openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But a few minutes or a few hours later, it can get synced again with some "random" events. The reason I call it "random" because I could not find any patter yet. This happens almost every day. What I found is 3 and 4 (consumer) sometime get newer entryCSN than 1 and 2 (provider) for example on 1 and 2 entryCSN: 20130115190406.091431Z#000000#001#000000 on 3 and 4 entryCSN: 20130116183923.969790Z#000000#000#000000 I have confirmed that with the following syncrepl config, we can not update entry on 3 or 4 directly. (ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral). So that exclude the possibility 3 and 4 get updated directly from ldap client. Any direction? Thanks Frank Attachment: sync config portion #server 1 serverID 1 syncrepl rid=001 provider=ldap://s2.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 2 serverID 2 syncrepl rid=002 provider=ldap://s1.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 3 syncrepl rid=003 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" #server 4 syncrepl rid=004 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" As you noticed, ldaptm.domain.com is a virtual service on load balancer with server 1 and 2 behind

2 1

slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Bryce Powell 25 Jan '13

25 Jan '13

Hi, I have setup an LDAP proxy using OpenLDAP 2.4.23 running on CentOS release 6.2 Linux 2.6.32-220.4.2.el6.x86_64. Every second search operation on a connection returns an error: SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 database ldap readonly on suffix "dc=example,dc=com" # Recreate cached connection before it can be dropped by the Active Directory. Default Active Directory timeout MaxConnIdleTime=900 idle-timeout 899 rebind-as-user yes uri "ldap://169.254.253.228/ ldap://169.254.239.115/ ldap://169.254.245.81/ ldap://169.254.239.91/" Here is an extract of the LDAP log, filtered on one connection: Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 fd=29 ACCEPT from IP=172.16.10.126:3579 (IP=0.0.0.0:389) Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" method=128 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 RESULT tag=97 err=0 text= Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foobar)(uid=foobar)(sn=foobar)(givenName=foobar)(mail=foobar))" Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foo.bar@example.com)(uid=foo.bar@example.com)(sn=foo.bar@example.com)(givenName=foo.bar@example.com)(mail=foo.bar@example.com))" Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Every subsequent search operation going forward generates the same error. The time difference between the bind (op=0) and the first successful search (op=1) is 40 minutes 29 seconds. The time between op=1 and the first failed search op=2 is 1 minute 45 seconds. This behaviour is consistent for all connections, and appears independent of time. Therefore I'm not seeing how timeouts factor into this issue. Appears a few folks have posted about this, here and elsewhere, but I could not find any suitable explanation that resolved the issue. Hoping someone can help me out. Thanks, and regards, Bryce Powell

3 4

exclude subtree from ppolicy
by Marc Patermann 25 Jan '13

25 Jan '13

Hi, is it possible to exclude a subtree (or some objects by filter) from the password policy overlay? Marc

2 1

Re: slapcat output is truncated every now and then
by Bálint Réczey 24 Jan '13

24 Jan '13

Hi Quanah, Thank you for the answer. 2013/1/22 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Sunday, January 20, 2013 11:58 AM +0100 Balint Reczey < > balint(a)balintreczey.hu> wrote: > > Dear Members of OpenLDAP Technical List, >> >> Could you please help in finding and explanation and potentially a fix >> for the bug reported at [1]? >> > > Per Howard Chu: > > I think it's because slapcat's attempt to get a read lock failed, probably > because slapd already had a conflicting write lock on it and the deadlock > detector chose slapcat to lose and slapcat doesn't retry on lock errors, > unlike slapd. > > The solution, of course, is to use back-mdb. > Forgive me for asking this with so little experience with OpenLDAP, but would fixing slapcat to retry on lock errors be an other option? It seems it could help people managing LDAP servers with high write-rate and others who are not be able to migrate to mdb in short term. Cheers, Balint

2 2

no data are fetched when using cn=config + back-sql
by Benin Technologies 24 Jan '13

24 Jan '13

Hi, I'm using back-sql. After converting to cn=config, ldapsearch fetches no data (with the old slapd.conf everything worked fine). Any idea why ? ------> $ ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 ------> Versions : OpenLDAP 2.4.33 with latest patchs applied (until ITS#7499) Debian 6.0.4

1 0

Preoperation Plugin Questions
by Julius Plenz 23 Jan '13

23 Jan '13

Hi, I'm writing an preoperation authentication plugin for OpenLDAP, but I have trouble finding any documentation whatsoever on this. So most of what I know comes from tutorials like this one from Oracle: http://docs.oracle.com/cd/E19099-01/nscp.dirsvr416/816-6683-10/custauth.htm But since this is not official documentation and I find the execution paths hard to trace, I have two questions stemming from above guide: 1) The guide says that for an authentication preop plugin, Your pre-operation plug-in function is responsible for sending the result code to the client and for setting the DN and authentication method for the connection. Okay, so I do that. Like in the code example, I set the connection's DN to the value I got from the 'pb' in the first place: slapi_pblock_set(pb, SLAPI_CONN_DN, slapi_ch_strdup(dn)); But setting the authentication type fails: slapi_pblock_set(pb, SLAPI_CONN_AUTHTYPE, SLAPD_AUTH_SIMPLE); This is no real error though, it's simply not implemented: See http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… case SLAPI_CONN_AUTHMETHOD: ... /* These parameters cannot be set */ rc = PBLOCK_ERROR; break; (This was noted in 2006 already, with no reply on this list: http://www.openldap.org/lists/openldap-software/200601/msg00044.html ) So basically it boils down to: Do I have to do *any* other stuff except for sending back the result code? Like this: slapi_send_ldap_result(pb, rc, NULL, NULL, 0, NULL); 2) What is the preferred return value for a plugin function? Most (other) documentations and the code hints at this: i) return 0 if you handled the authentication ii) return 1 if you want successive plugins/backends/... to handle the authentication Is this correct? Or should I use the more suggestive SLAPI_BIND_SUCCESS and SLAPI_BIND_FAIL? Thanks! Julius P.S.: What I'm actually trying to achieve is to do RADIUS authentification via an external library. But I want to send the client's IP in a Calling-Station-Id attribute, so I cannot simply write a password check function, right? If you got any ideas that are better than a preop module, please tell me...

3 4

RE: slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Quanah Gibson-Mount 23 Jan '13

23 Jan '13

--On Wednesday, January 23, 2013 11:22 AM -0700 Bryce Powell <Bryce.Powell(a)TELUS.COM> wrote: > Hi Quanah, > > Thank you. Is this a known issue that's been addressed in the 2.4.33 > release? Please keep replies to the list, and please don't top post. There have been a multitude of bug fixes to slapd-ldap since the 2.4.23 release (I counted over 10 in the CHANGES file). There are also numerous other reasons not to use the generally broken packages provided by RH/CentOS. The first step to getting help with an issue like this is always going to be to first verify whether or not it occurs on a current release. Regards, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

openldap overlays
by Carlos Santos 23 Jan '13

23 Jan '13

Greetings, I'm relatively new to OpenLDAP and I think I am an average user and a newbie when it comes to development. I am currently on a project on which we use openldap2.4 and the dyngroup overlay. My goal is to build another group overlay which will fetch data from outside the ldap machine (webservices) and then works just like the regular dyngroup overlay, returning the members of that group based on the results of the call to the webservices. The problem is, like I said, that I'm a newbie. I looked at dyngroup.c and I find it quite hard to understand what is going on. It has very few comments and of little help. Can someone give me an overview of the code, and maybe introduce me to the steps of creating an overlay? thanks, Carlos Santos

1 0

RE: (ITS#7498) Openldap syncrepl issue
by Chris Card 23 Jan '13

23 Jan '13

Hi,> > Hi, > > I've been having issues with syncrepl in openldap. This is plain > syncrepl. I'm not using delta-syncrepl as I run with mirror mode on. > > I've noticed that when there are a large number of writes on the > writemaster (Typically around 10 per second) the data on the readslave > goes out of sync with the master, typically having entries which have > been deleted on the master. The contextCSNs on both the readslaves and > writemaster match eventually, but the data doesn't. I'm running the > readslave in refreshOnly mode with an interval of 1 minute. I'm using a > reasonably large DB of size ~ 2 GB. I turned on the sync logs and found > lots of entries with "nonpresent_callback" and "syncrepl_del_nonpresent". > > Tested this and found it occurring in both 2.4.29 and 2.4.33 (Latest as > of this time), and with BDB 4.2.36 as the backend. > > I was wondering if anyone has faced similar issues before, and if there > exists a solution to this problem. I will send any relevant > configuration and log snippets as needed. > > Thanks >I am certainly seeing similar problems with plain syncrepl in an MMR setup (all writes to one server currently, openldap 2.4.31):for example, at the moment in my production system, there are 18 DNs (out of 5.7 million) which are in the writemaster but which are missing from the 3 readslaves, although the contextCSNs all match. Deleting and re-adding such DNs to the writemastercan usually fix this up, but sometimes the contextCSNs get out of sync, andthen the only practical way to recover is to rebuild the readslaves from a backup taken from the writemaster. Because of this issue I am planning to change to using delta-syncrepl, which does appear to work and not get out of sync in the testingI have done. I believe this is the only solution at the moment. Chris

1 0

Grant access to a group
by Onno van der Straaten 23 Jan '13

23 Jan '13

Hi, I would like to grant access to a group in my directory. Granting access to user is straightforward and works, for example access to attrs=myAttribute by dn="cn=User,dc=mydomain,dc=com" write by anonymous auth by users read by * none Now I'm trying to do the same using a group for example access to attrs=myAttribute by group/groupOfUniqueNames/uniqueMember="cn=ldap-admins,dc=groups,dc=mydomain,dc=com" write by anonymous auth by users read by * none I can't get this to work. I tried by group and by group.exact, these also don't work. From the documentation I understand that by group assumes objectClass 'groupOfNames' and attribute 'member' I used groupOfUniqueNames and uniqueMember so the configuration ended up as above. Is is possible to grant access to the directory in such a way? To a group? How? Best Regards, Onno

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical