openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

LTB DOWNLOAD
by Borresen, John - 0442 - MITLL 10 Dec '13

10 Dec '13

Sorry, if this is not the forum to post this issue...but...received the following error when downloading the LTB Packages: Is this ok [y/N]: y Downloading Packages: openldap-ltb-2.4.38-1.el5.x86_64.rpm | 3.9 MB 00:01 Running rpm_check_debug Running Transaction Test Finished Transaction Test Transaction Test Succeeded Running Transaction Error in PREIN scriptlet in rpm package openldap-ltb-2.4.38-1.el5.x86_64 error: %pre(openldap-ltb-2.4.38-1.el5.x86_64) scriptlet failed, exit status 1 error: install: %pre scriptlet failed (2), skipping openldap-ltb-2.4.38-1.el5 Failed: openldap-ltb.x86_64 0:2.4.38-1.el5 Complete! John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory

2 1

Recovering from a Single-Node downtime in a Multi-Master Setup
by Marco Nett 10 Dec '13

10 Dec '13

Quick question: State 1: - I have two OpenLDAP slapd servers (ldap1 and ldap2) configured as Multi-master. - The both have the exact same data between the mirrored directories. - If I create a new directory entry on one server, it immediately gets mirrored to the second server. - I'm happy. State 2: - One LDAP-Master (ldap1) is down because of whatever. - Changes to the directory are made on the LDAP-Master which is still up (ldap2). - Changes are not mirrored to ldap1 because it's down. - I'm a little worried but still happy. State 3: - ldap1 is back up and running, but it's directory is not up to date. - The changes made to ldap2 in state 2 are not on ldap1 and aren't getting replicated automatically. - Mirroring again works fine, but ldap1 still doens't know about changes made in state 2. - I'm confused because I can't seem to find any information on how to recover from this. I couldn't just delete the directory on ldap1 and import the one from ldap2 because the importing would also be mirrored to ldap2. right? how would i go about recoverying from a downtime in a multi-master setup?

4 6

Q: empty groups (groupOfNames, member)
by Ulrich Windl 09 Dec '13

09 Dec '13

Hi! I had a problem with "empty groups": object class groupOfNames has a MUST member attribute, so you cannot create an empty group. I consider this to be a bug in the object class definition, specifically as groupOfNames is structural, and not auxillary. So in SLES empty (POSIX) groups are created with a namedObject structural class. Unfortunately because of "structural object class modification from 'namedObject' to 'groupOfNames' not allowed", the entry has to be recreated whenever the first member is added or the last member is removed to/from a group. While examining the problem,. I found out that the namedObject (rfc2307bis.schema) has ist "cn" attribute optional: ## namedObject is needed for groups without members objectclass ( 1.3.6.1.4.1.5322.13.1.1 NAME 'namedObject' SUP top STRUCTURAL MAY cn ) I'd consider this workaround as a bug also. Two questions remaining: 1) is there a technical reason against empty groups? I'd consider them as valid as empty arrays. 2) Is it an LDAP requirement to forbid structural changes in object classes, or is it an implementation restriction? In my experience the ID of an entry is (if not the entry's UUID) more the value of DN rather than the structural objectClass... Insights? Regards, Ulrich

4 6

OPENLDAP HANGS DAILY
by Borresen, John - 0442 - MITLL 06 Dec '13

06 Dec '13

All, I just restarted with the group, and the OpenLDAP software has not been upgraded - currently 2.4.23 (that will be coming...hopefully). Anyway, an issue that was brought to my attention upon starting was that slapd needs to be restarted daily. It is still running, it just stops responding (no one can log in). Nothing has, previously, been found in the logs. The other day, during my initial search through the slapd logs I found: conn=1144 op=1 SRCH attr=automountKey automountInformation <= bdb_equality_candidates: (automountKey) not indexed <= bdb_equality_candidates: (automountKey) not indexed <= bdb_equality_candidates: (automountKey) not indexed Which I added "olcDbIndex: automountKey eq" to the cn=config/olcDatabase={1}bdb.ldif. Took care of that one. But, under further investigation I am finding this, repeatedly (for slapcat, slapd, and others): Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/libanonymous.so.2: /usr/lib/sasl2/libanonymous.so.2: wrong ELF class: ELFCLASS32 Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/libplain.so.2: /usr/lib/sasl2/libplain.so.2: wrong ELF class: ELFCLASS32 Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/libsasldb.so.2: /usr/lib/sasl2/libsasldb.so.2: wrong ELF class: ELFCLASS32 Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/liblogin.so.2: /usr/lib/sasl2/liblogin.so.2: wrong ELF class: ELFCLASS32 Dec 5 02:00:02 server_name setroubleshoot: SELinux is preventing sendmail (system_mail_t) "read" to libsasl2.so.2 (usr_t). For complete SELinux messages. run sealert -l c4516acc-2dde-4dca-973e-86cd6686ee9f Dec 5 02:30:02 server_name setroubleshoot: SELinux is preventing sendmail (system_mail_t) "read" to libsasl2.so.2 (usr_t). For complete SELinux messages. run sealert -l c4516acc-2dde-4dca-973e-86cd6686ee9f Dec 5 02:31:08 server_name tar: nss-ldap: do_open: do_start_tls failed:stat=-1 Not sure why it should even been trying to use the these lib files, as one, we are not using SASL. Looking at "ldd slapd" it is seeing only 64-bit libraries. Anyone have any suggestions? John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

5 7

Mysql to Ldap
by Burk Al 06 Dec '13

06 Dec '13

Hi, I am using mysql to store my users and mailbox information on my email server (postfix & dovecot). And I am using Postfix Admin as my front end to manage domains, users and such. I want to replace mysql with ldap server. Somehow, I need to find a way to create the same or similar structure of mysql schema on ldap server. I am not expecting a tool, magic wand to make that conversion but what is the easiest and right approach to do this? Any sample, documentation etc etc would help greatly. Thanks...

1 0

[LMDB] Problem with extending size on Windows
by Alain 05 Dec '13

05 Dec '13

I encountered a problem trying to change the mapsize of an existing store. It turned out to be that the newsize argument to mdb_env_map wasn't set correctly when coming from mdb_env_open2. So I had to change the call to be: rc = mdb_env_map(env, meta.mm_address, newenv || env->me_mapsize != meta.mm_mapsize); (adding the || != test) Also I had some issues with large files (4GB) and I made some small changes which better match documentation and reported issues, but not sure if the original code was flawed or not. It is in mdb_env_map when we set the file pointer and EOF: if (newsize) { if ((SetFilePointer(env->me_fd, sizelo, &sizehi, 0) == INVALID_SET_FILE_POINTER && GetLastError() != ERROR_SUCCESS) || !SetEndOfFile(env->me_fd) || (SetFilePointer(env->me_fd, 0, NULL, 0) == INVALID_SET_FILE_POINTER && GetLastError() != ERROR_SUCCESS)) return ErrCode(); } Again, I made those changes according to what I noticed and this might not be the perfect final solution. Cheers, Alain

2 2

RE: OPENLDAP HANGS DAILY
by Quanah Gibson-Mount 05 Dec '13

05 Dec '13

<http://ltb-project.org/wiki/download> --On December 5, 2013 at 2:36:07 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > This was built from source, the OS flavor is 5.9 (originally built on > 5.7). The rpm versions were/are too old. > > Is the link to the LTB packages? > http://ltb-project.org/wiki/documentation/openldap-rpm > > Thanks > Dave > > -----Original Message----- > From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] > Sent: Thursday, December 05, 2013 2:19 PM > To: Borresen, John - 0442 - MITLL; Michael Ströder; > openldap-technical(a)openldap.org Subject: RE: OPENLDAP HANGS DAILY > > You can quickly upgrade if you use the LTB packages... Which are more > sanely built than the RH ones anyway, which I'm going to guess you are > using based on the version. > > --Quanah > > --On December 5, 2013 at 1:53:15 PM -0500 "Borresen, John - 0442 - MITLL" > <John.Borresen(a)ll.mit.edu> wrote: > >> Yea, I was afraid you were going to say that. >> >> -----Original Message----- >> From: Michael Ströder [mailto:michael@stroeder.com] >> Sent: Thursday, December 05, 2013 1:30 PM >> To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org >> Subject: Re: OPENLDAP HANGS DAILY >> >> Borresen, John - 0442 - MITLL wrote: >>> I just restarted with the group, and the OpenLDAP software has not >>> been upgraded - currently 2.4.23 (that will be coming...hopefully). >>> Anyway, an issue that was brought to my attention upon starting was >>> that slapd needs to be restarted daily. It is still running, it just >>> stops responding (no one can log in). Nothing has, previously, been >>> found in the logs. The other day, during my initial search through >>> the slapd logs I found: >> >> Please upgrade first. Everything else is waste of yours and others time. >> >> Ciao, Michael. >> >> >> > > > > -- > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Sync working in lab but not in production
by Philip Colmer 05 Dec '13

05 Dec '13

> Big mistake, as mentioned numerous times on the list. Use a current build. OK - I'll test the upgrade process. Thanks for the pointer on that. Philip On 5 December 2013 16:45, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 05, 2013 1:38 PM +0000 Philip Colmer > <philip.colmer(a)linaro.org> wrote: > >> I suspect I've broken a fundamental rule of how sync works on OpenLDAP >> but here goes ... >> >> We've been running a single OpenLDAP server for a while now so I >> wanted to get some resiliency into place. We are using version 2.4.28 >> on Ubuntu 12.04. > > > Big mistake, as mentioned numerous times on the list. Use a current build. > > Your log indicates that there is no accesslog DB, so I'd start with > investigating there after you fix the first problem. > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Sync working in lab but not in production
by Philip Colmer 05 Dec '13

05 Dec '13

I suspect I've broken a fundamental rule of how sync works on OpenLDAP but here goes ... We've been running a single OpenLDAP server for a while now so I wanted to get some resiliency into place. We are using version 2.4.28 on Ubuntu 12.04. The original machine is a VM so I cloned it and built two further servers from that clone. I then followed the instructions in https://help.ubuntu.com/12.04/serverguide/openldap-server.html to add the provider bits to server A and the consumer bits to server B. That works fine. So, since I had a working consumer, I added the provider bits to the original LDAP server and changed the configuration on server B so that it queries that server and not server A. Syncing now fails and I'm getting the following in the log: slapd[8201]: conn=1059 fd=18 ACCEPT from IP=127.0.0.1:52374 (IP=0.0.0.0:389) slapd[8201]: conn=1059 op=0 BIND dn="cn=XXX,dc=YYY,dc=ZZZ" method=128 slapd[8201]: conn=1059 op=0 BIND dn="cn=XXX,dc=YYY,dc=ZZZ" mech=SIMPLE ssf=0 slapd[8201]: conn=1059 op=0 RESULT tag=97 err=0 text= slapd[8201]: conn=1059 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(?objectClass=auditWriteObject)(?reqResult=0))" slapd[8201]: conn=1059 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN slapd[8201]: conn=1059 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= slapd[8201]: do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT (32) No such object slapd[8201]: do_syncrep2: rid=000 (32) No such object slapd[8201]: conn=1059 op=2 UNBIND I've double-checked the configuration on the provider and if I revert the configuration on server B so that it consumes from server A, it all works again. Have I broken a fundamental rule? If I have, how can I fix it? If I haven't, what have I done wrong? Thanks. Philip

3 3

Found bug in GET_BOTH_RANGE
by Alain 04 Dec '13

04 Dec '13

I found a bug where the data was not updated in a call to cursor get with GET_BOTH_RANGE Here is what I did to fix it, but not 100% sure it covers everything correctly: rc = mc->mc_dbx->md_dcmp(data, &d2); if (rc) { if (op == MDB_GET_BOTH || rc > 0) return MDB_NOTFOUND; data->mv_data = d2.mv_data; //added data->mv_size = d2.mv_size; //added rc = 0; } Please confirm. Thanks Alain

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical