openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Search speed regarding BDB_IDL_LOGN and order in search filter
by Meike Stone 31 Jan '13

31 Jan '13

Hello, I'm sorry, but I want to ask again for clarifying. First question: - An index slot is loosing precision if the search result for an (indexed) attribute is larger than 2^16. Then the search time is going to increase a lot. - I can change this via BDB_IDL_LOGN. - But if I have a directory, that holds 200.000 employees with '(ObjectClass=Employees)', the result is larger than 2^16 and it is slow. - lets say, the employees are distributed over 4 continents and the DIT is structured geographical eg.: o=myOrg, c=us (100,000 employees) o=myOrg, c=gb ( 30,000 employees) o=myOrg, c=de ( 25,000 employees) o=myOrg, c=br ( 45,000 employees) Can i prevent it this problem with index slot size, if I change the search base to "o=myOrg, c=gb", because there are only 30,000 employees. This takes me to the second question: "How is a search filter evaluated?" Lets say, I combine three filter via "and" like '(&(objectlass=Employees)(age=30)(sex=m))' and the all attributes are indexed. Each filter results: (objectlass=Employees) => 200,000 entries (age=30) => 10,000 entries (sex=m) => 3,000 entries Does the order matter regarding speed, is it better to form the filter like this? '(&(sex=m)(age=30)(objectlass=Employees))' Thanks Meike

2 2

CLOSE_WAIT TCP connection
by Vanpeer 31 Jan '13

31 Jan '13

Hello, Could you please help me to understand the problem that i didn't really resolv.. I have my openldap platform which has been working well OpenldapServer : 2.3.39 Openldapclient : RedHat 5.x with nss_ldap and pam_ldap.so release 253-51 All my servers were configured with : /etc/nsswitch.conf /etc/ldap.conf and /etc/pam.d/sshd The user authentification with ssh connection is perfect. The filter of authorisation host connection is ok too. Everything is ok. But i've recently realized that i have a lot of TCP CLOSE_WAIT connexion from differents servers to my OpenLdapServer. These connexions are somethings like : tcp 1 0 IP_CLIENT:44633 OPENLDAP_SERVER:389 CLOSE_WAIT 3321/crond off (0.00/0/0) tcp 1 0 IP_CLIENT:44674 OPENLDAP_SERVER:389 CLOSE_WAIT 2426/nagios off (0.00/0/0) tcp 1 0 IP_CLIENT:44956 OPENLDAP_SERVER:389 CLOSE_WAIT 4652/ntpd off (0.00/0/0) ..... And so on .. I have ~20 TCP CLOSE_WAIT connection to OPENLDAP_SERVER I don't understand when these applications tried to connect to OPENLDAP server and why i have TCP persistent connexion. Meanwhile, I only have SSHD configured to use pam_ldap.so ... Someone can help me please ?!? Thanks by advance for your answer and i m sorry about my English

1 0

indexing with mdb
by anil beniwal 30 Jan '13

30 Jan '13

Hi i am using openldap 2.4.33 on rhel 6.3 with large mdb database size. We are using it for last few weeks, now we want to add index few attributes. What approach we should take, so that there is no downtime. How we can check the status if indexing is complete or not ? with both dynamic and static config We are using flat file configuration. Anil

1 0

Kerberos/LDAP integration
by Asmaa Ahmed 30 Jan '13

30 Jan '13

Hello, I am trying to integrate Kerberos to my Openldap server, and I am following pretty much the instructions from there 'http://www.rjsystems.nl/en/2100-d6-kerberos-openldap-client.php'But still can't get it work to connect the client server to the LDAP one after the integration!I can see this error in my logs:Jan 30 17:27:17 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:17 mail nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...Jan 30 17:27:18 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:18 mail nscd: nss_ldap: could not search LDAP server - Server is unavailable Thanks.

2 2

ldapsearch question
by Benin Technologies 29 Jan '13

29 Jan '13

Hi, I was wondering if the following search can be done. Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | -->cn=Jane Doe | |-- objectClass=inetOrgPerson |-- cn=Jane Doe |-- mobile : 11223344 |--> cn=secretary | |--objectClass=organizationalRole |--cn=secretary |--telephoneNumber = 12345678 I'd like to return, in a SINGLE search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 In other words, I'd like the search to return the attribute telephoneNumber AS an attribute of Jane Doe, and not as an attribute of Jane Doe --> cn=secretary Ben

2 1

ldapsearch trying to use SASL
by Scott Classen 29 Jan '13

29 Jan '13

Hello, I have a script which checks for the existence of an email address in my LDAP directory. the relevant line is: ldapsearch -D "uid=nss,dc=bah,dc=com" -w mypassword -b "ou=People,dc=blah,dc=com" uid=bobthebuilder mail If I run this script as the root or tomcat user it works as expected and returns the mail attribute. If this script is called from Apache Tomcat webapp (running as the tomcat user). I receive the following errors in my slapd.log file: Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 fd=26 ACCEPT from IP=131.1.2.3:50230 (IP=0.0.0.0:389) Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SRCH attr=supportedSASLMechanisms Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=1 BIND dn="uid=nss,dc=bah,dc=com" method=163 Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: security flags do not match required Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=2 BIND dn="uid=nss,dc=bah,dc=com" method=163 Jan 29 13:59:29 bl1 slapd[3783]: SASL [conn=247839] Failure: no secret in database Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=2 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 fd=26 closed (connection lost) I don't understand why the ldapsearch is searching for attr=supportedSASLMechanisms when invoked from within a Tomcat Webapp, but works fine when invoked from a c shell. Any ideas? Your help is greatly appreciated. Scott

2 2

TLS problem
by Chris 29 Jan '13

29 Jan '13

Hi I am running Openldap 2.4.23 on RHEL6. I can telnet to the server on both 389 636 ports. I can do a ldapsearch and ldapadd without any errors. I get this error when I start the slapd daemon. /ldap_start_tls_s() failed: Can't contact LDAP server: Transport endpoint is not connected (uri="ldap://ldapserver")// //failed to bind to LDAP server ldap://ldapserver: Can't contact LDAP server: Transport endpoint is not connected/ When I do a ldapsearch -x -d1 -Z -b 'dc=flamengro,dc=co,dc=za' I get the following error /TLS: certificate [//CA certificate details omitted here...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //TLS: error: connect - force handshake failure: errno 0 - moznss error -8172// //TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //ldap_err2string// //ldap_start_tls: Connect error (-11)// // additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user/ Any help will be appreciated. This is my slapd.conf file include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCipherSuite HIGH TLSCertificateFile /etc/pki/tls/certs/slapdcert.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapdkey.pem TLSVerifyClient never database bdb suffix "dc=flamengro,dc=co,dc=za" checkpoint 1024 15 rootdn "cn=Manager,dc=flamengro,dc=co,dc=za" rootpw secret directory /var/lib/ldap/flamengro index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitor # allow only rootdn to read the monitor access to * by dn.exact="cn=Manager,dc=flamengro,dc=co,dc=za" read by * none access to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none I

4 3

Atribute Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hi, I have a master ldap master, then make replication. The replication is ok, but when i see the samba atributes are empty. sambaAcctFlags: [U] sambaLogonScript: netlogon.vbs sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000 00000000 sambaPwdCanChange: 1359464617 sambaPwdLastSet: 1359464617 sambaPwdMustChange: 2147483647 sambaLMPassword: sambaNTPassword: sambaSID: S-1-5-21-4183517729-3427035622-36389750-6040 sambaPrimaryGroupSID: S-1-5-21-4183517729-3427035622-36389750-3003 Any suggestion ? Rodrigo Faria Tavares

1 0

Replication LDAP Users Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hello, Today, I have one host vmware, it a master, it replicate all datas about LDAP from filesever01 (Samba). Using LDAP, I using the inteface, and when i create a ldap user, it create a samba account. So, i not need create user samba. ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=us ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap passwd sync = yes pam password change = yes encrypt passwords = True ldap suffix = ou=def,dc=def,dc=mg,dc=gov,dc=us ldap ssl = no ldap user suffix = ou=Users Well, When I remove slapd config replicate, i got change users samba passwords. But is replication LDAP is active, my ldap users can to email, but sambausers is not login in domain. root@fileserver02:~# smbclient -L localhost -U house.green Enter house.green's password: session setup failed: NT_STATUS_LOGON_FAILURE Any suggestion ? Rodrigo Faria Tavares

1 0

389 port is closed from the client point of view
by Asmaa Ahmed 29 Jan '13

29 Jan '13

Hello, I am trying to get my ldap binding running, but some how it doen't work!When I checked the port using nmap, I can see clearly that it is closed while the server listens to it! client# nmap -p 389 ldap.domain.com Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on ldap.domain.com (203.28.247.83):PORT STATE SERVICE389/tcp closed ldap Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds root@server:/etc/ldap# nmap -p 389 localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on localhost (127.0.0.1):PORT STATE SERVICE389/tcp open ldap Nmap done: 1 IP address (1 host up) scanned in 0.04 secondsroot@server:/etc/ldap#root@server:/etc/ldap# nmap localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:10 ESTInteresting ports on localhost (127.0.0.1):Not shown: 994 closed portsPORT STATE SERVICE22/tcp open ssh80/tcp open http389/tcp open ldap464/tcp open kpasswd5636/tcp open ldapssl749/tcp open kerberos-adm Nmap done: 1 IP address (1 host up) scanned in 0.05 secondsroot@server:/etc/ldap# cat /etc/hosts127.0.0.1 localhost#127.0.1.1 ldap.domain.com ldap203.28.247.83 ldap.domain.com ldap How can I fix this? Thanks.

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical