openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

replication problem after provider crash
by mimo benjamin 13 Feb '12

13 Feb '12

I'm using a single provider and one consumer (Open Ldap 2.4.26 on Windows). The replication seems to work only if the provider is online. E.g. if i unplug the provider from the network, the consumer replication will stop and never retries, although retry and interval parameter are set. Only after I restart the consumer, the replication will be continued. Here are my slapd.conf for provider/consumer: ServerID 1 "ldap://ldapmaster:389" ServerID 2 "ldap://ldapslave:10389" ####################################################################### # bdb database definitions ####################################################################### database bdb suffix "o=userManagement" rootdn "uid=admin,o=userManagement" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw admin rootpw {MD5}ISMvKXpXpadDiUoOSoAfww== # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 password-hash {md5} and for consumer ServerID 1 "ldap://ldapmaster:389" ServerID 2 "ldap://ldapslave:10389" ####################################################################### # bdb database definitions ####################################################################### database bdb suffix "o=userManagement" rootdn "uid=admin,o=userManagement" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw admin rootpw {MD5}ISMvKXpXpadDiUoOSoAfww== # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq syncrepl rid=002 provider=ldap://ldapmaster:389 type=refreshOnly interval=00:00:05:00 searchbase="o=userManagement" attrs="*,+" scope=sub schemachecking=off retry="5 2 1 +" bindmethod=simple binddn="uid=admin,o=userManagement" credentials=admin password-hash {md5} Are my settings bad or did I misunderstood it? My assumption was that this setup should do a replication between provider and consumer in the given interval yielding a r/o replica in the consumer ldap. Thanks for any help, mimo -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0

ldapmodify is crashing the slapd process
by Daniel Savard 11 Feb '12

11 Feb '12

Hi everyone, I am trying to do a number of changes into the configuration database using the following ldif entries: dn: cn=config changetype: modify add: olcTLSCACertificatePath olcTLSCACertificatePath: /etc/ssl/certs - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/openldap/ssl/slapd.cert - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/openldap/ssl/slapd.key - add: olcTLSCipherSuite olcTLSCipherSuite: AES256 - replace: olcTLSVerifyClient olcTLSVerifyClient: allow - When running the ldapmodify command as follow: ldapmodify -f tlsmods.ldir -D cn=config -H ldapi:/// -x -W the slapd process is crashing. I tried to gather some info into the syslog using -s 255 and I cannot find any hints why the process is crashing. I am running OpenLDAP 2.4.24 and here are the entries generated in the syslog after the ldapmodify command: Feb 7 16:00:27 charpak ldapmodify: mdns: Couldn't open nss_mdns configuration file /etc/nss_mdns.conf, using default. Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: slap_listener_activate(9): Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 busy Feb 7 16:00:31 charpak slapd[23821]: >>> slap_listener(ldapi://%2fvar% 2frun%2fopenldap%2fslapd.sock) Feb 7 16:00:31 charpak slapd[23821]: daemon: listen=9, new connection on 15 Feb 7 16:00:31 charpak slapd[23821]: daemon: added 15r (active) listener=(nil) Feb 7 16:00:31 charpak slapd[23821]: conn=1000 fd=15 ACCEPT from PATH=/var/run/openldap/slapd.sock (PATH=/var/run/openldap/slapd.sock) Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: 15r Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: read active on 15 Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: connection_get(15) Feb 7 16:00:31 charpak slapd[23821]: connection_get(15): got connid=1000 Feb 7 16:00:31 charpak slapd[23821]: connection_read(15): checking for input on id=1000 Feb 7 16:00:31 charpak slapd[23821]: op tag 0x60, time 1328648431 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 do_bind Feb 7 16:00:31 charpak slapd[23821]: >>> dnPrettyNormal: <cn=config> Feb 7 16:00:31 charpak slapd[23821]: <<< dnPrettyNormal: <cn=config>, <cn=config> Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 BIND dn="cn=config" method=128 Feb 7 16:00:31 charpak slapd[23821]: do_bind: version=3 dn="cn=config" method=128 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Feb 7 16:00:31 charpak slapd[23821]: do_bind: v3 bind: "cn=config" to "cn=config" Feb 7 16:00:31 charpak slapd[23821]: send_ldap_result: conn=1000 op=0 p=3 Feb 7 16:00:31 charpak slapd[23821]: send_ldap_result: err=0 matched="" text="" Feb 7 16:00:31 charpak slapd[23821]: send_ldap_response: msgid=1 tag=97 err=0 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 RESULT tag=97 err=0 text= Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: 15r Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: read active on 15 Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: connection_get(15) Feb 7 16:00:31 charpak slapd[23821]: connection_get(15): got connid=1000 Feb 7 16:00:31 charpak slapd[23821]: connection_read(15): checking for input on id=1000 Feb 7 16:00:31 charpak slapd[23821]: op tag 0x66, time 1328648431 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 do_modify Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 do_modify: dn (cn=config) Feb 7 16:00:31 charpak slapd[23821]: >>> dnPrettyNormal: <cn=config> Feb 7 16:00:31 charpak slapd[23821]: <<< dnPrettyNormal: <cn=config>, <cn=config> Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 modifications: Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCACertificatePath Feb 7 16:00:31 charpak slapd[23821]: one value, length 14 Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCertificateFile Feb 7 16:00:31 charpak slapd[23821]: one value, length 28 Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCertificateKeyFile Feb 7 16:00:31 charpak slapd[23821]: one value, length 27 Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCipherSuite Feb 7 16:00:31 charpak slapd[23821]: one value, length 6 Feb 7 16:00:31 charpak slapd[23821]: replace: olcTLSVerifyClient Feb 7 16:00:31 charpak slapd[23821]: one value, length 5 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 MOD dn="cn=config" Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 MOD attr=olcTLSCACertificatePath olcTLSCertificateFile olcTLSCertificateKeyFile olcTLSCipherSuite olcTLSVerifyClient Feb 7 16:00:31 charpak slapd[23821]: <= acl_access_allowed: granted to database root Feb 7 16:00:31 charpak slapd[23821]: oc_check_required entry (cn=config), objectClass "olcGlobal" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "objectClass" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "cn" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConfigFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConfigDir" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcArgsFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcAttributeOptions" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcAuthzPolicy" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcAuthzRegexp" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConcurrency" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConnMaxPending" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConnMaxPendingAuth" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcGentleHUP" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIdleTimeout" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrIfMaxLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrIfMinLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrAnyLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrAnyStep" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexIntLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcLocalSSF" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcPidFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcReadOnly" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcReverseLookup" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSaslHost" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSaslSecProps" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcServerID" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSockbufMaxIncoming" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSockbufMaxIncomingAuth" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcThreads" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcToolThreads" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcWriteTimeout" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "structuralObjectClass" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "entryUUID" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "creatorsName" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "createTimestamp" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCACertificatePath" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCertificateFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCertificateKeyFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCipherSuite" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSVerifyClient" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "entryCSN" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "modifiersName" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "modifyTimestamp" Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Any hints? -- Daniel Savard

5 9

howto prepare automatic backups
by deconya 11 Feb '12

11 Feb '12

Hi Im looking how to prepare automatic backups to openldap database. In last mail I comment problem with a crash report, and Im testing how can I do backups and restore it. Only I view slapcat command, but you need to stop the database, and is a critical server and I can't do this stop without create problems to users. There is not any other form? And for other part I would like to understand the content of every folder, because Im with a ubuntu 9.04 server and Im checking what folder I need to control for future restores. Can someone explain the funcition of /var/lib/ldap and /etc/ldap/??? Where is the users data? Thanks

3 3

Loging problem in Ubuntu 11.10 with rsyslog
by rey sebastien 11 Feb '12

11 Feb '12

Hi, I'm using the last release of slapd compiled with --debug option on ubuntu 11.10 :) ./configure --with-tls=openssl --with-threads --with-cyrus-sasl --enable-crypt --enable-debug --enable-cleartext --enable-spasswd --enable-dynacl --enable-aci --enable-modules --enable-wrappers --enable-rewrite --enable-rlookups The ldap is functionnal, i add and modify data without problem, except the logging .. I read tutorial, and documentation, and make some modification to ldap and rsyslog : a > My modification on config : /dn: cn=config replace: olcLogLevel olcLogLevel: Stats dn: cn=config replace: olcLogFile olcLogFile:/var/log/ldap.log/ b > Modification on /etc/rsyslog.d/50-default.conf (syslog.conf doesn't exist anymore on ubuntu ...) I change the last line on this block of rules : /# # First some standard log files. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log #daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log #lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log #user.* -/var/log/user.log local4.* /var/log/ldap.log/ c > /touch /var/log/ldap.log / d > /chown openldap:openldap /var/log/ldap.log/ I restart ( service rsyslog restart) and restart slapd ... But this procedure doesn't work, and syslog continue to catch all debug information :( Do you have and idea to help me ? Best regards, SR

1 0

GnuTLS / OpenSSL certificates compatibilty
by rey sebastien 11 Feb '12

11 Feb '12

Hi, One or two question about certificate compatibility, I have self signed certificate generated by openSSL, and the official package of openldap in Ubuntu is compilated with gnutls library. Do you think this configuration could create error ? If this is the case, and if i want to maintain the easy deb package upgrade system, do you know a repository with deb version of openldap compiled with openssl library ? Thanks for advice, SR

5 5

problem recovering ldap database
by deconya 11 Feb '12

11 Feb '12

Hi Im having a big problem with a database user for ldap and samba users. Without reason the database crashes with the error: Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): file id2entry.bdb has LSN 26/7816674, past end of log at 26/1025642 Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): Commonly caused by moving a database from one database environment Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): to another without clearing the database LSNs, or by removing all of Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): the log files from a database environment Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): /var/lib/ldap/id2entry.bdb: unexpected file type or format Feb 11 09:46:23 earth slapd[5395]: hdb_db_open: database "dc=esci,dc=es": db_open(/var/lib/ldap/id2entry.bdb) failed: Invalid argument (22). Feb 11 09:46:23 earth slapd[5395]: backend_startup_one: bi_db_open failed! (22) Feb 11 09:46:23 earth slapd[5395]: bdb_db_close: database "dc=esci,dc=es": alock_close failed Feb 11 09:46:23 earth slapd[5395]: slapd stopped. And only I have backups from files, but this not works NEVER!!!!!! How it's possible? How I can restore the database? I was looking for internet and only sais to recover from ldif file, How can be possible If I replace the files continues appearing the same error? Any help will be appreciated Best Regards

1 0

Linux Authentication
by Andy Carlson 10 Feb '12

10 Feb '12

I am getting the following error when I attempt to add the account objectclass to an existing LDAP account: invalid structural object class chain (inetOrgPerson/account) I read an explanation of which the cliffnote version was "an person is a person, not an account, so the two objectclasses can't be on the same entry". While that logic makes sense, I have many accounts on a Sun Directory instance that have both objectclasses. I am trying to migrate entries from Sun to an existing OpenLDAP instance, but because of this error I am unable to implement this objectclass. Ultimately, the functionality I am trying to implement is Linux Authentication. I have successfully added posixAccount and shadowAccount objectclasses, but am unable to add account. Any thoughts? Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 2

Migration of old LDAP / old schema to new release of openLDAP and new GOSA schema!
by rey sebastien 10 Feb '12

10 Feb '12

Hi, here the step i begin to make a clean migration between ldap(s) with different version of gosa schema : a ) I export all my users from old ldap + old gosa 2.6.2 into a backup ldif file backup.ldif, b) I create a new openLdap (last release version) on a server wich run with all the new schema for gosa 2.7.1 c) I start with a new bdb which get the data from my backup.ldif : database config rootdn "cn=admin,cn=config" rootpw {SSHA}... database bdb suffix "dc=parisgeo,dc=cnrs,dc=fr" rootdn "cn=admin,dc=parisgeo,dc=cnrs,dc=fr" rootpw {SSHA}.... c ) I import the backup.ldif into the new ldap, no problem at this step ! d ) i install the new version of Gosa on apache2, and i configure gosa.conf to connect to this dn ="cn=admin,cn=config" with the good admin password. At this step i'm not sure, but i think gosa want a specific administrator dn, not THE config dn, can you certify me this point ? If it's the case, the new LDAP doesn't have the correct ACL and i think i need to import old ACL for specific administrors of Gosa. But i'm not sure, it is possible to use the cn=config access to use with gosa ? Thansk for enlightements, SR

1 0

Simple bind error in CAS-Openldap authentication.
by Darouichi, Aziz 10 Feb '12

10 Feb '12

Hi, I am trying to use CAS-Openldap authentication for a local application. At this point I am not sure if this error is a CAS problem or Openldap: This is the error in catalina.out: WHAT: simple bind failed: ldap1.curry.edu:389; nested exception is javax.naming.CommunicationException: simple bind failed: ldap1.curry.edu:389 [Root exception is javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake] ACTION: TICKET_GRANTING_TICKET_NOT_CREATED APPLICATION: CAS WHEN: Fri Feb 10 11:15:48 EST 2012 CLIENT IP ADDRESS: 192.168.1.91 SERVER IP ADDRESS: 192.168.60.44 Thanks, Aziz

1 0

Syncreplication configuration - olcSyncProvConfig no such objectClass
by Valentin Bud 10 Feb '12

10 Feb '12

Hello Community, I am trying to setup LDAP replication using the syncrepl overlay. I am using Debian Squeeze up to date as of today. # dpkg -l | grep slapd ii slapd 2.4.23-7.2 OpenLDAP server (slapd) As far as I understand on the master/provider I just have to tell him that it is a syncrepl provider. I have tried to achieve just that using: # ldapadd -a -x -W -D cn=admin,cn=config -H ldapi:/// << 'SYNCREPL' dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 SYNCREPL The following error occurs: ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax I have searched in the schemas for olcSyncProvConfig objectClass but it is no where to be found. What do you suggest to do next? Have a great day, -- w: http://databus.ro/blog in: http://www.linkedin.com/pub/valentin-bud/9/881/830 t: https://twitter.com/valentinbud

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical