openldap-technical

openldap-technical@openldap.org

23 participants
9804 discussions

ACL in dynamic configuration
by Nick Milas 16 Mar '12

16 Mar '12

Hello, I have converted from static (slapd.conf) to dynamic (cn=config) configuration using auto file conversion. I would like to ask a couple of questions regarding ACL conversion. Here follows one of the rules we have in initial form (a), and after conversion (b): (a) access to dn.subtree="dc=xxx.xxx.xxx.in-addr.arpa,ou=dns1,dc=example,dc=gr" attrs="children,entry" by group.exact="cn=TechAdmins,ou=Groups,dc=example,dc=gr" write by group.exact="cn=Dept1Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept2Admins,ou=Groups,dc=example,dc=gr" write by group.exact="cn=Dept3Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept4Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept5Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=GuestAdmins,ou=Groups,dc=example,dc=gr" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=gr" read by * break (b) as an olcAccess attribute value: {10}to dn.subtree="dc=xxx.xxx.xxx.in-addr.arpa,ou=dns1,dc=example,dc=gr" attrs=children,entry by group/groupOfNames/member.exact="cn=techadmins,ou=groups,dc=example,dc=gr" write by group/groupOfNames/member.exact="cn=Dept1Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept2Admins,ou=groups,dc=example,dc=gr" write by group/groupOfNames/member.exact="cn=Dept3Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept4Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept5Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=guestadmins,ou=groups,dc=example,dc=gr" read by dn.base="uid=dnsauthusr,ou=system,dc=example,dc=gr" read by * +0 break Question 1. Why "group.exact" was changed to "group/groupOfNames/member.exact" ? Yes, groups are defined as entries of groupOfNames objectClass, with members defined as values of attribute "member". But should it be like that? Should we change (manually) "group/groupOfNames/member.exact" back to "group.exact" again or not (and why)? Question 2. Is there a way we can add (manually, since conversion removed the ones which existed in initial configuration files) line breaks in olcAccess attribute value so it can be more legible (for administrative purposes)? Question 3. What is the "+0" added before "break" and why is needed? Thanks in advance, Nick

3 3

Is this a sensible architecture?
by Brett Watson 16 Mar '12

16 Mar '12

Folks, I'm currently planning a shift in our use of LDAP to incorporate mirror mode masters for the sake of high availability. The plan is to hide a mirror mode master pair behind a virtual IP using "sorry server" fail-over, such that the primary mirror server takes 100% of the load when it's up and responsive, with fall-back to the secondary mirror server when the primary is down. In this way, the virtual IP presents a "virtual master" to the outside world, and the plan is for *all* outside LDAP interaction with the masters to happen over this single virtual IP. There will be other "slave" servers which replicate the master (to distribute read-only load), and the plan is for them to syncrepl from the master virtual IP. I gather that a possible alternative to this arrangement is to have the "slave" servers act as syncrepl consumers to *both* masters simultaneously, via their real IP addresses. If this is indeed a valid configuration, does it convey any advantages? The single "virtual master" approach seems architecturally simpler, but is it considered robust by those in the know? Thanks in advance.

5 5

Fwd: OpenLdap Startup Failure
by Swapnesh sharma 15 Mar '12

15 Mar '12

Hi All, I have installed OpenLdap-2.4.26 on Solaris 10 (SunOS xxx 5.10 Generic_142900-09 sun4v sparc SUNW,SPARC-Enterprise-T5220) using the packages available from sunfreeware ( http://www.sunfreeware.com/indexsparc10.html) Installation was successful without any error. But when starting slapd, I am getting below error. Can anyone please help/redirect me ? I am trying to find a solution using the documents and archive mails. Let me know if you require more information. bash-3.00#/usr/local/libexec/slapd -d 255 slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context config_build_entry: "cn=config" config_build_entry: "cn=schema" >>> dnNormalize: <cn={0}core> <<< dnNormalize: <cn={0}core> config_build_entry: "cn={0}core" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=my-domain,dc=com" bdb_db_open: "dc=my-domain,dc=com" *bdb_db_open: database "dc=my-domain,dc=com": dbenv_open(/usr/local/var/openldap-data).* *bdb(dc=my-domain,dc=com): Ignoring log file: /usr/local/var/openldap-data/log.0000000001: magic number 88090400, not 40988* *bdb(dc=my-domain,dc=com): Invalid log file: log.0000000001: Invalid argument* *bdb(dc=my-domain,dc=com): PANIC: Invalid argument* *bdb(dc=my-domain,dc=com): unable to join the environment* *bdb_db_open: database "dc=my-domain,dc=com" cannot be opened, err -30974. Restore from backup!* ====> bdb_cache_release_all bdb(dc=my-domain,dc=com): txn_checkpoint interface requires an environment configured for the transaction subsystem bdb_db_close: database "dc=my-domain,dc=com": txn_checkpoint failed: Invalid argument (22). backend_startup_one (type=bdb, suffix="dc=my-domain,dc=com"): bi_db_open failed! (-30974) slapd shutdown: initiated ====> bdb_cache_release_all bdb_db_close: database "dc=my-domain,dc=com": alock_close failed slapd destroy: freeing system resources. slapd stopped. Regards, Swapnesh

2 1

FW: Partial LDAP replication with syncrepl
by Patrick Krauer 15 Mar '12

15 Mar '12

-----Original message----- To:+openldap+pkrauer+4a901aeb3d.openldap-technical#openldap.org@spamgourmet.com; From:Patrick Krauer <patrick(a)krauer.org> Sent:Thu 15-03-2012 08:05 Subject:Partial LDAP replication with syncrepl Hi all, I'm using OpenLDAP for different purposes (e.g. zarafa, ssh authentication and HTTP authentication). Each Service (zarafa, apache) is running on a different server. SSH for sure runs on every server. For stability reasons, I replicate my LDAP database to each slave server (zarafa, apache and others). I'm using syncrepl which works fine by know. Now I want to use LDAP for another service (typo3). For this I need to apply another schema. If I do this on the master LDAP server only, all slave servers will claim. If I set schemachecking off in the slave configuration, the LDAP server does not stop, but it does not load entities which use the new objectClass. I tried to select only particular attributes on the slave server (like cn, uid but not objectClass) but that doesn't help. I don't want to apply the new schema to each and every server which doesn't use it at all. How can I solve this issue? What is the common way for such a setup? Best regards, Patrick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 15 Mar '12

15 Mar '12

--On Thursday, March 15, 2012 1:08 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Quanah; > > A question about the "entryCSN" attributes, the three zeros (entryCSN:= > 20120308173545.066786Z#000000#000#000000) between the #-marks correspond > to the Server ID, correct? If they do, why are some "000" and others > "001" when I only have one server? Some entries were created before it considered itself a provider. I wouldn't worry about 000 vs 001 at this time. ;) > Thank you for your assistance on getting me over the syncrepl wall. > > I noticed in the 2.4 Admin Guide that configuring the monitor database for > cn=config has not been published yet; and, there isn't a lot online, > period, about it. The manpages are not overly helpful either from > cn=config is concerned. > > I am seeing this: "bdb_monitor_db_open: monitoring disabled; configure > monitor database to enable" > > on both the Provider and Consumer. > > Can you recommend something, relevant to cn=config monitor setup? Add the monitor DB to your cn=config, and add any acl you want applied to it. That's all there is to it. For example, mine is: dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admins,cn=zimbra " read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: FALSE --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

WINDOWS AD CLIENTS & LINUX LDAP CLIENTS UNABLE TO OPEN X-WINDOWS EMULATORS
by Borresen, John - 0442 - MITLL 15 Mar '12

15 Mar '12

All, Sorry for the long subject line. 1) We are migrating away from NIS to LDAP for our Linux/Unix clients and servers. 2) All our Windows clients authenticate with the main Active Directory server. Now the issue: Many of our end-users utilize various X-Windows Emulators (Exceed, XWin32, Xming, etc) to open a connection to a Linux server. When we used NIS, the End-users had no problem opening a X-Win session to a server. Now under LDAP, the users get authenticated properly but the X-Win session gets blocked and never opens. In the messages file, and secure file, you can see the users getting authenticated and granted access but the X-win session never opens on the client machine. Has anyone else seen this issue? Thanks, Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory 244 Wood Street Lexington, MA 02420 john.borresen(a)ll.mit.edu

1 0

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 15 Mar '12

15 Mar '12

--On Wednesday, March 14, 2012 4:25 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Saw a post of yours from a while back, so I backed up the consumer's dbase > and moved the directory out of the way, then ran slapadd and brought slapd > up on the consumer. Yes, when you go to reload a server, you must delete the existing DB. > Things look more in-sync with each other than they did. > > Question: I noticed that there are seven "reqStart" entries in the > cn=accesslog on the Provider machine. They were there when I was testing > and beating my head against the wall. Should they be deleted manually > since I used slapcat/slapadd? Or does it matter? It doesn't matter. The point of syncrepl is it is intelligent enough to ignore data it's already replicated. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Scaling LDAP
by Gaurav Gugnani 15 Mar '12

15 Mar '12

Hi All, First of all thks for helping me out with the issues on openLDAP. Well today, my query is pretty generic and lot many people working on LDAP would face such an issues. We are using openldap 2.4.26 with BDB as backend. We've installed the setup on linux machine of 64 bit with 4GB ram. Now, currently we have some 10K records in it and its working perfectly fine. Our systems is running under replication - syncrepl. However, in near future we can foresee some million of records to turn up. So, Can any one please advise - What are the different Scaling options available with LDAP? I need to do some research and test our cases. Please suggest. Thanks and Regards, Gaurav Gugnani

3 3

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 14 Mar '12

14 Mar '12

--On Wednesday, March 14, 2012 2:44 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Quanah; Pesonally, I use a specific replicator ID for replication that has full read to all data on the master, and make that the first ACL. Then I don't have to worry whether or not the other ACLs interfere. At this point, if you haven't, I'd wipe out the replicas DB and make it do a fresh sync, so you can confirm it is working properly, OR slapcat the master, and use the appropriate flags to slapadd to reload it, and then ensure the replica keeps up to date. If you're using the replica as-is, where you've had an invalid configuration for days, I fully expect the data on the replica to be in an odd state. Make sure nothing is using the replica if you choose to reload it in either method. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 14 Mar '12

14 Mar '12

--On Tuesday, March 13, 2012 3:38 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Maybe it's just that it is near the end of the day...but, first here is my > ldif to add the provider to my cn=accesslog: Look at the example LDIF I provided you. Clearly your base DN of the entry you are trying to add is invalid. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical