openldap-technical

openldap-technical@openldap.org

1 participants
9868 discussions

hashed credentials for idassert-bind?
by Steve Eckmann 23 Apr '13

23 Apr '13

I thought I could use something like "credentials={SSHA}/iiPJIZ2Srf+O0HqLIypyKYKccx9V6ag" with idassert-bind or acl-bind in configuring an ldap backend in slapd.conf, instead of including the cleartext password. But when I try that I get an "invalid credentials" error from the proxied Active Directory. I've carefully regenerated the hashed value with slappasswd and repasted the new value into my slapd.conf file, so I'm pretty sure that the hash is correct. Is there a right way to obfuscate passwords that will be sent to a proxied AD server? Thanks. Steve

3 4

Re: How to improve performance with MDB backend?
by Saša-Stjepan Bakša 21 Apr '13

21 Apr '13

How do you measure or compare speed? I have a Python program which add a predefined number of users (1mil and each user consists of 8 DNs and 3 alias DNs) and for Modify test I have also Python program which modify 1 attribute with random value under one DN changed sequentially from 1 to 1mil) Now I can add those 1 million of users in 5508 sec what amounts to 181,55 users per second. Modify program can do 2141,33 modifications per sec. Do you find those numbers reasonable or are they nonsense? Is there a way to get 10000 modifications per second or I am asking a stupid question? Sasa On Mon, Apr 8, 2013 at 4:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, April 08, 2013 4:49 AM -0700 Howard Chu <hyc(a)symas.com> > wrote: > > Saša-Stjepan Bakša wrote: >> >>> Hi, >>> >>> Maybe this is not the best way to ask but I would like to get some >>> performance expectations or maybe suggestions how to improve >>> performance. I do have relatively long experience with OpenLDAP as a >>> precompiled package and with much less users so performance was not an >>> issue for those installations. >>> >>> Now I need to put few million users (now one million for test), custom >>> tailored schema and search performance is crucial but also modify >>> performance is big issue. Before MDB I have used HDB as backend. >>> >>> What to do to improve write part of performance or performance in general >>> (when adding data – from time to time – OpenLDAP stalls in a way)? >>> Just around 5 add/mod operations during that time then it continue with >>> much higher speed. >>> >>> I have used many different sources to find out other peoples experience >>> and I didn't choose to write to list lightly but I really need some >>> help/hints. >>> >> >> There's nothing particular to LMDB to tune. But if you're seeing pauses >> due to disk I/O, as your iotop output seems to indicate, you might want >> to look into using a different I/O scheduler. >> > > Not quite true. On Linux, I suggest setting the olcDbFlags as follows: > > olcDbEnvFlags: writemap > olcDbEnvFlags: nometasync > > With those flags set, writes are 65x faster for me with back-mdb than they > are with back-hdb/back-bdb. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

7 27

backsql -> slapd restart necessary?
by hornuda 21 Apr '13

21 Apr '13

Hello, I use backsql as ldap backend. Is it necessary to restart the slapd server when a new entry was written into a table (postgresql) to make this entry available in ldap? Cheers, hornuda

2 1

disabling user account
by Jignesh Patel 20 Apr '13

20 Apr '13

Does openldap has a provision like active directory to disable a user? useraccountcontrol 544 -Jignesh

6 8

LDAP proxy
by Šerých Jakub 19 Apr '13

19 Apr '13

Dear group, I manage the school network in which we have two separate MS-AD servers (one for teachers and the other for students). We also have mySQL database of our alumni. I would like to connect this three information bases to one "virtual" LDAP server (for authentication purposes on various LAMP web servers etc.). Is it possible to configure such virtual or proxy server using OpenLDAP? And if yes, could anybody be so kind and redirect me to some how-to resources? I was trying to search this using Google, but as I'm OpenLDAP newbie, I don't know the terminology exactly and my search results are not good. Thanks in advance for any help Jakub

2 1

Re: Alias dereferencing
by Saša-Stjepan Bakša 19 Apr '13

19 Apr '13

Compiled from source, version current OpenLDAP RE24 (from GIT) ./configure --prefix=/opt/openldap Data was added with same ldapadd progy, schema is the same version. Here it is - config, slapcat from slapd.d (lengthy schema omitted): dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /opt/openldap/var/run/slapd.args olcLogLevel: none olcPidFile: /opt/openldap/var/run/slapd.pid structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: a8df00ce-80fb-1031-8652-fff9cf1d6a3e createTimestamp: 20120822232009Z olcServerID: 1 ldap://spr1.lab.os olcServerID: 2 ldap://spr2.lab.os olcThreads: 2 olcToolThreads: 32 olcIdleTimeout: 10 entryCSN: 20130402101823.578807Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130402101823Z contextCSN: 20130402101823.578807Z#000000#001#000000 contextCSN: 20130329141804.133907Z#000000#002#000000 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: 9c79c918-80fb-1031-92fa-11190a1d893e creatorsName: cn=config createTimestamp: 20120822231948Z entryCSN: 20120822231948.419573Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120822231948Z snip-----------------------------------------------------------------------------------------snip dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb structuralObjectClass: olcBackendConfig entryUUID: 8c59fb88-2cc3-1032-9b7c-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135149Z entryCSN: 20130329135149.548491Z#000000#001#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329135149Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read structuralObjectClass: olcDatabaseConfig creatorsName: cn=config entryUUID: a8df0ace-80fb-1031-8653-fff9cf1d6a3e createTimestamp: 20120822232009Z olcSizeLimit: 5000000 entryCSN: 20130326133336.496532Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130326133336Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: a8df1960-80fb-1031-8654-fff9cf1d6a3e creatorsName: cn=config olcRootDN: cn=admin,cn=config createTimestamp: 20120822232009Z olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcSyncrepl: {0}rid=001 provider=ldap://spr1.lab.os binddn="cn=admin,cn=config " bindmethod=simple credentials=siemens searchbase="cn=config" type=refreshAn dPersistretry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://spr2.lab.os binddn="cn=admin,cn=config " bindmethod=simple credentials=siemens searchbase="cn=config" type=refreshAn dPersistretry="5 5 300 5" timeout=1 olcMirrorMode: TRUE entryCSN: 20130329141804.133907Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141804Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth entryUUID: 36e07d68-2cc7-1032-8bf6-1905ee7d8e9d createTimestamp: 20130329141804Z entryCSN: 20130329141804.132859Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141804Z dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /opt/openldap/var/openldap-data olcSuffix: dc=spr olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=spr" write by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=spr" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=spr olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcDbCheckpoint: 4096 10 olcDbNoSync: TRUE olcDbMaxSize: 107374182400 structuralObjectClass: olcMdbConfig entryUUID: 804a8ede-2cc3-1032-9b7a-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135129Z olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: MSISDN eq olcDbIndex: IMSI eq olcDbIndex: pfUsername eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: contextCSN eq olcMirrorMode: TRUE olcSyncrepl: {0}rid=003 provider=ldap://spr1.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider=ldap://spr2.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 entryCSN: 20130329141637.442296Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130329141637Z dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth entryUUID: e2aa5b24-2cc6-1032-8bf5-1905ee7d8e9d createTimestamp: 20130329141542Z entryCSN: 20130329141542.849443Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141542Z Output from ldapsearch done on server with mdb: root@test7kde:~# ldapsearch -x -h 172.17.103.200 -D cn=admin,dc=spr -s sub -a always -W -b pfUsername=user1,dc=USERNAME,dc=spr Enter LDAP Password: # extended LDIF # # LDAPv3 # base <pfUsername=user1,dc=USERNAME,dc=spr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Output from ldapsearch done on server with hdb: root@test7kde:~# ldapsearch -x -h 172.17.103.215 -D cn=admin,dc=spr -s sub -a always -W -b pfUsername=user1,dc=USERNAME,dc=spr Enter LDAP Password: # extended LDIF # # LDAPv3 # base <pfUsername=user1,dc=USERNAME,dc=spr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # 1, USERS, STANDARD, SPR dn: uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprUser uid: 1 # userData, 1, USERS, STANDARD, SPR dn: subdata=userData,uid=1,ds=USERS,o=STANDARD,dc=SPR roamingAllowed: TRUE objectClass: sprUserData subdata: userData prepaidFlag: TRUE sn: TestProv pfUsername: user1 givenName: pcrfUser loginPassword: 123 pfPassword: 123 # applicationData, 1, USERS, STANDARD, SPR dn: subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprUserData subdata: applicationData # aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: aaa # 2g3g, aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=2g3g,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: 2g3g # pcrf, aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=pcrf,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: pcrf # 2g3gProf, 2g3g, aaa, applicationData, 1, USERS, STANDARD, SPR dn: subdata=2g3gProf,ds=2g3g,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=S TANDARD,dc=SPR service2g3g: defaultService profile2g3g: profile1 productCode2g3g: prodCode barringStatus2g3g: barringStatus objectClass: spr2g3gUser uniqueId2g3g: user1 apnGroup2g3g: apnGG provider2g3g: me-myself-and-i framedIPAddress2g3g: 1.1.1.1 accountGroup2g3g: acctGroup subdata: 2g3gProf msisdn: 1234560001 flagStatus2g3g: flagStatus class2g3g: classs type2g3g: type creationDate2g3g: 01.10.2010. classification2g3g: 111 poolGroup2g3g: poolGroup status2g3g: ACTIVE # pcrfProf, pcrf, aaa, applicationData, 1, USERS, STANDARD, SPR dn: subdata=pcrfProf,ds=pcrf,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=S TANDARD,dc=SPR profile: 3100 totalUsedVolume: 3 msisdn: 1234560001 objectClass: sprPcrfProf totalMaximumVolume: 5 imsi: 1991234560001 subdata: pcrfProf subscriberServiceProfile: TM00003100 featureList: Faeture1 paymentTypexy: NeverPaid pfUsername: user1 tariffId: 1 pcrfServiceId: 3100 # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 On Thu, Apr 18, 2013 at 4:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, April 18, 2013 1:55 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> >> I am using alias dereferencing with hdb backed because that was >> application requirement. Now I am switching to mdb but I can't get the >> same answer with ldapsearch. >> >> Does dereferencing work for mdb? >> > > OpenLDAP version? Example configuration? > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

I can't delete a shell DB
by Diego Woitasen 18 Apr '13

18 Apr '13

Hi, I was using shell backend and now switched to sock backend (shell looks unstable). My problem not is that I can't delete the shell DB. This is the entry in cn=config: dn: olcDatabase={3}shell,cn=config objectClass: olcShellConfig objectClass: olcDatabaseConfig olcDatabase: {3}shell When I try to remove it I get Error 53 - Unwilling to perform. Looks like there is a dependency with this entry, but I don't see where. Is the last one, i removed the suffix.... hints? And don't see anything usefull in the logs. Regards, Diego -- Diego Woitasen

4 11

Stable schema definition for dynlist overlay?
by Paolo Miotto 18 Apr '13

18 Apr '13

Hello, I'm trying dynamic groups on ldap via dynlist overlay. In the documentation (slapo-dynlist man page, openldap administrator guide) the examples are using the dyngroup.schema, which is marked as experimental. There are more reliable schemas? The experimental label is only due to the lack of an rfc, or other issues can be found using this schema? Or it is better to define new attributes and objectclass in our internal schema? The authorization attributes and objectclass are required or it is safe to ignore them if not used? I have tried a schema without them and I have only a warning in the log, but it is a test environment and maybe it is not exaustive. Best regards Paolo Miotto ---------------------------------------------------------------------- SEMEL (SErvizio di Messaging ELettronico) - AINF, Universita' di Udine

2 1

Alias dereferencing
by Saša-Stjepan Bakša 18 Apr '13

18 Apr '13

I am using alias dereferencing with hdb backed because that was application requirement. Now I am switching to mdb but I can't get the same answer with ldapsearch. Does dereferencing work for mdb? Lp Sasa

2 1

Backend meta and write access?
by Yoann Gini 18 Apr '13

18 Apr '13

Hello, I’m working on a setup with backend meta, the aim of the setup is to have a LDAP database for our Samba 3. We already have a LDAP but we don’t wan’t to change the schema, so I’ve build a LDAP server on Centos with a local database for samba (cn=samba) and I plan to use meta to do the merge (and the translucent to save locally new fields for existing users). I’ve successfully deploy the meta backend but it work in readonly mode, I can’t write on it… Here is my config, if someone can give me a clue, that would be great :-) ####################################################################### # Samba Database ####################################################################### database bdb directory "/var/db/openldap/samba-directory" suffix "cn=samba" rootdn "uid=samba_root,cn=users,cn=samba" rootpw {SSHA}--- access to * by dn.exact="uid=samba_root,cn=users,dc=example,dc=com,dc=meta" write by * read ####################################################################### # Meta Database ####################################################################### database meta suffix "dc=example,dc=com,dc=meta" ## Main database dc=example,dc=com mapped to dc=example,dc=com,dc=meta uri "ldap://192.168.2.200/dc=example,dc=com,dc=meta" suffixmassage "dc=example,dc=com,dc=meta" "dc=example,dc=com" ## Mapping for specific Samba node uri "ldap://127.0.0.1:1389/sambaDomainName=EXAMPLE,dc=example,dc=com,dc=meta" suffixmassage "sambaDomainName=EXAMPLE,dc=example,dc=com,dc=meta" "sambaDomainName=EXAMPLE,cn=samba" uri "ldap://127.0.0.1:1389/cn=idmap,dc=example,dc=com,dc=meta" suffixmassage "cn=idmap,dc=example,dc=com,dc=meta" "cn=idmap,cn=samba" uri "ldap://127.0.0.1:1389/cn=nt-computers,dc=example,dc=com,dc=meta" suffixmassage "cn=nt-computers,dc=example,dc=com,dc=meta" "cn=nt-computers,cn=samba" access to * by dn.exact="uid=samba_root,cn=users,dc=example,dc=com,dc=meta" write

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical