openldap-technical

openldap-technical@openldap.org

22 participants
9803 discussions

replication without making the consumer database readonly
by Wuensche Michael 08 Mar '12

08 Mar '12

I have an Openldap 2.4 environment with 2 servers, one serving as provider for 2 databases and one as consumer. On one of the databases I only want to replicate certain entries, filtered by objectclass. I use sync repl for replication. Now I would like to be able to write database entries on the consumer server, which are not covered by the filter and so are not replicated. But Openldap sends me a referral to the master on write attempts if I use the updateref directive. If I don't use this directive, I get error 53: unwilling to perform. Is there a way to have part of a databases entries to be replicated and others being allowed to write locally? Alternatively I'm considering to split the suffix into several databases. Kind regards, Michael

1 0

[SOLVED] RE: OpenLDAP 2.4 : replication doesn't work when customer is stopped
by PROST Frédéric 08 Mar '12

08 Mar '12

After so many days of testing I finally found the solution, which is working on both the last version built from source and the Debian version : I found it thanks to this post : http://www.openldap.org/lists/openldap-technical/201008/msg00274.html When we check the csn value it appears that ServerID is not transmitted : csn=20120308091919.539118Z#000000#000#000000 (the string #000# should be serverID) . To correct this problem, I simply changed the slapd -h option in my startup script (/etc/default/slapd on Debian) from : SLAPD_SERVICES="ldap:/// ldapi:///" To : SLAPD_SERVICES="ldap://<ip or hostname of the server (same as oclServerID)>" This has to be done on both nodes with the correct IP. Then, my csn is now someting like : csn=20120308111043.060040Z#000000#001#000000 (note the #001# corresponding to the serverId) Then retart the server and everything is runnig fine. Regards, -- Frédéric PROST -----Message d'origine----- De : Quanah Gibson-Mount [mailto:quanah@zimbra.com] Envoyé : mercredi 7 mars 2012 18:02 À : PROST Frédéric; openldap-technical(a)openldap.org Objet : RE: OpenLDAP 2.4 : replication doesn't work when customer is stopped --On Wednesday, March 07, 2012 8:06 AM +0100 PROST Frédéric <f.prost(a)mb-line.com> wrote: > Hello, > > My OpenLDAP version is 2.4.23 (installed with apt-get install slapd on > Debian Squeeze). Using 2.4.23 from Debian is a bad decision, for numerous reasons, which have been discussed multiple times on the list. Please see: <http://www.openldap.org/faq/data/cache/1456.html> for just a beginning of the reasons as to why this is a bad idea. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Migration of Openldap server from Solaris 8 to 10
by jay.chouhan＠indiatimes.com 08 Mar '12

08 Mar '12

Dear Admin, We are running Openldap server on Solaris 9 (Kernel version: SunOS 5.9 Generic 122300-30 Jul 2008) Could you please guide me how to migrate Openldap server from Solais9 to Solaris10, We are planning to upgrade OS from Solaris 9 to Solaris 10 by re-installing the OS.. Appreciate your kind reply on this. thanks Kind regards, Jay

2 1

Help tweaking settings so slapd is not writing to disk so much
by Marc Roos 07 Mar '12

07 Mar '12

Hi I am running on a vm dovecot and sendmail with authentication through pam agains ldap. I have got strange spikes in the load and I think slapd is writing to much to disk. I want to reduce disk io. Anybody an idea why slapd is so often writing to disk instead of reading? The slapd process keeps writing to disk although it is setup as a 'consumer' and it does not receive any new data. There are only 2200 records and olcDbDNcacheSize and olcDbIDLcacheSize are both set to 3000. Thanks in advance for suggestions. Total DISK READ: 0.00 B/s | Total DISK WRITE: 0.00 B/s TID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 10297 be/4 ldap 0.00 B/s 42.66 K/s 0.00 % 0.00 % slapd -h ldap:///~/ ldapi:/// -u ldap 10298 be/4 ldap 0.00 B/s 11.64 K/s 0.00 % 0.00 % slapd -h ldap:///~/ ldapi:/// -u ldap 10299 be/4 ldap 0.00 B/s 11.64 K/s 0.00 % 0.00 % slapd -h ldap:///~/ ldapi:/// -u ldap 1 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % init 2 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [kthreadd] 3 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/0] 4 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/0] 5 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/0] 6 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [watchdog/0] 7 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/1] 8 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/1]

5 6

syncrepl consumer retry and sync questions
by Nick Milas 06 Mar '12

06 Mar '12

Hi, Concluding from the documentation (I think it's not clear on this), retry="60 +" should mean that the consumer retries indefinitely every 60 seconds. However, I am observing that consumers with the config: syncrepl rid=111 provider=ldaps://ldap.example.com tls_reqcert=never type=refreshAndPersist retry="60 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials="secret" retry the first time after 60 seconds, then retry again after 2 hours: (Note: Consumers lose connection to the provider at 18:47:59 as the provider is stopped for a few minutes to become upgraded to 2.4.pre30.) Feb 25 18:47:59 consumer111 slapd[2482]: do_syncrep2: rid=111 (-1) Can't contact LDAP server Feb 25 18:47:59 consumer111 slapd[2482]: do_syncrepl: rid=111 rc -1 retrying Feb 25 18:48:59 consumer111 slapd[2482]: do_syncrep2: rid=111 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 20:48:59 consumer111 slapd[2482]: do_syncrep2: rid=111 (-1) Can't contact LDAP server Feb 25 20:48:59 consumer111 slapd[2482]: do_syncrepl: rid=111 rc -1 retrying Feb 25 20:48:59 consumer111 slapd[2482]: connection_read(35): no connection! Feb 25 20:48:59 consumer111 slapd[2482]: connection_read(35): no connection! Feb 25 20:49:59 consumer111 slapd[2482]: syncrepl_entry: rid=111 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) ...sync continues... Note that there were a bunch of edits on the provider between 19:47 and 19:55 but they were not propagated to this consumer, until 20:49. About my other two consumers (which have identical configuration, but they bind with a non-root user), on which I wrote on my earlier email: It seems they were also in some kind of delay (for two hours too??), but I didn't wait and restarted slapd: The first: Feb 25 18:47:59 consumer222 slapd2.4[2140]: do_syncrep2: rid=222 (-1) Can't contact LDAP server Feb 25 18:47:59 consumer222 slapd2.4[2140]: do_syncrepl: rid=222 rc -1 retrying Feb 25 18:48:59 consumer222 slapd2.4[2140]: do_syncrep2: rid=222 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 20:18:04 consumer222 slapd2.4[2141]: slapd starting Feb 25 20:18:04 consumer222 slapd2.4[2141]: syncrepl_entry: rid=222 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) ...sync continues... and the second: This one was stopped and upgraded to 2.4.30b3 (as I named it - it was pre-30): At 18:54:45 (and later at 19:29) it was started after upgrade, then, as it was not syncing, it was restarted at 20:02:55 and it synced. Feb 25 18:47:59 consumer333 slapd[2357]: do_syncrep2: rid=333 (-1) Can't contact LDAP server Feb 25 18:47:59 consumer333 slapd[2357]: do_syncrepl: rid=333 rc -1 retrying Feb 25 18:48:59 consumer333 slapd[2357]: do_syncrep2: rid=333 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 18:52:39 consumer333 slapd[2357]: daemon: shutdown requested and initiated. Feb 25 18:52:39 consumer333 slapd[2357]: slapd shutdown: waiting for 1 operations/tasks to finish Feb 25 18:52:40 consumer333 slapd[2357]: slapd stopped. Feb 25 18:52:40 consumer333 slapd[23371]: [OK] OpenLDAP stopped after 1 seconds Feb 25 18:52:40 consumer333 slapd[23372]: [INFO] no data backup done Feb 25 18:52:40 consumer333 slapd[23373]: [INFO] Halting OpenLDAP replication... Feb 25 18:52:40 consumer333 slapd[23374]: [INFO] no replica found in configuration, aborting stopping slurpd Feb 25 18:54:27 consumer333 slapd[23425]: [INFO] Using /etc/default/slapd for configuration Feb 25 18:54:27 consumer333 slapd[23430]: [INFO] Halting OpenLDAP... Feb 25 18:54:27 consumer333 slapd[23431]: [INFO] can't read PID file, to stop slapd try: /etc/init.d/slapd forcestop Feb 25 18:54:27 consumer333 slapd[23432]: [INFO] Halting OpenLDAP replication... Feb 25 18:54:27 consumer333 slapd[23433]: [INFO] no replica found in configuration, aborting stopping slurpd Feb 25 18:54:44 consumer333 slapd[23458]: [INFO] Using /etc/default/slapd for configuration Feb 25 18:54:44 consumer333 slapd[23463]: [INFO] Launching OpenLDAP configuration test... Feb 25 18:54:45 consumer333 slapd[23486]: [OK] OpenLDAP configuration test successful Feb 25 18:54:45 consumer333 slapd[23496]: [INFO] No db_recover done Feb 25 18:54:45 consumer333 slapd[23497]: [INFO] Launching OpenLDAP... Feb 25 18:54:45 consumer333 slapd[23498]: [OK] File descriptor limit set to 1024 Feb 25 18:54:45 consumer333 slapd[23499]: @(#) $OpenLDAP: slapd 2.4.X (Feb 25 2012 18:38:31) $ swbuilder@vdev.example.com:/home/swbuilder/rpmbuild/BUILD/openldap-2.4.30b3/servers/slapd Feb 25 18:54:45 consumer333 slapd[23500]: slapd starting Feb 25 18:54:45 consumer333 slapd[23500]: do_syncrep2: rid=333 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 18:54:46 consumer333 slapd[23505]: [OK] OpenLDAP started Feb 25 19:29:14 consumer333 slapd[2318]: [INFO] Using /etc/default/slapd for configuration Feb 25 19:29:14 consumer333 slapd[2323]: [INFO] Launching OpenLDAP configuration test... Feb 25 19:29:15 consumer333 slapd[2346]: [OK] OpenLDAP configuration test successful Feb 25 19:29:15 consumer333 slapd[2356]: [INFO] No db_recover done Feb 25 19:29:15 consumer333 slapd[2357]: [INFO] Launching OpenLDAP... Feb 25 19:29:15 consumer333 slapd[2358]: [OK] File descriptor limit set to 1024 Feb 25 19:29:15 consumer333 slapd[2359]: @(#) $OpenLDAP: slapd 2.4.X (Feb 25 2012 18:38:31) $ swbuilder@vdev.example.com:/home/swbuilder/rpmbuild/BUILD/openldap-2.4.30b3/servers/slapd Feb 25 19:29:15 consumer333 slapd[2360]: slapd starting Feb 25 19:29:15 consumer333 slapd[2360]: do_syncrep2: rid=333 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 19:29:16 consumer333 slapd[2365]: [OK] OpenLDAP started Feb 25 20:02:42 consumer333 slapd[2943]: [INFO] Using /etc/default/slapd for configuration Feb 25 20:02:42 consumer333 slapd[2948]: [INFO] Halting OpenLDAP... Feb 25 20:02:42 consumer333 slapd[2360]: daemon: shutdown requested and initiated. Feb 25 20:02:42 consumer333 slapd[2360]: slapd shutdown: waiting for 1 operations/tasks to finish Feb 25 20:02:42 consumer333 slapd[2360]: slapd stopped. Feb 25 20:02:43 consumer333 slapd[2952]: [OK] OpenLDAP stopped after 1 seconds Feb 25 20:02:43 consumer333 slapd[2953]: [INFO] No data backup done Feb 25 20:02:55 consumer333 slapd[2983]: [INFO] Using /etc/default/slapd for configuration Feb 25 20:02:55 consumer333 slapd[2988]: [INFO] Launching OpenLDAP configuration test... Feb 25 20:02:55 consumer333 slapd[3011]: [OK] OpenLDAP configuration test successful Feb 25 20:02:55 consumer333 slapd[3021]: [INFO] No db_recover done Feb 25 20:02:55 consumer333 slapd[3022]: [INFO] Launching OpenLDAP... Feb 25 20:02:55 consumer333 slapd[3023]: [OK] File descriptor limit set to 1024 Feb 25 20:02:55 consumer333 slapd[3024]: @(#) $OpenLDAP: slapd 2.4.X (Feb 25 2012 18:38:31) $ swbuilder@vdev.example.com:/home/swbuilder/rpmbuild/BUILD/openldap-2.4.30b3/servers/slapd Feb 25 20:02:55 consumer333 slapd[3025]: slapd starting Feb 25 20:02:55 consumer333 slapd[3025]: syncrepl_message_to_entry: rid=333 DN: dc=bridge-o.admin,dc=example.com,ou=dns1,dc=example,dc=com, UUID: a483715a-56bd-102f-9a9d-87b8bcc59e1e Feb 25 20:02:55 consumer333 slapd[3025]: syncrepl_entry: rid=333 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) ...sync continues... Questions: 1. What does the message "connection_read(35): no connection!" signify? (On this consumer -only- I also get occasional messages, like the following: Feb 27 22:25:56 consumer111 slapd[2939]: connection_input: conn=1001 deferring operation: binding ) 2. Why there was a stop in retrying for two hours on the running consumers (111, 222)? 3. Why the upgraded consumer (333) did not sync? It was started after the provider and it was running when the changes were made on the provider. Thanks, Nick

2 2

Re: Re: delta-syncrepl and mirrormode problem (2.4.29 and 2.4.30)
by frank.offermanns＠caseris.de 06 Mar '12

06 Mar '12

I tested with 2.4.30 and still have the same problems. Frank -- Von: Frank Offermanns/CAE An: openldap-technical(a)openldap.org Datum: 17.02.2012 11:35 Betreff: Re: delta-syncrepl and mirrormode problem (2.4.29) I wanted to add, that one database is empty when I start and the other has only some data. But with master/slave this is no problem, so I think it should also work for master/master, doesn't it? I retried with a patched version with these patches: < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=patch;h=8e7af6331… > < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=d4b3… > < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=eace… > Unfortunately the problem still persists. Could at least anyone confirm that the configuration is correct? Then I can at last stop searching for a error I possibly did and accept that OpenLDAP with Master/Master (delta-syncrepl) for Windows simply does not work. Best regards, Frank -- openldap-technical-bounces(a)OpenLDAP.org schrieb am 13.02.2012 11:53:16: > Von: frank.offermanns(a)caseris.de > An: openldap-technical(a)openldap.org > Datum: 13.02.2012 12:07 > Betreff: delta-syncrepl and mirrormode problem (2.4.29) > Gesendet von: openldap-technical-bounces(a)OpenLDAP.org > > Hi, > > I want to use delta-syncrepl replication with 2 masters. > But each slapd-process permanently needs about 25 % CPU usage without any > traffic on it. > > The log looks endless like this: > > ** ld 01e43698 Outstanding Requests: > * msgid 55, origid 55, status InProgress > outstanding referrals 0, parent count 0 > ld 01e43698 request count 1 (abandoned 18) > ** ld 01e43698 Response Queue: > Empty > ld 01e43698 response count 0 > ldap_chkResponseList ld 01e43698 msgid 55 all 0 > ldap_chkResponseList returns ld 01e43698 NULL > ldap_int_select > read1msg: ld 01e43698 msgid 55 all 0 > ber_get_next > ber_get_next: tag 0x30 len 1187 contents: > abandoned/discarded ld 01e43698 msgid 53 message type search-entry > wait4msg continue ld 01e43698 msgid 55 all 0 > ** ld 01e43698 Connections: > * host: secondmaster.mydomain.local port: 389 (default) > refcnt: 2 status: Connected > last used: Mon Feb 13 11:26:53 2012 > > > ** ld 01e43698 Outstanding Requests: > * msgid 55, origid 55, status InProgress > outstanding referrals 0, parent count 0 > ld 01e43698 request count 1 (abandoned 18) > ** ld 01e43698 Response Queue: > Empty > ld 01e43698 response count 0 > ldap_chkResponseList ld 01e43698 msgid 55 all 0 > ldap_chkResponseList returns ld 01e43698 NULL > ldap_int_select > read1msg: ld 01e43698 msgid 55 all 0 > ber_get_next > ber_get_next: tag 0x30 len 1187 contents: > abandoned/discarded ld 01e43698 msgid 53 message type search-entry > wait4msg continue ld 01e43698 msgid 55 all 0 > ** ld 01e43698 Connections: > * host: secondmaster.mydomain.local port: 389 (default) > refcnt: 2 status: Connected > last used: Mon Feb 13 11:26:53 2012 > > > here is my configuration (completely the same for both masters): > ----------------------------------------------------------------------------------------------------- > ucdata-path ./ucdata > include ./schema/core.schema > include ./schema/cosine.schema > include ./schema/Personcaesar.schema > include ./schema/ConfigObjects.schema > > loglevel 0 > logfile "C:/test/slapd.log" > > pidfile ./run/slapd.pid > argsfile ./run/slapd.args > > access to * by dn.one="ou=Admins,o=caesar" write > by anonymous auth > > ServerID 1 "ldap://firstmaster.mydomain.local" > ServerID 2 "ldap://secondmaster.mydomain.local" > > ###################################################################### > database config > rootdn cn=config > rootpw {SHA}secret > > ####################################################################### > # BDB database definitions > ####################################################################### > # Accesslog database definitions > database hdb > suffix cn=accesslog > checkpoint 1024 5 > cachesize 10000 > directory "C:/test/accessdata" > dbconfig set_cachesize 0 30000000 1 > dbconfig set_flags DB_LOG_AUTOREMOVE > dbconfig set_lg_regionmax 1048576 > dbconfig set_lg_max 10485760 > dbconfig set_lg_bsize 2097152 > rootdn cn=accesslog > index objectClass,entryCSN,entryUUID eq > # I even tried removing reqMod, reading your docs I am not sure if this is > needed here > index reqEnd,reqResult,reqMod,reqStart eq > > overlay syncprov > syncprov-nopresent TRUE > syncprov-reloadhint TRUE > # Let the replica DN have limitless searches > limits dn.exact="cn=Replicator,ou=admins,o=caesar" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > > # Primary database definitions > database hdb > suffix "o=caesar" > checkpoint 1024 5 > cachesize 10000 > idlcachesize 30000 > rootdn "cn=Administrator,o=caesar" > rootpw {SHA}secret > directory "C:/test/data" > dbconfig set_cachesize 0 100000000 1 > dbconfig set_flags DB_LOG_AUTOREMOVE > dbconfig set_lg_regionmax 1048576 > dbconfig set_lg_max 10485760 > dbconfig set_lg_bsize 2097152 > > > # syncprov specific indexing > index sn pres,eq > index cn pres,eq,sub > ... > index entryUUID eq > index entryCSN eq > index objectClass eq > > # syncrepl Provider for primary db > overlay syncprov > syncprov-checkpoint 1000 60 > syncprov-sessionlog 10000 > > # accesslog overlay definitions for primary db > overlay accesslog > logdb cn=accesslog > logops writes > logsuccess TRUE > # scan the accesslog DB every day, and purge entries older than 7 days > logpurge 07+00:00 01+00:00 > > sizelimit size.soft=100 size.hard=1000 size.prtotal=unlimited > # Let the replica DN have limitless searches > limits dn.exact="cn=Replicator,ou=admins,o=caesar" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > > syncrepl rid=001 > provider="ldap://firstmaster.mydomain.local" > searchbase="o=caesar" > type=refreshAndPersist > retry="5 3 15 +" > binddn="cn=Replicator,ou=admins,o=caesar" > bindmethod=simple > credentials="secret" > logbase="cn=accesslog" > logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" > schemachecking=on > syncdata=accesslog > > > syncrepl rid=002 > provider="ldap://secondmaster.mydomain.local" > searchbase="o=caesar" > type=refreshAndPersist > retry="5 3 15 +" > binddn="cn=Replicator,ou=admins,o=caesar" > bindmethod=simple > credentials="secret" > logbase="cn=accesslog" > logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" > schemachecking=on > syncdata=accesslog > > > MirrorMode On > ----------------------------------------------------------------------------------------------------- > > I did my test on 2 Windows PCs and OpenLDAP 2.4.29 with Berkeley 5.1 . > > > > Thanks for any hints, > FO >

3 6

<what> in ACL defined by set?
by Michael Ströder 05 Mar '12

05 Mar '12

HI! Is it possible to specify the <what> clause in an ACL with a set? We have several applications and for each application there's a specific AUXILIARY object class for application-specific user attributes. So for each application I add ACLs like this: access to dn.onelevel="ou=Users,dc=example,dc=org" attrs=@app1User by dn.subtree="cn=app1,ou=Systems,dc=example,dc=org" read by * break Obviously I'd like to have one ACL which references an attribute specifying the auxiliary object class in the app's system entry. Is that possible? Ciao, Michael.

2 3

production best-practices for cn=monitor
by Aaron Bennett 05 Mar '12

05 Mar '12

Hi, I'm curious what people think about best practices for cn=monitor in production environments. Do people generally keep it enabled? Is there a drawback to keeping it enabled? Are there any specific security or performance concerns? Best, Aaron Bennett

2 1

syncrepl simple bind
by S.A. 05 Mar '12

05 Mar '12

Hello, For syncrepl to work do we need to enable the sasl? I had the sasl disabled and configured to replicate using simple bindmethod, with the following config: syncrepl rid=001 provider=ldap://ldap2.example.com type=refreshAndPersist retry="5 5 300 +" searchbase="o=tld" bindmethod=simple binddn="uid=admin,ou=users,o=tld" credentials=password schemachecking=on but I get the following error: slap_client_connect: URI=ldap://ldap2.example.com DN="uid=admin,ou=users,o=tld" ldap_sasl_bind_s failed (-1) However, I can bind and search entries both in cn=config and o=tld from command line using the above binddn and credentials. Thanks

2 3

LDAP_OPT_X_TLS_xxx option in SSL/TLS connection
by Qiang Xu 05 Mar '12

05 Mar '12

Hello All, Today I came across a strange problem. I wrote a program to test ldap ssl/tls connection with OpenLDAP library. Something like the code snippet as follows: int ret = LDAP_OPT_SUCCESS; int cert_flag = LDAP_OPT_X_TLS_NEVER; ... ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server cert_flag = LDAP_OPT_X_TLS_DEMAND; ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server The first binding is successful, as expected. However, the second binding is also successful, which is contrary to my expectation, because I didn't create any cert file yet. Another observation here is that if the first binding with LDAP_OPT_X_TLS_NEVER is removed, and the second binding with LDAP_OPT_X_TLS_DEMAND set is done right from the beginning, then it will fail, as expected. So, it seems the first value set to the option LDAP_OPT_X_TLS_REQUIRE_CERT will override the later values, isn't it? Is it possible to change this option's value on the fly (means different bindings use different values for this cert option)? Thanks, Qiang

4 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical