openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

High load times with mdb
by Bill MacAllister 11 Jul '13

11 Jul '13

With the release of Debian 7 (wheezy) I was rebuilding a couple test systems and was surprised to find that the load times I am seeing for populating the mdb database with slapd have gone up dramatically. The load for a master server that was taking about 10 minutes just took 35 minutes. The slave is worse. A normal load time is 20 minutes and it is at 31 minutes now with an eta of about 2.5 hours. These systems are using OpenLDAP 2.4.35. Here are some relevent bits from the configuration. dn: cn=config olcToolThreads: 2 dn: olcDatabase={2}mdb,cn=config olcDbCheckpoint: 1024 5 olcDbEnvFlags: writemap olcDbEnvFlags: nometasync olcDbNoSync: FALSE olcDbMaxSize: 85899345920 The systems are Dell r610s with 16 gbyte of memory. Our database is currently 3.2G on the master server. I have been loading wheezy/2.4.35 databases for weeks now in preparation upgrading the OS and installing the new version of OpenLDAP on our production servers. This is the first time I have seen this. I fiddled with the hardware enough to the point I don't think it is a hardware problem. There is not really much tuning to do with mdb and I would appreciate some suggestions for what to look at next. Bill -- Bill MacAllister Infrastructure Delivery Group, Stanford University

3 5

"No such object" error with translucent overlay and base scope search
by Steve Eckmann 10 Jul '13

10 Jul '13

We found that we get a "No such object" error from the translucent overlay when we do a search like this: ldapsearch -x -H ldaps://localhost -LLL \ -b "cn=John Doe,ou=Users,dc=example,dc=com" -s base \ -D "cn=admin,dc=example,dc=com" -w admin \ '(&)' if there is no entry for "cn=John Doe,ou=Users,dc=example,dc=com" in the local database, whether or not the remote entry exists. It seems like a mistake for the translucent overlay to report an error if the remote entry exists, since it only means that we haven't added any local attributes yet. Is there a way to suppress the error result when the proxied server returns an entry, so we don't have to hack around this weirdness in our client? Thanks. Steve

2 2

RE: unable top add ppolicy_overlay.ldif
by Sotomayor, Vicente (ITD) 10 Jul '13

10 Jul '13

I had a similar error using RH 6 and so I used pwdAttribute: 2.5.4.35 instead of pwdAttribute: userPassword

3 2

configuring monitor database in SLES11 SP2
by Ulrich Windl 10 Jul '13

10 Jul '13

Hi! I wonder how to configure the monitor database with dynamic configuration in general ,and then specifically for SLES11 SP2 (possibly slapd isn't configured for that, but I'm not sure). The docs still describe the slapd.conf-way... Regards, Ulrich

1 0

Need Help on ACL
by pradyumna dash 10 Jul '13

10 Jul '13

Hi, Need a help related to ACL. I need to setup some basic ACL for LDAP, I need Manager only should have access to the entire tree both read and write and only users under ou=operation can have a read only access to the tree. Currently i dont have any ACL in the slapd.conf file. Would be great if you can share the ACL. Please help. Regards, /Pradyumna

2 1

unable top add ppolicy_overlay.ldif
by Michael Roth 09 Jul '13

09 Jul '13

I'm using Ubuntu 12.04 server running OpenLDAP-2.4.28. I'm following this tutorial HERE<http://raerek.blogspot.com/2012/09/openldap-password-policy-on-ubuntu-1204.…> When I get to the step to add the ppolicy_overlay.ldif I get this error: ldapadd -x -D "cn=admin,cn=config" -w secret -f ppolicy_overlay.ldif adding new entry "olcOverlay={1}ppolicy,olcDatabase={1}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: User Schema load failed for attribute "pwdAttribute". Error code 17: attribute type undefined What could the issue be? future thanks!

1 0

Mirror mode replication breaks at times.
by Pradyumna 09 Jul '13

09 Jul '13

Hi, I have configured mirror mode replication. It's 2 node. Everything works fine but if I don't work on the server or say 30/40 mins or so and then when I try to add or delete any users or groups it don't get replicated to the other node. Am not getting any error in the logs and if I restart the slapd service it's syncs again and giving expected results. The same setup I have in the test environment and its works like a charm the only difference in this setup is that the 2 servers are hosted on 2 different DC geographically separated where as in test they are in same DC. Am using the openldap version which comes by default with RHEL 6.3. If it would have been a version issue then I should have expected the same result in test as well? Please help. Regards, /Pradyumna Sent from my iPhone

4 3

"Fan-Out" replication
by espeake＠oreillyauto.com 08 Jul '13

08 Jul '13

Oracle talks about doing a "fan-out" replication that fits what we are looking at doing. What we want to do is once a day or once a week is to replicate our production LDAP from our master to a master LDAP server at our DR site. That server would then push changes to the consumer LDAP servers at our DR site. We are trying to keep the sites basically mirrored but I do not want changes made at the DR site to replicate back to the production master. Master LDAP /\ / \ / \ / \ / \ DR Master LDAP \ / \ / \ / \ / Production Consumers / / DR Consumers I hope that helps to visualize what we are trying to do. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

What should I use as hostname for php to connect to openLDAP?
by Jason Huang 08 Jul '13

08 Jul '13

Hello - I am a newbie to openLDAP and wants to get some help here. I've deployed apache on a EC2 server, obtain an elastic IP from amazon and point xyz.com to this IP. I've installed a service provider(simplesamlphp) with hostname sp.xyz.com, pointing to this same IP. I've also installed an identity provider (simplesamlphp) with hostname idp.xyz.com, pointing to this same IP. Now I am installing openLDAP on this same server. What hostname should I use for php to connect to this ldap server? Should I use "xyz.com" or " sp.xyz.com" or "idp.xyz.com", or something else like "ldap.xyz.com"? If I am using "ldap.xyz.com", where should I specify this hostname? thanks!

2 1

slapd[16890]: main: TLS init def ctx failed: -1
by Ulrich Windl 08 Jul '13

08 Jul '13

Hi! I found out that "slapd[16890]: main: TLS init def ctx failed: -1" is due to [pid 16890] open("/etc/ssl/private/slapd.key", O_RDONLY) = -1 EACCES (Permission denied) and I wonder whether it isn't possible pro privide a better error message like "slapd[16890]: main: TLS init failed to read /etc/ssl/private/slapd.key: Permission denied" Regards, Ulrich

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical