openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

Memory usage (ITS 6660): Is there a patch to 2.4.23 version to fix the problem ?
by Friedrich Locke 02 Aug '11

02 Aug '11

Dear list members, i am running openlda 2.4.23 and i am facing memory usage problems (ITS 6660). I am not given the option to change to 2.4.23. Is there a patch to fix this problem? Thanks once more.

4 12

SSL server certificate that has an intermediary certificate in the chain
by Francis Swasey 02 Aug '11

02 Aug '11

I have searched the faq-o-matic, google, the admin guide, and I cannot find any documentation that will allow me to set up my OpenLDAP 2.4.25 server using an SSL certificate that was issued from a CA that uses intermediate certificates (by, which I mean to indicate any commercial SSL cert company currently selling certs). Apache has the SSLCertificateChainFile directive to handle this. OpenLDAP seems to be lacking this functionality. I have tried placing both the server certificate and the intermediate certificate in the same file. OpenLDAP won't start if I put the intermediate certificate first, and openssl fails to verify the certificate chain if I put the server certificate first in the file. Have I missed something obvious or has OpenLDAP really forced me into the position of needing to add the intermediate certificate from my SSL CA Vendor into my trusted store on all my clients? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

6 16

rewrite on bindDN
by Perrin, David 02 Aug '11

02 Aug '11

Hi, thank you for reading this message! I'm configuring openldap (2.4.26) as a proxy for active directory (Win 2003) and encountered some inconsistent responses to bind/search requests that may relate to a misconfiguration around an rwm mapping. Hopefully this is the right place to ask for this kind of assistance. I haven't yet been able to see what I'm missing but have spent a lot of time with slapd.conf man, slap-rwm man, and tailing logs even at loglevel -1. Here's what happens: On the console of the openldap server, I'll start the slapd service like: ./slapd -4 -n slapd-ldap -u ldap -g ldap then run an ldapsearch command to the openldap server using a bindDN that requires no rewrite, and a base that requires a rewrite. I get successful binds and search results 100% of the time. If I then run an ldapsearch where the bindDN requires a rewrite, occasionally I'll get a "bind massage" error on the console. Tailing the log file, shows a line like this: Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SEARCH RESULT tag=101 err=1 nentries=0 text=00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece If I stop slapd, restart the service, and run the ldapsearch where the bindDN requires a rewrite, I'll only get errors. Then if I do an ldapsearch with a bindDN that doesn't need a rewrite (which always binds and searches successfully), subsequent ldapsearch bind/search attempts with a bindDN that requires a rewrite will succeed most of the time. Below I've included some shell interaction and log output (loglevel 256 for brevity), non-comment lines from my slapd.conf, and other configuration details. Any suggestions for how I could debug this further or glaring mistakes would be greatly appreciated. Humbly yours, Dave # Start openldap Aug 1 16:38:42 localhost slapd-ldap[19426]: @(#) $OpenLDAP: slapd 2.4.26 (Jul 29 2011 14:11:30) $#012#011dave@localhost.localdomain:/usr/src/openldap-2.4.26/servers/sla pd Aug 1 16:38:42 localhost slapd-ldap[19427]: slapd starting # bind and search that requires no rewrite on bind but a rewrite on base (ou=App Auth 1 -> ou=Students) - this always works /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "CN=Addott\, Steven (saddott),ou=Students,DC=TEST_STUDENT,DC=TEST_EDU" -w "saddott" -x "(mail=sadd*)" name Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 fd=8 ACCEPT from IP=127.0.0.1:36499 (IP=0.0.0.0:389) Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" method=128 Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=0 RESULT tag=97 err=0 text= Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=1 SRCH attr=name Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=2 UNBIND Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 fd=8 closed # success! this comes back in the console: # extended LDIF # # LDAPv3 # base <ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU> with scope subtree # filter: (mail=sadd*) # requesting: name # # Addott\2C Steven (saddott), Students, TEST_STUDENT.TEST_EDU dn: cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU name: Addott, Steven (saddott) # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 # now search and bind requiring a search base rewrite and bind rewrite (mail -> cn) /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "mail=saddott(a)localhost.localdomain,ou=Students,DC=TEST_STUDENT,DC=TEST_ EDU" -w "saddott" -x "(mail=sadd*)" name Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 fd=8 ACCEPT from IP=127.0.0.1:36502 (IP=0.0.0.0:389) Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 fd=12 ACCEPT from IP=127.0.0.1:36503 (IP=0.0.0.0:389) Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=0 SRCH attr=1.1 Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=1 UNBIND Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 fd=12 closed Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=0 RESULT tag=97 err=0 text= Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=1 SRCH attr=name Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=2 UNBIND Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 fd=8 closed # and again, success! this comes back # extended LDIF # # LDAPv3 # base <ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU> with scope subtree # filter: (mail=sadd*) # requesting: name # # Addott\2C Steven (saddott), Students, TEST_STUDENT.TEST_EDU dn: cn=Addott\2C Steven (saddott),ou=Students # restarting the service Aug 1 16:44:54 localhost slapd-ldap[19427]: daemon: shutdown requested and initiated. Aug 1 16:44:54 localhost slapd-ldap[19427]: slapd shutdown: waiting for 0 operations/tasks to finish Aug 1 16:44:54 localhost slapd-ldap[19427]: slapd stopped. Aug 1 16:45:02 localhost slapd-ldap[19489]: @(#) $OpenLDAP: slapd 2.4.26 (Jul 29 2011 14:11:30) $#012#011dave@localhost.localdomain:/usr/src/openldap-2.4.26/servers/sla pd Aug 1 16:45:02 localhost slapd-ldap[19490]: slapd starting # here's where I get a failure, attempting to bind where the bind requires a rewrite # same request as above but this time I'm doing it right after a service restart [root@localhost openldap]# /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "mail=saddott(a)localhost.localdomain,ou=Students,DC=TEST_STUDENT,DC=TEST_ EDU" -w "saddott" -x "(mail=sadd*)" name ldap_bind: Other (e.g., implementation specific) error (80) additional info: bindDN massage error .. log file shows Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 fd=8 ACCEPT from IP=127.0.0.1:46174 (IP=0.0.0.0:389) Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 fd=10 ACCEPT from IP=127.0.0.1:46175 (IP=0.0.0.0:389) Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SRCH attr=1.1 Aug 1 16:45:12 localhost slapd-ldap[19490]: ==> rewrite_context_apply error ... Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 op=0 RESULT tag=97 err=80 text=bindDN massage error Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SEARCH RESULT tag=101 err=1 nentries=0 text=00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 fd=8 closed (connection lost) Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=1 UNBIND Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 fd=10 closed Now back to the request that required no bind rewrite [root@localhost openldap]# /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "CN=Addott\, Steven (saddott),ou=Students,DC=TEST_STUDENT,DC=TEST_EDU" -w "saddott" -x "(mail=sadd*)" name # extended LDIF # # LDAPv3 # base <ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU> with scope subtree # filter: (mail=sadd*) # requesting: name # # Addott\2C Steven (saddott), Students, TEST_STUDENT.TEST_EDU dn: cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU name: Addott, Steven (saddott) # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 fd=8 ACCEPT from IP=127.0.0.1:46177 (IP=0.0.0.0:389) Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" method=128 Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=0 RESULT tag=97 err=0 text= Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=1 SRCH attr=name Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=2 UNBIND Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 fd=8 closed and searching again with the bindDN requiring a map rewrite - this time it failed [root@localhost openldap]# /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_KSC" -D "mail=saddott(a)localhost.localdomain,ou=Students,DC=TEST_STUDENT,DC=TEST_ EDU" -w "saddott" -x "(mail=sadd*)" name ldap_bind: Other (e.g., implementation specific) error (80) additional info: bindDN massage error Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 fd=8 ACCEPT from IP=127.0.0.1:46180 (IP=0.0.0.0:389) Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 fd=13 ACCEPT from IP=127.0.0.1:46181 (IP=0.0.0.0:389) Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=0 SRCH attr=1.1 Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=0 SEARCH RESULT tag=101 err=1 nentries=0 text=00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=1 UNBIND Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 fd=13 closed Aug 1 16:45:56 localhost slapd-ldap[19490]: ==> rewrite_context_apply error ... Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 op=0 RESULT tag=97 err=80 text=bindDN massage error Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 fd=8 closed (connection lost) I tried the same ldapsearch command again and this time it succeeded Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 fd=8 ACCEPT from IP=127.0.0.1:46182 (IP=0.0.0.0:389) Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 fd=13 ACCEPT from IP=127.0.0.1:46183 (IP=0.0.0.0:389) Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=0 SRCH attr=1.1 Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=1 UNBIND Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 fd=13 closed Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=0 RESULT tag=97 err=0 text= Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=1 SRCH attr=name Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=2 UNBIND Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 fd=8 closed AD is running on a VM openldap-2.4.26 was configured on a Fedora 15 (2.6.38.8-35.fc15.i686) VM with: ./configure --prefix=/opt/openldap/proxy --enable-ldap --enable-rewrite --enable-rwm --enable-memberof --with-tls=no non-comment lines from my slapd.conf look like: include /opt/openldap/proxy/etc/openldap/schema/core.schema include /opt/openldap/proxy/etc/openldap/schema/cosine.schema include /opt/openldap/proxy/etc/openldap/schema/inetorgperson.schema # schema to add sAMAccountName include /opt/openldap/proxy/etc/openldap/schema/myorg.schema pidfile /opt/openldap/proxy/var/run/slapd.pid argsfile /opt/openldap/proxy/var/run/slapd.args moduleload rwm.la ####################################################################### # BDB database definitions ####################################################################### database ldap suffix "dc=TEST_STUDENT,dc=TEST_EDU" uri "ldap://..." # ... is the ip of my AD host acl-bind bindmethod=simple binddn="cn=serviceuser,cn=Users,dc=TEST_STUDENT,dc=TEST_EDU" credentials="pwd" idassert-bind bindmethod=simple binddn="cn=serviceuser,cn=Users,dc=TEST_STUDENT,dc=TEST_EDU" credentials="pwd" authzID="dn:cn=serviceuser,cn=Users,dc=TEST_STUDENT,dc=TEST_EDU" loglevel 256 # much of this was borrowed from slapo-rwm man page overlay rwm rwm-rewriteEngine on # all dataflow from client to server referring to DNs rwm-rewriteContext default rwm-rewriteRule "(.+,)?<virtualnamingcontext>$" "$1<realnamingcontext>" ":" # empty filter rwm-rewriteContext searchFilter # from server to client rwm-rewriteContext searchEntryDN rwm-rewriteRule "(.+,)?<realnamingcontext>$" "$1<virtualnamingcontext>" ":" rwm-rewriteContext searchAttrDN alias searchEntryDN rwm-rewriteContext matchedDN alias searchEntryDN # misc empty rules rwm-rewriteContext referralAttrDN rwm-rewriteContext referralDN # define default rewrite for virtual of anything # ou=App Auth 1 -> ou=Students rwm-rewriteContext searchDN rwm-rewriteRule "(.+)?ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU$" "$1ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" ":" # bind map from source rwm-rewriteMap ldap source2dn "ldap:///ou=Students,dc=TEST_STUDENT,dc=TEST_EDU?dn?sub" rwm-rewriteContext bindDN rwm-rewriteRule "^mail=([^,]*),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" "${source2dn(mail=$1)}" ":"

1 0

openldap 2.4.15 with error
by deconya 02 Aug '11

02 Aug '11

HI Im using openldap database with samba and Im with the database broken with this message Aug 2 11:20:43 earth slapd[4145]: slap_client_connect: URI=ldap://earth.esci.es DN="cn=admin,dc=esci,dc=es" ldap_sasl_bind_s failed (80) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=005 retrying (1 retries left) Aug 2 11:20:43 earth slapd[4145]: slap_client_connect: URI=ldap://moon.esci.es DN="cn=admin,dc=esci,dc=es" ldap_sasl_bind_s failed (-1) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=008 retrying (4 retries left) Aug 2 11:20:43 earth slapd[4145]: slap_client_connect: URI=ldap://moon.esci.es DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=004 retrying (4 retries left) Aug 2 11:20:43 earth slapd[4145]: bdb(dc=esci,dc=es): PANIC: fatal region error detected; run recovery Aug 2 11:20:43 earth last message repeated 9 times Aug 2 11:20:43 earth slapd[4145]: null_callback : error code 0x50 Aug 2 11:20:43 earth slapd[4145]: syncrepl_entry: rid=007 be_add failed (80) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=007 retrying (4 retries left) Aug 2 11:20:45 earth slapd[4145]: bdb(dc=esci,dc=es): PANIC: fatal region error detected; run recovery Aug 2 11:20:48 earth last message repeated 9 times Aug 2 11:20:48 earth slapd[4145]: slap_client_connect: URI=ldap://earth.esci.es DN="cn=admin,dc=esci,dc=es" ldap_sasl_bind_s failed (80) Aug 2 11:20:48 earth slapd[4145]: do_syncrepl: rid=005 retrying Aug 2 11:20:48 earth slapd[4145]: bdb(dc=esci,dc=es): PANIC: fatal region error detected; run recovery Really I don't know how to repair and all information speaks to use db_recovery but inside ubuntu I dont' know how to install this commands. For example. http://sdb.open-xchange.com/node/29 It's some important to recover this databse because has information without backup and never has problems. Any help will be appreciate Thanks

2 1

chaining and referral object with two referrals
by Andreas Haubod 31 Jul '11

31 Jul '11

Hello, I use the overlay "chain" on one Server (lets call "global-ldap-01.site." ). How does the overlay chain behave, if it get an referral object with two referrals: dn: ou=finance,dc=mycomapny,dc=com objectClass: referral objectClass: extensibleObject ref: ldap://ldap-01-p.site/ou=finance, dc=mycomapny,dc=com ref: ldap://ldap-01-s.site/ou=finance, dc=mycomapny,dc=com This referral is in the DIT from the global-ldap-01 database, but refers to other ldap-servers. (ldap-01-p and ldap-01-s are configured as N-Way multi-master and located in different data centers) The objective is, that I can shut down one server (or if one Server fails) and the system is running without "bigger" disruption. If I turn off the ldap-01-p, ldap-01-s will be used from the global-ldap-01 So that works fine. If the ldap-01-p comes back, the global-ldap-01 use it again automatically. But if the Server ldap-01-p is down a longer time and I turn on this server, it has to replicate with the running ldap-01-s first. Can I control or configure this preemption and behavior? Thank and kindly regards Meike

1 0

Re: SlapD is using more CPU
by Édnei 30 Jul '11

30 Jul '11

Hello, sorry for the message delayed. So, how many clients you have in this server ? On 28-07-2011 05:28, arun.sasi1(a)wipro.com wrote: > > Hi, > > Below are the latest unexpected service outage log > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=2 SEARCH > RESULT tag=101 err=32 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 fd=36 ACCEPT > from IP=134.32.44.37:60341 (IP=0.0.0.0:389) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=0 BIND > dn="cn=admin,dc=emb,dc=slb,dc=com" method=128 > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=0 BIND > dn="cn=admin,dc=emb,dc=slb,dc=com" mech=SIMPLE ssf=0 > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=0 RESULT > tag=97 err=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=1 SRCH > base="dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=posixAccount)(uidNumber=470649))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=1 SRCH > attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell > gecos description objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=1 SEARCH > RESULT tag=101 err=0 nentries=1 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=8 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-1-0))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=8 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=8 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=3 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=3 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=3 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3260 op=3 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3260 op=3 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3260 op=3 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=9 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-5-2))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=9 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=9 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 fd=36 closed > (connection lost) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: daemon: shutdown > requested and initiated. > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3173 fd=19 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=4 fd=21 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=0 fd=22 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=1 fd=23 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3230 fd=24 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=6 fd=25 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=805 fd=26 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3223 fd=27 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3246 fd=28 closed > (slapd shutdown) > > Thanks, > > -Arun > > *From:*Arun Sasi V (WI01 - Manage IT) > *Sent:* Tuesday, July 26, 2011 9:39 AM > *To:* 'Édnei' > *Subject:* RE: SlapD is using more CPU > > Hi, > > I can show you the settings by live meeting session... there we can > chat or can call too... > > Can I have your number and also let me know your convenient time to > share the session... > > Thanks, > > -Arun > > *From:*Arun Sasi V (WI01 - Manage IT) > *Sent:* Tuesday, July 26, 2011 9:16 AM > *To:* 'Édnei' > *Cc:* openldap-technical(a)openldap.org > *Subject:* RE: SlapD is using more CPU > > Fyi... > > Thanks, > > -Arun > > *From:*Édnei [mailto:ednei.felipe.rodrigues@gmail.com] > *Sent:* Tuesday, July 26, 2011 2:11 AM > *To:* Arun Sasi V (WI01 - Manage IT) > *Cc:* openldap-technical(a)openldap.org > *Subject:* Re: SlapD is using more CPU > > Hello. > Do you show us the settings ? > On 25-07-2011 04:54, arun.sasi1(a)wipro.com > <mailto:arun.sasi1@wipro.com> wrote: > > Hello Team, > > Whenever the number of search increase to the master server... slapd > is utilizing more about more than 100%... What could be the reason and > also is there any bench mark defined... > > Whenver it goes 100% slapd server is getting stopped... > > Thanks & Regards, > > *Arun Sasi V* > > *Please do not print this email unless it is absolutely necessary. * > > The information contained in this electronic message and any > attachments to this message are intended for the exclusive use of the > addressee(s) and may contain proprietary, confidential or privileged > information. If you are not the intended recipient, you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately and destroy all copies of this message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient > should check this email and any attachments for the presence of > viruses. The company accepts no liability for any damage caused by any > virus transmitted by this email. > > www.wipro.com <http://www.wipro.com> > > *Please do not print this email unless it is absolutely necessary. * > > The information contained in this electronic message and any > attachments to this message are intended for the exclusive use of the > addressee(s) and may contain proprietary, confidential or privileged > information. If you are not the intended recipient, you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately and destroy all copies of this message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient > should check this email and any attachments for the presence of > viruses. The company accepts no liability for any damage caused by any > virus transmitted by this email. > > www.wipro.com >

2 2

sudo via ldap
by Tim Dunphy 30 Jul '11

30 Jul '11

Hello list! I have configured an ldap server to include the sudo schema. In my slapd.conf file i have the following entry in my schemas section: include /usr/local/etc/openldap/schema/sudo.schema On my one test client I have the following ldap.conf: host 127.0.0.1 base dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=services,dc=summitnjhome,dc=com bindpw secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com And in my nsswitch I have the following entry: sudoers: ldap I can authenticate and search through the pam_ldap account as well as anonymously. I have my user account setup in the directory this way: # summitnjhome.com dn: dc=summitnjhome,dc=com dc: summitnjhome objectClass: dcObject objectClass: organization o: Summit NJ Home # staff, summitnjhome.com dn: ou=staff,dc=summitnjhome,dc=com ou: staff objectClass: organizationalUnit # sudoers, Services, summitnjhome.com dn: ou=sudoers,ou=Services,dc=summitnjhome,dc=com ou: sudoers objectClass: organizationalUnit objectClass: top # defaults, sudoers, Services, summitnjhome.com dn: cn=defaults,ou=sudoers,ou=Services,dc=summitnjhome,dc=com objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here # %summitnjops, sudoers, Services, summitnjhome.com dn: cn=%summitnjops,ou=sudoers,ou=Services,dc=summitnjhome,dc=com objectClass: top objectClass: sudoRole cn: %summitnjops sudoHost: ALL sudoRunAsUser: ALL sudoCommand: ALL sudoOption: !authenticate sudoUser: %summitnjops sudoUser: bluethundr # bluethundr, summitnjops, staff, summitnjhome.com dn: uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. Dunphy givenName: Timothy P. sn: Dude mail: bluethundr(a)example.com mailRoutingAddress: bluethundr(a)mail.example.com mailHost: mail.summitnjhome.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword:: e0NSWVBUfWNySmg3NGtXbHRXeVE= uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. loginShell: /bin/bash But when I attempt to sudo from the user account, the ladap server searches the correct DN but does not find the user account from what I can tell, tho I am still trying to get the hang of parsing ldap log files: [bluethundr@LBSD2:/usr/home/bluethundr]$sudo -i Password: bluethundr is not in the sudoers file. This incident will be reported. >From the log: Jul 30 22:02:30 LBSD2 slapd[95958]: conn=349346 op=1 SRCH base="ou=sudoers,ou=Services,dc=summitnjhome,dc=com" scope=2 deref=0 filter="(cn=defaults)" I was hoping I could get some advice on how to perhaps adjust either the directory structure or the ldap query so that the sudo user can be found. I'm including my slapd.conf file, dump of the directory (named snjh.ldif) and more complete logs in hopes that someone out there can help track down the solution to the problem. The log file is basically a snapshot in time of the event when I try to log in as the sudo user. Thanks in advance! Tim

1 0

Re: Memory usage (ITS 6660): Is there a patch to 2.4.23 version to fix the problem ?
by Friedrich Locke 30 Jul '11

30 Jul '11

On Sat, Jul 30, 2011 at 6:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, July 30, 2011 6:23 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > > Please don't top post. > Sorry. > >> It is not that's using 63MB. It is that is uses 63MB after performing >> 4 lookup, i.e., its memory usage grows from 15MB to 63MB. > > >> cachesize 4096 > > How many entries do you have in your database? > No more than 50 entries at most. >> dbnosync >> dirtyread > > These are *not* good values to set. You should remove them. I will remove then. > > You have failed to provide some key pieces of information. Please provide > your DB_CONFIG file. Please provide the total size of your BDB database (du > -c -h *.bdb). Please provide the number of real cores your system has > available. ITS6660 *only* affects systems with 4+ CPUs. All I've seen you > say so far is that as slapd is used, it grows in size. That's typical of > slapd loading entries from off of disk into memory. Unless we know how > large your database itself *is*, there is no telling if what it is doing is > wrong or not. My DB_CONFIG is: set_cachesize 0 16777216 1 set_lg_regionmax 262144 set_lg_bsize 2097152 My database size is: gustav# du -c -h *.bdb 32.0K cn.bdb 32.0K dn2id.bdb 64.0K id2entry.bdb 32.0K mail.bdb 32.0K mailAlternateAddress.bdb 32.0K mailHost.bdb 32.0K objectClass.bdb 32.0K uid.bdb 288K total gustav# My system has 2 cores! > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Memory usage (ITS 6660): Is there a patch to 2.4.23 version to fix the problem ?
by Friedrich Locke 30 Jul '11

30 Jul '11

It is not that's using 63MB. It is that is uses 63MB after performing 4 lookup, i.e., its memory usage grows from 15MB to 63MB. If i try more ldap lookup (15 in total), it goes to 425 MB of usage. I tried to limit data usage via unix resource control (/etc/login.conf, yes, i am using openbsd). The process (slapd) die after reaching the limit for data memory usage. Here is my configuration (/etc/openldap/slapd.conf) # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/qmail.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/oldap/slapd.pid argsfile /var/run/oldap/slapd.args database bdb #suffix "dc=my-domain,dc=com" suffix "dc=ufv,dc=br" #rootdn "cn=Manager,dc=my-domain,dc=com" rootdn "cn=oldap,dc=ufv,dc=br" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}HBjSmSCbiE8J26EuDg3ULnSj2SmN1x5g # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/openldap-data # Indices to maintain index cn eq index objectClass eq index mail,mailalternateaddress,uid eq,sub index accountstatus,mailhost,deliverymode eq index default eq cachesize 4096 checkpoint 128 15 dbnosync dirtyread sasl-host gustav.cpd.ufv.br sasl-realm UFV.BR sasl-regexp uid=([^,]+),cn=UFV.BR,cn=gssapi,cn=auth uid=$1,ou=people,dc=ufv,dc=br limits dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.onelevel="ou=people,dc=ufv,dc=br" time=4 size=1 access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth # by * none access to dn.one="ou=appsrv,dc=ufv,dc=br" by self read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=objectclass by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" search by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=homedirectory by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=entry,uid by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidnumber,gidnumber,loginshell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailalternateaddress,qmailuid,qmailgid,mailmessagestore,mailquotasize,mailquotacount,mailsizemax,mailforwardingaddress,deliveryprogrampath,mailhost,deliverymode,mailreplytext,qmaildotmode,accountstatus,qmailaccountpurge by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" by self read # by * none access to dn.base="ou=people,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.base="dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=group,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.base="ou=group,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none ####################################################################### # Monitor database definitions ####################################################################### database monitor access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read # by * none =============== END OF CONFIGURATION ==================== On Sat, Jul 30, 2011 at 4:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, July 29, 2011 12:51 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list members, >> >> i am running openlda 2.4.23 and i am facing memory usage problems (ITS >> 6660). I am not given the option to change to 2.4.23. >> Is there a patch to fix this problem? > > Given your stated database size, I sincerely doubt you are hitting the issue > in ITS6660. You also fail to note any of your configuration settings. I > personally don't see a slapd size of 63MB particularly large. Does it > continually grow, or does it stay steady at 63MB? > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 2

Re: invalid syntax when teletexstring
by Erwann ABALEA 30 Jul '11

30 Jul '11

First, sorry for having placed this thread in private, that was unintentional (maybe I should reconsider using a "reply to all" by default). Group added. 2011/7/29 Howard Chu <hyc(a)symas.com>: > Erwann ABALEA wrote: [...] >> In fact, I know such a CA that was generated some months ago, with a >> very large audience, and whose certificates are to be stored in an >> LDAP structure. Czech Republic passport CA certificate. If you want to >> know how it's used, and by who, we can talk about it in private, or >> you can look at www.icao.int, search for Doc9303 documents, PKD >> structure, etc. (In fact, I didn't know of this limitation, and I'll >> look forward its impact in integrating the Czech certificates in the >> OpenLDAP structures we sell and deploy). >> I agree that UTF8String would have been a much better choice, but >> X.509 doesn't prevent the use of T61String. >> In the meantime, some products still don't support UTF8String in >> certificates, a Novell proxy product (I don't remember its exact name) >> is an example I encountered recently. > > If that's the case, what solutions do you propose? We could accept T61String > if it only uses characters that are present in 7-bit ASCII of course. But > once you venture into 8-bit and extended/accented characters all bets are > off. I'll need to grab this CA certificate back. I was asked to give my opinion on whether it was to be considered valid or not. Despite the fact that T61String is clearly deprecated in RFC5280/3280/2459, and that ICAO has chosen to base their certificate profile on RFC3280 (a bad choice), asking for a country to change its root CA cert signing all its passports because that doesn't follow rules I personally don't adhere to is difficult and counterproductive. I wasn't the only one to have this idea, and it was accepted. I'm 99% sure 7 bits didn't suffice. The remaining 1% will be fixed as soon as I find the certificate. Do you have any document or pointer to understand the task of converting to/from T.61, and incompatible character sets you talked about? I Googled for this, but I'm not sure of what I found (what I found reminds me of old character sets we used many years ago in France for the Minitel, with G1/G2 character groups, etc, not that far from VT consoles). The ICAO group or PKD Board could ask the Czechs to produce X.509 certificates with UTF8String encoding for the issuerName's fields, it's perfectly valid by X.520 rules (as long as the content is semantically identical, differently encoded strings are equal, as you know), but that's asking for implementors to produce completely compliant code. And such code will have to be clearly written by dozens of staffs in the world, and used by autonomous devices reading passports, etc. A big bet. Given what I see in different countries' certificates, we're far from this. I'll try to take a look tomorrow. -- Erwann.

3 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical