openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Issue with index in OpenLDAP?
by External Mathieu DEDECKER (CAMPUS) 03 Jan '12

03 Jan '12

Hi @All, We meet a performance problem with our OpenLDAP. We think that we face a problem with the index of the database, and we think that the problem can be resolve by tunning the config (but not sure). We would like to be sure that our configuration is correct, in order to confirm if we are on a wrong track or not. *[Description]* We have an attribute (cardNumber) which is indexed. When we request the indexed attribute (cardNumber) with an LDAP Client (Ldapbrowser), we have either fast or very long response time. For the long response time, the CPU of the server hits 100%. *For example*: Request1: cardnumber=2098001010034 (less than 1sec) Request2: cardnumber=2090389917486 (nearly 20 sec). By checking the hit ratio of the attribute, we can see that cache is correctly used (97%). *[Details]* - We are running on a VM with RedHat with 4 process with 24 Go RAM. - The version of the OpenLDAP is 2.4.16. - We have 2 500 000 accounts. *[Attachment]* - *201111223_os.txt* -> informations about OS and Hardware. - *openldap_version.txt* -> informations about the version of OpenLDAP. - *20111220_stats.txt* -> informations about index and perf. - *olcDatabase={1}hdb.ldif.txt * -> informations about hdb config. Do not hesitate if you need some more informations. Thank you for your help (: Mathieu

2 2

Syncrepl problem
by Bram Cymet 03 Jan '12

03 Jan '12

Hi, I have a syncrepl setup that I thought was working fine because whenever I would change an attribute in an entry the changes would be reflected in slave. Recently I noticed that if I remove and entry or add a new entry that will not get synced. Any idea what would be going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 3

suggestion regarding updating server and clients
by Götz Reinicke 03 Jan '12

03 Jan '12

Hi, we do run an Red Hat EL 6.x server with the openldap package from Red Hat currently version 2.4.19-15.el6_0.2. The ldap is used by our mail and fileserver for authentication. The last time I updated I had a big problem with the deamon crashing after some time. That problem should be solved now in the recent version 2.4.23-20.el6. My question: Could I 'mix' the installed version for now, meaning leave the ldap clients at the current installed version .19 and only update the server first to version .23 or should / do I have to update all systems to the same version? Thanks for any suggestion and best regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

2 1

Merging LDAP DB's
by Alex Samad - Yieldbroker 02 Jan '12

02 Jan '12

Hi I would like to merge data from 2 LDAP DB's into 1. So I have windows 2008R2 AD which has all of our corporate users in there, with passwords. I would like to create another ldap DB for all the non-Windows users. The aim is to use this LDAP db as a userid/password repo for our product. So for example if my ad naming it ad.com, so that the base DN: dc=ad,dc=com I would like to say create a openldap server (say abc.local. ) on a server and attach another DB as say dc=ldap,dc=ad,dc=com So server abc.local I would setup 2 DB definitions 1) for a local db with base dn dc=ldap,dc=ad,dc=com 2) for a proxy (? Is this the best way or rewrite / proxy ?) with base dn dc=ad,dc=com Now if I make a ldapsearch using -H abc.local and a base dn of dc=ad,dc=com, will it include information from both DB's ? All I want to be able to do, is to authenticate people against LDAP but my information need to come from both sources. I don't want to have to pay a cal for each user I am going to add and I don't want to have to places to store my companys userid/passwords. Thanks Alex

1 0

openldap ssl/tls not getting started
by Jayavant Patil 02 Jan '12

02 Jan '12

Hi, I am using openldap-2.4.19-4.fc12.x86_64 on fedora 12 machine. I want to start slapd with ssl/tls enabled. I have followed all the necessary steps as per specified in admin guide but still slapd not getting started in ssl/tls mode. Whenever I do ldapsearch with -ZZ option, it shows can't contact LDAP server(-1). Can anybody tell me the detailed steps and settings so that I can match those with my followed steps? Server file names are as follows: /etc/openldap/slapd.conf /etc/openldap/ldap.conf /etc/ldap.conf /etc/nsswitch.conf Client file names are as follows: /etc/openldap/ldap.conf /etc/ldap.conf /etc/nsswitch.conf -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 1

Question about using memberOf attribute in OpenLDAP
by Suneet Shah 02 Jan '12

02 Jan '12

Hello, Java and its native libraries to work with OpenLDAP in our application. I need to be able to associate users to groups and this part works file. I can do an ldap search and I can see the membership ie: dn: cn=NURSE,ou=roles,dc=mydir,dc=com uniqueMember: uid=Suneet.LDAP-TEST-1,ou=users,dc=mydir,dc=com ldif for Role dn: ou=roles,dc=mydir,dc=com objectClass: top objectClass: organizationalUnit ou: roles Sample user that created for above: dn: uid=Suneet.LDAP-TEST-1,ou=users,dc=mydir,dc=com preferredLanguage: E displayName: LDAP-TEST-1,Suneet employeeType: PERM FULL TIME userPassword:: cGFzc3dvcmQ= ou: OpenIAM givenName: Suneet uid: Suneet.LDAP-TEST-1 telephoneNumber: 234-123-4567 mail: suneet_shah(a)openiam.com cn: Suneet LDAP-TEST-1 manager: uid=abc,ou=users,dc=mydir,dc=com o: OpenIAM departmentNumber: - sn: LDAP-TEST-1 title: Test User x-com-mydir-userStatus: Inactive objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: DIRUser I also need to be able to remove users from a group. In this case, I am looking up the user to see if they a have memberOf attribute. However, when I do this, my search results are always empty. My code and search filter are below. Any thoughts on what I am doing wrong? I tried this OpenDS and it works, but I need to get this work with OpenLDAP. Also I noticed that my user in ldap does not contain any attributes that show membership to a group. I have pasted below my code where I add a user to a group incase that is the source of my error Code snippet to search for a user before adding/removing from a group: String[] attrIds = {"memberOf", "isMemberOf"}; NamingEnumeration results = null; try { SearchControls searchCtls = new SearchControls(); searchCtls.setReturningAttributes(attrIds); String searchFilter =" (&(objectclass=inetOrgPerson)(uid=Suneet.LDAP-TEST-1))" results = ldapctx.search(objectBaseDN, searchFilter, searchCtls); Code to add a users to a group: ModificationItem mods[] = new ModificationItem[1]; mods[0] = new ModificationItem(DirContext.ADD_ATTRIBUTE, new BasicAttribute("uniqueMember", ldapName)); ldapctx.modifyAttributes(s, mods); thanks for your help

2 1

Ldap Tree References and Timeouts
by Klemens Kittan 29 Dec '11

29 Dec '11

Hello, I incorporated a subtree in our LDAP tree by reference. This subtree is offered by two servers. That's why I set the uri parameter to ldap1 and ldap2. If one of these servers is down, searches take very long (>10 min). The manpage says: "The URI list is space- or comma-separated. Whenever the server that responds is not the first one in the list, the list is rearranged and the responsive server is moved to the head, so that it will be first contacted the next time a connection needs be created." Have I missed something here or is there a timeout value to be set? This is our configuration for that part: # ---------------------------------------------------------- # --- Specific Backend Directives for ldap ----------------- # ---------------------------------------------------------- backend ldap # ---------------------------------------------------------- # --- Specific Directives for database ldap (babylon) ------ # ---------------------------------------------------------- database ldap # --- The base of your directory suffix "dc=subtree,dc=xyz,dc=de" uri "ldap://ldap1.xyz.de ldap://ldap2.xyz.de" # --- Save the time that the entry gets modified lastmod off # --- Specify that the current backend database is a subordinate subordinate Regards, Klemens

1 0

memory leak
by Paul DiSciascio 28 Dec '11

28 Dec '11

We are running a cluster of 2 ldap servers using the syncrepl overlay with mirror mode. After upgrading from SLES 10 SP2 (openldap 2.4.11) to SLES 11 SP1 (openldap 2.4.20), we have encountered a memory problem. The slapd process grows unbounded to the point that it uses all of the memory available to the ldap user on the server, currently 2.5GB, in a matter of hours. The database only contains around 30,000 records, so this amount of memory usage seems unusually high. No changes to the server configuration were made during the upgrade. In an attempt to address the issue, we upgraded both instances further to openldap version 2.4.28, but this has not helped. Below is the slapd.conf (security related pieces have been redacted) that we are using. ~Paul -------------------BEGIN SLAPD.CONF-------------- # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Load dynamic backend modules: modulepath /usr/lib/openldap/modules TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCertificateFile /etc/openldap/cert.pem TLSCertificateKeyFile /etc/openldap/cert.key <ACLs go Here> loglevel none ServerID 1 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=redacted" checkpoint 1024 5 cachesize 10000 overlay ppolicy rootdn "cn=redacted" sizelimit -1 ppolicy_default "cn=redacted" ppolicy_use_lockout directory /var/lib/ldap # Indices to maintain index cn,sn,uid eq index entryUUID eq index entryCSN eq index member eq index objectClass eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 limits dn.exact="uid=replica,ou=redacted" time=unlimited size=unlimited syncrepl rid=501 provider=ldap://peerhost:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=redacted" attrs="*,+" scope=sub bindmethod=simple binddn="uid=redacted" credentials= interval=00:01:00:00 mirrormode on database monitor -------------------END SLAPD.CONF--------------

2 1

Re: LDAP and file based authentication co-exist
by Daniel Qian 28 Dec '11

28 Dec '11

On 11-12-28 8:37 PM, yang feng电话 wrote: > > No, i configure /etc/openldap/ldap.conf, need /etc/ldap.conf Also? > > Generally speaking /etc/openldap/ldap.conf is for Ldap application software/utilities whereas /etc/ldap.conf is for system. Apparently You need the later for Ldap users to show up in your system.

1 0

LDAP and file based authentication co-exist
by 杨峰 28 Dec '11

28 Dec '11

It's a strange problem, I settle down LDAP setting and can get correct ldapsearch result at the mgmt node, but when I use "su" to the user, the system prompt "the user is not existed". It seems the LDAP service ( slaped ) is running and the user authentication goes through /etc/passwd still. How to move the user authentication to LDAP only? I had changed /etc/nsswitch.conf to use ldap also. [root@xcat user]# ldapsearch -x -v -D "cn=root,dc=isilon,dc=cn" -W -b "ou=People,dc=isilon,dc=cn" "uid=demo" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: uid=demo requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <ou=People,dc=isilon,dc=cn> with scope subtree # filter: uid=demo # requesting: ALL # # demo, People, isilon.cn dn: uid=demo,ou=People,dc=isilon,dc=cn uid: demo cn: demo sn: demo mail: demo(a)isilon.cn objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JHkuMjUwS3hlJE9VZ3BidXJDdlg0UFk2NVFSSXBKNjhtNnpxYVp OVHdZYnBpZkdJVUJuQk1ZZnlVdmtEMHNwMTZLUmtaQmhoT0xrQ1NZdEhUU2NEUDRhTmhGUnJNSWIv shadowLastChange: 15334 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 501 gidNumber: 500 homeDirectory: /ifs/home/demo # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [root@xcat user]# su - demo su: user demo is not existed

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical