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Slapd sometimes stucks: slapd shutdown: waiting for N operations/tasks to finish
by Покотиленко Костик 20 Nov '13

20 Nov '13

Hi, In our 1 Master - several slaves environment master slapd sometimes stucks in such condition that it takes minutes to get replay to simple queries with no visible resource consumption on both: the slapd process itself and the linux it is running on. Restarting slapd helps for several days. Today I have not been able to restart it without kill -9 because of: slapd shutdown: waiting for 12 operations/tasks to finish Waited 5 minutes with no luck, kill -9, start. slapd: 2.4.28 OS: Ubuntu 12.04.2 LTS I'm Ok with "try latest version", but it would be nice to have some pointers (maybe bug in this version or error in configuration). The server is running for 6+ month with no problems. The stucks first appeared 2 weeks ago after changing ACLs to use group.exact instead of set which came deadly slow.

2 2

openldap syncrepl issue
by Chris Card 19 Nov '13

19 Nov '13

Hi All, I am running openldap 2.4.36 with BDB for my main backend db, and multi-master replication setup using delta-syncrepl with MDB for the cn=accesslog db. I monitor the contextCSN to check that replication is in sync, but I've noticed what looks like a bug: If I try to delete a non-existent DN from the main db on machine A, I see the delete attempt in the cn=accesslog db on machine A with status 32, but the contextCSN of the main db is not changed, as expected. On machine B the contextCSN of the main db is updated, as if the delete had succeeded, and then machine A appears to be behind machine B according to the contextCSN values. Is this a known bug? Chris

3 7

RE24 testing call (OpenLDAP 2.4.37)
by Sergio NNX 15 Nov '13

15 Nov '13

Ciao all. I'd like to contribute to this testing call. I'm afraid I haven't been as lucky as the rest of you, guys! I'm building OpenLDAP 2.4.37 from source under MinGW. When I type in: make check, all tests pass except the ones (quite a few, by the way) containing the following line: $SLAPADD -f $ADDCONF -l $LDIFORDERED (for instance here: test001-slapadd) ... 52812558 bdb_db_open: database "dc=example,dc=com": dbenv_open(testrun/db.1.a). Program received signal SIGSEGV, Segmentation fault. 0x008061de in pthread_mutex_unlock () (gdb) bt #0 0x008061de in pthread_mutex_unlock () #1 0x0055d2d1 in ldap_pvt_gettime () #2 0x0055d464 in ldap_pvt_csnstr () #3 0x004753b3 in slap_get_csn () #4 0x0041f2e5 in slap_add_opattrs () #5 0x00480fff in bdb_db_open () #6 0x00423647 in backend_startup_one () #7 0x00423785 in backend_startup () #8 0x0043f028 in slap_startup () #9 0x00477ed5 in slap_tool_init () #10 0x00476a3a in slapadd () #11 0x0080dcf3 in main () However, if I use: ldapadd ...... using exactly the same LDIF, it works fine. I've done some Google search but found nothing. Since I have no knowledge about how to fix this, I'd like to know whether there's a patch available somewhere or how I can overcome this issue. Thanks in advance. Sergio.

3 4

Replication fails after network outage
by Darouichi, Aziz 15 Nov '13

15 Nov '13

Hi, We are running 2 replicas one local and the other is remote. When there is a network interruption replication fails and I have to delete the entire database in the remote replica, and let it re-synch again. Is there a way to make the remote continue its replication after the network connection is established without having to delete the database or restart the services? Thank you,

6 10

Can a DN entry have multiple structural object class
by Harishkumar Pathangay 14 Nov '13

14 Nov '13

Hi, Can a DN entry have multiple structural object class? For example, an entry with inetOrgPerson Object class with custom object class, both being STRUCTURAL. Thanks,Harish Pathangay

2 1

trouble when switching from bdb to mdb database
by Aleksander Dzierżanowski 14 Nov '13

14 Nov '13

Hi. I have properly runnig setup of three multimaster OpenLDAP servers (version 2.4.36 from ltb project) with bdb database backend. Everything was working flawless so I decided to try out ‚new shiny' mdb database with the same configuration - the only thing I changed was removing ‚cache’ settings and adding ‚maxsize’. What I’m doing and observing: - clear all config and database on all masters. Generate new configuration from slapd.conf using ‚slaptest’ tool. - on master1 I add three base organizations let’s say o=test1 + o=test2 + o=test3 using slapadd [without -w switch] - on master1 I add some entries using ldapadd command so all organizations have now contextCSN attribute. - starting master1 - everything OK - starting master2 - everything OK, including succesfull replication from master1 - starting master3 - everything OK and including replication, but… some or all other master are dying unexpectedly. strace of dying process show: --- write(2, "slapd: id2entry.c:509: mdb_opinfo_get: Assertion `!rc' failed.\n", 63) = 63 — debug log last lines: — => mdb_entry_get: ndn: „o=test1” => mdb_entry_get: oc: "(null)", at: „contextCSN" — But when I do ‚slapcat’ I can clearly see contextCSN for all o=test[123] databases... Is it bug or some possible replication configuration issue? — Olo

4 5

olcAccess: Regex questions for "departments" and there admins
by Denny Fuchs 14 Nov '13

14 Nov '13

hi, I plan the new ACL layout for our Wheezy LDAP server. Our layout: Main suffix: dc=example,dc=com than the first department: ou=department1,dc=example,dc=com ou=people,ou=department1,dc=example,dc=com uid=foobar,ou=people,ou=department1,dc=example,dc=com [...] ou=groups,ou=department1,dc=example,dc=com gid=students,ou=groups,ou=department1,dc=example,dc=com [...] ou=roles,ou=department1,dc=example,dc=com cn=mail,ou=roles,ou=department1,dc=example,dc=com cn=admins,ou=roles,ou=department1,dc=example,dc=com ou=services,ou=department1,dc=example,dc=com ou=mail,ou=services,ou=department1,dc=example,dc=com cn=aliases,ou=mail,ou=services,ou=department1,dc=example,dc=com [...] next department2, the same: ou=department2,dc=example,dc=com ou=people,ou=department2,dc=example,dc=com uid=foobar,ou=people,ou=department2,dc=example,dc=com [...] [...] .... complete the same one, as department1 Now I stuck on the ACLs. I want to make use of RegEx, so that every department has its own roles, groups and admins and access only to there (for example) services. What I already have: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTpassword by self =xw by anonymous auth by * none {1}to dn.regex="uid=(.+),ou=people,ou=(.+),dc=example,dc=com$" attrs="myFB,myStudiengang,gender,myMatrikel,myTudUserUniqueID" by self read by * none {2}to dn.regex="uid=(.+),ou=people,ou=(.+),dc=example,dc=com$" attrs="mail,myMailalias,myMailDomain,myNoMail" by self read by dn.regex="cn=mail,ou=roles,ou=$2,dc=example,dc=com$" read by * none {3}to dn.regex="^(.+,)?ou=mail,ou=services,ou=(.+)?,dc=example,dc=com$" by dn.regex="cn=mail,ou=roles,ou=$2,dc=example,dc=com$" read {4}to dn.regex="^(.+,)?ou=services,ou=(.+,)?dc=example,dc=com$" by * none {5}to * by dn.base="cn=Admin,dc=example,dc=com" write by * read {6}to dn.base="dc=example,dc=com" by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read I'm able to read the subtree: "ou=mail,ou=services,ou=department1,dc=example,dc=com" only with the authenticated user "cn=mail,ou=roles,ou=department1,dc=example,dc=com" and "ou=mail,ou=services,ou=department2,dc=example,dc=com" with authenticated user "cn=mail,ou=roles,ou=department2,dc=example,dc=com" and I can't search with user from ou=department2 the service tree from ou=department1 :-) But, why I can't see the "ou=services,ou=department2,dc=example,dc=com" ? Just for me to know, where I have a problem ... for the services (Postfix in most cases) it isn't important, that they can't see the "ou=services" Also I want to make sure, that every department "admin group" (cn=admins,ou=roles,ou=<department>,dc=example,dc=com -> groupOfUniqueNames) can do everything under there (and only) three ou=<department>,ou=example,ou=com so, any tipps are welcome :-) cu denny pages I have already open: http://www.openldap.org/doc/admin24/access-control.html http://wiki.mandriva.com/fr/uploads/3/3a/Mandriva-dit-access-template.conf http://www.openldap.org/devel/admin/slapdconf2.html

2 3

Re: [Engine-devel] OpenLdap and Kerberos for oVirt on f19
by Piotr Kliczewski 14 Nov '13

14 Nov '13

On Thu, Nov 14, 2013 at 11:05 AM, Juan Hernandez <jhernand(a)redhat.com> wrote: > On 11/14/2013 11:01 AM, Piotr Kliczewski wrote: >> Hello everyone, >> >> I working on configuring OpenLdap 2.4.36 with kerberos for oVirt running on f19. >> >> I follow following instruction: >> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5 >> >> Please note that the instruction was written for f18. In order to have >> step 18 working from >> command line I had to set SASL_NOCANON to off. The reason was that I got: >> >> ldap_sasl_interactive_bind_s: Invalid credentials (49) >> additional info: SASL(-13): authentication failure: GSSAPI Failure: >> gss_accept_sec_context >> >> When SASL_NOCANON is off I can search the ldap but have the same issue >> from java code: >> >> I got javax.naming.AuthenticationException: [LDAP: error code 49 - >> SASL(-13): authentication failure: GSSAPI Failure: >> gss_accept_sec_context]. >> Have this when connecting using engine-manage-domains >> (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/… >> line 84). >> >> Can you please point me where is my config issue? >> >> I copied engine-devel for reference. >> > > Do you have the cyrus-sasl-gssapi package installed? That should have > been part of step 1. Try this: > > # yum -y install cyrus-sasl-gssapi > > I think that once that is installed you shouldn't need to set > SASL_NOCANON off. > You are right the package was not installed I restarted slapd, krb5kdc and kadmin after installing. I kinit one more time and tried to ldapsearch as in step 18 but with the same result. > -- > Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta > 3ºD, 28016 Madrid, Spain > Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.

1 1

OpenLdap and Kerberos for oVirt on f19
by Piotr Kliczewski 14 Nov '13

14 Nov '13

Hello everyone, I working on configuring OpenLdap 2.4.36 with kerberos for oVirt running on f19. I follow following instruction: https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5 Please note that the instruction was written for f18. In order to have step 18 working from command line I had to set SASL_NOCANON to off. The reason was that I got: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context When SASL_NOCANON is off I can search the ldap but have the same issue from java code: I got javax.naming.AuthenticationException: [LDAP: error code 49 - SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context]. Have this when connecting using engine-manage-domains (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/… line 84). Can you please point me where is my config issue? I copied engine-devel for reference. Thanks, Piotr

1 0

"dn: cn=admin,cn=config" adding problem
by Oleg 13 Nov '13

13 Nov '13

Hello. Our slapd listens on outer interfaces and i want to create an access rule for rootdn to allow admin access only from 127.0.0.1 ip. So, i try to add "dn: cn=admin,cn=config" record to config database: ~# cat admin.ldif dn: cn=admin,cn=config objectClass: person cn: admin sn: admin userPassword: 1 ~# ldapadd -xWD 'cn=admin,cn=config' -f admin.ldif Enter LDAP Password: adding new entry "cn=admin,cn=config" ldap_add: Object class violation (65) I got no extra info, just this. According to core.schema mandatory fields are only cn and sn. So, i don't understand why i see this error. Can anybody help me? Thanks.

7 18

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical