openldap-technical

openldap-technical@openldap.org

10001 discussions

Can't contact LDAP server
by Mark 09 Sep '11

09 Sep '11

I have a 2-way multi-master setup on srv1.foo.com (EDT) and srv2.foo.com (PDT). For about 2hrs this morning srv2 was syslog'ing "Can't contact LDAP server" while it was in a replication conversation with srv1: Sep 9 05:29:45 srv2 slapd[9413]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 9 05:29:45 srv2 slapd[9413]: do_syncrepl: rid=001 rc -1 retrying Sep 9 05:30:00 srv2 slapd[9413]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Sep 9 05:30:01 srv2 last message repeated 34 times Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0 ... Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:29 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:29 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) Sep 9 05:30:29 srv2 slapd[9413]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 9 05:30:29 srv2 slapd[9413]: do_syncrepl: rid=001 rc -1 retrying Sep 9 05:30:45 srv2 slapd[9413]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Sep 9 05:30:45 srv2 last message repeated 34 times Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:45 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:45 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) ... During that time no errors or closes were logged in the srv2 syslog. I tried bouncing each slapd, but the issue continued. After about 2hrs it stopped occurring. My question is: What would cause the "Can't contact LDAP server message"? The srv1 side doesn't log any error or log that the connection was closed. The text "Can't contact" would seem to imply that the error occurred during a connection attempt, but these errors seemed to occur during a active conversation. Does the srv2 side notice an read or write error on the socket and abandon the connection? I've been looking through the code trying to determine what causes that error message. Does it happen on a single read/write error? Does it retry a few times? I hate to just say "Must be a network error" without some due diligence. My env: RHEL 5.5 OpenLDAP 2.4.25 BerkeleyDB 4.8.40 OpenSSL 1.0.0d Cyrus SASL 2.1.23 2-way Multi-master ==================== #srv1 slapd.conf -> slapd.d include /appl/openldap/etc/schema/core.schema include /appl/openldap/etc/schema/cosine.schema include /appl/openldap/etc/schema/nis.schema include /appl/openldap/etc/schema/inetorgperson.schema include /appl/openldap/etc/schema/foo.com.schema argsfile /appl/openldap/var/run/slapd.args pidfile /appl/openldap/var/run/slapd.pid threads 16 tool-threads 4 idletimeout 300 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 1 ldap://srv1.foo.com:10806 modulepath /appl/openldap/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,dc=foo,dc=com database monitor rootdn cn=manager,dc=foo,dc=com database hdb rootdn cn=manager,dc=foo,dc=com suffix dc=foo,dc=com directory /appl/openldap/var/data/dc=foo,dc=com cachesize 1000 idlcachesize 3000 cachefree 5 checkpoint 128 15 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://srv1.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://srv2.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 limits dn.exact="cn=replicator,dc=foo,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ==================== #srv2 slapd.conf -> slapd.d include /appl/openldap/etc/schema/core.schema include /appl/openldap/etc/schema/cosine.schema include /appl/openldap/etc/schema/nis.schema include /appl/openldap/etc/schema/inetorgperson.schema include /appl/openldap/etc/schema/foo.com.schema argsfile /appl/openldap/var/run/slapd.args pidfile /appl/openldap/var/run/slapd.pid threads 16 tool-threads 4 idletimeout 300 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 2 ldap://srv2.foo.com:10806 modulepath /appl/openldap/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,dc=foo,dc=com database monitor rootdn cn=manager,dc=foo,dc=com database hdb rootdn cn=manager,dc=foo,dc=com suffix dc=foo,dc=com directory /appl/openldap/var/data/dc=foo,dc=com cachesize 1000 idlcachesize 3000 cachefree 5 checkpoint 128 15 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://srv1.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://srv2.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 limits dn.exact="cn=replicator,dc=foo,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

1 0

Need Help On Master-Master Replication Setup!!
by pradyumna dash 09 Sep '11

09 Sep '11

Hi, I would like to setup OpenLDAP Mater-Master replication, before that i would like to know something more about it, because i never implemented the same. Suppose i have 2 servers ldap1.example.com and ldap2.example.com I will configure M-M replication with LDAPS, in this scenario how my architecture should be? Do i need to keep it behind the loadbalancer or what are the steps to do it? How come the client will come to know if any of the server is down, it will talk to the other server, because in my ldap.conf file i will have a single URI/host entry pointing to one of the server and also how to create the certificate, do i need 2 individiual certificate 1 for ldap1 and 1 for ldap2? Please help me. Regards, Neo

2 1

Re:Slapd-meta stop at the first unreachable candidate
by Michel Gruau 09 Sep '11

09 Sep '11

I performed many new tests and provide below several new comments. I recall that of them concern the fact to perform an ldapsearch on the meta suffix while one URI is unrechable. 1/ When network-timeout is not set for the unreachable URI, then no entry is returned. Unless the URI becomes unreachable after the meta startup AND for the first request only. 2/ When network-timeout is set, then the meta always returns entries, but only from the URI which are above the unreachable URI is slapd.conf. 3/ When conn-ttl is set, the walk-around which is to perform a search below the root node in order to open the channel to the different URI, is not working. Channels are always lost after the ttl expire. 4/ I saw slightly different behaviours when the unrechable URI is the first one in slapd.conf. Most of my earlier tests were performed with an unreachable URI which is the second one in slapd.conf. 4/ Such behaviour concern the case in which the URI contains valid IP (I mean pingable) but the port is unreachable (remote ldap server is stopped or port in wrong). I mean : each time the connect error is returned very quickly from network layers. But there are other cases in which connect error is returned more slowly (for instance IP address is not "pingable" or IP address is a LB virtual IP address and the remote server is unreachable). In these later cases, the meta behaviour is greatly different. I mean the meta behaviour is quite normal and entries from all reachable URI are returned ... once the different timer have elapsed. However, this later case led me to several new problems described below. 5/ The timer which is taken into account for the connection is not the "network-timeout" parameter but the "timeout" parameter. According to the slapd-meta man page, this timeout is supposed to be intended for LDAP operations and not for the network connection step. 6/ The value of the "timeout" parameter is the only one which is taken into account, but ... only if the "network-timeout" parameter is set. In other cases, a default (and longer) timeout seems to be applied. The value of network-timeout remains meaningless, it has only to be set with any value. 7/ The "timeout" parameter which is used is not the parameter corresponding to the unreachable URI. After many tests, I discovered it is the maximum value among all "timeout" in the "database meta" section, whatever the URI is !!! Conclusions: all these parameters provide a really powerfull way to cutomize the configuration but few of them are working as excepted. Could anyone explain me whether I can provide all those details as a bug report ? Or should I wait that anyone could reproduce ? Thanks for all. Michel > Message du 05/09/11 16:31 > De : "Michel Gruau" > A : "openldap-technical openldap org" > Copie à : > Objet : Re:Slapd-meta stop at the first unreachable candidate > > Below is a sample configuration allowing to reproduce the problem : > > Three openldap data instances configured as follows: > include /opt/openldap/etc/openldap/schema/core.schema > include /opt/openldap/etc/openldap/schema/cosine.schema > include /opt/openldap/etc/openldap/schema/inetorgperson.schema > include /opt/openldap/etc/openldap/schema/nis.schema > include /opt/openldap/etc/openldap/schema/dyngroup.schema > include /opt/openldap/etc/openldap/schema/misc.schema > pidfile /opt/openldap/var/run/server1.pid > argsfile /opt/openldap/var/run/server1.args > loglevel stats > database bdb > suffix ou=orgunit,o=gouv,c=fr > directory /opt/openldap/var/server1 > > Note: server1 is changed by server2 and server3 for other instances. > > Each instance contains the following data: (only 4 entries): > dn: ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: organizationalUnit > ou: orgunit > > dn: ou=dept1,ou=orgunit,o=gouv,c=fr > ou: dept1 > objectClass: top > objectClass: organizationalUnit > > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > mail: user11(a)server1.com > cn: User 11 > uid: user11 > givenName: User > sn: 11 > > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > mail: user12(a)server1.com > cn: User 12 > uid: user12 > givenName: User > sn: 12 > > Note: user1x and dept1 are substituted in instances 2 and 3 by user2x, dept2, user3x,dept3. > > Data instances are launched using this command: > /opt/openldap/libexec/slapd -n server1 -f /opt/openldap/etc/openldap/server1.conf -h ldap://0.0.0.0:1001/ > /opt/openldap/libexec/slapd -n server2 -f /opt/openldap/etc/openldap/server2.conf -h ldap://0.0.0.0:1002/ > /opt/openldap/libexec/slapd -n server3 -f /opt/openldap/etc/openldap/server3.conf -h ldap://0.0.0.0:1003/ > > Meta instance is configured as follows: > include /opt/openldap/etc/openldap/schema/core.schema > include /opt/openldap/etc/openldap/schema/cosine.schema > include /opt/openldap/etc/openldap/schema/inetorgperson.schema > include /opt/openldap/etc/openldap/schema/nis.schema > include /opt/openldap/etc/openldap/schema/dyngroup.schema > include /opt/openldap/etc/openldap/schema/anais.schema > include /opt/openldap/etc/openldap/schema/misc.schema > pidfile /opt/openldap/var/run/meta.pid > argsfile /opt/openldap/var/run/meta.args > database meta > suffix ou=orgunit,o=gouv,c=fr > uri ldap://localhost:1001/ou=dept1,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 3 > uri ldap://localhost:1002/ou=dept2,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 4 > uri ldap://localhost:1003/ou=dept3,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 4 > > and it is launched as follows: > /opt/openldap/libexec/slapd -n meta -f /opt/openldap/etc/openldap/meta.conf -h ldap://0.0.0.0:1000/ -d 256 > > # test with the 3 servers up > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr > => entries from the three servers are returned > > # stop server 2 (kill -INT ...) and perfom a new search: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => looks good : entries from server1 and server 3 are returned > > Below are the meta instance logs: > conn=1001 fd=9 ACCEPT from IP=172.30.8.13:55048 (IP=0.0.0.0:1000) > conn=1001 op=0 BIND dn="" method=128 > conn=1001 op=0 RESULT tag=97 err=0 text= > conn=1001 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" > conn=1001 op=1 SRCH attr=dn > conn=1001 op=1 meta_back_retry[1]: retrying URI="ldap://localhost:1002" DN="". > conn=1001 op=1 meta_back_retry[1]: meta_back_single_dobind=52 > conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=4 text= > conn=1001 op=2 UNBIND > conn=1001 fd=9 closed > => looks good as nentries=4 > > # perform numerous new search without changing anything: > [root@pp-ae2-proxy2 log]# /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > => nothing returned > > Below are the corresponding logs: > conn=1002 fd=9 ACCEPT from IP=172.30.8.13:55049 (IP=0.0.0.0:1000) > conn=1002 op=0 BIND dn="" method=128 > conn=1002 op=0 RESULT tag=97 err=0 text= > conn=1002 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" > conn=1002 op=1 SRCH attr=dn > conn=1002 op=1 meta_search_dobind_init[1]: retrying URI="ldap://localhost:1002" DN="". > conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=1002 op=2 UNBIND > conn=1002 fd=9 closed > => looks bad as nentries=0 > => Only the first search after server2 stop is successfull. > > # new search but using server1 ou: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept1,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > => looks good > > # same search as earlier i.e. using root node: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > => Looks good also. It looks like all is OK but only once a channel is opened to server1 using another manner > > # new search but using server3 base object: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept3,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => looks good > > # new search but using slapd-meta base object: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => entries from server1 and server3 are returned > => this confirms lookups in server1 and server3 are not performed until a channel is opened to both of them using their repective base object > => another strange behavior : if search using server3 ou is performed before serach using server ou, then next search attempt using root node allows to retrieve entries from both server1 and server3 ... > > # new search after server2 restart: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => good, all entries are returned > > # new search after meta instance restart while server2 is already stopped > opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > => unlike the previous test case (server2 stopped while meta instance is already running) we do not see the single successfull search. > > Then, behaviour is the same i.e. search on root node works again, but only once a search has been performed using ou=dept1 and ou=dept3. > > In addition, behaviour is slightly different adding the "conn-ttl" parameter set to 3 (3 seconds). I could expose it in a new post. > > Thanks for anyone who could help to identify whether it is a misconfiguration or a bug. > > Michel Gruau > > > Message du 19/08/11 13:13 > > De : "Michel Gruau" > > A : "openldap-technical openldap org" > > Copie à : > > Objet : Slapd-meta stop at the first unreachable candidate > > > > Hello, > > It have a slapd-meta configuration as follows: > > database meta > suffix dc=com > uri ldap://server1:389/dc=suffix1,dc=com > uri ldap://server2:389/dc=suffix2,dc=com > uri ldap://server3:389/dc=suffix3,dc=com > > I performed numerous tests using "base=com" and changing the order of the above list of uri (in slapd.cnof) and I see that as soon as a candidate directory is unreachable, all other directories located below the directory in failure are not requested by the proxy. For instance, in example below: > - if server2 is down, then server 3 is not requeted > - if server1 is down, then none of the directories is requested. > > I have the felling this is a bug ... could you confirm ? > > FYI, I also tried the "'onerrr continue" config, but did not change annything > > Thanks in advance. > > Michel > > > > > > > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? > Je crée ma boîte mail www.laposte.net > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

How to replace account with inetOrgPerson?
by Mi 09 Sep '11

09 Sep '11

I am trying to add the "inetOrgPerson" objectClass, but some users already have the "account" objectClass. After a long search, I found that you cannot have both. So I am trying to remove "account", and add "inetOrgPerson". But I cannot do that either. I just get the following error : err=69 text=structural object class modification from 'account' to 'inetOrgPerson' not allowed If I just try to remove "account", I get entry failed schema check: no structural object class provided So, how can I add "inetOrgPerson" and remove "account" ? Also, I notice that I don't have "account" listed under dn: cn=schema,cn=config. What I have is: {0}core {1}cosine {2}nis {3}inetorgperson {4}samba {5}apple Thanks for any help mi PS: I just need a "mail" attribute. Maybe there is a simpler way than to add inetOrgPerson with all it's ridiculous attributes like "audio" or "carLicense" ?

9 25

pcache template doesn't allow negative assertions?
by Ron Peterson 08 Sep '11

08 Sep '11

OpenLDAP version 2.4.23 Negative assertions don't appear to work in pcacheTemplate filter expressions. Is this intentional? line 435 (pcacheTemplate (!(globalOff=)) 0 900) /local/etc/openldap/proxy/slapd.conf: line 435: unable to parse template: AttributeDescription contains inappropriate characters. slaptest: bad configuration file! Works fine without the negative assertion. - Somewhat related question. I'm attempting to use pcache to expedite the application of a filter expression used in an ACL context (ldap backend). I haven't done this before. Does pcache work for this purpose? e.g. access to dn.sub="ou=email" filter="(!(globalOff=))" ... (this is a simplification of what I'm really doing, for illustrative purposes only). -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 2

Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 08 Sep '11

08 Sep '11

Hi,I think I fixed the Database related error during openldap configure step. I have downloaded the new DB "db-4.8.26" and I configured it for unix i.e build_unix. and compiled it successfully. after this I configured the openldap-2.4.26 successfully with the following command. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2" CPPFLAGS="-I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix" --prefix=/mips/ldap --with-yielding_select=no after that I build teh dependencies successfully with the command "make depend" but when I compile I am getting the following error. /bin/sh ../../libtool  --mode=compile /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -I../../include -I../../include   -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix   -DLBER_LIBRARY -c version.c /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -I../../include -I../../include -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -DLBER_LIBRARY -c version.c -o version.o/bin/sh ../../libtool  --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2    -release 2.4 -version-info 9:1:7 -rpath /mips/ldap/lib -o liblber.la assert.lo decode.lo encode.lo io.lo bprint.lo debug.lo memory.lo options.lo sockbuf.lo stdio.lo version.lo  -lresolv rm -fr  .libs/liblber.a .libs/liblber.la .libs/liblber.laiar cru .libs/liblber.a  assert.o decode.o encode.o io.o bprint.o debug.o memory.o options.o sockbuf.o stdio.o version.oranlib .libs/liblber.acreating liblber.la(cd .libs && rm -f liblber.la && ln -s ../liblber.la liblber.la)/bin/sh ../../libtool --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -static -g -O2     -o dtest dtest.o liblber.la ../../libraries/liblutil/liblutil.a  -lresolv  /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -o dtest dtest.o  ./.libs/liblber.a ../../libraries/liblutil/liblutil.a -lresolv./.libs/liblber.a: could not read symbols: Archive has no index; run ranlib to add onecollect2: ld returned 1 exit statusmake[2]: *** [dtest] Error 1make[2]: Leaving directory `/product/wibro/premium/src/APP/Protocols/ASNGW/openldap-2.4.26/libraries/liblber'make[1]: *** [all-common] Error 1make[1]: Leaving directory `/product/wibro/premium/src/APP/Protocols/ASNGW/openldap-2.4.26/libraries'make: *** [all-common] Error 1 I thought this is because I am compiling openldap for MIPS architecture and db-4.8.26 is compiled for normal linux. So i thought I'll compile db-4.8.26 for MIPS and run the following command ../dist/configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2" and tried to compile this for MIPS, but same error is happening here also. please check the below error [vijay@trlx6 build_unix]$ make./libtool --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2  -o db_archive  \    db_archive.o util_sig.o libdb-4.8.a -lpthreadlibtool: link: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -o db_archive db_archive.o util_sig.o  libdb-4.8.a -lpthread/opt/montavista/pro/devkit/mips/fp_be/bin/../lib/gcc-lib/mips-hardhat-linux/3.3.1/../../../../mips-hardhat-linux/bin/ld: db_archive.o: Relocations in generic ELF (EM: 3)db_archive.o: could not read symbols: File in wrong formatcollect2: ld returned 1 exit statusmake: *** [db_archive] Error 1 Kindly help me where I am making mistake and how it can be fixed?? Thank you. RegardsVijay S.

2 1

Search queries with greater-than or smaller-than
by Tobias Prinz 08 Sep '11

08 Sep '11

Hello there, I am just starting with LDAP, but there is some basic thing that I do not understand and that does not make sense at all: I have got an OpenLDAP server and it does contain data. This search returns a bunch of results: ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(gidNumber=500)' Yet this returns no results: ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(gidNumber>=500)' So I invert it and this returns no results either: ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(!(gidNumber>=500))' This simply fails (okay, I knew that, but at least I know the ones above are not syntax errors, because the greater-sign alone is not defined as a filter in RFC 1960 nor RFC 4515): ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(gidNumber>499)' Can someone point me in the right direction, please? Thanks in advance, Tobias

3 3

Re: Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 07 Sep '11

07 Sep '11

I have removed the "-I/usr/include" and added "-I/opt/montavista/pro/devkit/mips/fp_be/include" in the configuration command. The command and options used for configuration is as follows. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2 -I/opt/montavista/pro/devkit/mips/fp_be/include" LDFLAGS=-Bsharable --prefix=/mips/ldap --with-yielding_select=no The error which i got is  configure: error: BerkeleyDB version incompatible with BDB/HDB backends The erros observed in the config.log files are as follows. conftest.c:29:36: __FOO__/generate_error.h: No such file or directoryconfigure:12289: $? = 1configure: failed program was:| /* confdefs.h */| #define PACKAGE_NAME "" conftest.c:30:38: __ASCII__/generate_error.h: No such file or directory configure:14968: result: noconfigure:14992: checking to see if -lrpcrt4 is needed for win32 UUID supportconfigure:15013: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/opt/montavista/pro/devkit/mips/fp_be/include  -Bsharable conftest.c  -lrpcrt4 >&5conftest.c:88: error: parse error before "UuidCreate"conftest.c:88: warning: data definition has no type or storage classconftest.c:89: error: parse error before "UuidToStringA"conftest.c:89: warning: data definition has no type or storage classconfigure:15013: $? = 1configure: failed program was:| /* confdefs.h */ configure:19126: checking for pthread_rwlock_destroy with <pthread.h>configure:19146: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/opt/montavista/pro/devkit/mips/fp_be/include  -Bsharable conftest.c  -pthread -lresolv  >&5conftest.c:106: error: parse error before "rwlock"conftest.c:106: warning: data definition has no type or storage class conftest.c:125: error: too many arguments to function `ctime_r'conftest.c:133: error: too few arguments to function `gethostbyname_r'conftest.c:136: error: too few arguments to function `gethostbyaddr_r' configure:20250: checking for db.hconfigure:20250: result: yesconfigure:20261: checking for Berkeley DB major version in db.hconfigure:20281: result: 3configure:20287: checking for Berkeley DB minor version in db.hconfigure:20307: result: 2configure:20313: checking if Berkeley DB version supported by BDB/HDB backendsconfigure:20349: result: noconfigure:20354: error: BerkeleyDB version incompatible with BDB/HDB backends I am not getting what is the exact problem. :(

1 0

Disable Anonymous Access
by Srini Avula 07 Sep '11

07 Sep '11

Hi I am using OpenLDAP 2.4 version. Is there any way to disable Anonymous access? Advise me please. Srini http://www.e-computingltd.com

5 4

manage vs write
by Christopher Wood 07 Sep '11

07 Sep '11

What access privileges over a particular suffix are granted to somebody with the "manage" level that somebody with the "write" level does not get? As background, using 2.4.26: This document specifies that somebody with the level "manage" gets everything else: http://www.openldap.org/doc/admin24/access-control.html#The%20access%20to%2… On the other hand, slapd.access(5) specifies that "manage grants all access including administrative access. The write access is actually the combination of add and delete, which respectively restrict the write privilege to add or delete the specified <what>." (I am very puzzled. It strikes me that once I can write (add/delete) any entry in a subtree I effectively manage it.)

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical