openldap-technical

openldap-technical@openldap.org

9951 discussions

Start a nNew thread

acl filter problem
by Dorit 08 May '12

08 May '12

2 4

Memory consumption when increasing BDB_IDL_LOGN
by Meike Stone 07 May '12

07 May '12

Hello, how does the memory usage increase if I increase the BDB_IDL_LOGN? I tried to discover and understand this by searching in the mailing list (Is there is a good guide to understand all of this?). After a search, each returned up ID from bdb is located in one slot in the IDL list. On a x86_64 system, each slot is 8Byte. Each search stack in each thread (threads in slapd.conf) gets his own IDL slots. The default value for the threads are 16. With 16 bit BDB_IDL_LOGN (default) on x86_64 with default threads, we need 64k*8*16 = 1024KB memory? If I increase the BDB_IDL_LOGN to 20 we need 512k*8*16 = 8MB? 1) Are my assumptions above correct? 2) How do I increase LDAP_PVT_THREAD_STACK_SIZE? In my tests I used "4 * 1024 * 1024 * sizeof(void *)" and all tests where running well. 3) Are there other variables to increase before compiling? 4) Here we talk about 8MB memory, did I miss something, that is not the problem today or are there other things I did not catch (other caches in memory e.g. cachesize, dncachesize, idlcachesize or shared memory ...)? 5) What is the amount overall I have to expect for memory consumption? I understand, that after adding and deleting entires, the IDs "sparse out" for one index and we loose precision (if we have after search more IDs than BDB_IDL_LOGN), because using ranges. This Problem will increase as older the database becomes. But if I increase the BDB_IDL_LOGN to my needed size (max expected returned IDs from during search a indexed attibute), the problem with "getting older" is not important for me? Thanks a lot, Meike

2 2

Cached user info?
by Braden McDaniel 07 May '12

07 May '12

I found it necessary to change the GID of a POSIX group defined in LDAP. But when I log in with a user that is a member of this group, I find that the user's group membership still reflects the old GID. At this point, I've tried removing the user from the group, and adding it back--it still comes up with the old GID when logged in (or, specifically, typing "groups" at the command prompt lists a group associated with the old GID), even though I can't see *anything* referencing the old GID in the LDAP database. I am stumped. Anyone have ideas about what might be going on here? -- Braden McDaniel <braden(a)endoframe.com>

4 8

HowTo index generalizedTimeOrderingMatch
by Meike Stone 07 May '12

07 May '12

Hello, I have in my own schema an attribute defined: attributetype (1.3.6.1.4.... NAME ('InsertTime') EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) Now I can use this and search, but it takes very long. So I want index it for searching: * greater (">=") * less ("<=") Is it possible and how can I do this? I have only seen "eq" and "pres". Thanks in advance Meike

3 3

open ldap gruop syncing
by dhanushka ranasinghe 06 May '12

06 May '12

hi guys ,,, i have a master LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=staff,dc=example,dc=com uid=user2,ou=staff,dc=example,dc=com and i want to sync this users to slave ldap server. under OU=staff , in my slave config file i used the following configuration , syncrepl rid=004 provider=ldap://masterldapserver bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="passWord" searchbase="cn=internal,ou=group,dc=example,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" sync seems to be working fine but users appers as [1] but not under OU=staff, [1] dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user1,ou=user,dc=example,dc=com is there any way sort out this issue Thank You Dhanushka

1 0

Can't login with ldap user
by zingalo 04 May '12

04 May '12

Hi, trying to login from my laptop ubuntu 11.10 using ldap user zingalo, appears a black screen and it comes back to login screen. Could you take a look of this paste of syslog please and tell me what do i have to fix? http://pastebin.com/k0dQq6NN Are many lines! Thanks

2 4

openldap to AD proxy
by Alex Samad - Yieldbroker 03 May '12

03 May '12

Hi I am still struggling with the my openldap to AD proxy connection. I have successfully connected such that I can do search when I bind to openldap with an AD dn, but I want to be able to do anon search and I want anon to map through to a dn I have created in AD which has read only rights. dn: olcDatabase={3}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcSuffix: dc=xyz,dc=com olcDburi: "ldap://ldap. xyz.com " olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no olcDbIDAssertBind: bindmethod=none binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no I have a subordinate db at ou=external, DC= xyz,DC=com I can do a ldapsearch -x -D " CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" -b " DC= xyz,DC=com" -w :) what I can't do is ldapsearch -x -b " DC= xyz,DC=com" I am thinking I want to map anon request through to the readonly DN. But still leave it such that when people bind to openldap as themselves they bind to AD as themselves How would I do that ? Thanks Alex

1 0

SMB+OPENLDAP
by Alejandro Iacobelli 03 May '12

03 May '12

Hello to all, my name is Alejandro and I have a little question to anyone of this list. I´ve created ,6 years ago, an ldap+smb proyect for a big company. Back then, samba (Lenny server) only worked with NT hashes but now (Squeeze server) they want to authenticate with Win7 (ntlm2 protocols) And configurating windows7 to accept old NT hashes is not an exit. I want to update ONLY the smb package from samba (2:3.2.5-4lenny15) to samba (2:3.5.6~dfsg-3squeeze8). My question is this: Can you give me some information about if openldap could crash if only I update the samba module and not the ldap one? i need to know if something could go wrong in the relation with openldap. ( I will not touch openldap because i've modified that version by myself ).

2 1

Re: Slapd Error
by Andy Carlson 03 May '12

03 May '12

Michael, Thanks for your help. We found that it was the audit log that was slightly over 2GB, so I cleaned that up and it is good now. Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu Michael Ströder <michael(a)stroeder.com> wrote: Andy Carlson wrote: > Here are the files [..] And what does ulimit -a say? Ciao, Michael.

1 0

Slapd Error
by Andy Carlson 02 May '12

02 May '12

I am running OpenLDAP 2.4.11 and I am getting an error when I attempt to modify, delete, or add to the directory with a credentialed user (has worked for the past few years perfectly). I did a debug-level report on the server and it's giving me with respect to my modify request, I am getting the following results: bdb_modify: updated id=00013892 dn="mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " send_ldap_result: conn=1057 op=1 p=3 send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX ") => bdb_entry_get: found entry: "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " bdb_entry_get: rc=0 => test_filter PRESENT => access_allowed: search access to "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 syncprov_matchops: sid 000 fscope 1 rc 6 ./slapd-PRODM1: line 227: 26203 File size limit exceeded$SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS slapd-PRODM1[26473]: [ALERT] slapd not running Also, the service script in /etc/init.d is named slapd-PRODM1. The line number given in the second to last line of the error corresponds to the line where the start_slapd function (to start the service) is declared. The function is as follows: start_slapd() { # Check if db_recover is required if [ $RECOVER_AT_STARTUP -eq 1 ] then db_recover else message "info" "[INFO] no db_recover done" fi # Start message message "info" "Launching OpenLDAP..." # File descriptor limit, only for root if [ `id -u` -eq 0 ] then ulimit -n $FD_LIMIT if [ $? -eq 0 ] then message "info" "[OK] file descriptor limit set to $FD_LIMIT" else message "warning" "[WARNING] Fail to set file descriptor limit to $FD_LIMIT, going to next step" fi else message "info" "[INFO] file descriptor limit not modified (require root privileges)" fi # Parameters # if [ "$SLAPD_CONF" ] # then # SLAPD_PARAMS="$SLAPD_PARAMS -f $SLAPD_CONF" # fi # if [ "$SLAPDD_DIR" ] # then # SLAPD_PARAMS="$SLAPD_PARAMS -F $SLAPDD_DIR" # fi SLAPD_PARAMS="$SLAPD_PARAMS $SLAPD_CONF_LOAD" if [ "$SLAPD_USER" -a `id -u` -eq 0 ] then SLAPD_PARAMS="$SLAPD_PARAMS -u $SLAPD_USER" fi if [ "$SLAPD_GROUP" -a `id -u` -eq 0 ] then SLAPD_PARAMS="$SLAPD_PARAMS -g $SLAPD_GROUP" fi # It's time to start slapd $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS sleep 1 # Presence of PID file if [ ! -r $SLAPD_PID_FILE ] then message "alert" "[ALERT] no PID file for slapd" exit 1 fi # Is slapd launched? PID=`cat $SLAPD_PID_FILE` if [ ! -e /proc/$PID ] then message "alert" "[ALERT] slapd not running" exit 1 else message "info" "[OK] OpenLDAP started on port $PORT" fi } It should be noted that this machine has been working without problems for the past year or more, so I can only assume that the "File Size Limit Exceeded" error above relates to one of the Berkley DB files. Is this correct? Let me know if you have any thoughts. Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 4

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical