openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

local password change in read-only replica?
by Marc Patermann 06 Nov '12

06 Nov '12

Hi, from a central master/provider server we replicate to (a lot of) sync-repl slave/consumers. Which are then - of course - read-only. We have passwordpolicy turned on on all the servers. Now we have three accounts - each an another "home" replica - which have a newer modifyTimestamp value on their replica then on the master and all other slaves. The userPassword attribute is different on the "home" replica. What could have caused this? In the log I cannot find any changing operation on the replica according to the time in modifyTimestamp. Marc

1 0

Ubuntu Server 12.04: StartTLS
by admus 05 Nov '12

05 Nov '12

Hello, I'm following https://help.ubuntu.com/12.04/serverguide/openldap-server.html#openldap-tls… how to: LDAP serwer starts correctly but when I tries to test StartTLS: ldapsearch -x -H ldap:/// -ZZ -d -1 I gets the following error: TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string ldap_start_tls: Connect error (-11) additional info: (unknown error code) Any idea?

6 10

Re: Error : when create usermachine in LDAP
by rodrigo tavares 05 Nov '12

05 Nov '12

Hello Mauricio, 1) How comfortable are you with linux/unix in general and debian specifically? Do not take this as an insult; I just want to know what I need to ask. Remember I have no access to your machine. ;) I like much Debian Linux, it's very fast. I began work with Linux, i used Conetiva 6.0 and Red Hat Enteprise/Fedora both using format RPM. Debian have a lot packages. And is free, diffent red hat. 2) Are you using ldap to login to this machine or just to check mail? Well I have a server email with LDAP and Suport Samba. So the base ldap the mailserver is replicated from server samba. Then, all modifications LDAP made go to server samba. It run about 5 minutes. I create users emails e samba users. Making intgretion with users samba. 3) I do speak portuguese (I lived in SJC and then Rio). Would you prefer that a gente fale em portugues? Once again, it is all about your comfort level. Speak an English. For others in discussion ________________________________ De: Mauricio Tavares <raubvogel(a)gmail.com> Para: rodrigo tavares <rodrigofariat(a)yahoo.com.br> Enviadas: Quarta-feira, 31 de Outubro de 2012 14:14 Assunto: Re: Error : when create usermachine in LDAP A few questions (I am replying directly to you instead of to the list): 1) How comfortable are you with linux/unix in general and debian specifically? Do not take this as an insult; I just want to know what I need to ask. Remember I have no access to your machine. ;) 2) Are you using ldap to login to this machine or just to check mail? 3) I do speak portuguese (I lived in SJC and then Rio). Would you prefer that a gente fale em portugues? Once again, it is all about your comfort level. On Wed, Oct 31, 2012 at 11:49 AM, rodrigo tavares <rodrigofariat(a)yahoo.com.br> wrote: > Hello, > > > How exactly are you adding the computer to ldap? I take it is not > using ldapadd. ;) > > > In Brazil in state Parana, exists on sofwtare called Expresso Mail Free. > It have a easy interface, and you can create mail users, users samba and > machine, all integrate in > LDAP. It have cyrus-imap, openldap, posfix and postgresql. > > > http://rodrigofariat.files.wordpress.com/2012/10/ldap-error.png > > Some logs: > > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 op=1 SRCH > base="dc=defensoria,dc=mg,dc=gov,dc=br" scope=2 deref=0 > filter="(uid=computer2$)" > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 op=1 SEARCH RESULT tag=101 > err=0 nentries=0 text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 op=2 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 fd=38 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 fd=38 ACCEPT from > IP=127.0.0.1:50679 (IP=0.0.0.0:389) > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" mech=SIMPLE ssf=0 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=0 RESULT tag=97 err=0 > text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=1 ADD > dn="uid=computer2$,ou=defensoria,dc=defensoria,dc=mg,dc=gov,dc=br" > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=1 RESULT tag=105 err=21 > text=gidNumber: value #0 invalid per syntax > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=2 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 fd=38 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 fd=38 ACCEPT from > IP=127.0.0.1:50680 (IP=0.0.0.0:389) > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" mech=SIMPLE ssf=0 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=0 RESULT tag=97 err=0 > text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 fd=39 ACCEPT from > IP=127.0.0.1:50681 (IP=0.0.0.0:389) > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" mech=SIMPLE ssf=0 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=0 RESULT tag=97 err=0 > text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=1 SRCH > base="dc=defensoria,dc=mg,dc=gov,dc=br" scope=2 deref=0 > filter="(objectClass=organizationalUnit)" > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=1 SRCH attr=dn > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=1 SEARCH RESULT tag=101 > err=0 nentries=1 text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=2 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 fd=39 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=1 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 fd=38 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1541 op=1 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1541 fd=17 closed > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 fd=17 ACCEPT from > IP=127.0.0.1:50682 (IP=0.0.0.0:389) > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 op=0 do_search: invalid > dn: "LDAP_DN" > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 op=0 SEARCH RESULT tag=101 > err=34 nentries=0 text=invalid DN > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 op=1 UNBIND > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 fd=17 closed > > Thanks ! > > Rodrigo > > > > ________________________________ > De: Mauricio Tavares <raubvogel(a)gmail.com> > Para: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Cc: rodrigo tavares <rodrigofariat(a)yahoo.com.br> > Enviadas: Quarta-feira, 31 de Outubro de 2012 12:47 > > Assunto: Re: Error : when create usermachine in LDAP > > On Wed, Oct 31, 2012 at 9:46 AM, Dan White <dwhite(a)olp.net> wrote: >> On 10/31/12 06:16 -0700, rodrigo tavares wrote: >>> >>> Hello, >>> >>> I try to create a computer in LDAP, come this message: >>> Error in OpenLDAP recording computer.* >>> >>> What is wrong ? >> >> >> Rodrigo, >> >> I am unfamiliar with the error message you are seeing. However, your >> post lacks some important information. See: >> >> http://www.chiark.greenend.org.uk/~sgtatham/bugs.html >> >> Provide a better mental image of what command or action you are performing >> that is causing your error, and what output you are expecting to see; what >> software are using that is causing this error? What version of OpenLDAP >> are >> you using? >> >> -- >> Dan White >> > Rodrigo: > > How exactly are you adding the computer to ldap? I take it is not > using ldapadd. ;) > > Does whatever you are using have a log and a debugging/verbose mode? > > >

2 2

general protection fault when deleting members from a large group (mdb)
by Mundry, Marvin 03 Nov '12

03 Nov '12

Hi, i was trying to remove all members from a group initially having 48428 members one by one. i.e.: dn: cn=students,ou=groups,dc=university,dc=com changetype: modify delete: member member: cn=user1,ou=users,dc=uni-hamburg,dc=de dn: cn=students,ou=groups,dc=university,dc=com changetype: modify delete: member member: cn=user2,ou=users,dc=uni-hamburg,dc=de [...] after some time ldapmodify stops as the slapd stops running. In the syslog i see the following message: Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=133 MOD dn="cn=students,ou=groups,dc=university,dc=com" Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=133 MOD attr=member Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=134 MOD dn="cn=students,ou=groups,dc=university,dc=com" Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=134 MOD attr=member Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=133 RESULT tag=103 err=0 text= Nov 3 15:05:45 oscar kernel: [21207.720483] slapd[11045] general protection ip:7fae665cbc1f sp:7faded9c9fc0 error:0 in back_mdb-2.4.so.2.8.5[7fae665a5000+30000] am i doing something wrong or is there a bug in my slapd? i am running openldap-2.4.33 on ubuntu 12.10, compiled with: --enable-dynamic=yes --enable-syslog=yes --enable-slapd=yes --enable-dynacl=yes --enable-crypt=yes --enable-modules=yes --enable-rewrite=yes --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-mdb=mod --enable-meta=mod --enable-monitor=mod --enable-overlays=mod --with-tls=openssl Best regards, Marvin Mundry

2 1

Modify schema add atributtes
by Jorge Armijo 03 Nov '12

03 Nov '12

Hi my friends im new with ldap and samba i need to add some attributes i need a tool or some thing similar i need replicate this in a 20 more servers Enviado desde mi iPhone

2 1

Re: Problem in sync-repling multiple databases
by Marco Pizzoli 02 Nov '12

02 Nov '12

On Wed, Oct 31, 2012 at 8:32 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, October 31, 2012 10:03 AM +0100 Marco Pizzoli < > marco.pizzoli(a)gmail.com> wrote: > > Hi Quanah, >> >> >> On Mon, Oct 29, 2012 at 6:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >> >> >> --On Monday, October 29, 2012 8:52 AM +0100 Marco Pizzoli >> <marco.pizzoli(a)gmail.com> wrote: >> >> >> If I try to configure a second replica configration targeted directly to >> (in example) to ou=ou3, then that ou get replicated. >> >> Any help/advice is welcome. >> >> >> Hi Marco, >> >> You have not provided any useful information with which to help you, so >> there is not really any advice one can offer you. I.e., you have not >> provided the configuration you are using on your master and replicas in >> the scenario where you have multiple DBs. >> >> >> You are absolutely right and I'm aware of it... >> The problem is in this case I can't provide any (even similar >> to)real configuration. Both from technical limitation (remote server >> with no possibility of copy/paste) and corporate policy*. >> >> * Continuing experimenting I found also 2 or 3 cases in which I'm able to >> crash OL 2.4.33 (in one case by simply slapadding using back-mdb) but I >> CAN'T provide any material to file a "valid" ITS. I'm sorry about that. >> > > Hi Marco, > > Your corporate policy sounds so severe, I'm surprised you can even send > email indicating you have faced any issues. Without an ability to provide > useful information, I don't believe there is any way anyone can help you. > > I would suggest you find a way to comply with your corporate policy while > providing useful information. Since I don't know what that policy is, it > is hard to know what you might do, but I'd hope you could supply your > configs minus any passwords and specific schema/attrs or something (i.e., > make generic configs that illustrate the issues you are facing). That's > what I generally do. > > If you require confidentiality, I would suggest a support agreement with > Symas that includes an NDA. > > Quanah, I appreciate you always answering my requests, but in this case my only question was if the problem I was facing is a known issue (at least in OL2.3 we know it was). If not, it could be my fault in the configuration. Maybe someone had a similar problem and could share his experience. By not being able to provide useful configuration snippets, I *have not* asked for a specific help. With your answers, do I have to assume that with OL2.4.x you never faced a problem syncrepl-ing a tree composed by multiple db's, testing both scenarios (more or less) similar to the two I presented from a (very) high-level-view perspective? Thanks again Marco

2 1

Memory usage with bdb
by Friedrich Locke 02 Nov '12

02 Nov '12

Is anyone aware of any buggy in openldap+bdb related to memory usage? Have anyone here using this type of backend ? Any problem to report? Thanks for your time and cooperation. Best regards.

6 7

memberOf data in new replica servers 2.4.31
by Todd Stein 02 Nov '12

02 Nov '12

Hi, I have a provider server and five consumer servers, all of which have the memberOf overlay configured: overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true memberof-dangling ignore syncrepl rid=005 provider=ldap://<server>:389 type=refreshAndPersist interval=00:00:05:00 retry="60 10 600 +" searchbase="dc=<removed>,dc=<removed>" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off starttls=no bindmethod=simple binddn="cn=replica,dc=<removed>,dc=<removed>" credentials=<removed> When I bring a new replica online, it appears that entries are replicated in the order that they were created on the provider server which produces many "memberof_value_modify failed err=32" messages in the log, and incomplete memberOf data. To get around this, I wrote a script which empties all groups prior to replication, and then recreates the memberships after the initial replication. This seems to work, but is hardly ideal. Is there a "more correct" way of replicating memberOf values without manipulating my provider each time I bring up a new consumer? Thank you very much, Todd

2 1

AW: openldap 2.2.x
by Pörschke, Gunnar 02 Nov '12

02 Nov '12

With my ldap client, JXplore, I import a subtree and get this error message: [LDAP: error code 21 - postalAddress: value #0 invalid per syntax]; remaining name 'uid=reskes(a)circa,ou=Users,ou=DATA,ou=fis-vl.bund.de,o=IRCusers,l=CIRCA' The import job fails (same result with slapadd). This are the data: postalAddress:: TmllZGVyc+RjaHNpc2NoZXMgTGFuZGVzYW10IGb8ciBWZXJicmF1Y2hlcnNj aHV0eiB1bmQgTGViZW5zbWl0dGVsc2ljaGVyaGVpdCwgRGV6ZXJuYXQgMjMsIFBvc3RmYWNoIDM 5NDksIDI2MDI5IE9sZGVuYnVyZw== -----Ursprüngliche Nachricht----- Von: Pörschke, Gunnar Gesendet: Donnerstag, 1. November 2012 13:51 An: 'openldap-technical(a)openldap.org' Betreff: openldap 2.2.x Hi all, we have an very old openldap running and we need to migrate data to latest openldap version. I create an ldif but the data in that file are encoded "base64". Is there a trick to disable that? My plan is to export everything from openldap 2.2 database (lbdb) without base64 encoding so I can easily use slapadd to add this data to a database on my new openldap 2.4.2x system Thank you for any idea. Gunnar

3 2

Re: Index Add Failures
by Kyle Smith 01 Nov '12

01 Nov '12

Thanks for the input, Quanah. I really appreciate it. On Thu, Nov 1, 2012 at 1:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > > --On Thursday, November 01, 2012 1:04 PM -0400 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > Is it possbile to use MMR to my advantage to switch over? For example, >> take down 1 of the servers, switch the db config from bdb to mdb, and >> then restart with a blank database (with appropriate structure) and >> have the MMR take care of backfilling the mdb entries? Then I wouldn't >> have to export to ldif, convert the db, and reimport while possibly >> loosing data from the other systems. >> > > Hi Kyle, > > I'm not sure what you are trying to avoid here... Slapcat/slapadd are > always faster than sync replication. Why would you lose data from the > other server while doing this? contextCSNs should be preserved w/ > slapcat/slapadd, so the server being converted will just catch up using > sync replication as before. You may wish to look at ITS#7427 though. The > fix for that is in current RE24. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical