openldap-technical

openldap-technical@openldap.org

3 participants
9868 discussions

syncrepl mirrormode with SSL/TLS issues
by Houston Ray 10 Jan '13

10 Jan '13

I am attempting to move my sycrepl with mirrormode configuration over to TLS using LDAPS (not starttls) and running into problems. Multimaster setup (2 servers) behind a VIP both RHEL 6.3 Openldap 2.4.23-26 still running the old slapd.conf method (apologies) There are 3 separate certificates ldap.mycompany.net, server01.mycompany.net, and server02.mycompany.net The primary certificate is used for running slapd, and the individual server certs are intended to allow syncrepl over ssl. My configurations for syncrepl/mirrormode are down below. I had success with non-ssl syncrepl/mirrormode. It worked great actually. Now I am attempting to get syncrepl/mirrormode working with SSL. What I observe is whichever slapd instance is the last to startup is the one that becomes a "Master" as if I was in a producer/consumer setup. Errors I am seeing are slapd[11995]: conn=1003 fd=13 ACCEPT from IP=<server1_IP>:56368 (IP= 0.0.0.0:636) slapd[11995]: connection_read(13): TLS accept failure error=-1 id=1003, closing slapd[11485]: slap_client_connect: URI=ldaps://server01.mycompany.netDN="cn=Admin,dc=mycompany,dc=net" ldap_sasl_bind_s failed (-1) slapd[11485]: do_syncrepl: rid=001 rc -1 retrying Server 1 configuration ************************* # Server1 synchronization settings serverID 1 syncrepl rid=002 provider=ldaps://server02.mycompany.net binddn="cn=Admin,dc=mycompany,dc=net" bindmethod=simple credentials=secret tls_cert=/etc/openldap/certs/server02.mycompany.net.pem tls_cacert=/etc/openldap/certs/Verisignbundle.crt tls_key=/etc/openldap/certs/server02.mycompany.net.key tls_reqcert=allow searchbase="dc=mycompany,dc=net" type=refreshAndPersist retry="5 5 300 +" timelimit=5 attrs="*,+" interval=00:00:05:00 schemachecking=off mirrormode on # Server1 synchronization overlay overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Server1 end ************************************************************************************************** Server 2 configuration ********************************* # Server2 syncronization settings serverID 2 syncrepl rid=001 provider=ldaps://server01.mycompany.net binddn="cn=Admin,dc=mycompany,dc=net" bindmethod=simple credentials=secret tls_cert=/etc/openldap/certs/server01.mycompany.net.pem tls_cacert=/etc/openldap/certs/Verisignbundle.crt tls_key=/etc/openldap/certs/server01.mycompany.net.key tls_reqcert=allow searchbase="dc=mycompany,dc=net" type=refreshAndPersist retry="5 5 300 +" timelimit=5 attrs="*,+" interval=00:00:05:00 schemachecking=off mirrormode on # Server02 synchronization overlay overlay syncprov syncprov-checkpoint 100 10 # Server2 end ************************************************************************************************** any help is greatly appreciated

2 1

Get machines in Base LDAP
by rodrigo tavares 09 Jan '13

09 Jan '13

Hello, I have in my smb.conf, the follow line is: add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u So, with the line machines get logon in domain, but machines come to /etc/passwd. I would like add all machines in LDAP, how I can to do it ? ldap admin dn = cn=admin,dc=brazil,dc=mg,dc=gov,dc=br ldap group suffix = ou=groups ldap machine suffix = ou=computers ldap passwd sync = yes ldap suffix = dc=brazil,dc=mg,dc=gov,dc=br ldap ssl = no ldap user suffix = ou=defensoria passdb backend = ldapsam:ldap://10.65.8.250 passdb backend = tdbsam hosts allow = 127.0.0.1, 10.65.8.0/255.255.252.0

2 1

slapd-ldap and backend errors
by John Madden 09 Jan '13

09 Jan '13

While setting up and testing new 2.4 infra (2.4.33), I've come across the situation where the proxy (slapd-ldap) doesn't pass LDAP_UNAVAILABLE back to the client when the backend slapd goes away. Is this behavior configurable on the proxy, something along the lines of chain-return-error? Example: connect to the backend slapd and ldapsearch a long-running query, then shut down slapd and the client provides the proper "error can't contact." Duplicate that behavior while searching against the proxy and you simply get a truncated list of entries with no errors. Thanks, John -- John Madden / Systems Engineer III Office of Technology / Ivy Tech Community College of Indiana Free Software is a matter of liberty, not price. To understand the concept, you should think of Free as in 'free speech,' not as in 'free beer.' -- Richard Stallman

2 2

access directive
by Friedrich Locke 09 Jan '13

09 Jan '13

Hi folks, i have just installed openldap and i am having trouble to understand access directive: I have 6 access rules : ################################################################################ # access definition on ou=people,dc=ufv,dc=br ################################################################################ access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidNumber,gidNumber,loginShell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=people,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read I have some rules, as you can see, giving acess to certain attributes of anything below (one level) ou=people,dc=ufv,dc=br. I have another rule given access to everything on the same level, this is the rule 5th. Everything works ok, for instance: sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: homedirectory # # sioux, people, ufv.br dn: uid=sioux,ou=people,dc=ufv,dc=br homeDirectory: /home/sioux # search result search: 5 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav$ But if i comment the 5th rule (I keep the others, giving access to the homedirectory attribute), it does not work: sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: homedirectory # # search result search: 5 result: 32 No such object # numResponses: 1 sioux@gustav$ Does anybody here know why ? Thanks in advance.

2 1

Re: MDB Newbie
by Kyle Smith 08 Jan '13

08 Jan '13

On Wed, Jan 2, 2013 at 5:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, January 02, 2013 4:35 PM -0500 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > >> Greetings and Salutations. >> >> >> December 20, I converted from bdb to mdb. Now my memory usage looks like >> this: http://faculty.ycp.edu/~**ksmith8/openldap_stats.png<http://faculty.ycp.edu/~ksmith8/openldap_stats.png> >> >> >> I am concerned with the graph for "superman". How can I start tracking >> down the usage and why almost 50% of my memory is being consumed. These 4 >> are in MMR and are 2.4.33 and are nearly exact in server specification. >> Thanks in advance! >> > > Memory is vague. Do you mean shared, resident, or virtual? Your graphs > don't illustrate which either. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Memory in this case is Physical memory as reported by ubuntu top. %MEM is the column. I did a "du -c -h data.mdb" on each of the four. Superman is listed at 1.4GB, while the other 3 are at 185MB. Not quite sure why that one is so much bigger. Thanks in advance.

1 0

Re: Replication status
by anil beniwal 07 Jan '13

07 Jan '13

Dear It means my DR server is not in sync with other two servers dc1 and dc2. but i am able to do successful search of last added user on all the servers.(which i added only on dc1 server) On Mon, Jan 7, 2013 at 7:44 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 07, 2013 5:24 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> Hi >> >> We are having 3 openldap 2.4.33 servers on rhel 6.3 in MMR, below is my >> replication status for all of them. >> We have imported all the data on one server and copied same data to other >> 2 servers. >> > > DR >> contextCSN: 20130101132757.303803Z#000000#**000#000000 >> contextCSN: 20130102093855.341468Z#000000#**001#000000 >> contextCSN: 20130102050153.147891Z#000000#**002#000000 >> contextCSN: 20130102135821.337371Z#000000#**003#00000 >> > > #000# is the CSN created before MMR was set up, so there were no servers > with any server ID, i.e., one server with a server ID of zero. This > context CSN will never update. > > #001# is the CSN of the server with ServerID 1. > #002# is the CSN of the server with ServerID 2. > #003# is the CSN of the server with ServerID 3. > > The 001 through 003 CSNs will reflect the last time any of those servers > had a direct *not replicated* update. For testing if a server is up to > date, you want to compare all the CSNs to one another between the two > servers. > > I.e., you want CSN 001 to match CSN 001 on both servers. CSN 002 to match > CSN 002 on both servers. CSN 003 to CSN 003 on both servers. I wrote a > rather fun perl script for Zimbra to do this across a MMR setup. > > I will note that delta-syncrepl MMR remains the best option for > configuring MMR, as it is the least likely to end up with conflicts, unless > you run purely in MirrorMode. It also retains the bandwidth and write > throughput advantages it has with provider/replica replication as well. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

MirrorMode, delta syncrepl and memberof issues
by Al 07 Jan '13

07 Jan '13

Hi All - I'm having an issue with mirrormode replication (via delta syncrepl) and the memberof overlay. When a group membership is changed on the first node, slapd on the second node is crashing with the following error (as seen from running slapd with -d-1): slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. If I disable either memberof or mirrormode, the change replicates correctly. This behavior happens on both bdb and mdb backends. Any thoughts on what that might mean? I am still in development, so I can try pretty much anything at this point - I appreciate any guidance that you can offer. Here are the important details: OpenLDAP 2.4.33 Redhat Linux 6.3 - x64 Server1 and Server2 are using the same configuration, minus the serverid and the syncrepl provider. here is server1's pertinent config: olcServerID: 1 ... olcSyncrepl: rid=000 provider=ldap://server1.xxx.xxx.com:389/ bindme thod=simple timeout=0 network-timeout=0 binddn="cn=ldapreplicator,xxx, xxx,xxx.com" credentials="secret" keepalive=0:0:0 starttls=critical filter="(objectclass=*)" searchbase="xxx.com" logfilter= "(&(objectClass=auditWriteObject)(reqResult=0))" logbase="cn=accesslog" scope =sub schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog olcMirrorMode: TRUE ... olcMemberOfRefInt: FALSE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniquemember Regards, Al

2 1

Replication status
by anil beniwal 07 Jan '13

07 Jan '13

Hi We are having 3 openldap 2.4.33 servers on rhel 6.3 in MMR, below is my replication status for all of them. We have imported all the data on one server and copied same data to other 2 servers. 1. I am not able to figure out why i am having 4th line in my DR server, while searching contextCSN, while we are having only 3 ldap servers 2. Why CSN values are different , while i am getting latest added record in search on all the servers. Before Adding user dc1 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 dc2 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DR contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 contextCSN: 20130102135821.337371Z#000000#003#000000 After adding User ( its reflecting on all the servers in search) DC 1 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DC 2 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DR contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 contextCSN: 20130102135821.337371Z#000000#003#00000 -- Thanks&Regards Anil Beniwal

2 1

How to change the base dn after installation
by Onno van der Straaten 07 Jan '13

07 Jan '13

Hi, I have a simple directory setup with base dn dc=my-domain, dc=com. How can I change the base dn? I'm running the latest OpenLDAP version on Fedora 17. Thanks, Onno

2 1

How to create a directory admin group
by Onno van der Straaten 07 Jan '13

07 Jan '13

Hi, How can I define a admin group for my directory? Currently I have one admin account, the one that was created during installation, cn=Manager, dc=my-domain, dc=com. I would like to create a group for example cn=ldap-admins,dc=my-domain,dc=com and then make users member of this group to grant them privilege to do admin work on the directory similar to cn=Manager. I suppose I have to add access rules. But where and how I don't know. Thanks, Onno

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical