openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Best Practices for configuration management with cn=config?
by Jeff B 03 Feb '12

03 Feb '12

I'm using puppet for configuration management and with the slapd.conf it was dumb simple to push configs to the master and the slave servers and have the server reload when the config was updated. However I'm running an overlay that pukes with a slapd.conf and had to convert over to cn=config. Now I'm not sure how I want to manage this. Can I safely modify the files while slapd is running? I wouldn't expect it to pick up the config changes without a reload, but if I want puppet to push configs and reload will this be a valid method? Or do I need to do something with an LDIF of the config and have some kind of ldapadd/ldapmodify mojo? Are there any puppet modules for cn=config that I missed when I looked?

4 3

Openldap 2.4.28 master/slave crash after upgrade?
by Raffael Sahli 03 Feb '12

03 Feb '12

Hi I did an upgrade of two ldap server (master/slave) from 2.4.21 to 2.4.28 two days ago. And today, the master crashed, if I do an ldapsearch: root@ldap-master001 /]#---> ldapsearch -ZZ -hlocalhost -d-1 ldap_create ldap_url_parse_ext(ldap://localhost) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x13c3910 ptr=0x13c3910 end=0x13c392f len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x13c3910 ptr=0x13c3915 end=0x13c392f len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush2: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x13bb660 msgid 1 wait4msg ld 0x13bb660 msgid 1 (infinite timeout) wait4msg continue ld 0x13bb660 msgid 1 all 1 ** ld 0x13bb660 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 26 21:43:50 2012 ** ld 0x13bb660 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x13bb660 request count 1 (abandoned 0) ** ld 0x13bb660 Response Queue: Empty ld 0x13bb660 response count 0 ldap_chkResponseList ld 0x13bb660 msgid 1 all 1 ldap_chkResponseList returns ld 0x13bb660 NULL ldap_int_select It hangs at ldap_int_select (There's nothing in the slapd debug log) Same problem again after a few seconds, if I kill the daemon and start it again. (The daemon crashed, only a kill -9 helped) And now, after one hour of debug, the same problem occurred on our first slave server.... Has someone similar problems, or can somone helps me? The next thing I'll do is go back to 2.4.21, maybe that helps.... Thanks -- Raffael Sahli public(a)raffaelsahli.com

2 3

BayLISA OpenLDAP talk
by Howard Chu 02 Feb '12

02 Feb '12

For any folks in the San Francisco area who haven't already heard, I'll be giving a talk on OpenLDAP's new memory-mapped database and backend (back-mdb) there on February 16. http://www.baylisa.org/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Directory Manager (cn=config) ACLs
by Andy Carlson 02 Feb '12

02 Feb '12

Are there any ACLs that control what cn=directory manager,cn=config can modify or is it a LDAP superuser sort-of account? I only ask because I want to blow away my ACLs (olcAccess attributes in olcDatabase={2}bdb) and re-add updated ones them (I know it sounds silly, but I have valid reasons for doing this) and I want to make sure that I can still make these modifications as this directory manager even if I have no ACLs. Thanks, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

2 1

openldap 2.4.28 and "allow bind_v2"
by Francis Swasey 02 Feb '12

02 Feb '12

I have built and upgraded one of my openldap servers from 2.4.26 to 2.4.28 (on RHEL release 5.7 x86_64) and with the identical configuration to my other servers, I am seeing the following messages in the slapd.log file: slapd[4434]: conn=115331 fd=263 ACCEPT from IP=X.X.X.X:51856 (IP=0.0.0.0:389) slapd[4434]: conn=115331 op=0 do_extended: protocol version (2) too low slapd[4434]: conn=115331 op=0 DISCONNECT tag=120 err=2 text=requires LDAPv3 slapd[4434]: conn=115331 fd=263 closed (operations error) I'm not seeing anything leaping out at me from the change log for 2.4.27/2.4.28 that indicates what I have gotten wrong that worked until now. As I said, I am running the same slapd.conf file on my 2.4.26 installations and not seeing these failures there at all (and since I use an F5 load balancer, these connections are sprayed all across my pool of servers). Where should I start looking? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

3 6

cn=Connection 0,cn=Connections,cn=Monitor?!?
by Michael Ströder 01 Feb '12

01 Feb '12

HI! on one platform on various servers I see strange entries in back-monitor (see below). It's an installation of RE24 committ-id 22ee28752e3e0d2a6910a22922fc69befd78578a self-compiled on RHEL 6.2 x86_64 linked to BDB, SASL and OpenSSL shipped with RHEL. We have two custom overlays in this setup but disabling them did not make this monitor entries disappear. On my local test system on openSUSE 11.4 x86_64 I don't see this. Any idea under which condition such monitor entries can appear and where to look in my configuration? Ciao, Michael. --------------------------------- snip --------------------------------- dn: cn=Connection 0,cn=Connections,cn=Monitor structuralObjectClass: monitorConnection creatorsName: modifiersName: createTimestamp: 19700101000000Z modifyTimestamp: 19700101000000Z monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 0 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 0 monitorConnectionGet: 0 monitorConnectionRead: 0 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z entryDN: cn=Connection 0,cn=Connections,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE dn: cn=Connection 0,cn=Connections,cn=Monitor structuralObjectClass: monitorConnection creatorsName: modifiersName: createTimestamp: 19700101000000Z modifyTimestamp: 19700101000000Z monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 0 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 0 monitorConnectionGet: 0 monitorConnectionRead: 0 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z entryDN: cn=Connection 0,cn=Connections,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE

2 5

[pasword Policy Control]How to use it in java
by Jacquot, Pierre 01 Feb '12

01 Feb '12

Hello everyone, I'm new on OpenLdap and I discover it since 2 or 3 month. Actually I'm working on using of password policies, and I encounter some problems when I try to get the password Policy control on my Java Application. In my case, I use JNDI connection and I make my connection like this : Control controls[]={new BasicControl("1.3.6.1.4.1.42.2.27.8.5.1")}; ld= new InitialLdapContext(env, controls); // env contains url connection, Credential, password and kind of authentification javax.naming.ldap.Control[] controls = ld.getResponseControls(); In result of this action, I receive one control object, but I don't know how to use it to obtains the control message associated to my user (account blocked for example or number of grace that I can use etc.). Do you know a good tutorial that explain how can I use password policies control in my application, or something else like that ? Thanks for your time spent on my message :) Cordially Pierre JACQUOT Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 1

making a full replica: slapd -c "rid=xxx" doesn't seem to work
by Jephte CLAIN 01 Feb '12

01 Feb '12

hello, I'm new on this list. I use OpenLDAP 2.4.23 on debian squeeze I'm currently testing full replication with the small configuration seed on the consumer side, but the replication is not complete. Let me explain in details: so, the consumer starts with no data at all (I wipe /etc/ldap/slapd.d/* files, and /var/lib/ldap/*) Based on the test049, I do 'slapadd -F /etc/ldap/slapd.d -b cn=config -l initial.ldif' with initial.ldif as: ------------- 8< ------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcSyncrepl: {0}rid=0 provider="ldap://master.tld/" searchbase=cn=config bindmethod=simple binddn=cn=config credentials=password type=refreshAndPersist retry="60 10 300 +" schemachecking=off ------------- 8< ------------- on the provider side, cn=config is the rootdn of cn=config so the database cn=config is replicated, except for the above objects. Indeed, the logs says: dn_callback : new entry is older than ours cn=config ours 20120127114737.207735Z#000000#000#000000, new 20120127112957.179717Z#000000#000#000000 dn_callback : new entry is older than ours olcDatabase={0}config,cn=config ours 20120127114737.207985Z#000000#000#000000, new 20120127112953.813862Z#000000#000#000000 and this makes sense. I searched the archives, and found a message from Howard Chu made on 19 Apr 2011: ------------- 8< ------------- >The problem I now face is that the initial cn=config entries used to do >the first sync do not get overwritten by the data from the master. So >the install password doesn't get replaced nor do the updated retry >timeouts for olcSyncRepl, because, I'm assuming, the 'stub' entries >have newer timestamps than those on the master. > >How can this be overcome from the perspective of the slave server. >Updating the entries on the master triggers the update as you would >expect. Is there a way to put the stub entries onto the slave with a >timestamp in the past so that they get overwritten during the first >sync? Or is there another way to trigger them to be updated? Use slapd -c. Read the slapd(8) manpage. ------------- 8< ------------- The manpage says: ------------- 8< ------------- -c cookie (...) Use only the rid part to force a full reload. ------------- 8< ------------- So I tried '/usr/sbin/slapd -c "rid=0" -d 16384 ...' but I got the message above about the entry not overwritten because of the timestamp. I wonder what I am doing wrong... I'd prefer not to have to use a more recent version, because debian already does a good job following the patches and keeping the whole thing stable :-) But If this is a known issue, what are my options? I mean, my goal is to replicate schemas, indexes, limits, acls and Authz definitions. I thought that a whole replica would the easiest. how do you guys do this? thanks in advance for your inputs. best regards, Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

3 8

Re: Global modifications
by Nick Milas 31 Jan '12

31 Jan '12

On 31/1/2012 4:30 μμ, Charles T. Brooks wrote: > You could always make an LDIF with your preferred awk > > ldapsearch -x -LLL -Dcn=manager,dc=example,dc=com -W 'mail=*' mail|gawk > '/^dn/{printf "%s\nchangetype: modify\nadd: acceptedEmail\n", > $0};/^mail/{printf "acceptedEmail: %s\n\n", $2}' > > and pipe it to ldapadd/ldapmodify... if you need to add the objectClass > as well, just modify the printf on the /^dn/ pattern. > > Seems like you might be independently recreating the Lachman schema, > though. > Thanks Charles, Your solution looks fine. Obviously ldapmodify cannot use existing data directly for new entries. I didn't know of Lachman schema, I guess you mean: http://www.sendmail.org/m4/laser.txt (which I found with a bit of googling). I'll take a look. From a first glance, however, it is more extensive than what I want. In fact, I want to disassociate mail attribute from use in our applications (mainly Postfix), and I want to use a different attribute for that use. Can I find the Lachman schema anywhere in a complete form, ready for Openldap? Nick

1 0

OpenLDAP/AD 2 way password sync.
by Darouichi, Aziz 31 Jan '12

31 Jan '12

Hi, Please forgive me if this topic was raised in the past. We have an SSO portal and all our applications have been moved to SSO. Authentication is done via an Openldap 2.4.23 Database. Also we run Microsoft Active Directory services on 2003 Domain. We are looking for a two way password synch between AD and Openldap so that a single password can be used for both AD domain and Portal. Thanks, Aziz

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical