openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

olcDbCacheSize: no equality matching rule
by Gerard Ranke 24 Jun '11

24 Jun '11

Dear listmembers, After upgrading from openldap 2.4.21 to 2.4.25 my olcDbCacheSize entry seems to have gone awoll. I tried to fix that with the following ldif file: dn: olcDatabase={1}hdb,cn=config changetype:modify add: olcDbCachesize olcDbCachesize: 10000 but I got this errormessage: modifying entry "olcDatabase={1}hdb,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcDbCacheSize: no equality matching rule Does anybody have any idea what is wrong? Many thanks in advance, Gerard Ranke

2 1

RE: ppolicy works, then doesn't
by Cyril GROSJEAN 23 Jun '11

23 Jun '11

Do you have any clue (from the access log for example), that this user’s password has been successfully changed after 20110606211056Z ? Or is there any chance that the password was changed while the policy overlay wasn’t loaded, which could occur if it was changed on a misconfigured replica for example.

2 1

N-Way replication
by Darouichi, Aziz 23 Jun '11

23 Jun '11

I setup N-Way replication openldap-2.4.23 in RHEL5. Config file is identical on both servers. In one server I get this error message in the log. send_search_entry: conn 1000 ber write failed. I run slapdindex, and turned off schemasearch. Error message still being generated. Thanks,

2 3

[SOLVED] olcDbCacheSize: no equality matching rule
by Gerard Ranke 23 Jun '11

23 Jun '11

>Dear listmembers, >After upgrading from openldap 2.4.21 to 2.4.25 my olcDbCacheSize entry seems to have gone awoll. I >tried to fix that with the following ldif file: >dn: olcDatabase={1}hdb,cn=config >changetype:modify >add: olcDbCachesize >olcDbCachesize: 10000 >but I got this errormessage: >modifying entry "olcDatabase={1}hdb,cn=config" >ldap_modify: Inappropriate matching (18) > additional info: modify/add: olcDbCacheSize: no equality matching rule Been staring at this for too long: The olcDbCacheSize was sitting right there... Sorry for the noise. Best, gerard

1 0

Schema modification errors
by Marc Elliott 23 Jun '11

23 Jun '11

Hi All, I have a brand new OpenLDAP server installed by Ubuntu and running locally on which I need to alter one of the core schemas to accommodate some legacy data. Unfortunately, I keep getting errors on my modification attempts. (BTW - the LDAP repository is current empty, though schemas have been added to cn=config) The LDIF I've been submitting is: dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) And the error I get is: #!RESULT ERROR #!CONNECTION ldap://localhost:389 #!DATE 2011-06-21T10:29:02.855 #!ERROR [LDAP: error code 21 - objectclasses: value #0 invalid per syntax] dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) Any ideas? I'm new to OpenLDAP and usually try to avoid changing standard schema elements so I may be missing something simple. Thanks! Marc

1 0

ppolicy works, then doesn't
by Bidwell, Matt 22 Jun '11

22 Jun '11

I had ppolicy working. Then it stopped. I've cut some stuff for security but I've included some debug info off the ldap server and the ldapsearch + output for that user. Most notably pwdHistory and pwdChangedTime no longer updates. pwdMinLength seems to work, as does pwdCheckQuality. Any ideas why it stopped working or what else I can use to debug? I've recently changed the hash, but it didn't coincide with the date ppolicy stopped working. Matt >From Ldap server debug: acl: internal mod entryCSN: modify access granted acl: internal mod modifiersName: modify access granted acl: internal mod modifyTimestamp: modify access granted bdb_modify_internal: replace userPassword bdb_modify_internal: replace entryCSN bdb_modify_internal: replace modifiersName bdb_modify_internal: replace modifyTimestampca oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "posixAccount" oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "shadowAccount" oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "inetOrgPerson" oc_check_allowed type "roomNumber" oc_check_allowed type "employeeType" oc_check_allowed type "shadowExpire" oc_check_allowed type "homePhone" oc_check_allowed type "givenName" oc_check_allowed type "mobile" oc_check_allowed type "objectClass" oc_check_allowed type "shadowLastChange" oc_check_allowed type "uid" oc_check_allowed type "mail" oc_check_allowed type "uidNumber" oc_check_allowed type "cn" oc_check_allowed type "telephoneNumber" oc_check_allowed type "loginShell" oc_check_allowed type "host" oc_check_allowed type "gidNumber" oc_check_allowed type "gecos" oc_check_allowed type "homeDirectory" oc_check_allowed type "sn" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "pwdHistory" oc_check_allowed type "pwdChangedTime" oc_check_allowed type "pwdPolicySubentry" oc_check_allowed type "userPassword" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" Ldapsearch: # testuser, fte, people, dn: uid=testuser,ou=fte,ou=people structuralObjectClass: inetOrgPerson entryUUID: 2c51bca1-1460-4b26-ae20-3c054c861d30 creatorsName: cn=admin createTimestamp: 20110523222307Z pwdHistory: 20110606211017Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}aZlEl1nHU2K pwdHistory: 20110606211045Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}LCJWgHumf2f pwdHistory: 20110606211056Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}toDKXKosvds pwdChangedTime: 20110606211056Z pwdPolicySubentry: cn=default,ou=policies entryCSN: 20110617223036.234028Z#000000#000#000000 modifiersName: uid=testuser,ou=fte,ou=people modifyTimestamp: 20110617223036Z entryDN: uid=testuser,ou=fte,ou=people subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1

1 1

Schema modification errors
by Marc Elliott 21 Jun '11

21 Jun '11

1 0

Re: schema replication problems with test059-slave-config
by Christopher Strider Cook 20 Jun '11

20 Jun '11

I'm assuming that my schema sync config issues are related to the mirrormode configuration I have not working well with the additional sync of the cn=schema,cn=config tree into cn=config,cn=slave. So I'm looking for other ways to have a single authoritative schema source that replicates to all locations. Overview: I have a pair of MirrorMode servers syncing cn=config between themselves. Also on these servers is a cn=config,cn=slave which also sync in a MirrorMode setup. Then there are a number of Consumer servers that syncrepl cn=config,cn=slave with a suffixmassage into their local cn=config databases. Initially, there was a syncrepl on the mirrormode servers that synced cn=schema,cn=config into cn=schema,cn=config,cn=slave. But this is failing (I'm presuming do to a conflict over use of the contextCSN, with the mirrormode syncs) So what are my options for keeping cn=schema,cn=config on the consumers in sync with cn=schema,cn=config on the mirrormode providers? Thanks, Chris

1 0

Password Policy
by Darouichi, Aziz 17 Jun '11

17 Jun '11

Hi, I am trying to institute a password policy in openldap-2.4.23. I would like to hash userPassword: I used "ppolicy_hash_cleartext" This is the policy file: dn: ou=policies,dc=establishment,dc=edu objectClass: top objectClass: organizationalUnit ou: policies dn: cn=default,ou=policies,dc=establishment,dc=edu cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 ppolicy_hash_cleartext pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 Password still shows up in clear txt. Thanks

2 1

experiences creating load-balanced/HA OpenLDAP clusters
by David N. Blank-Edelman 17 Jun '11

17 Jun '11

Hi- I'm in the process of building out our next revision of an OpenLDAP cluster (a master, several slaves, and a load balancer HA pair to distribute the workload to these servers). I was curious if anyone who has done a similar thing with open source software would be willing to share their experiences? I've combed the archives and it seems like the last time this topic came up here was around two years ago. I'm not sure the choices have changed much since then, but just in case I thought I'd ask to get a sense of the current "state of the art". At the moment I'm thinking about either doing a Pacemaker + HAproxy setup or just an updated version of our current ultramonkey setup (LVS + heartbeat + ldirectord). Does anybody have a config they particularly like/dislike? Thanks! -- dNb

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical