openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Oracle OpenLDAP 2.4.30 add on PPOLICY
by David Barr 17 Dec '13

17 Dec '13

I am trying to get policy to work in an Oracle Solaris 11 environment. Trouble is it is pre-compiled, anyone know how I can use a policy that didn't come with the OpenLDAP 2.4.30-0.175.1.0.0.24.0 ? Excerpt from my slapd.conf ########### # SCHEMAS # ########### # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema ########### # MODULES # ########### # Load dynamic backend modules: modulepath /etc/openldap/modules moduleload ppolicy.la ################### # PASSWORD POLICY # ################### overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,dc=XXXXX,dc=XXXXX" ppolicy_use_lockout Any Ideas? ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

3 2

deploy monitor backend while existing DB in the root namespace
by GALAMBOS Daniel 17 Dec '13

17 Dec '13

Hi, My task was to configure our existing openldap (debian wheezy 2.4.31-1+nmu2) to use use monitor backend. The main problem is that our (BDB backed) database has empty suffix (for historical reason). If the monitor defined later under the /etc/ldap/slapd.d then the BDB, slapd fails to start, because BDB database would hide the monitor. database init failed (monitor) 52b038c0 olcDatabase: value #0: "monitor" database serving namingContext "cn=Monitor" is hidden by "bdb" database serving namingContext "". (monitor) 52b038c0 config error processing olcDatabase={2}monitor,cn=config: "monitor" database serving namingContext "cn=Monitor" is hidden by "bdb" database serving namingContext "". If it's defined before the bdb, then the slapd starts, but ldapsearch give 'no such object' for cn=Monitor. (should not be permission issue) It was doesn't matter if i included 'olcSubordinate: true' in the monitor. When I added a non-empty suffix to the bdb in the devel environment, the monitor worked, but this can't be the solution for our prod servers. monitor backend is defined by: dn: olcDatabase=monitor objectClass: olcDatabaseConfig olcDatabase: monitor olcAccess: {0}to * by read olcSubordinate: TRUE A colleague is concerned about the performance loss because of the monitor backend. Does monitor use significant resources in a heavily used slapd? Thanks, Dancsa

2 1

replication refint
by Artur Nike 17 Dec '13

17 Dec '13

Hi All, debian wheezy, OpenLDAP 2.4.31, muti-master replication Small question whether referential integrity (multiple-captains) are replicated? It seems to me that, yes, but the change (removal), entry on one of the servers does not call the bonds on the other. can by example: in annex replikat_refint.html ...sorry for the little technical diagram but I just had libre-office. Can anyone have any suggestions or experience with this problem. For all, thank you in advance. Muniek

2 3

default setup examples/documentation
by Alex Mestiashvili 17 Dec '13

17 Dec '13

Hi All, I am trying to find some kind of official documentation or examples for default structures for ldap. It is clear that the structure can vary a lot for different cases. But most of the users I think want to have a couple of ldif files simulating unix's passwd/group files something like that: ou=People,dc=example,dc=com uid=toor,ou=People,dc=example,dc=com ou=Group,dc=example,dc=com with proper objectClasses and shadow attributes. That should be enough to start using ldap. For sure there are tons of examples in the net, but this time I tried to do it just by reading openldap.org site and couldn't find enough to start with it. Could you please point me on more or less official documentation for the case above ? Thank you, Alex

1 0

Question about openLDAP proxy to MSAD
by Alex Samad - Yieldbroker 16 Dec '13

16 Dec '13

Hi I am using openldap to sit in front of MS AD. So that servers in the DMZ can access information in MS AD and in openldap. My problem is that MS AD sends back referrals and using referrals = ignore fails. Is there anything in the olcLDAPConfig that I set to stop referrals and/or set it to point back to itself A

1 0

Storing graph data structure with MDB_FIXEDMAP
by Aris Setyawan 16 Dec '13

16 Dec '13

Hi, I'm new in this list. I plan to store graph data structure (vertex and edge) in LMDB. The "edge" data value of a record will contain a pointer which is pointing to the address of "vertex" data value. So, I must make it sure that data value address is not changing during operation. According to the doc, I can use MDB_FIXEDMAP. And from the doc: "... the memory map will always reside at the same virtual address and pointers used to reference data items in the database will be constant across multiple invocations. ..." Spesifically: "... pointers used to reference data items in the database will be constant ..." Is this mean that I must allocate memory to write data using mdb_put with MDB_RESERVE flag?

2 3

Fwd: Linux kernel performance regressions
by Howard Chu 16 Dec '13

16 Dec '13

-------- Original Message -------- Subject: Linux kernel performance regressions Date: Wed, 11 Dec 2013 04:33:06 -0800 From: Howard Chu <hyc(a)symas.com> To: OpenLDAP-devel(a)openldap.org <OpenLDAP-devel(a)openldap.org> We upgraded from kernel 3.5 to 3.12.3 to update some of our benchmark numbers and hit some major performance regressions, mainly because the kernel is throttling processes that use too much CPU. This is definitely a kernel bug, as the throttle mechanism belongs to the realtime scheduler and none of the processes being affected had realtime priority when the throttle kicked in. I've posted a query to the linux kernel mailing list but haven't gotten any satisfactory answers yet. The same throttling behavior also occurs with 3.11.10, but there are no corresponding messages in the kernel log. The email thread is here http://lkml.indiana.edu/hypermail/linux/kernel/1312.1/02313.html A patch that may be related is described here http://lkml.org/lkml/2013/5/29/640 which explains part of the observed behavior, but not all of it (and indeed may be a red herring, unless it has some interaction with the realtime scheduler). There appear to be other serious networking related regressions in 3.12 as well. http://lkml.indiana.edu/hypermail/linux/kernel/1312.1/02588.html I recommend staying on 3.10 for production servers until this is sorted out. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 3

Design for large openldap deployments
by Christian Kratzer 16 Dec '13

16 Dec '13

Hi, I have been thinking about a scalable multi site deployment architecture for openldap where I would like to: - Have a small number of master servers centrally in the enterprise with MMR. - All account provisioning would be at the central sites. - Have multiple edge sites replicate of those masters in a star toplogy with MMR. - Allow writes to those edge sites for the purpososes of slapo_ppolicy, slapo_lastbind and password changes. I would like to avoid fully meshing all servers for MMR and would prefer a star topology where each edge site only replicates with the central site. I would also like to avoid chaining. See my previous posts why. Before I set this up in my lab I would like a second opinion. The customer is asking for best practice in large deployments. Any comments ? Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

4 8

Multi-master replication (ldap_sasl_bind_s failed)
by Artur Nike 16 Dec '13

16 Dec '13

Hi all, My adventure with LDAP lasts a few months, and I came to the topic of replication, namely multiple-master replication. cn = config is replicated perfectly, but the schema, say, dc = example, dc = com does not want to: (. I have two servers slap1 and slap2 I have a standard installation ##Server slap1 whezzy debian 64bit apt-get install-y slapd ldap-utils added my scheme ldapadd-Y EXTERNAL-H ldapi :///-f $ CURRENT / memberof.ldif ldapadd-Y EXTERNAL-H ldapi :///-f $ CURRENT / refint.ldif # Add "ldap :/ / ldap1 / in /etc/default/slapd sed-i "/^ SLAPD_SERVICES/s/=[^]*/=\"ldap:\/\/slap1\//'/etc/default/slapd ldapmodify-Y EXTERNAL-H ldapi :/ / /-f replica1.ldif where replica1.ldif (replication configuration):: dn: cn=config changetype: modify add: olcServerID olcServerID: 1 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}syncprov.la dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW #only for tests olcRootPW: 123 dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://slap1/ olcServerID: 2 ldap://slap2/ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://slap1/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://slap2/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE This same scenario takes on a server slap2 (the name change slap1 -> slap2) where replica2.ldif (replication configuration only servers slap2) : dn: cn=config changetype: modify add: olcServerID olcServerID: 2 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}syncprov.la dn: olcDatabase={0}config,cn=config changetype: modify #only for tests add: olcRootPW olcRootPW: 123 dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://slap1/ olcServerID: 2 ldap://slap2/ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://slap1/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://slap2/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE and it works , the whole configuration is replicated . Now I want ( I'm trying to add a replication scheme . ) Adds only one server , eg slap2 : ldapmodify - Y EXTERNAL -H ldapi :/ / / -f rep_schema.ldif where rep_schema.ldif : # add replica schema dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: 123 - replace: olcRootDN olcRootDN: cn=admin,dc=example,dc=com dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcLimits olcLimits: dn.exact="cn=admin,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited - add: olcSyncRepl olcSyncRepl: rid=004 provider=ldap://ldap1/ binddn="cn=admin,dc=example,dc=com" bindmethod=simple credentials="123" searchbase="dc=example,dc=com" starttls=no filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=of type=refreshAndPersist interval=00:00:00:10 retry="5 5 10 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://ldap2/ binddn="cn=admin,dc=example,dc=com" bindmethod=simple credentials="123" searchbase="dc=example,dc=com" starttls=no filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=off type=refreshAndPersist interval=00:00:00:10 retry="5 5 10 5" timeout=1 - add: olcDbIndex olcDbIndex: entryUUID eq - add: olcDbIndex olcDbIndex: entryCSN eq - add: olcMirrorMode olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Configuration replicates and the end, schema does not replicate. If you try to replicate one of the servers are in the logs I see: Dec 15 23:44:48 slap1 slapd[4496]: do_syncrepl: rid=004 rc -1 quitting Dec 15 23:44:48 slap1 slapd[4496]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:48 slap1 slapd[4496]: do_syncrepl: rid=005 rc -1 retrying Dec 15 23:44:58 slap1 slapd[4496]: =>do_syncrepl rid=005 Dec 15 23:44:58 slap1 slapd[4496]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:50 slap2 slapd[4456]: do_syncrepl: rid=004 rc -1 retrying Dec 15 23:44:54 slap2 slapd[4456]: =>do_syncrepl rid=005 Dec 15 23:44:54 slap2 slapd[4456]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:54 slap2 slapd[4456]: do_syncrepl: rid=005 rc -1 quitting Dec 15 23:45:00 slap2 slapd[4456]: =>do_syncrepl rid=004 Dec 15 23:45:00 slap2 slapd[4456]: slap_client_connect: URI=ldap://ldap1/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) from server slap2 to search slap1: ldapsearch -x -D cn=admin,dc=example,dc=com-H ldap://slap1/ -b dc=example,dc=com -w 123 (working) from server slap1 to search slap2: ldapsearch -x -D cn=admin,dc=example,dc=com-H ldap://slap2/ -b dc=example,dc=com -w 123 (working) I'm out of ideas... user : DN="cn=admin,dc=example,dc=com" is created automatically when I install slapd Can anyone have any suggestions or experience with this problem. For all, thank you in advance. Muniek

1 1

RE24 testing call (OpenLDAP 2.4.37)
by Quanah Gibson-Mount 15 Dec '13

15 Dec '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.37 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

12 32

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical