openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Port 636 and SLAPD(8)
by jumpgroup＠aol.com 08 Jan '14

08 Jan '14

Hello Experts, In need of a little guidance please. I'm installed OpenLdap 2.4.23 on RHEL in a sandbox and would like to enable SSL on port 636. All documentation references SLAPD(5), but since I'm using SLAPD(8), I do not know have the slapd.conf file. Looking for the current SLAPD(8) method of configuring this along with starting the service to support port 636. Thanks in advance! Jeff P.

5 5

mdb searchstack parameter
by Paul B. Henson 08 Jan '14

08 Jan '14

>From reading the documentation, it sounds like when configuring this parameter you need to strike a balance between potential performance impact if it is too low, and wasted memory if it is too high. While running, is there any way to tell whether or not a search exceeded your configured value and required additional allocation? Whether via the monitor backend, or a log entry, or? Ideally, it would be nice to be able to tell if your configured value was too low and adjust as necessary. Thanks.

2 2

mdb_stat
by Paul B. Henson 08 Jan '14

08 Jan '14

Where does one typically acquire the mdb_stat binary for use with openldap? It appears to be part of liblmdb. openldap includes a bundled copy of liblmdb, but does not actually build mdb_stat. Is the intention for distributions to have a separate package for liblmdb, which would include mdb_stat, which one would then install to acquire it (even though the library isn't needed for openldap itself)? I can obviously just compile it myself :), but plan to open a bug with my distribution (Gentoo) to see about making it available, and I'm not sure whether it would be better to compile the one within openldap and install that as part of the openldap package, or create a new package for liblmdb. Given it is still under relatively early development, would it be better to install the bundled one as ol_mdb_stat or something like that, to make sure it corresponds to the version actually used by the installed openldap? What are other distributions doing? Thanks.

2 2

replicating central NSS data (was: DBIS - new IETF drafts)
by Michael Ströder 08 Jan '14

08 Jan '14

(I take this point to openldap-technical(a)openldap.org since it discusses OpenLDAP-specific things.) Howard Chu wrote: > The discussion of caching here > http://www.ietf.org/id/draft-bannister-dbis-mapping-02.txt is one such example > - this is purely a client-side implementation issue. Also you give nscd as an > example, and nscd has been thoroughly discredited and is well known to be > unsuitable for real use. Critical deployments can use a local LDAP server with > a replica of the central data, to avoid error-prone caching implementations. > This is a commonly recommended approach when using OpenLDAP nssov, for example. I really wonder how this replication approach works in practice without disclosing too much data on a system more exposed to attacks from the outside. In theory one could implement partial replication based on systems's bind identity. But in practice I have some doubts because in a really paranoid setup you don't even want to disclose replication meta data and intermediate entries of the tree structure. Ciao, Michael.

2 1

Problem with back-mdb
by Grégory T 08 Jan '14

08 Jan '14

Hello, before starting, we wish a happy new year to the community ! Now, we start with presentation. We have compiled the Openldap build version 2.4.38 on a ubuntu 12.04. This openldap server is a dual processor Intel Xeon with 4 Gb Memory. This machine is virtualized (vmware). Openldap is configured with back-mdb, overlays memberof and syncprov, and envflags writemap and nosync. We encounter a problem with a callback procedure in a perl script. This script have to remove a couple of attributes for each entry (~120 000). In order to save memory consumption, we use a callback function to treat each entry one after one. Everything works with back-bdb but ... there are mistakes with back-mdb. In ldap.log, this kind of message appears many times : ldapserver slapd[7264]: connection_input: conn=1014 deferring operation: awaiting write ldapserver last message repeated 55 times And suddenly, ldapserver slapd[7264]: conn=1014 fd=14 closed (connection lost) Our script result in "connection reset by peer" message. The script stop around the 1040 entry. Although the connection was closed by server, it still continue to run. However, no explicit message in ldap.log. If we run the script once again, the next ~1040 entries will be treated and the script stop. We have try with envflags writemap and nosync deactivated ... but unsuccessful. This is the ldapsearch request : my $result=$ldapMaster->search(base=>$baseDN,scope=>'sub',filter=>$filter,typesonly=>'1',callback=>\&callback); And this is the callback function : sub callback{ my ($search,$ent)=@_; return unless defined $ent; my $entry = $search->shift_entry(); my @tabAttribToDel=(); if (defined $entry){ my $dn=$entry->dn(); $countDN++; foreach my $attrib($entry->attributes){ if ($attrib ~~ @tabOldAttrib){ $countAttrib++; push (@tabAttribToDel,$attrib); } } if (($SUPPR==1) && (@tabAttribToDel)) { $countTrace++; my $result = $ldapMaster->modify($dn,delete => \@tabAttribToDel); warn "(nbEntry:$countTrace, nbAttr:$countAttrib) Error with $dn: ".$result->error."\n" if $result->code; } } } Why is this script working well with back-bdb but not with back-mdb ? Thanks, -- Grégory Trucy Ingénieur système et réseau Aix-Marseille Université

3 2

replication of databases with different backends???
by lux-integ 08 Jan '14

08 Jan '14

Greetings, I have two computers with these:- host 1: --cpu amd64 3 cores --os blfs linux-3.10.24, openldap-2.4.33 with bdb backend host 2: --cpu amd64 3 cores --os blfs linux-3.10.24, openldap-2.4.33 with sql backend QUESTION: can I replicate these databases over each host (in other words can I for example do N-ray multimaster syncrepl ( http://www.openldap.org/doc/admin24/replication.html ) or another type of replication in view of the different backends ? thanks in advance sincerely luxnteg

4 3

Search filter for ou=Groups
by jupiter 07 Jan '14

07 Jan '14

Hi, How can I search for displaying all members in ou=Groups only? I added a filter (&(objectClass=posixGroup)(ou=Groups)), but nothing displayed (I can get every entries if the filter is not used) ldapsearch -x -W -D cn=insecure,dc=ldap,dc=hce,dc=org "(&(objectClass=posixGroup)(ou=Groups)" # extended LDIF # # LDAPv3 # base <dc=ldap,dc=hce,dc=org> (default) with scope subtree # filter: (&(objectClass=posixGroup)(ou=Groups)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Thanks. jupiter

2 1

openldap problem with synchronization
by Robert Mach 07 Jan '14

07 Jan '14

Hello, I have troubles using openldap replication in Centos 6.4. and Centos 5.3 I have two server with following version of openldap from centos repository configures as multimaster replication (internal servers): openldap-servers-2.4.23-32.el6_4.1.x86_64 openldap-clients-2.4.23-32.el6_4.1.x86_64 openldap-2.4.23-32.el6_4.1.x86_64 Then I have one external server with following products: openldap-servers-2.3.43-12.el5_5.3 openldap-clients-2.3.43-12.el5_5.3 openldap-2.3.43-12.el5_5.3 Then two internal servers are configured as multi-master replication and everything is working fine. The external server is configures as slave replication from one of those internal servers using the following configuration: CODE: SELECT ALL database bdb suffix "o=test,c=cz" rootdn "cn=Manager,o=test,c=cz" directory /var/local/ldap/test.cz index entryCSN,entryUUID eq index objectClass eq,pres index ou,cn,mail eq,pres,sub syncrepl rid=132 provider=ldaps://xxxxx.xxx.xxx type=refreshOnly interval=00:00:01:00 searchbase="o=test,c=cz" filter="(!(objectclass=simpleSecurityObject))" scope=sub updatedn="cn=SyncMaster,o=test,c=cz" bindmethod=sasl saslmech=external attrs="objectClass,cn,sn,ou,o,mail,serialNumber,userCertificate,cACertificate,certificateRevocationList,authorityRevocationList,entrustPolicyCertificate,crossCertificatePair" schemachecking=on There is a problem with replication from internal server to external. If I delete the database of external server and start the consumer, everything is correctly replicated from the provider (internal server) to the consumer. Therefore I assume, that the replication is configured correctly. But if the servers are running for a while and changes are made on the Provider (internal server) some data are not replicated to the consumer. More precisely the contextCSN of the root of the tree of consumer (external server) is updated and is the same as on the Provider(internal server), but some entries lower in the three are not replicated correctly, both the entry entryCSN and the entry data itself are not updated on the Consumer. Do you have any idea where could be the problem? Thank you, Rob

6 8

OpenLDAP can manage IP/MAC/Assets and other information?
by Tian Zhiying 07 Jan '14

07 Jan '14

Hi OpenLDAP can manage IP/MAC/Assets and other information? If it can, what schema I need to add ? Thanks. Tian Zhiying

2 1

"ber write failed", followed by slapd not responding
by Chris Down 07 Jan '14

07 Jan '14

Hello, I am having a small problem with an OpenLDAP master at work. Twice today, at seemingly random intervals, it has stopped responding to all queries, and all clients lose connection to the master, immediately after printing the following message in the debug log: Jan 7 10:04:58 ldap slapd[20310]: send_search_entry: conn 1851 ber write failed. There are no more messages printed before or after this for hours. I looked at the source, but it didn't seem particularly illuminating (it looks like this happens when send_ldap_ber() doesn't write anything and returns 0 bytes, but I don't know how to debug that, since there are a lot of conditions there that return 0). I saw this[0] thread, but we are already using 2.4.23 on Debian Squeeze, so it appears to not be the same problem: @(#) $OpenLDAP: slapd 2.4.23 (Dec 16 2012 11:48:44) $ root@carillon:/tmp/buildd/openldap-2.4.23/debian/build/servers/slapd I am not aware of performing any changes to our LDAP configuration recently. How should I go about debugging this? Is this a known issue? I searched openldap-bugs, but I didn't find anything recent that seemed related. Thanks. 0: http://www.openldap.org/lists/openldap-technical/200907/msg00199.html

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical