openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Re: ldap syncrepl issue.
by Ashok Kumar Shah 09 Nov '13

09 Nov '13

I have upgraded to OpenLDAP 2.4.31. I was hoping that the syncrepl issue will subside with the upgrade, but problem continue to persist even now. Just to point out that the master still runs the older version i.e 2.4.31, but i guess that should be ok since the issue is with the replication or perhaps with contextCSN not getting updated on the client(slaves). Thanks, Ashok On Mon, Jul 15, 2013 at 3:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Sunday, July 14, 2013 10:35 PM +0530 Ashok Kumar Shah < > ashok.shah(a)flipkart.com> wrote: > > >> I am running OpenLDAP 2.4.23. >> > > I would advise you to run a modern release. I would strongly advise you > to read the changes log since 2.4.23. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Reseting content/database/schema
by Ryan Tandy 08 Nov '13

08 Nov '13

Hi, Please, let's keep the discussion on the list. On 13-11-08 12:26 AM, Merve Temizer wrote: > Tandy thanks for your answer. > > Might the problem be about default conf despite that i was able to add > my ldif at first installation? Sure, it's definitely possible that I was wrong. It doesn't really matter, though: stop the daemon and remove everything from /etc/ldap/slapd.d and from /var/lib/ldap, and you're immediately in a clean and unconfigured state. Purging and reinstalling the package doesn't do much else. If you want more detailed help, please provide more details about the problem: a full transcript of the commands you're running (including any input files) and their output, plus the exact version of OpenLDAP you're running, would be a good start. -- Ryan Tandy - Programmer/Analyst rtandy(a)sd63.bc.ca School District 63 (Saanich) +1 250 652 7385

1 0

PBKDF2 for OpenLDAP
by Tsukasa HAMANO 08 Nov '13

08 Nov '13

Hi, I was concerned that OpenLDAP have no modern key derivation function. (It seems eglibc's crypt(3) has bcrypt, but it's depends environment) So I just implemented PBKDF2 module for OpenLDAP. https://github.com/hamano/openldap-pbkdf2 # Installation $ cd <OPENLDAP_BUILD_DIR>/contrib/slapd-modules/passwd/ $ git clone https://github.com/hamano/openldap-pbkdf2.git $ cd openldap-pbkdf2/ $ make # make install in slapd.conf: moduleload pw-pbkdf2.so password-hash {PBKDF2} # Usage $ slappasswd -o module-load=pw-pbkdf2.la -h {PBKDF2} -s secret {PBKDF2}60000$Y6ZHtTTbeUgpIbIW0QDmDA$j/aU7jFKUSbH4UobNQDm9OEIwuw This format is compatible with Python's passlib.hash.ldap_pbkdf2_sha1 http://pythonhosted.org/passlib/lib/passlib.hash.ldap_pbkdf2_digest.html And also, I have roadmap to implement {PBKDF2-SHA256} and {PBKDF2-SHA512} schemes in the future. Could you merge the module into contrib/ directory? Thank you. -- Open Source Solution Technology Corporation HAMANO Tsukasa <hamano(a)osstech.co.jp> fingerprint = 2285 2111 6D34 3816 3C2E A5B9 16BE D101 6069 BE55

2 2

different hdbs for ou
by Denny Fuchs 08 Nov '13

08 Nov '13

hi, I have one main HDB Database for: dc=example,dc=net -> /var/lib/ldap/ with one subtree: ou=department,dc=example,dc=net Now I want to let other departments use our N-Way LDAP server too. My idea was to put the new departments into different hdb databases: ou=department-1,dc=example,dc=net -> /var/lib/ldap/department-1/ ou=department-2,dc=example,dc=net -> /var/lib/ldap/department-2/ ou=department-n,dc=example,dc=net -> /var/lib/ldap/department-n/ all with own admin access to there root dn. How should I do that? cu denny

2 6

Reseting content/database/schema
by Merve Temizer 07 Nov '13

07 Nov '13

I need to remove every configuration/schema/database. Is it possible and if so how? So far Code: sudo apt-get purge slapd ldap-utils remove Code: /etc/ldap /etc/openldap /var/lib/ldap and Code: sudo apt-get install slapd ldap-utils tried to Code: sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend2.example.com.ldif still getting 80 error, which means, according to my restricted knowledge, ldap already has modules and cn s in ldif file.

2 1

OpenLDAP DB question
by Dheeraj Khanna 07 Nov '13

07 Nov '13

Hi I wanted to find if I can add a host based authentication, here is my setup. Regular LDAP DB , I use group and users and associate permissions to users based on groups. What I want to achieve is this: *If a User A is a member of "Group A" and has access to "hostsA" allow else deny, this will allow me to limit access to certain server types based on user groups. I think we can define this in /etc/ldap.conf but I could not find find the right syntax to add hosts in this config file.* *Question: *I do not know how to add this ou called "hostaccess", I used a GUI portal called Apache Directory Studio to add/delete users and groups. If some one knows how to add hosts in LDAP and be able t map groups and users to it that would greatly help me. Thanks Dheera

3 3

slapd-mdb network performance
by Jancewicz, Russell 06 Nov '13

06 Nov '13

Hello, I am experiencing a bit of an issue with mdb network traffic. When I request large queries (entire subtrees) from remote hosts my searches take hundreds of times longer to complete than they do if I search on the local machine (in all expect for one case). I have attempted to tune the kernel network settings, adjusted tx buffer sizes all to no avail. Just before turning to this list i gave one last shot in the dark attempt running my query using the rootDN. This produced the expected results. When queried with a typical account DN my system was transmitting around 2.0Mbps to the remote client. When queried with the rootDN my system was transmitting around 100Mbps to the client. The system has an olcLimits rule allowing unlimited time and size to the account "typical account" I was testing with. ' olcLimits: dn.children="ou=accounts,dc=example,dc=com" time=unlimited size=unlimited ' Clearly the server is capable of serving data to the remote machine at 100Mbps (given that the rootDN has done so) I cannot for the life of me find a configuration option or setting would should be impacting the transmission bandwidth of searches. Any help or advice of where I should be looking would be greatly appreciated. I have included the relevant cn=config information below. Thank you, -Russell J. Jancewicz University of Connecticut OpenLDAP: slapd 2.4.36 (Sep 19 2013 11:16:48) $ dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /srv/ldap/example.com olcSuffix: dc=example,dc=com # ... olcAccess olcLimits: {0}dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" time=unlimited size=unlimited olcLimits: {1}dn.children="ou=accounts,dc=example,dc=com" time=unlimited size=unlimited olcRootDN: cn=root,dc=example,dc=com olcDbCheckpoint: 512 30 olcDbNoSync: FALSE olcDbMaxSize: 8589934592

3 4

unsubscribe
by Richards, Toby 06 Nov '13

06 Nov '13

Respectfully Submitted, R. Toby Richards Network Administrator Superior Court of California In and for the County of San Luis Obispo (805) 781-4150

1 0

slapd appears to incorrectly report an object class violation when renaming an entry
by Jon C Kidder 06 Nov '13

06 Nov '13

I am running 2.4.36 in my sandbox environment and have recently found myself needing to rename some entries in my directory. Slapd is reporting an object class violation when attempting to rename the entries even though all required attributes are present on the entry. I have a sample ldif that reproduces this problem. dn: cn=testuser,ou=users,dc=example,dc=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: testuser uid: testuser sn: surname dn: cn=testuser,ou=users,dc=example,dc=com changetype: modrdn newrdn: uid=testuser deleteoldrdn: 1 newsuperior: ou=users,dc=example,dc=com When I run this ldif using ldapmodify this is the result I get back. adding new entry "cn=testuser,ou=users,dc=example,dc=com" modifying rdn of entry "cn=testuser,ou=users,dc=example,dc=com" ldap_rename: Object class violation (65) additional info: object class 'inetOrgPerson' requires attribute 'cn' As you can see from the ldif the cn attribute is clearly present. I am assuming this is a bug and needs reported but wanted to review it with the list members before I submitted the ITS entry. -Jon C. Kidder American Electric Power Middleware Services Email: jckidder(a)aep.com<mailto:jckidder@aep.com> Phone: 614-716-4970

4 3

Openldap Synch problem
by Darouichi, Aziz 06 Nov '13

06 Nov '13

Hi, I have 2 Openldaps that are configured for replication one is on site, the other is a remote. They are connected via a VPN tunnel and every time there is a connection problem between the two the replication fails, but I have to stop the services on the remote, delete the database and start a fresh replication. Is there a way that I can configure the remote to force it to re-synch without having to delete the database and start all over again? This is what I see in the log after connection gets re-established: Nov 6 11:37:39 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1cffefb0 20131106163739.780633Z#000000#000#000000 Nov 6 11:37:50 LDAP-TLS-2 slapd[4903]: do_syncrep2: rid=006 LDAP_RES_SEARCH_RESULT Nov 6 11:37:50 LDAP-TLS-2 slapd[4903]: do_syncrepl: rid=006 rc -2 retrying Nov 6 11:38:28 LDAP-TLS-2 slapd[4903]: slap_queue_csn: queing 0x41d1be70 20131106163828.873440Z#000000#000#000000 Nov 6 11:38:28 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1d10d1f0 20131106163828.873440Z#000000#000#000000 Nov 6 11:38:39 LDAP-TLS-2 slapd[4903]: slap_queue_csn: queing 0x41d1c0e0 20131106163839.682221Z#000000#000#000000 Nov 6 11:38:39 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1d3f3fc0 20131106163839.682221Z#000000#000#000000 Nov 6 11:38:49 LDAP-TLS-2 slapd[4903]: slap_queue_csn: queing 0x4251ce70 20131106163849.281885Z#000000#000#000000 Nov 6 11:38:49 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1d369af0 20131106163849.281885Z#000000#000#000000 Nov 6 11:38:50 LDAP-TLS-2 slapd[4903]: do_syncrep2: rid=006 LDAP_RES_SEARCH_RESULT Nov 6 11:38:50 LDAP-TLS-2 slapd[4903]: do_syncrepl: rid=006 rc -2 retrying. This is the config of the remote for synrepl syncrepl rid=006 provider=ldap://192.168.19.43 tls_cert=/etc/pki/tls/certs/ldap-tls.curry.edu.cert.pem tls_key=/etc/pki/tls/private/ldap-tls.curry.edu.key.pem tls_cacert=/etc/pki/tls/certs/cacert.pem tls_reqcert=demand searchbase="dc=curry,dc=edu" schemachecking=on timelimit=unlimited sizelimit=unlimited type=refreshAndPersist retry="60 +" keepalive=240:10:30 Thank You

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical