openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

OpenLDAP (using BDB) stalls adding 65,536th entry
by Mark Cooper 30 Jul '13

30 Jul '13

I've been doing some testing using OpenLDAP with BDB on a couple of different platforms. I noticed a similar situation. When I sit in a loop doing adds, at the 65,536th added entry the process stalls for a short period of time. After a minute or two, the add succeeds. My first thought is that this is a BDB issue, so I posted this question to Oracle's BDB forum. But I have yet to receive any answer. This situation seems to happen when I have around 43 10MB log files. During the stall, I notice many log files are being written (another 25 or so), which is a much quicker rate than was being written prior to the stall. The stall only happens once. I added another 350,000 entries and no more stalls. I ran a few other tests. Added 65,535 entries. All is fine. As soon as the next entry is add, even if I recycle the server, I hit the condition. I even tried deleting 1,000 entries. I would then need to add 1,0001 to get to 65,536 entries in the database and then hit the delay. I did try playing around with the number of indexes and it did seem to affect the size of the delay, but not the fact that the delay occurs. I'm trying to understand what OpenLDAP or BDB is doing during the stall. Is their a reorganizing of tables/indexes based on a threshold of 65,536 entries? Is this a one time only event as my testing seems to show? Again, my suspicion is that it's more of a BDB issue, but thought others here may have seen this situation. Some values from my DB_CONFIG file: set_cachesize 0 20971520 1 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lk_max_locks 2000 set_lk_max_objects 2000 set_open_flags db_private Some values from my slapd.conf: database bdb suffix "dc=myco,dc=com" rootdn "cn=Manager,dc=myco,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq index cn eq,sub index departmentNumber eq index employeeNumber eq,sub index uid eq,sub index entryCSN eq index entryUUID eq cachesize 5000 idlcachesize 5000 dncachesize 30000 cachefree 100 searchstack 8 threads 4 Thanks for any help, Mark

4 6

back_sql synrepl producer
by Raymond Page 30 Jul '13

30 Jul '13

Pierangelo, Has the status of back_sql as a valid syncrepl provider changed since this conversation: http://www.openldap.org/lists/openldap-technical/200904/msg00145.html I have a back_sql producer that I want to query and populate/synchronize to a back_hdb consumer. From the 2009 email exchange, it sounds as though it is impossible or unsupported, though some emails from 2004 made it sound as though its feasible. http://www.openldap.org/lists/openldap-devel/200410/msg00020.html -------------------------------------------------------------- # My SQL Producer database null suffix "cn=admin" rootdn "cn=admin" rootpw password #Clone of SQL entries for verifying syncrepl configuration #database hdb #suffix "ou=virtual" #rootdn "cn=admin" #directory /var/lib/ldap/virtual database sql lastmod on readonly on suffix "ou=virtual" dbname dbname dbuser dbuser upper_func UPPER use_subtree_shortcut yes children_cond "ldap_entries.dn=UPPER(?)" subtree_cond "UPPER(ldap_entries.dn) LIKE UPPER(CONCAT('%',?))" has_ldapinfo_dn_ru no overlay syncprov -------------------------------------------------------------- # My HDB Consumer database null suffix "cn=admin" rootdn "cn=admin" rootpw password database hdb rootdn "cn=admin" directory /var/lib/ldap syncrepl rid=123 provider=ldaps://localhost:636 type=refreshOnly interval=00:00:05:00 searchbase="ou=virtual" schemachecking=off bindmethod=simple binddn="cn=admin" credentials=password tls_cacertdir=/etc/pki/cacerts ---------------------------------------------------------- # Producer logging from -d 16384 syncprov_search_response: cookie=rid=123,csn=20130724213107.411609Z#000000#000#000000 slap_queue_csn: queing 0x7fe7fbffcb70 20130724213725.653540Z#000000#000#000000 slap_graduate_commit_csn: removing 0x7fe7f4168ef0 20130724213725.653540Z#000000#000#000000 ----------------------------------------------------------- # Consumer logging from -d 16384 do_syncrep2: rid=123 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=123 cookie=rid=123,csn=20130724213107.411609Z#000000#000#000000 slap_queue_csn: queing 0x7fba781ae900 20130724213107.411609Z#000000#000#000000 slap_graduate_commit_csn: removing 0x7fba781ae880 20130724213107.411609Z#000000#000#000000 syncrepl_updateCookie: rid=123 be_modify failed (32) -- Raymond Page

2 1

ldap_bind() extended response for password policy
by Andrius Kulbis 29 Jul '13

29 Jul '13

Hello, I'm trying to pull the password policy response message from ldap_bind() method. While checking the packet content from OpenLDAP after ldap_bind() request, with Wireshark, there is a control hooked to the ldap_bind() response, were the message code and message text about password expiration is, but I can't manage to parse that message from response. AFAIK, the OpenLDAP C API ldap_get_option() method doesn't have LDAP_OPT_SERVER_CONTRLOLS case implementation, and I can't get the PASSWORDPOLICYRESPONSE, although I have set the PASSWORDPOLICYREQUEST before the bind. Is there a workaround of this problem? ------ Regards, Andrius Kulbis

3 4

Q: "olcMirrorMode: no equality matching rule"
by Ulrich Windl 29 Jul '13

29 Jul '13

Hi! When trying to add "olcMirrorMode: TRUE" to a database where the value already exists, I get: --- # ldapmodify -ZZ -x -W -D cn=config -f mirrormode.ldif -v -c ldap_initialize( <DEFAULT> ) Enter LDAP Password: add olcMirrorMode: TRUE modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcMirrorMode: no equality matching rule add olcMirrorMode: TRUE modifying entry "olcDatabase={1}hdb,cn=config" modify complete --- It looks to me as if a compare operator for "TRUE" (Boolean?) is not defined. Am I right? olcObjectIdentifier: OMsBoolean OMsyn:7 Regards, Ulrich

2 1

How to Pointing Openldap Slave from Openldap Master on Openldap Replication
by Iftakhul Anwar 27 Jul '13

27 Jul '13

Hi All, I just successfully replicated Openldap using ubuntu 10.04 as master server (provider), 12.04 as slave server (consumer). I'm using syncrepl method for this replication. Below configuration for provider.ldif and customer.ldif *### provider ### # Add indexes to the frontend db. dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryCSN eq - add: olcDbIndex olcDbIndex: entryUUID eq #Load the syncprov and accesslog modules. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov - add: olcModuleLoad olcModuleLoad: accesslog # Accesslog database definitions dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=teleneos,dc=org olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart # Accesslog db syncprov. dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE # syncrepl Provider for primary db dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE # accesslog overlay definitions for primary db dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE # scan the accesslog DB every day, and purge entries older than 7 days olcAccessLogPurge: 07+00:00 01+00:00* Then below consumer.ldif * ### consumer ### #Load the syncprov module. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov # syncrepl specific indices dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryUUID eq - add: olcSyncRepl olcSyncRepl: rid=0 provider=ldap://139.193.195.170 bindmethod=simple binddn="cn=admin,dc=teleneos,dc=org" credentials=teleneos searchbase="dc=teleneos,dc=org" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog - add: olcUpdateRef olcUpdateRef: ldap://139.193.195.170* Now when i add any value on ldap provider, They will replicated on consumer (ldap slave server). But on my mechanism, i will have many ldap master machine on internet which will have to replicated to one ldap slave server.I will created centralized system. Moreover every ldap server is using dynamic Ip address which should change automatically. So not possible for me if i must add line* olcUpdateRef: ldap://ip_provider*for every ldap provider on ldap configuration. Is there configuration on ldap provider to pointing where ldap slave is ? So that, to replicate to slave server on my provider server (ldap master) , i just need pointing ip of slave ldap server is. So configuration pointing on every ldap provider. Help me to solve this issue. Thanks

1 0

undefined symbol: ldap_x_utf8s_to_wcs
by Michael 26 Jul '13

26 Jul '13

Hi, I originally sent this to the wrong mail list. I hope this is the correct one. I've compiled v2.4.35 on CentOS v6.4 with the smbk5pwd overlay. When I change my password the openldap terminates with the message: /usr/sbin/slapd: symbol lookup error: /usr/lib64/openldap/smbk5pwd-2.4.so.2: undefined symbol: ldap_x_utf8s_to_wcs Thanks for any help. Google wasn't so helpful this time. Mike

1 0

Example for SASL bind to Microsoft AD
by radiatejava 26 Jul '13

26 Jul '13

I am trying to do OpenLDAP integration with Microsoft AD/LDAP. For some initial troublehooting purpose, I am looking for using ldapsearch command with SASL bind (DIGEST-MD5). Can anyone give me the exact syntax for how to use ldapsearch command with SASL bind for active directory ? Appreciate your help. I have been trying out whats there over the web but no luck yet. Thanks.

3 5

Fwd: Fwd: Example for SASL bind to Microsoft AD
by radiatejava 26 Jul '13

26 Jul '13

These are my tries, do you see anything wrong here: ldapsearch -h 10.77.125.83 -p 389 -Y DIGEST-MD5 -R agentdev-dc.agentdev.com -X "dn:CN=sburnwal,CN=Users,DC=agentdev,DC=com" -b "dc=agentdev,dc=com" "(cn=iqsyed)" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: 80090303: LdapErr: DSID-0C0904BE, comment: The digest-uri does not match any LDAP SPN's registered for this server., data 0, v1db1 ldapsearch -h 10.77.125.83 -p 389 -Y DIGEST-MD5 -R agentdev-dc.agentdev.com -U sburnwal(a)agentdev.com -X "dn:CN=sburnwal,CN=Users,DC=agentdev,DC=com" -b "dc=agentdev,dc=com" "(cn=iqsyed)" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: 8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1 Thanks.

1 0

Replicating schema
by espeake＠oreillyauto.com 26 Jul '13

26 Jul '13

Okay so I am very new to openLDAP and we are running v 2.4.28 on ubuntu 12.04. In trying to set up a mirror with two servers that will grow to 3 soon. THis is what I get in the log about syncing the schema: Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 fd=16 ACCEPT from IP= 172.17.3.148:39672 (IP=0.0.0.0:389) Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=0 BIND dn="uid=admin,dc=example,dc=com" method=128 Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=0 BIND dn="uid=admin,dc=example,dc=com" mech=SIMPLE ssf=0 Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=0 RESULT tag=97 err=0 text= Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=1 SRCH base="cn=config" scope=2 deref=0 filter="(objectClass=*)" Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=1 SRCH attr=* + Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: findbase failed! 32 Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=2 UNBIND Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 fd=16 closed >From what I can tell it is binding with the simple methad establishes the search base looking at all of the object classes. but then it says it can't find the data base. Here is the ldif file from olcDatabase{0}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcsyncrepl: rid=001 provider=ldap://tntest-ldap-1.example.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=example,dc=com" credentials=secret olcsyncrepl: rid=002 provider=ldap://tntest-ldap-2.example.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,example,dc=com" credentials=secret olcMirrorMode: TRUE olcAccess: to * by by dn="uid=admin,dc=example,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" read by * none Any ideas on where I should be looking to make a correction or any other information you need to help me figure this out? Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

Replicating the Access Log
by Tim Gustafson 25 Jul '13

25 Jul '13

Hi, I'm using the accesslog overlay on all three of my LDAP servers to record BIND and WRITE operations. Is there any reason I can't replicate the data from cn=log on all three of my servers in MirrorMode so that all three of my servers contain a complete audit log of all bind and write operations? I tried to Google this, but all I'm findind is how-tos and questions about using accesslog and delta replication, which is not what I want. I want to actually replicate the contents of the accesslog itself between all of my servers. -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical