openldap-technical

openldap-technical@openldap.org

9 participants
9989 discussions

How to make OpenLDAP use random (v4) UUIDs in entryUUID attribute
by dorian taylor 01 Jun '13

01 Jun '13

Hello, It is my understanding that OpenLDAP keys its entries on UUIDs under the hood. I have a system that makes extensive use of UUIDs as canonical (and sometimes public-facing) identifiers, and would like to tap into the UUIDs generated for the objects in the LDAP directory for certain operations over those objects. The problem is I'm using type 4 (random) UUIDs [1] everywhere, and OpenLDAP uses type 1 (time-based). It is important to the system to some extent that these identifiers be resistant to sequencing. As such, they really ought to be random. Since it hasn't been deployed in production yet, the sanest course of action seems to be to bend OpenLDAP to comply. (The alternative would be to maintain a dictionary of some kind, which I'm not keen about.) A survey of the code is as such: OpenLDAP doesn't appear to care which version of UUID it uses save for the generator function itself. The util library is hardcoded [2] to use type 1, and the entryUUID attribute itself is constrained in the schema [3] to not permit modification (where "modification" ostensibly also extends to adding new records). I'm not too familiar with the source but at a glance it appears to accommodate an entryUUID attribute as input [4]. I guess my question is: what's the best strategy? * Relax NO-USER-MODIFY on the entryUUID schema entry and set it at the application layer (easiest but most prone to problems) * Hack uuid.c to use uuid_generate_random instead of uuid_generate (easy, but introduces a maintenance problem) * Create an overlay (no idea where to start but can figure it out) * Figure out some way to make the UUID version configurable and send a patch upstream (most work and would it even be desirable?) Links: 1) http://tools.ietf.org/html/rfc4122#section-4.4 2) http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… 3) http://tools.ietf.org/html/rfc4530#section-2.4 4) http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… -- Dorian Taylor http://doriantaylor.com/

2 4

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 01 Jun '13

01 Jun '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> Hello, >> >> >> is it possible to use a ldif-backup with operation attributes >> (ldapsearch ... '+' '*') with slapadd, to save the operation >> attributes, if no slapcat backup is available? Are there any concerns? > > > If you can't get a slapcat backup, how would you get a ldapsearch backup? > A seconds reason, why I try to prevent using slapcat on a productive system is: ======================================================= slapd[4812]: bdb(ou=root): PANIC: Permission denied slapd[4812]: bdb(ou=root): DB_ENV->log_newfh: 15752: DB_RUNRECOVERY: Fatal error, run database recovery slapd[4812]: bdb(ou=root): txn_checkpoint: failed to flush the buffer cache: DB_RUNRECOVERY: Fatal error, run database recover slapd[4812]: bdb(ou=root): PANIC: fatal region error detected; run recovery slapd[4812]: null_callback : error code 0x50 slapd[4812]: syncrepl_updateCookie: rid=001 be_modify failed (80) slapd[4812]: do_syncrepl: rid=001 rc 80 retrying (4 retries left) ======================================================= This message I got today on a productive system while getting a ldif via slapcat for setting up an syncrepl slave. This shouldn happen, slapcat (8) manpage tells: "For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. *It is always safe to run slapcat with the slapd-bdb(5)*, slapd-hdb(5), and slapd-null(5) backends." So using ldapsearch is more reliable for me ... Kindly regards Meike

2 2

Any issue on random OIDs?
by Geo P.C. 31 May '13

31 May '13

For our openldap server we created custom attributes by giving random OIDs like 2.25.10.1, 2.25.10.100.10 etc . We are able to add custom attributes and the LDAP server is working fine. Please let us know is there any issue in giving random OIDs for attributes and object classes. Also is there any issue in future while using this. Can anyone please advise us on this. Also I came to know that we can create OIDs without registering. From this site http://www.itu.int/ITU-T/asn1/cgi-bin/uuid_generate I can create UUID but from where I can convert this UUID to OID? Suppose when we convert this UUID to decimal shall we can use it permanently without any issue? Please help us on it Thanks Geo* <http://pcgeo.blogspot.in/>*

2 4

About ldapwhoami
by Jacques Foucry 31 May '13

31 May '13

Hello folks, I think I misunderstood something, but I can't make ldapwhoami working. Mu openldap server work perfectly I and all my users can connect using it. But whe I try to use ldapwhoami I get an error: ldapwhoami -x -D uid=jfoucry,ou=people,dc=example,dc=com -W Enter LDAP Password: ldap_bind: Invalid credentials (49) I am sure to use my LDAP password. I try with -d1 to have debug, and I reach to right server. What's going wrong? Thanks in advance for your help, regards, Jacques -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

3 5

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 8:04 PM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> I want to preserve the operational attributes from the ldapsearch ldif >> (created with '+' '*'). >> But I saw, that a ldapsearch ldif with operational attributes has a >> more operational attributes than from the slapcat ldif. > > > An ldapsearch generated and slapcat generated LDIF of the same db will be > identical for *,+ for ldapsearch. So your statement doesn't really make > much sense. I compared it and found this three additional attributes are in the ldapsearch, but not in slapcat: - entryDN - subschemaSubentry - hasSubordinates It seems, that slapcat ignores this values or at least, it does not complain... Kindly regards Meike

1 0

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 7:51 PM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> 2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>> >>> --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone >>> <meike.stone(a)googlemail.com> wrote: >>> >>>> Hello, >>>> >>>> >>>> is it possible to use a ldif-backup with operation attributes >>>> (ldapsearch ... '+' '*') with slapadd, to save the operation >>>> attributes, if no slapcat backup is available? Are there any concerns? >>> >>> >>> >>> If you can't get a slapcat backup, how would you get a ldapsearch backup? >>> >> >> That's a a ldif created from a colleague, before the database on the >> test system was deleted.. >> I want to simulate some documented test from this colleague, but ony >> the ldif exist and no slapcat. > > > So slapadd it. slapadd will automatically generate the operational attrs. > > I want to preserve the operational attributes from the ldapsearch ldif (created with '+' '*'). But I saw, that a ldapsearch ldif with operational attributes has a more operational attributes than from the slapcat ldif. Is it possible with this ldif, to create the database like my colleague it used? Thanks Meike

4 4

Post-clone Cleanup of Hostname on Version Query
by Kim, Robert 31 May '13

31 May '13

I've been cloning servers with LDAP server set up on them and the process has been working fine but when I recently queried the version with slapd -V, the hostname of the original server shows up. I tried re-running make and make install with no luck. How can I change the hostname that shows up on the version query without redoing the whole installation? OpenLDAP 2.4.30 Red Hat 5.7 Robert Kim Staff Systems Engineer Lockheed Martin IS&GS National/Defense 3100 Zanker Rd San Jose, CA 95134 408-473-4260 Office 408-505-8717 Cell

3 2

Re: how to take hot backup of MDB ...
by anil beniwal 31 May '13

31 May '13

Hi Sanjay e.g /opt/symas/bin/mdb_copy /openldap-data /backup/ syntax:- mdb_copy /<db-dir> /<backup destination> You only need data.mdb file. We are having very big db size(about 500Gb) and we never face any problem with backup. lock.mdb is not required. You can simply copy back data.mdb to your db directory for restoration and it will work like magic. On Thu, May 30, 2013 at 3:21 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, May 29, 2013 2:26 PM -0700 Sanjay Jain <sjain74(a)gmail.com> > wrote: > > How do I take backup of data.mdb and lock.mdb files while server >> is up and provisioning is going on? Is mdb_copy not the right tool for >> this purpose? What am I missing? >> > > a) What version of OpenLDAP are you using? I can mdb_copy a live DB just > fine. > > b) You only need a backup of data.mdb. That's why lock.mdb isn't copied. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2 1

use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

Hello, is it possible to use a ldif-backup with operation attributes (ldapsearch ... '+' '*') with slapadd, to save the operation attributes, if no slapcat backup is available? Are there any concerns? Thanks Meike

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical