openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

How to make a temporary password expire?
by jeevan kc 12 Jul '13

12 Jul '13

With the Openldap password policy I was able to lock the account after a certain number of failed login attempts. When I reset the password, the user can login whenever. What I want to ask is, is there a way to make the password expire if the user doesn't login within lets say 24 hours after the password has been reset? Thank you! Jeevan

3 3

Re: ldap syncrepl issue.
by Ashok Kumar Shah 12 Jul '13

12 Jul '13

Is there a way reliable determine whether ldap slave is sync with master? Currently i am using ContextCSN diff between master and slave to determine the lag. Thanks in advance. Ashok On Fri, Jul 12, 2013 at 9:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, July 12, 2013 5:40 PM +0530 Ashok <ashok.shah(a)flipkart.com> > wrote: > > >> >> >> >> >> Hi, >> >> I am running ldap master and multiple slave with RefreshandPersist config. >> ldap search for an user shows different set of records. ContextCSN on >> master and slave are exactly same. >> What can i do to fix this. I tried restarting slave ldap but didn't help. >> Also i keep getting do_syncrepl: rid=112 rc 68 retrying every minute. I >> doubt if there is replication issue. >> > > It sounds like it is resyncing the DB, and skipping entries that already > exist: LDAP_ALREADY_EXISTS is error code 68. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

OTP
by Vishesh kumar 12 Jul '13

12 Jul '13

Do anyone point me right direction for setting up OTP authentication in openldap. Reference to URL or guide will be sufficient. -- Thanks & Regards Vishesh Kumar http://linuxmantra.com

3 3

Re: Antw: Re: olcSizeLimit become ignored somehow
by Quanah Gibson-Mount 12 Jul '13

12 Jul '13

--On Friday, July 12, 2013 8:06 AM +0200 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 11.07.2013 um 20:56 >>>> in > Nachricht <3CC7F3DA0AFBA8ED75D07A48(a)[192.168.1.28]>: >> --On Thursday, July 11, 2013 9:36 PM +0300 Покотиленко >> Костик <casper(a)meteor.dp.ua> wrote: >> >>> Hi, >>> >>> We have 1 master + 2 slaves setup (2.4.28, Ubuntu). >> >> Why are you running such an ancient version of OpenLDAP? Get a current >> release and then see if you have issues. > > For your records: SLES11 SP2 currently has 2.4.26, and SLES10 SP4 has > 2.3.32. Both are still "supported" by the vendor. > Basically those versions seem to work also ;-) What does this have to do with anything? Using distribution provided OpenLDAP builds is generally an extremely bad idea. Please keep replies to the list as well. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ldap syncrepl issue.
by Ashok 12 Jul '13

12 Jul '13

Hi, I am running ldap master and multiple slave with RefreshandPersist config. ldap search for an user shows different set of records. ContextCSN on master and slave are exactly same. What can i do to fix this. I tried restarting slave ldap but didn't help. Also i keep getting do_syncrepl: rid=112 rc 68 retrying every minute. I doubt if there is replication issue. Thanks, Ashok

2 1

olcSizeLimit become ignored somehow
by Покотиленко Костик 12 Jul '13

12 Jul '13

Hi, We have 1 master + 2 slaves setup (2.4.28, Ubuntu). We had an issue with only 500 search entries returned due to the default limit. I've added olcSizeLimit 100000 parameter to cn=config on all 3 servers and checked that all 3 servers return 500+ entries Ok. In a week or so the problem returned. I've checked - the setting existed on all 3 servers, but only one of them returned 500+, the rest 2 returned only 500 with 4 size limit exceeded. Solution was to change olcSizeLimit to some different value and then back. So, the question is how could slapd "forget" about the olcSizeLimit until it's changed? Known bug? Also, docs state that olcSizeLimit=0 is no limit, in fact it's literal 0. I've seen posts about that in the past, but it seems to still exist.

2 3

Q: Managing entryCSN with slapadd
by Ulrich Windl 12 Jul '13

12 Jul '13

Hi! I have a question: Is there a way to fix entryCSNs for slapadd? Reasoning: With dynamic configuration, sometimes (if you messed up) you'll have to edit your slapcat dump to reinitialize the config database. Unfortunately with replication the entry CSNs seem to casue trouble: If you don't change the CSN, the canges are not replicated, it seems; if you change the CSN, OpenLDAP doesn't seem to like it. I see repeating message slike these: slapd[3017]: Entry olcDatabase={0}config,cn=config CSN 20130709140112.108165Z#000000#000#000000 older or equal to ctx 20130709140112.108165Z#000000#000#000000 slapd[3017]: do_syncrep2: rid=001 CSN too old, ignoring 20130712085712.643156Z#000000#000#000000 (olcDatabase={2}monitor,cn=config) Ist there a way to fix this? Regards, Ulrich Windl

2 1

mdb grows to olcDbMaxsize if searched before syncrepl completes.
by Jancewicz, Russell 11 Jul '13

11 Jul '13

I am experiencing strange behavior when running an mdb database, as compared to the same system configured with hdb. If I conduct any queries while the server is receiving its initial data the server via syncrepl it stops receiving new entries and the data.mdb file balloons to the olcDbMaxsize value. I have tried adjusting configuration settings but regardless this continues to occur is this to be expected with mdb? It should be noted that if I wait for the entire database to replicate I can query the database fine and the size of data.mdb does not change. Furthermore if new changes are propagated down to the replica the issue does not arise. Any help would be appreciated. Please find below configuration ldifs and version information. -Russell J. Jancewicz University of Connecticut Version: @(#) $OpenLDAP: slapd 2.4.35 (Jun 17 2013 12:21:32) $ My olcDatabaseConfig: # {1}mdb, config dn: olcDatabase={1}mdb,cn=config changetype: add objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /srv/ldap/example.com olcSuffix: dc=example,dc=com olcRootDN: dc=example,dc=com olcRootPW: secret olcDbMaxsize: 4294967296 olcDbNoSync: FALSE olcReadOnly: TRUE olcDbCheckpoint: 512 30 olcDbIndex: default pres,eq olcAccess: to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * break olcAccess: to * by * none olcSyncrepl: rid=101 provider=ldap://replica0.ldap.example.com starttls=critical bindmethod=simple binddn="dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" olcSyncrepl: rid=102 provider=ldap://replica1.ldap.example.com starttls=critical bindmethod=simple binddn="dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" # {1}memberof, {1}hdb, config dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: top objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof

1 0

caseIgnoreMatch for Country String
by Maucci, Cyrille 11 Jul '13

11 Jul '13

Hello gurus, When I have this piece of schema included in my slapd.conf file... attributetype ( 1.3.6.1.4.1.11.11.1.1.1.1.402 NAME ( 'TestCountryString' 'TestCountryStringSyn' ) DESC 'Test Country String' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.11 SINGLE-VALUE ) ... my 2.4.32 slapd -Tt complains with this error: line 8 attributetype: AttributeType inappropriate matching rule: "caseIgnoreMatch". My understanding of http://tools.ietf.org/html/rfc4517 is that caseIgnoreMatch is valid for country string: "The caseIgnoreMatch rule compares an assertion value of the Directory String syntax to an attribute value of a syntax (e.g., the Directory String, Printable String, Country String, or Telephone Number syntax) whose corresponding ASN.1 type is DirectoryString or one of its alternative string types. " Could you confirm whether this is a bug in openldap or simply a misunderstanding from me ? Thanks in advance ++Cyrille

2 1

RE: configuring monitor database in SLES11 SP2
by Dieter Klünter 11 Jul '13

11 Jul '13

Hi, Am Wed, 10 Jul 2013 16:09:17 +0200 schrieb "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>: > Hi! > > I wonder how to configure the monitor database with dynamic > configuration in general ,and then specifically for SLES11 SP2 > (possibly slapd isn't configured for that, but I'm not sure). The > docs still describe the slapd.conf-way... first check if back-monitor is statically build in /usr/lib/openldap/slapd -VVV if so, slapadd dn -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical