openldap-technical

openldap-technical@openldap.org

2 participants
9868 discussions

replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

Hi, I set up a back-sql server to access some existing data in a postgresql database. I was wondering if it's possible to replicate that server to some (read-only) back-hdb servers. Thanks BT

2 2

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

back-sql : defining groups
by DavidHornung 27 Jan '13

27 Jan '13

Hello, until now I don't understand how to add users to a group in Openldap with back-sql I use a VIEW for ldap_entries like described in the manual pages of slapd-sql. CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER(’o=MyCompany,c=NL’), 3, 0, ’baseObject’ FROM unixusers WHERE userid=’root’ UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT(’cn=’,gecos),’,o=MyCompany,c=NL’)), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT(’cn=’,groupnaam),’,o=MyCompany,c=NL’)), 2, 0, groupnummer FROM groups; How can I add users to a group? 1.) build additional entries like uid=testuser,cn=group1,o=MyCompany,c=NL OR 2.) use the memberOf Attribute (but how?) Thank you for your answers Cheers, David

1 0

Re: slapcat output is truncated every now and then
by Bálint Réczey 26 Jan '13

26 Jan '13

Hi Quanah, 2013/1/25 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 25, 2013 12:07 AM +0100 Bálint Réczey < > balint(a)balintreczey.hu> wrote: > > >> I have a attached two patches hoping that they may be useful. >> > > I suggest you file an ITS if you want them considered for inclusion: > I have file them under http://www.openldap.org/its/index.cgi?findid=7503 and http://www.openldap.org/its/index.cgi?findid=7504 hopefully complying to the instructions. Please CC me in further related discussions about the problem because I will unsubscribe from the list for now. Cheers, Balint

2 2

using back-sql with cn=config
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

2 2

slapd not starting at boot when compiled with --enable-sql
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, I'm not sure wether this is an OpenLDAP issue or a Debian issue... When installing OpenLDAP 2.4.33 from source on Debian 6.0.4 with back-sql support, I'm unable to make it start at boot. I tested it a few times to isolate the problem, and the simple fact of installing OpenLDAP with "--enable-sql" seems to be the cause. My "/etc/init.d/slapd" file works fine, but the service won't start at boot. Does anybody have an idea ? Below the details of my tests, I tried two configurations, without and with back-sql enabled : Config 1°/ I installed OpenLDAP 2.4.33 WITHOUT back-sql support. (plain "./configure") I installed an adequate "/etc/init.d/slapd" file (inspired from the file shipped with the Debian package installation), and then I installed the slapd service (update-rc.d slapd defaults). When I reboot the debian server, everything works fine, slapd starts. Config 2°/ Same installation, but this time WITH back-sql support (./configure --enable-sql) Like before, I deployed my "/etc/init.d/slapd" file. The file works fine ("/etc/init.d/slapd start" starts the OpenLDAP server) Then I install the slapd service, it seems to install well (update-rc.d slapd defaults). But when I reboot, slapd fails to start. I tried the following commands : # service slapd start Starting OpenLDAP: slapd failed! # /etc/init.d/slapd start Starting OpenLDAP: slapd. # service slapd stop Stopping OpenLDAP: slapd So it seems the "slapd" service can not be started by the "service" command (and thus cannot be launched a boot). NOTE that the ONLY difference between Config 1 and Config 2 is that I compiled OpenLDAP with "--enable-sql". At this point, I don't even use a back-sql backend (I'm still with the default configuration, using the bdb backend). Does anybody have an idea what's happening ? One last thing : I tried also to compile OpenLDAP with back-sql as a dynamic loaded module (./configure --enable-modules --enable-sql=mod). Same result, if my "slapd.conf" contains the instructions to dynamically load "back_sql.la", then : - OpenLDAP doesn't start at boot - "#service slapd start" doesn't work - "#/etc/init.d slapd start" still works Ben Note : I tried to use insserv instead of update-rc.d, same result

1 0

Re: syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

thanks. I am using 2.4.23 sudo /opt/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Mar 9 2011 11:39:07) $ I understand that delta-syncrepl will significantly reduce traffic but that should not be the problem here. Also we have mirror mode turned on and I read "Note: Delta-syncrepl is not yet supported with MirrorMode." Frank On Fri, Jan 25, 2013 at 2:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, January 25, 2013 11:59 AM -0500 Frank Luo > <frank.luoy(a)gmail.com> wrote: > >> We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 >> and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But >> a few minutes or a few hours later, it can get synced again with some >> "random" events. The reason I call it "random" because I could not >> find any patter yet. This happens almost every day. > > > a) Always note the version of OpenLDAP you are using > b) Use delta-syncrepl > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But a few minutes or a few hours later, it can get synced again with some "random" events. The reason I call it "random" because I could not find any patter yet. This happens almost every day. What I found is 3 and 4 (consumer) sometime get newer entryCSN than 1 and 2 (provider) for example on 1 and 2 entryCSN: 20130115190406.091431Z#000000#001#000000 on 3 and 4 entryCSN: 20130116183923.969790Z#000000#000#000000 I have confirmed that with the following syncrepl config, we can not update entry on 3 or 4 directly. (ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral). So that exclude the possibility 3 and 4 get updated directly from ldap client. Any direction? Thanks Frank Attachment: sync config portion #server 1 serverID 1 syncrepl rid=001 provider=ldap://s2.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 2 serverID 2 syncrepl rid=002 provider=ldap://s1.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 3 syncrepl rid=003 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" #server 4 syncrepl rid=004 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" As you noticed, ldaptm.domain.com is a virtual service on load balancer with server 1 and 2 behind

2 1

slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Bryce Powell 25 Jan '13

25 Jan '13

Hi, I have setup an LDAP proxy using OpenLDAP 2.4.23 running on CentOS release 6.2 Linux 2.6.32-220.4.2.el6.x86_64. Every second search operation on a connection returns an error: SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 database ldap readonly on suffix "dc=example,dc=com" # Recreate cached connection before it can be dropped by the Active Directory. Default Active Directory timeout MaxConnIdleTime=900 idle-timeout 899 rebind-as-user yes uri "ldap://169.254.253.228/ ldap://169.254.239.115/ ldap://169.254.245.81/ ldap://169.254.239.91/" Here is an extract of the LDAP log, filtered on one connection: Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 fd=29 ACCEPT from IP=172.16.10.126:3579 (IP=0.0.0.0:389) Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" method=128 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 RESULT tag=97 err=0 text= Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foobar)(uid=foobar)(sn=foobar)(givenName=foobar)(mail=foobar))" Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foo.bar@example.com)(uid=foo.bar@example.com)(sn=foo.bar@example.com)(givenName=foo.bar@example.com)(mail=foo.bar@example.com))" Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Every subsequent search operation going forward generates the same error. The time difference between the bind (op=0) and the first successful search (op=1) is 40 minutes 29 seconds. The time between op=1 and the first failed search op=2 is 1 minute 45 seconds. This behaviour is consistent for all connections, and appears independent of time. Therefore I'm not seeing how timeouts factor into this issue. Appears a few folks have posted about this, here and elsewhere, but I could not find any suitable explanation that resolved the issue. Hoping someone can help me out. Thanks, and regards, Bryce Powell

3 4

exclude subtree from ppolicy
by Marc Patermann 25 Jan '13

25 Jan '13

Hi, is it possible to exclude a subtree (or some objects by filter) from the password policy overlay? Marc

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical