openldap-technical

openldap-technical@openldap.org

23 participants
9804 discussions

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 21 May '12

21 May '12

Tx! We'plan to upgrade the system, so we'll use openldap2.4.x. We have more than 1500 server and about 50% of them are linux, we must use rhel rpms (due to our datacenter roles, all the servers should be identical). The worst thing was that testing with the same db without the index files, all the results of the query are almost immediate. I'm unable to reproduce the problem in test environment. Regards Michele MAsè On Tue, May 15, 2012 at 6:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 15, 2012 2:55 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Anyone??????? >> >> > OpenLDAP 2.3 has not been supported for several years. Since it stopped > development, there have been hundreds, if not over a thousand, bug fixes > and improvements. Furthermore, I'm going to guess that you are running > RH's build of OpenLDAP 2.3, which was even further behind than the last > release of OpenLDAP 2.3. Given the information you provided, I would guess > that there is some bug in the version of BDB that OpenLDAP was linked to > that caused the error. I would note that at one point RH was linking > OpenLDAP against BDB version 4.3, despite the fact OpenLDAP's configure > script explicitly disabled such linking because BDB 4.3 was known to have > serious issues. If your 2.3 OpenLDAP is linked to BDB 4.3 that could well > be the cause of your issue. > > Beyond that, trying to investigate any further is a waste of everyone's > time. Upgrade to a modern supported version of OpenLDAP, and build your > own packages, don't rely on distribution packages. > > <http://www.openldap.org/faq/**data/cache/1456.html<http://www.openldap.org/faq/data/cache/1456.html> > > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 5

Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries
by Chris Hiestand 20 May '12

20 May '12

Part 1: Readability I know you veterans are probably sick to death of us late-comers asking questions about cn=config. I understand but please hear me out because I feel I have done due diligence; but I still have some concerns with the transition. Workflow has been discussed before, but I suspect it hasn't been fleshed out because the switch from editing schema and ACLs in flat files to LDAP entries reduces readability. I have no problem using cn=config for most configuration attributes, but it gets a lot less user friendly when the value is, what used to be in slapd.conf, a multi-line string. But I could just be missing something. Your help is appreciated. Attached are some screenshots of editing ACLs and a custom schema via 3 methods: 1. cn=config via ldap client (ie apache directory studio) 2. cn=config via ldif 3. old style slapd.conf Look at the pictures and pick which method you'd like to use to edit ACLs or a schema: http://snl.salk.edu/~chiestand/openldap/ACLs-via-ldap.png http://snl.salk.edu/~chiestand/openldap/ACLs-via-ldif.png http://snl.salk.edu/~chiestand/openldap/ACLs-via-slapd.conf.png http://snl.salk.edu/~chiestand/openldap/schema-via-ldap.png http://snl.salk.edu/~chiestand/openldap/schema-via-ldif.png http://snl.salk.edu/~chiestand/openldap/schema-via-slapd.conf.png I think the choice is clearly old style slapd.conf. Otherwise you miss comments and ordering (until Howard Chu's X-ORDERED ldap extension is implemented), and unlimited whitespace to substantially improve readability. The LDIF files are a mess because of the way words are split unpredictably by new lines. You can't use a simple search and replace with any hope of it working. Readability would be vastly improved with new lines before keywords (eg to, filter, attrs …) but I don't think it's possible to have ldapsearch output this way. Editing via an ldap client is easy if you're just editing an attribute here and there, but because of the interacting nature of ACLs and schema elements, poor readability (no newlines) makes editing via an ldap client more difficult (a gui with smart sorting and syntax highlighting could make it better). Am I just missing workflow techniques or key concepts that improves readability? Or is your advice to just suck it up and get used to it? Part 2: Deleting entries in cn=config Quanah Gibson-Mount has said entry deletes are coming in 2.5, is that still the plan? The Roadmap page isn't specific. What about whole schema deletes? From a sysadmin perspective, I should be able to add, modify, or delete anything from the configuration. For QA reasons, you want to be have the exact configuration you want; not the configuration you want plus legacy boogers. I understand if this isn't trivial to achieve from the developer perspective. Granted I don't have the whole picture here, but I'd argue that it's worth it. Lastly, I thank everyone who contributes to OpenLDAP.

16 47

OLC version of plugin directive
by Joseph L. Casale 19 May '12

19 May '12

I am trying to adapt a plugin preoperation|postoperation setup from an older slapd.conf to my current OLC based config. I can not seem to find any applicable olc based directives that accomplish the same, anyone have a pointer? Thanks! jlc

2 2

SSL client cert authc problems with OpenLDAP client and OpenDJ server
by Michael Ströder 18 May '12

18 May '12

HI! (cross-posted since OpenLDAP and OpenDJ are involved) I have some SSL client cert authc problems with a OpenLDAP 2.4.23 LDAP client (dynamically linked to OpenSSL 0.9.8e on RHEL 5.6) and OpenDJ 2.4.5 running under control of Java 1.6.0_31. I cross-checked all the cert and trust stuff several times. It seems to be correct. Unfortunately we're stuck with 2.4.23 in this setup because of OpenLDAP's ITS#6997. (I manually obfuscated parameters and log lines herein.) At first glance OpenLDAP's ldapwhoami seems to work correctly with the first OpenDJ replica: $ LDAPTLS_CERT=ldap-client.crt LDAPTLS_KEY=client.key ldapwhoami -H ldaps://master1.example.com -Y EXTERNAL SASL/EXTERNAL authentication started SASL username: cn=ldapclient,o=example,c=DE SASL SSF: 0 dn:cn=ldapclient,ou=Users,cn=example But in OpenDJ's access-log file there's written: [18/May/2012:16:52:00 +0200] CONNECT conn=15 from=x.x.x.x:33358 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:52:00 +0200] BIND REQ conn=15 op=0 msgID=1 type=SASL mechanism=EXTERNAL dn="" [18/May/2012:16:52:00 +0200] BIND RES conn=15 op=0 msgID=1 result=0 authDN="cn=ldapclient,o=example,c=DE" etime=0 [18/May/2012:16:52:00 +0200] EXTENDED REQ conn=15 op=1 msgID=2 name="Who Am I?" oid="1.3.6.1.4.1.4203.1.11.3" [18/May/2012:16:52:00 +0200] EXTENDED RES conn=15 op=1 msgID=2 result=0 additionalInfo="authzID="dn:cn=ldapclient,ou=Users,cn=example"" etime=1 [18/May/2012:16:52:00 +0200] DISCONNECT conn=15 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?" The attempt to do the same on another OpenDJ replica fails completely (no differences in TLS configuration - checked cn=config for potential differences with diff): $ LDAPTLS_CERT=ldap-client.crt LDAPTLS_KEY=client.key ldapwhoami -H ldaps://consumer1.example.com -Y EXTERNAL ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) In OpenDJ's access-log file there's written: [18/May/2012:16:52:38 +0200] CONNECT conn=6 from=x.x.x.x:61841 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:52:38 +0200] DISCONNECT conn=6 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLHandshakeException: General SSLEngine problem" [18/May/2012:16:53:06 +0200] CONNECT conn=7 from=x.x.x.x:61842 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:53:07 +0200] DISCONNECT conn=7 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLHandshakeException: General SSLEngine problem" Any clue what's going on here? Ciao, Michael.

3 3

slapadd -S defaulting to 0
by Mark 18 May '12

18 May '12

Why does the '-S' option on slapadd to default 0 instead of the (olc)ServerID value currently being used? (according to the manpage) Thank you, Mark

1 0

ACL syntax with wildcards
by Nick Milas 18 May '12

18 May '12

Hi, We would like to use ACL statements of the form (used for illustration purposes): access to dn.subtree="ou=people,dc=example,dc=com" filter="(ou=xxxxx)" attrs="someAttrs" by group.exact="cn=xxxxxAdmins,ou=Groups,dc=example,dc=com" write by group.exact="cn=allAdmins,ou=Groups,dc=example,dc=com" read by self read where xxxxx is some string. In essence, we assign people entries to various administrative groups, depending on the value of the ou attribute of the entry. Of course we can write many statements, one per ou value / admin group, but it would be much more concise to use just one statement using wildcards. Could someone please suggest if and how the above can be written correctly, using e.g. regex? I appreciate any suggestions. Thanks, Nick

7 15

ACL Manual Additions request
by Nick Milas 18 May '12

18 May '12

Hi, I think it would be important to add some text in http://www.openldap.org/doc/admin24/access-control.html regarding the use of <control> keywords (i.e. stop, continue, break), esp "break". These are not explained at all in the particular page, and IMHO they are notsatisfactorily explained in FAQ-O-Matic as well (unless there is a page which I missed, in which case please add the appropriate info in the above page which is a main point of reference). For example, the above man page does not even include an example with a break keyword. At least one example should be included for children, entry attributes (and the significance of break there should be explained). There are some examples in FAQ-O-Matic, for example: http://www.openldap.org/faq/data/cache/1474.html http://www.openldap.org/faq/data/cache/429.html http://www.openldap.org/faq/data/cache/189.html but they do not provide sufficient insight. So, currently the significance and use of <control> keywords is obscure. Although I am now (after almost two years) in a position to be able to understand and handle ACLs to an extensive degree successfully (not without effort), yet I am far from writing a tutorial or manual text, I felt the above addition is a real need (esp. for new users) that I should mention, asking the project team for it. Regards and thanks for the project's efforts, Nick

1 0

translucent overlay and local objects?
by Eugene Vilensky 17 May '12

17 May '12

Greetings, Pardon if this is an RTFM (I'd love a link), but is it possible to store entities locally using the translucent overlay? The overlay works for what we are trying to do when it comes to search and modifying attributes on an entry, but I would like to create an entire local groupofnames, consisting of remote UIDs. For example, this LDIF imports OK: #!RESULT OK #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:01:33.961 dn: cn=instructors,ou=Groups,dc=xxxx,dc=zzz changetype: add objectClass: groupofnames member: uid=nate member: uid=penelope member: uid=rhonda cn: instructors But searching for it does not bring back a result. However, it must have gone somewhere since if I try to import the same LDIF again: #!RESULT ERROR #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:21:28.221 #!ERROR [LDAP: error code 68 - Entry Already Exists] Kind regards, Eugene

4 11

CAN I MADE MY OWN SCHEMA
by amine boubou 16 May '12

16 May '12

hi i've installed openldap correctly, but now i want to use some attributs that not exist in default objectclass. My question: can i configure openldap with new specifique schema without using the default (core.schema cosine.schema nis.schema and inetorgperson.schema). thanks for answer :)

2 1

Adding ODERING to a core attribute
by Emmanuel Dreyfus 16 May '12

16 May '12

Hi I have a VoIP phone that insist on having ORDERING set on sn and givenName in core.schema. Is there any smart way of doing it without modifying the core.schema file? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical