openldap-technical

openldap-technical@openldap.org

9 participants
9866 discussions

Private E-Mail Address
by chris_news＠arcor.de 18 Jul '12

18 Jul '12

Hi, whereis the best place to store the private e-mail address of an inetOrgPerson? Is the order of the attribute's values fixed? So I could save the business address as first value and the private as second? May the first value be empty? Would an auxiliary class be better? Which one? Thank you in advance. - Chris

2 1

syncrepl and attribute order
by Evgeniy Kosov 18 Jul '12

18 Jul '12

Hi there, First of all, I'm new to this list, so, please, forgive me if this is a wrong place for the questions below, and feel free to redirect me wherever is more appropriate. The issue I'm facing as stated above is regarding the syncrepl and attribute order. I'm writing a Perl module to be used with back_perl and noticed behaviour that seems strange. Making some modifications on the master server (provider) and looking on the relevant modifications on the slave I saw that they didn't quite match. There were some extra REPLACE operations made by syncrepl. Later investigation showed that the cause of those REPLACE's was different attribute order on the master and slave nodes. synrepl.c says that: /* We assume that attributes are saved in the same order * in the remote and local databases. So if we walk through * the attributeDescriptions one by one they should match in * lock step. If not, look for an add or delete. */ Which seems strange to me. As a result syncrepl makes a REPLACE for every attribute whuch is "misplaced" in the local object. This is probably not an issue if master and slave both use the same back-end module. Which is not true in my case. So, the questions are: Is that replacing of "misplaced" attributes by syncrepl is expected behaviour or just a side effect of its syncrepl_diff_entry diff'ing algorithm? Does attribute order matter? Is it specified somehow (sorted by modification time?)? Should this issue be reported as bug? Thank you. -- Regards, Evgeniy Kosov

3 8

More efficient way to represent local+remote views?
by Kartik Subbarao 17 Jul '12

17 Jul '12

I'm currently using the following configuration for an application-specific LDAP directory to present a unified view of its local data (ou=localapp) and remote data (ou=people), all under dc=example,dc=com: database hdb suffix ou=localapp,dc=example,dc=com # ... database meta suffix dc=example,dc=com uri ldapi:///ou=localapp,dc=example,dc=com uri ldap://remoteldap.example.com/ou=people,dc=example,dc=com The idea being that clients of this directory can simply set the base DN to dc=example,dc=com without needing to know which parts are local and which parts are pulled in remotely. My understanding is that this approach incurs some overhead in going through the ldapi interface for each operation that ends up being performed on the local backend. Is it possible to eliminate that overhead through an alternate approach? I looked at back_relay, but couldn't get it to do what I wanted. I don't want to rewrite any of the suffixes -- I just want it to do exactly as above in the back-meta configuration, but replace "ldapi:///" with "internal-backend-api:///", as mentioned in this part of the back-relay docs: "back-relay bypasses the real database frontend operations by short-circuiting operations through the internal backend API". Thanks, -Kartik

2 2

ppolicy and replication issues
by Guillaume Rousse 16 Jul '12

16 Jul '12

Hello list. I'm planning to deploy ppolicy on our directory, but I'm facing a problem with replication, as I only control the master server, and not the slaves configuration for the moment. Despite being only active on the master server, a local experiment told me than the slaves need the following items: - the ppolicy schema, for replicating policies objects - the ppolicy overlay, for replicating operational attributes of user objects The first requisite is quite easy to achieve, as it is just a file I need other admins to add in their configuration. The second is a bit more difficult, as it is an additional binary, and given the lack of consistency between servers, I'm not sure it is available for each installation... So, is there some way of either configuring ppolicy or the replication, to avoid the need for the ppolicy overlay on the slaves, while I don't have full control over all the servers ? -- A system software crash will cause hardware to act strangely and the programmers will blame the customer engineer. -- Murphy's Laws of Computer Programming n°6

2 3

Tutorial to start ldap replication ?
by Frank Bonnet 16 Jul '12

16 Jul '12

Hello All is in the subject ! I need to start a replication server. Actually I run only one server and would like to start another one just in case the main stop/crash. Both machines runs FreeBSD , slapd is installed from FreeBSD ports on both machines, OpenLDAPversion is the same. Thanks for any pointers/links.

3 2

substitute a schema
by paulo bruck 15 Jul '12

15 Jul '12

Hi Guys I develop a simple schema and now I would like to suibstitute the actual schema for another one with same attributes and objectclass + another attibutes and obcejtclass . See its a superseed of ther previus one... I have already try using : ldapdelete -Y EXTERNAL -H ldapi:/// cn={6}squid,cn=schema,cn=config but received a: ldap_delete: Server is unwilling to perform (53) Doing it by hand it worked ( stoping ldap, substituted cn=squid with new one and restarting ldap), but I know that is not correct... How can I do it using ldapdelete ? best regards

4 3

Re[8]: Searching few domains for one uid
by kefast＠o2.pl 14 Jul '12

14 Jul '12

> --On Friday, July 13, 2012 10:12 AM +0200 kefast(a)o2.pl wrote: >> >>> --On Thursday, July 12, 2012 11:16 AM +0200 kefast(a)o2.pl wrote: >> >> >>>> >>>> I've got 3 databases on a server >>>> dc=a,dc=com >>>> dc=b,dc=com,dc=de >>>> dc=c,dc=com,dc=fr >>>> >>>> When on a client side a pointed BASE "" >>>> the server says: >>>> slapd[13330]: do_search: invalid dn ("") >>>> >>>> Should I reconfigure my database maybe and set dn to "" ? >>>> If yes how should the root dn look like ? >>>> dn: "" >>>> dc: "" >>>> objectClass: top >>>> objectClass: domain >>>> structuralObjectClass: domain >> >>> The easiest thing to do is to create a single database, with a root of >>> "". You don't need to create an entry for "" itself, as it is inherent >>> to the openldap directory server. >> >>> First entry would (in your case) likely be for dn: dc=com >> >>> dn: dc=com >>> objectClass: organization >>> objectClass: dcObject >>> o: com domain >>> dc: com >> >> >>> --Quanah >> >> >>> -- >> >>> Quanah Gibson-Mount >>> Sr. Member of Technical Staff >>> Zimbra, Inc >>> A Division of VMware, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration >> >> >> But in my case not all of my domains finishs on .com in the end. >> So beside a.com I've got b.com.de and b.com.fr, so in that case I'm >> not sure the root "com" would do, so maybe making root as .corp and then >> a.com.corp, b.com.de.corp, c.com.fr.corp. >> And one more think, is that statement which combines all parts of a >> domain in one dc would be ok ? >> dn="ou=People,dc=b.com.de,dc=corp" >> Would't it spoil something ? > You are missing the point of using "". ;) The point of using "" is that > you can store any and all domains in the same database. > In your case, if you have .de and .fr, then create entries for them too: > dn: dc=com > objectClass: organization > objectClass: dcObject > o: com domain > dc: com > dn: dc=de > objectClass: organization > objectClass: dcObject > o: de domain > dc: de > dn: dc=com, dc=de > objectClass: organization > objectClass: dcObject > o: com.de domain > dc: com > dn: dc=fr > objectClass: organization > objectClass: dcObject > o: fr domain > dc: fr > dn: dc=com, dc=fr > objectClass: organization > objectClass: dcObject > o: com.fr domain > dc: com > etc. > You could even create: > dn: cn=IamWildAndCrazy > objectClass: organizationalRole > description: Insane entry > cn: IamWildAndCrazy > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration Ok, thanx, I do understand that, but my point is, where I can put those "" in configuration files ? On a client side set BASE "" and in slapd.conf database bdb suffix "" rootdn "cn=admin" ? How persisly set config files (client, server) to search for all of those domains You listed. -- Pozdrowienia, kefast(a)o2.pl

2 1

olcSubordinate versus Chaining
by Warren Howard 13 Jul '12

13 Jul '12

Dear all, I'm setting up a replicated directory service, so far I have a single provider and a single consumer with Syncrepl in refreshOnly mode. The consumer is a complete shadow copy of the provider, ldap clients can read from the consumer but not write to the consumer because it is a shadow copy. Next I would like "refer" ldap clients that wish to write to the consumer to the provider. Based on the notes here : http://www.openldap.org/doc/admin24/referrals.html, I would like to how to do this by using the olcSubordinate keyword. I've read the olcSubordinate section in slapd-config man page and I don't see a way forward and I'm not even sure that using olcSubordinate is the correct approach, since the steps described in http://www.openldap.org/doc/admin24/overlays.html#Chaining appear more relevant to set up I'm attempting. Any guidance much appreciated. Regards, Warren.

3 3

modifying network timeout behavior of ldap clients
by Ryan Palamara 13 Jul '12

13 Jul '12

I am running several CentOS servers that have 2 ldap servers defined. I would like to modify the ldap network timeout, so that if the first ldap server listed goes down entirely, that it will go to the next server quickly. I know that the setting will be LDAP_OPT_NETWORK_TIMEOUT, but I am not sure when this change is made. Can this be done in the ldap.conf file, or is it done elsewhere? Thank you, Ryan Palamara ZAIS Group, LLC 2 Bridge Avenue, Suite 322 Red Bank, New Jersey 07701 Phone: (732) 450-7444 Ryan.palamara(a)zaisgroup.com<mailto:Ryan.palamara@zaisgroup.com> ________________________________ This e-mail message is intended only for the named recipient(s) above. It may contain confidential information. If you are not the intended recipient you are hereby notified that any dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender by replying to this e-mail and delete the message and any attachment(s) from your system. Thank you. This is not an offer (or solicitation of an offer) to buy/sell the securities/instruments mentioned or an official confirmation. This is not research and is not from ZAIS Group but it may refer to a research analyst/research report. Unless indicated, these views are the author's and may differ from those of ZAIS Group research or others in the Firm. We do not represent this is accurate or complete and we may not update this. Past performance is not indicative of future returns. IRS CIRCULAR 230 NOTICE:. To comply with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained herein (including any attachments), unless specifically stated otherwise, is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending any transaction or matter addressed herein to another party. Each taxpayer should seek advice based on the taxpayer's particular circumstances from an independent tax advisor. "ZAIS", "ZAIS Group" and "ZAIS Solutions" are trademarks of ZAIS Group, LLC.

2 2

Re[6]: Searching few domains for one uid
by kefast＠o2.pl 13 Jul '12

13 Jul '12

> --On Thursday, July 12, 2012 11:16 AM +0200 kefast(a)o2.pl wrote: >> >> I've got 3 databases on a server >> dc=a,dc=com >> dc=b,dc=com,dc=de >> dc=c,dc=com,dc=fr >> >> When on a client side a pointed BASE "" >> the server says: >> slapd[13330]: do_search: invalid dn ("") >> >> Should I reconfigure my database maybe and set dn to "" ? >> If yes how should the root dn look like ? >> dn: "" >> dc: "" >> objectClass: top >> objectClass: domain >> structuralObjectClass: domain > The easiest thing to do is to create a single database, with a root of "". > You don't need to create an entry for "" itself, as it is inherent to the > openldap directory server. > First entry would (in your case) likely be for dn: dc=com > dn: dc=com > objectClass: organization > objectClass: dcObject > o: com domain > dc: com > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration But in my case not all of my domains finishs on .com in the end. So beside a.com I've got b.com.de and b.com.fr, so in that case I'm not sure the root "com" would do, so maybe making root as .corp and then a.com.corp, b.com.de.corp, c.com.fr.corp. And one more think, is that statement which combines all parts of a domain in one dc would be ok ? dn="ou=People,dc=b.com.de,dc=corp" Would't it spoil something ? -- Pozdrowienia, kefast(a)o2.pl

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical