openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

back-sql : defining groups
by DavidHornung 27 Jan '13

27 Jan '13

Hello, until now I don't understand how to add users to a group in Openldap with back-sql I use a VIEW for ldap_entries like described in the manual pages of slapd-sql. CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER(’o=MyCompany,c=NL’), 3, 0, ’baseObject’ FROM unixusers WHERE userid=’root’ UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT(’cn=’,gecos),’,o=MyCompany,c=NL’)), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT(’cn=’,groupnaam),’,o=MyCompany,c=NL’)), 2, 0, groupnummer FROM groups; How can I add users to a group? 1.) build additional entries like uid=testuser,cn=group1,o=MyCompany,c=NL OR 2.) use the memberOf Attribute (but how?) Thank you for your answers Cheers, David

1 0

Re: slapcat output is truncated every now and then
by Bálint Réczey 25 Jan '13

25 Jan '13

Hi Quanah, 2013/1/25 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 25, 2013 12:07 AM +0100 Bálint Réczey < > balint(a)balintreczey.hu> wrote: > > >> I have a attached two patches hoping that they may be useful. >> > > I suggest you file an ITS if you want them considered for inclusion: > I have file them under http://www.openldap.org/its/index.cgi?findid=7503 and http://www.openldap.org/its/index.cgi?findid=7504 hopefully complying to the instructions. Please CC me in further related discussions about the problem because I will unsubscribe from the list for now. Cheers, Balint

2 2

using back-sql with cn=config
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

2 2

slapd not starting at boot when compiled with --enable-sql
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, I'm not sure wether this is an OpenLDAP issue or a Debian issue... When installing OpenLDAP 2.4.33 from source on Debian 6.0.4 with back-sql support, I'm unable to make it start at boot. I tested it a few times to isolate the problem, and the simple fact of installing OpenLDAP with "--enable-sql" seems to be the cause. My "/etc/init.d/slapd" file works fine, but the service won't start at boot. Does anybody have an idea ? Below the details of my tests, I tried two configurations, without and with back-sql enabled : Config 1°/ I installed OpenLDAP 2.4.33 WITHOUT back-sql support. (plain "./configure") I installed an adequate "/etc/init.d/slapd" file (inspired from the file shipped with the Debian package installation), and then I installed the slapd service (update-rc.d slapd defaults). When I reboot the debian server, everything works fine, slapd starts. Config 2°/ Same installation, but this time WITH back-sql support (./configure --enable-sql) Like before, I deployed my "/etc/init.d/slapd" file. The file works fine ("/etc/init.d/slapd start" starts the OpenLDAP server) Then I install the slapd service, it seems to install well (update-rc.d slapd defaults). But when I reboot, slapd fails to start. I tried the following commands : # service slapd start Starting OpenLDAP: slapd failed! # /etc/init.d/slapd start Starting OpenLDAP: slapd. # service slapd stop Stopping OpenLDAP: slapd So it seems the "slapd" service can not be started by the "service" command (and thus cannot be launched a boot). NOTE that the ONLY difference between Config 1 and Config 2 is that I compiled OpenLDAP with "--enable-sql". At this point, I don't even use a back-sql backend (I'm still with the default configuration, using the bdb backend). Does anybody have an idea what's happening ? One last thing : I tried also to compile OpenLDAP with back-sql as a dynamic loaded module (./configure --enable-modules --enable-sql=mod). Same result, if my "slapd.conf" contains the instructions to dynamically load "back_sql.la", then : - OpenLDAP doesn't start at boot - "#service slapd start" doesn't work - "#/etc/init.d slapd start" still works Ben Note : I tried to use insserv instead of update-rc.d, same result

1 0

Re: syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

thanks. I am using 2.4.23 sudo /opt/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Mar 9 2011 11:39:07) $ I understand that delta-syncrepl will significantly reduce traffic but that should not be the problem here. Also we have mirror mode turned on and I read "Note: Delta-syncrepl is not yet supported with MirrorMode." Frank On Fri, Jan 25, 2013 at 2:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, January 25, 2013 11:59 AM -0500 Frank Luo > <frank.luoy(a)gmail.com> wrote: > >> We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 >> and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But >> a few minutes or a few hours later, it can get synced again with some >> "random" events. The reason I call it "random" because I could not >> find any patter yet. This happens almost every day. > > > a) Always note the version of OpenLDAP you are using > b) Use delta-syncrepl > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But a few minutes or a few hours later, it can get synced again with some "random" events. The reason I call it "random" because I could not find any patter yet. This happens almost every day. What I found is 3 and 4 (consumer) sometime get newer entryCSN than 1 and 2 (provider) for example on 1 and 2 entryCSN: 20130115190406.091431Z#000000#001#000000 on 3 and 4 entryCSN: 20130116183923.969790Z#000000#000#000000 I have confirmed that with the following syncrepl config, we can not update entry on 3 or 4 directly. (ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral). So that exclude the possibility 3 and 4 get updated directly from ldap client. Any direction? Thanks Frank Attachment: sync config portion #server 1 serverID 1 syncrepl rid=001 provider=ldap://s2.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 2 serverID 2 syncrepl rid=002 provider=ldap://s1.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 3 syncrepl rid=003 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" #server 4 syncrepl rid=004 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" As you noticed, ldaptm.domain.com is a virtual service on load balancer with server 1 and 2 behind

2 1

slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Bryce Powell 25 Jan '13

25 Jan '13

Hi, I have setup an LDAP proxy using OpenLDAP 2.4.23 running on CentOS release 6.2 Linux 2.6.32-220.4.2.el6.x86_64. Every second search operation on a connection returns an error: SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 database ldap readonly on suffix "dc=example,dc=com" # Recreate cached connection before it can be dropped by the Active Directory. Default Active Directory timeout MaxConnIdleTime=900 idle-timeout 899 rebind-as-user yes uri "ldap://169.254.253.228/ ldap://169.254.239.115/ ldap://169.254.245.81/ ldap://169.254.239.91/" Here is an extract of the LDAP log, filtered on one connection: Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 fd=29 ACCEPT from IP=172.16.10.126:3579 (IP=0.0.0.0:389) Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" method=128 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 RESULT tag=97 err=0 text= Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foobar)(uid=foobar)(sn=foobar)(givenName=foobar)(mail=foobar))" Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foo.bar@example.com)(uid=foo.bar@example.com)(sn=foo.bar@example.com)(givenName=foo.bar@example.com)(mail=foo.bar@example.com))" Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Every subsequent search operation going forward generates the same error. The time difference between the bind (op=0) and the first successful search (op=1) is 40 minutes 29 seconds. The time between op=1 and the first failed search op=2 is 1 minute 45 seconds. This behaviour is consistent for all connections, and appears independent of time. Therefore I'm not seeing how timeouts factor into this issue. Appears a few folks have posted about this, here and elsewhere, but I could not find any suitable explanation that resolved the issue. Hoping someone can help me out. Thanks, and regards, Bryce Powell

3 4

exclude subtree from ppolicy
by Marc Patermann 25 Jan '13

25 Jan '13

Hi, is it possible to exclude a subtree (or some objects by filter) from the password policy overlay? Marc

2 1

Re: slapcat output is truncated every now and then
by Bálint Réczey 24 Jan '13

24 Jan '13

Hi Quanah, Thank you for the answer. 2013/1/22 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Sunday, January 20, 2013 11:58 AM +0100 Balint Reczey < > balint(a)balintreczey.hu> wrote: > > Dear Members of OpenLDAP Technical List, >> >> Could you please help in finding and explanation and potentially a fix >> for the bug reported at [1]? >> > > Per Howard Chu: > > I think it's because slapcat's attempt to get a read lock failed, probably > because slapd already had a conflicting write lock on it and the deadlock > detector chose slapcat to lose and slapcat doesn't retry on lock errors, > unlike slapd. > > The solution, of course, is to use back-mdb. > Forgive me for asking this with so little experience with OpenLDAP, but would fixing slapcat to retry on lock errors be an other option? It seems it could help people managing LDAP servers with high write-rate and others who are not be able to migrate to mdb in short term. Cheers, Balint

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical