openldap-technical

openldap-technical@openldap.org

9868 discussions

N-Way Master replication no contextcsn
by espeake＠oreillyauto.com 02 Aug '13

02 Aug '13

Trying a different method of replication to suit or need and I set up two test servers for n-way master mirroring servers. Both servers have the same configuration being fed to them through puppet. In the logs I can see them bind and check cookies but I get CSN too old, ignoring 20110608165005.984980Z#000000#000#000000 (olcOverlay= {4}syncprov,olcDatabase={1}hdb,cn=config) THen the last slapd entry in the log is rid=002 cookie=rid=002,sid=002,csn=20110915141524.047299Z#000000#000#000000 and then nothing else happens. If I make a change to user it never syncs to the other server. At this point I don't know what to look at or what you might want to look at to help diagnose the problem. I followed the documentation in the admin guide to set this up. Any and all help is appreciated. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

5 9

Fw: OpenLDAP (using BDB) stalls adding 65,536th entry
by Mark Cooper 02 Aug '13

02 Aug '13

Does anyone have opinions about questions 2 and 3? Thanks ----- Forwarded by Mark Cooper/Poughkeepsie/IBM on 08/01/2013 10:27 PM ----- From: Mark Cooper/Poughkeepsie/IBM To: Howard Chu <hyc(a)symas.com>, Cc: openldap-technical(a)openldap.org, openldap-technical-bounces(a)openldap.org Date: 07/30/2013 09:58 PM Subject: Re: OpenLDAP (using BDB) stalls adding 65,536th entry Not sure exactly how I am supposed to respond (reply all, or just to openldap-technical(a)openldap.org). So, excuse me if I did it wrong doing a reply all. I appreciate all the quick responses. I've been working on this issue for a couple of weeks, so it's great to be able to post a question and get back the answer so rapidly. I do have some follow-up questions based on the responses: 1) Quanah wrote: "This is indeed a BDB bit." Not sure I understand what that means. Is part of the delay due to BDB? It does seem like a whole bunch (maybe 30) log files getting written to file before processing resumes. 2) Index lists get collapsed into ranges - I assume this done to make processing more efficient. Is this a one time event? As I mentioned, I did not see it happen again. 3)If I know I'm going to have greater than 64K elements, is there any way to force it to use ranges at server startup and avoid the delay? I didn't see any such option. Quanah - Yes, I understood that 65,536 is a power of 2 and it's importance in computer processing :) Thanks again for the answers From: Howard Chu <hyc(a)symas.com> To: Mark Cooper/Poughkeepsie/IBM@IBMUS, openldap-technical(a)openldap.org, Date: 07/30/2013 05:11 PM Subject: Re: OpenLDAP (using BDB) stalls adding 65,536th entry Sent by: openldap-technical-bounces(a)openldap.org Mark Cooper wrote: > I've been doing some testing using OpenLDAP with BDB on a couple of different > platforms. I noticed a similar situation. When I sit in a loop doing adds, > at the 65,536th added entry the process stalls for a short period of time. > After a minute or two, the add succeeds. My first thought is that this is a > BDB issue, so I posted this question to Oracle's BDB forum. But I have yet to > receive any answer. This is all known/expected behavior. One (or more) of your index slots hit its maxsize of 65535 elements and was collapsed into a range. This typically happens with the objectClass index first, if you're adding a bunch of objects all of the same classes. Taking a minute or two is abnormal, but I suppose is possible if multiple indices hit the condition at the same time. > This situation seems to happen when I have around 43 10MB log files. During > the stall, I notice many log files are being written (another 25 or so), which > is a much quicker rate than was being written prior to the stall. > > The stall only happens once. I added another 350,000 entries and no more > stalls. I ran a few other tests. Added 65,535 entries. All is fine. As > soon as the next entry is add, even if I recycle the server, I hit the > condition. I even tried deleting 1,000 entries. I would then need to add > 1,0001 to get to 65,536 entries in the database and then hit the delay. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

DR scenerio
by espeake＠oreillyauto.com 01 Aug '13

01 Aug '13

Okay here is what we are wanting to do and I need to know if it is possible with openLDAP. We have a main production ldap server v. 2.4.28 running on Ubuntu 10.04 We are adding two servers that will handle authenication and refer writes to the main provider server. What I would like to to setup another provider in our DR site and have it pull replication from the main LDAP server once a day, maybe twice. Then in turn that server would be the provider for two consumers at the DR site that would handle auth requests and refer write to the provider at the DR site. But the no changes at the DR site would be written back to the main production provider. I don't want someone testing something in the DR to be written back to production. In a nut shell I want to have two systems that look the same and the information for the second system would come from a sync with the first system, but the second system would not be able to write back to the main system. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

Error 32 object not found.
by espeake＠oreillyauto.com 01 Aug '13

01 Aug '13

Here is the error message I get when I and trying to replicate my databases. Aug 1 11:05:41 tntest-ldap-2 slapd[4871]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Aug 1 11:05:41 tntest-ldap-2 slapd[4871]: do_syncrepl: rid=002 rc -2 retrying Here is the ldif from the master. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=secret olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.com olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" read by dn="uid=ldapAdmin,ou=system,dc=oreillyauto,dc=com" read by * none structuralObjectClass: olcDatabaseConfig entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20110503162710Z Here is the ldif from the consumer. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.co olcsyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="10 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=secret olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config ModifyTimestamp: 20110503162710Z Getting cloaser I think. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

how to configure subsuffix?
by Zeus Panchenko 01 Aug '13

01 Aug '13

hi all, I'm absolutely new to LDAP and need advice, please how is it better/correct to configure database to implement "corporative users tree" covered? what I mean is structure for head office (ho), branch 1 of head office (bo1), ... branch N of head office (boN): - ho -+- bo1 -+- People | +- Groups | +- Hosts ... | +- boN -+- People +- Groups +- Hosts I see it as core LDAP server which replicates db partially, to the consequent branches while trying to google the solution I found this (just what I described as I believe): http://www.centos.org/docs/5/html/CDS/ag/8.0/Configuring_Directory_Database… but it've occured not enough for me :( so, may somebody advice, how to implement the structure in .ldif? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

2 2

Removing Overlays Using cn=config
by Tim Gustafson 01 Aug '13

01 Aug '13

Hi, I would like to remove the "auditlog" overlay from one of my databases on my OpenLDAP server that is running 2.4.35 and is configured via cn=config. But, when I try to remove the overlay object, I get: 0x35 (LDAP_UNWILLING_TO_PERFORM) I Googled around about this, and found some older list messages about not being able to delete overlays, but most of those messages are years old and I was wondering if this has changed at all? If not, what is the "proper" way to remove an overlay? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

4 3

Re: Antw: N-Way Multi-Master TLS problem
by Patrick Lists 31 Jul '13

31 Jul '13

On 07/31/2013 11:50 AM, Ulrich Windl wrote: > Hi! > > I had the same problem, and I found a solution: > > In config, don't use the host name as filename for the certificate/key, but use the service name (like "slapd"). Then (the confusing part), store the server's certificate in that "slapd" file. So even if the file name is the same on every server, the file's contents are different. > > I use (SLES11, your paths may vary): > > olcTLSCertificateFile: /etc/ssl/servercerts/slapd.pem > olcTLSCertificateKeyFile: /etc/ssl/private/slapd.key > olcTLSCACertificatePath: /etc/ssl/certs > > Here that works fine, but I feel documentation should talk about that also. Wow that certainly is a solution I did not see coming. Thanks! I think I got it working now :-) IMHO it sounds like a bug to me. Never seen such a requirement for a TLS config. Thanks again, much appreciated! Regards, Patrick

1 0

Re: RE24 testing call (OpenLDAP 2.4.36)
by Andrew Cobaugh 31 Jul '13

31 Jul '13

On Mon, Jul 29, 2013 at 3:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.36 release, please do so. > I can report that all tests run by 'make test' complete successfuly on a stock 64-bit RHEL6 host. --andy

1 0

OpenLDAP syncrepl over SSL
by Tony Davis 31 Jul '13

31 Jul '13

Hi, I wonder if anyone can help me with a question I have regarding an openldap setup on Redhat / Centos 5.8 using openldap-2.3.43. I am trying to setup replication, I have set this up using the simple bind method, which stores a password for the replication in the config. (This works) but I wondered if there was a way to have this replication take place using ssl certificates without the need to store the unhashed password in the slapd.conf? Is this possible? or do I still have to specify a replication user and pass, but all the auth takes place over ssl? This is my current config for replication: syncrepl rid=001 provider=ldap://master01.tld type=refreshAndPersist interval=00:00:05:00 retry="5 5 300 +" searchbase="dc=tld" attrs="*,+" bindmethod=sasl saslmech=EXTERNAL tls_cert=/etc/master02.tld.pem tls_key=/etc/master02.tld.key tls_cacert=/etc/openldap/cacerts/ca.pem tls_reqcert=demand starttls=yes mirrormode on updateref ldap://master01.tld but in the replication log i get the following: Jul 31 11:06:18 master02 slapd[6958]: do_syncrep1: rid 001 ldap_sasl_interactive_bind_s failed (7) Jul 31 11:06:18 master02 slapd[6958]: do_syncrepl: rid 001 retrying (3 retries left) Jul 31 11:06:18 master02 slapd[6958]: daemon: activity on 1 descriptor Jul 31 11:06:18 master02 slapd[6958]: daemon: activity on:

3 2

ldap_sasl_bind doesn't fail with wrong credentials
by Andrius Kulbis 31 Jul '13

31 Jul '13

Hello, Shouldn't ldap_sals_bind fail if wrong credentials are given? Or am I checking the bind result in wrong way? I pass wrong password or username and still can't get BIND ERROR. #include <stdio.h> #include <ldap.h> #include <stdlib.h> #define HOST "x.x.x.x" int main (int argc, char **argv) { char *UID = argv[1]; char *PASSWD = argv[2]; char BASEDN[80]; strcpy(BASEDN, "eduPersonPrincipalName="); strcat(BASEDN, UID); strcat(BASEDN, "@ex.com,ou=People,ou=Users,dc=ex,dc=com"); LDAP *ld; char *ldapuri = NULL; LDAPURLDesc url; memset( &url, 0, sizeof(url)); url.lud_scheme = "ldap"; url.lud_host = HOST; url.lud_port = LDAP_PORT; url.lud_scope = LDAP_SCOPE_DEFAULT; ldapuri = ldap_url_desc2str( &url ); int rc, msgid, version = LDAP_VERSION3; struct berval passwd = {0, NULL}; passwd.bv_val = PASSWD; passwd.bv_len = strlen(PASSWD); LDAPControl c; LDAPControl **sctrlsp = NULL; LDAPControl *sctrls[3]; LDAPControl sctrl[3]; int nsctrls = 0; c.ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST; c.ldctl_value.bv_val = NULL; c.ldctl_value.bv_len = 0; c.ldctl_iscritical = 1; sctrl[nsctrls] = c; sctrls[nsctrls] = &sctrl[nsctrls]; sctrls[++nsctrls] = NULL; sctrlsp = sctrls; if((rc = ldap_initialize(&ld, ldapuri)) != LDAP_SUCCESS) { printf("LDAP_INIT Error\n"); return 1; } ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); ldap_set_option(ld, LDAP_OPT_REFERRALS, 0); ldap_set_option(ld, LDAP_OPT_SERVER_CONTROLS, sctrlsp); if((rc = ldap_sasl_bind(ld, BASEDN, LDAP_SASL_SIMPLE, &passwd, NULL, NULL, &msgid)) != LDAP_SUCCESS) { printf("BIND ERROR\n"); return 1; } return 0; } Regards, Andrius

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical