openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Re: alias entries across database bounds, allowed if DBs are "subordinate"?
by Judd Maltin 24 Feb '12

24 Feb '12

On Fri, Feb 24, 2012 at 11:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 23, 2012 5:04 PM -0800 Howard Chu <hyc(a)symas.com> > wrote: > >> Judd Maltin wrote: >>> >>> Hey folks, >>> >>> On the same slapd server, I have two databases with different suffixes. >>> >>> I'd like to create an alias entry in one database and suffix to return >>> an entry from the other database and suffix. >>> >>> Would this be possible if the second database were subordinate to the >>> other? Or, because it does not share namingContext by being in the >>> same suffix, would it fail? >>> >>> Otherwise I'm going to setup another slapd and use back-ldap/meta to >>> proxy what I need. >> >> >> No, aliases cannot cross DB boundaries, regardless of subordinate. > > > Any reason why you don't make it all a single DB? > > --Quanah > Thanks for the responses, guys. I inherited the existing and will be replacing with one DB. I'm now slapcatting the DBs and loading into a single DB as POC. -judd -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

1 0

OpenLDAP training Europe
by Pieter Baele 24 Feb '12

24 Feb '12

Any recommendations for OpenLDAP traing going further then the basics? location: Belgium, France, Germany or UK Sincerely, PieterB

2 1

alias entries across database bounds, allowed if DBs are "subordinate"?
by Judd Maltin 24 Feb '12

24 Feb '12

Hey folks, On the same slapd server, I have two databases with different suffixes. I'd like to create an alias entry in one database and suffix to return an entry from the other database and suffix. Would this be possible if the second database were subordinate to the other? Or, because it does not share namingContext by being in the same suffix, would it fail? Otherwise I'm going to setup another slapd and use back-ldap/meta to proxy what I need. Thanks! -judd -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

3 2

bdb to hdb conversion
by btb＠bitrate.net 24 Feb '12

24 Feb '12

i've just converted an existing database/directory from bdb to hdb. it appears to have worked, and all seems to be in order, but is there something i can do to demonstrate empirically that it is in fact hdb now?

2 2

Re: Howto implement RBAC with OU's and posixGroups
by Fred van Zwieten 23 Feb '12

23 Feb '12

What I mean with "this" in "in AD this is possible" is the fact that you can assign group membership to OU membership (When user A is member of OU B, user A will become member of group C". Afaik this is not possible with OpenLDAP. If it is, I would really like to know how. My only bet is with dynamic groups/list, but I have no idea how. Fred 2012/2/23 Buchan Milne <bgmilne(a)staff.telkomsa.net> > On Wednesday, 22 February 2012 11:22:55 Fred van Zwieten wrote: > > Hi all, > > > > warning: openldap newbie.. > > > > is it possible to have a person put into an OU and, because of this, will > > become member of some group in such a way that this group shows up in > linux > > using "id". This to implement some form of RBAC. I found GroupofMembers, > > but that has nothing to do with OU's. Also, it seems posixGroup and > > groupOfMembers objecttypes are no longer allowed together because the are > > both STRUCTURAL. > > Not in nis.schema, but in rfc2307bis.schema, posixGroup is not structural. > > > In AD this is possible. > > It is possible in OpenLDAP too. Just now with nis.schema. Most LDAP clients > support rfc2307bis. > > Regards, > Buchan >

2 1

2.4.29 memberof: entry_encode: Assertion `i == a->a_numvals' failed.
by Colin Hudler 23 Feb '12

23 Feb '12

Greetings, Haven't used OpenLDAP since 2.1; I see it has come a long way. I have a few hundred static groups and am using the memberOf overlay. There's a hundred thousand or so people entries and thousands of memberships. The overlay is configured thusly: # {0}memberof, {1}bdb, config dn: olcOverlay={0}memberof,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: drop olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniqueMember olcMemberOfMemberOfAD: isMemberOf (I know a number of these attributes are not strictly correct -- a legacy encumbrance) When the replica starts a total update, it goes well for a while, then stops right here every time: 4f450e2d syncrepl_entry: rid=004 be_search (0) 4f450e2d syncrepl_entry: rid=004 cn=uc:org:nsit:integration:techag,ou=groups,dc=uchicago,dc=edu 4f450e2d conn=-1 op=0: memberof_op_add("cn=uc:org:nsit:integration:techag,ou=groups,dc=uchicago,dc=edu"): member="uid=chudler,ou=people,dc=uchicago,dc=edu" does not exist (stripping...) slapd: entry.c:773: entry_encode: Assertion `i == a->a_numvals' failed. The member ("uid=chudler") does exist in the master, I can find it with ldapsearch. I believe it does not yet exist in the replica. I'd like for total replication to succeed without doing an initial slapcat. Has anyone encountered this before? I am happy to debug if you need more information. Version 2.4.29, also using the refint overlay if that matters.

1 1

Re: daemon: bind(6) failed errno=98 (Address,already in use)
by Marc Patermann 23 Feb '12

23 Feb '12

stefano, stefano schrieb (23.02.2012 10:40 Uhr): > STATE "B" slapd is stopped run "/etc/init.d/slapd start"--->it works > checking pid "pgrep slaps"--->2237 stopping slapd "/etc/init.d/slapd > stop"---> slapd is stopped pgrep slapd--->2237 -the process is still > active- starting slapd "/etc/init.d/slapd start" ---> failed > > why stopping slapd "/etc/init.d/slapd stop" doesn't free the PID? This is out of scope of this mailing list. Check with your distribution "support". Marc

2 1

LDAP guide, manuals
by stefano 22 Feb '12

22 Feb '12

Hi, am searching documentation, guide, manuals, about Ldap. on line there are many and differents things. where can i find a guide complete and reliable about ldap on linux to understand everything? thank you

10 9

daemon: bind(6) failed errno=98 (Address,already in use)
by stefano 22 Feb '12

22 Feb '12

Hi folks, i don't understand a little problem with mi ldap server I installed and configuring my ldap server. after configuring slapd.conf, restarting the server was ok. then i prepared the client with ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. URI ldap://localhost BASE dc=amahoro,dc=bi BINDDN cn=Administrator,dc=amahoro,dc=bi #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never and tryed to test the server: ldapsearch -x -W -D 'cn=Administrator,dc=amahoro,dc=bi' -b "" -s base and it asks me Enter LDAP Password. i wrote the password asked me during the ldap installation without success. i tried to change it with ldappasswd it asked me the password, i wrote the same password but the answer is ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database. i tryied to comment everything in ldap.conf and restart the ldap server but is failed. checking in syslog the error is daemon: bind(6) failed errno=98 (Address,already in use) do you have any idea about the resolution of this problem? thank you

3 2

Join my network on LinkedIn
by Nathaniel Simch de Morais via LinkedIn 22 Feb '12

22 Feb '12

LinkedIn ------------ Nathaniel Simch de Morais requested to add you as a connection on LinkedIn: ------------------------------------------ I'd like to add you to my professional network on LinkedIn. Accept invitation from Nathaniel Simch de Morais http://www.linkedin.com/e/-48cabe-gyyo5kj5-2j/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Nathaniel Simch de Morais http://www.linkedin.com/e/-48cabe-gyyo5kj5-2j/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ Why might connecting with Nathaniel Simch de Morais be a good idea? Nathaniel Simch de Morais's connections could be useful to you: After accepting Nathaniel Simch de Morais's invitation, check Nathaniel Simch de Morais's connections to see who else you may know and who you might want an introduction to. Building these connections can create opportunities in the future. -- (c) 2012, LinkedIn Corporation

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical