openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

syncrepl not propagating changes
by Mark Coetser 22 Aug '12

22 Aug '12

Hi current version of openldap 2.4.23-7.2 I have however built and used 2.4.31 with the same results. I have a single provider that has multiple domians ie dc=company dc=subdivision1,dc=company dc=subdivision2,dc=company on some of the consumers, I have a single syncrepl config with the base, so these servers have all the users and replication tends to work fine. olcSyncrepl: {0} rid=00x provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=company" scope=sub attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem on some of the consumers, I have multiple syncrepl configs so that I replicate specific subdivision data to those servers. olcSyncrepl: {0} rid=001 provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=company" scope=base attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem olcSyncrepl: {1} rid=002 provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=repl_config,dc=company" scope=base attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem olcSyncrepl: {2} rid=002 provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=subdivision,dc=company" scope=base attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem whats happening with these consumers is that the initial sync seems to work and some changes to the provider do make it down to the consumer but lately most changes are NOT making it down to the consumer, when I log sync then I am seeing that the csn is committed for the change for the first rid but then for the next rid it logs that the csn is too old? Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 NEW_COOKIE: rid=080,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_queue_csn: queing 0xb4230120 20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 NEW_COOKIE: rid=082,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 NEW_COOKIE: rid=081,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 cookie=rid=083,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_graduate_commit_csn: removing 0xb422e830 20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 CSN too old, ignoring 20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 NEW_COOKIE: rid=082,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 NEW_COOKIE: rid=081,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 NEW_COOKIE: rid=080,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 cookie=rid=083,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_queue_csn: queing 0xb4f11d20 20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_graduate_commit_csn: removing 0xb4f18508 20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 CSN too old, ignoring 20120822075659.112753Z#000000#000#000000 -- Thank you, Mark Adrian Coetser mark(a)pkfnet.co.za

3 4

LDAP password management
by Adrian Paleacu 22 Aug '12

22 Aug '12

Hi everyone, I have a binding question regarding the password. Is possible to send a hashed password to LDAP system. My passwords are hashed and I don't have a way to send it as plain text. regards, Adrian

2 1

Re: syncrepl not propagating changes
by Mark Coetser 22 Aug '12

22 Aug '12

On 22/08/2012 12:00, Rein Tollevik wrote: > On 22.08.12 10:46, Mark Coetser wrote: >> On 22/08/2012 10:39, Howard Chu wrote: >>> Mark Coetser wrote: >>>> >>>> on some of the consumers, I have multiple syncrepl configs so that I >>>> replicate specific subdivision data to those servers. >>> >>> That is not supported. You can only use multiple consumers in the same >>> database if they are all pointing at different providers (and each of >>> those >>> providers uses a unique serverID). >> >> Can I split them into separate databases on the consumer? Or whats the >> correct way of doing what I am trying to achieve? > > Use a single syncrepl stanza on these consumers too, replicating your > toplevel cn=company dn. Add acl's on the provider which limits the user > these consumers binds as to only see those sub-trees you wish them to see. > > Rein > Hi Please could someone confirm that these acls would be secure, I am trying to allow services like pam/nss on the provider to still function and have access to the entire tree, then allow the replica user from the consumer to see the base of the tree and the whole of the subdivision tree including userPassword,shadowLastChange, also could someone assist with an example of a regex acl that I could use to say that "cn=replica,*" has read access to everything in that users subtree? access to attrs=userPassword,shadowLastChange by dn.base="cn=admin,dc=company" write by dn.base="cn=replica,dc=subdivision,dc=company" read by anonymous auth by self write by * none access to dn.base="" by peername.regex=127\.0\.0\.1 read by * none access to dn.base="dc=company" by dn.base="cn=replica,dc=subdivision,dc=company" read access to dn.subtree="dc=subdivision,dc=company" by dn.base="cn=replica,dc=subdivision,dc=company" read access to * by dn.base="cn=admin,dc=company" write by peername.regex=127\.0\.0\.1 read by * none -- Thank you, Mark Adrian Coetser mark(a)pkfnet.co.za

1 0

Re: syncrepl not propagating changes
by Mark Coetser 22 Aug '12

22 Aug '12

1 1

Re: Query regarding the Database files..
by Howard Chu 22 Aug '12

22 Aug '12

Pierangelo Masarati wrote: >> If you build the mdb_stat program in the libmdb source (it is not built by >> default) you can use it to examine the individual MDB databases. E.g.: > > Time for a slapstat tool? Eh... We lived thru 12 years of BerkeleyDB without needing such a thing. I don't see why we should need it now. It would be useful to flesh out mdb_stat to report more interesting information, but that's a pretty low priority on my list at the moment. For completeness' sake MDB should have mdb_stat, mdb_dump, and mdb_load. Patches welcome... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Using ldap.searchFilter
by rodrigo tavares 22 Aug '12

22 Aug '12

Hello ! I installed Openfire im my server, and using client spark, with base LDAP. I get log in server, but i can´t search the users. Then a need : ldap.searchFilter. In a doc Openfire: LDAP Guide. I found: ldap.searchFilter -- an optional search filter to append to the default filter when loading users. The default search filter is created using the attribute specified by ldap.usernameField. For example, if the username field is "uid", then the default search filter would be "(uid={0})" where {0} is dynamically replaced with the username being searched for. http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/lda… How I can to define this parameter ? Thanks ! Rodrigo Faria

3 2

Query regarding the Database files..
by aryan rawat 21 Aug '12

21 Aug '12

Hi All, In slapd.conf have these indexes *index objectClass eq* *index msisdn eq* *index entryCSN,entryUUID eq* When I run the same slapd.conf under MDB I can see 2 files * **data.mdb and lock.mdb* When I run the same slapd.conf under BDB (HDB) I can see files on which the index is created *entryCSN.bdb id2entry.bdb objectClass.bdb dn2id.bdb entryUUID.bdb msisdn.bdb alock* So does this means MDB does not do indexing if I am not wrong?? Please clarify the doubt?? BR's, Aryan

3 2

multi-master syncrepl issue
by Chris Card 21 Aug '12

21 Aug '12

Hi All, I have a multi-master openldap setup with 2 machines replicating a directory containing about 3.5 million entries. I'm running openldap 2.4.31 on centos 6, and the directory is using the BDB backend. Although the 2 machines are configured for multi-master syncrepl replication, in practice data is only written to one of the machines (I'll call it the master), and the second machine (which I'll call the slave) only gets data written by openldap replication. Currently the contextCSN of the directory is the same from both machines, which (as I understand it) should mean that the directories are in sync, but I have written a program to compare what is in both directories which finds that there are 16 entries in the master directory not in the slave directory. I have double checked thisusing ldapsearch on both directories. I can't see any error messages in the openldap log and there doesn't appear to be any pattern connecting the entries which are missing from the slave. Most of the missing entries werein the master directory before I created the slave machine and configured replication and have not changed. The syncrepl config looks like this: dn: olcDatabase={1}bdb,cn=configolcSyncrepl: {0}rid=101 provider="ldap://<master>:389" binddn="<binddn>" bindmethod=simple credentials=<bindpw> searchbase="<prefix>" type=refreshAndPersist retry="5 5 300 5" timeout=1olcSyncrepl: {1}rid=110 provider="ldap://<slave>:389" binddn="<binddn>" bindmethod=simple credentials=<bindpw> searchbase="<prefix>" type=refreshAndPersist retry="5 5 300 5" timeout=1 Are there any known issues with openldap replication which could result in missing data? How can I force these missing entries to appear in the slave without rebuilding the whole of the slave directory and without changing the data in the master directory? Chris

3 8

slapadd *very* slow: tuning advice?
by Nick Urbanik 21 Aug '12

21 Aug '12

Dear Folks, I'm upgrading a cluster of OpenLDAP servers from 2.3.43-25.el5 to 2.4.32 with BDB 4.8.30 on CentOS 5, x86_64, on HP BL460cG6 blades with two 4-core CPUs, and 12GB RAM. These are slaves, and have eleven trees on them. I have dumped and restored six of the LDAP databases in reasonable time, but the seventh is taking a long time. Here are the sizes of the slapcatted LDIF files: 320M 252M 80M 225K 246K 833K 2.6G 1.2G 24M 947M 522K It's the 2.6G LDIF file that's taking the time to slapadd: -############ 63.34% eta 02h09m elapsed 03h43m30s spd 2.7 k/s As you can see, it has slowed to a crawl. # cat DB_CONFIG set_flags DB_LOG_AUTOREMOVE set_cachesize 0 286162472 0 # egrep 'tool-threads|cachesize' /etc/openldap/slapd.conf tool-threads 8 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 On another member of the cluster, not upgraded from 2.3.43 yet, we have, for this big tree: # sudo -u ldap slapd_db_stat -d id2entry.bdb Tue Aug 21 15:15:38 2012 Local time 53162 Btree magic number 9 Btree version number Little-endian Byte order Flags 2 Minimum keys per-page 16384 Underlying database page size 3 Number of levels in the tree 4611665 Number of unique keys in the tree 4611665 Number of data items in the tree 418 Number of tree internal pages 36096 Number of bytes free in tree internal pages (99% ff) 308745 Number of tree leaf pages 871M Number of bytes free in tree leaf pages (82% ff) 0 Number of tree duplicate pages 0 Number of bytes free in tree duplicate pages (0% ff) 0 Number of tree overflow pages 0 Number of bytes free in tree overflow pages (0% ff) 0 Number of empty pages 0 Number of pages on the free list # sudo -u ldap slapd_db_stat -d dn2id.bdb Tue Aug 21 15:34:30 2012 Local time 53162 Btree magic number 9 Btree version number Little-endian Byte order duplicates, sorted duplicates Flags 2 Minimum keys per-page 4096 Underlying database page size 4 Number of levels in the tree 9227811 Number of unique keys in the tree 9263210 Number of data items in the tree 2185 Number of tree internal pages 2781648 Number of bytes free in tree internal pages (68% ff) 219185 Number of tree leaf pages 287M Number of bytes free in tree leaf pages (68% ff) 37 Number of tree duplicate pages 40214 Number of bytes free in tree duplicate pages (73% ff) 0 Number of tree overflow pages 0 Number of bytes free in tree overflow pages (0% ff) 0 Number of empty pages 0 Number of pages on the free list QUESTIONS: ========== Any suggestions on how to optimise this a little more towards slapadd? Would mdb possibly be faster than bdb? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

3 6

RE: multi-master syncrepl issue
by Quanah Gibson-Mount 21 Aug '12

21 Aug '12

--On Tuesday, August 21, 2012 3:33 PM +0000 Chris Card <ctcard(a)hotmail.com> wrote: > > > >> >> --On Tuesday, August 21, 2012 2:50 PM +0000 Chris Card >> >> <ctcard(a)hotmail.com> wrote: >> >> >> >> >> Do you have sync logging enabled? >> >> >> >> >> > >> >> > Log level is set to none, so the slapd log doesn't give much help. >> >> >> >> Fix your log level. >> > olcLogLevel: sync ? >> >> Yes > I turned on sync logging for a short while, loads of stuff was written to > the log, and strangely (coincidently?) the contextCSN is now up to date. > However, the database is still missing a lot of entries (about 25000 I > think) - will syncrepl fix this automatically? Unlikely. What openldap version are you using? --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical