openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Setting idletimeout based upon bind DN
by Mark 01 Jun '11

01 Jun '11

Is there a way to set idletimeout based upon bind DN (like the limits config option). I'd like to set an idletimeout to drop connections no longer in use, but I don't want to affect my refreshAndPersist syncrepls. Thank you, Mark

2 2

Client expects response to change-password extended operation
by Michael Smith 01 Jun '11

01 Jun '11

I noted some old correspondence about this topic in the mailing-list archives, but now it has bitten me. We have an email server in my shop (from Mirapoint) which offers users an option to change their password. It sends the password-modify extended operation, but the user's session hangs, apparently unless Mirapoint gets a response. I understand that this is non-standard behavior. But unfortunately I'm stuck with this not-very-satisfactory product. Is there any way I can tweak openLDAP to respond to the password-modify ex-op? -- -- Michael J. Smith mjs(a)smithbowen.net http://stopmebeforeivoteagain.org http://www.cars-suck.org http://fakesprogress.blogspot.com

3 2

slapo-rwm to change userPassword attribute into a string
by Lucio Capuani 01 Jun '11

01 Jun '11

That is, in OpenLDAP the userPassword attribute is binary, even when its content is cleartext. I would need to have an extra attribute of "String" type, containing that very password. Is it possible to achieve this by using slapo-rmw (or maybe translucent?), by creating a view that "offers" that "fake" string attribute, rather than being forced to duplicate the real source attribute into a second one, only differently encoded? Thank you so much, -- Lucio

1 1

Valid reasons to choose OpenLDAP over Oracle Directory Server for Linux clients?
by Pieter Baele 01 Jun '11

01 Jun '11

Right now, our primary LDAP systems are Sun Directory Server and AD. All Solaris boxes connect to the Directory Server, but isn't it better to set up seperate OpenLDAP servers for a Linux environment? I am also thinking about customisation. For example, integration with krb, puppet.... Greetings, Pieter Baele

2 1

Should Berkeley DB backends be reloaded occasionally?
by Mark 01 Jun '11

01 Jun '11

Back in the days of OpenLDAP 2.1 with Berkeley DB 4.1.25.3 we used to have to 'reload' out backend database occasionally as non-indexed reads would get slower and slower over time. The 'reload' entailed: - stop slapd - slapcat the contents to an .ldif file - remove the database files - slapadd the .ldif file to create a new, fresh db instance - start slapd Then our performance problems went away. Re-indexing didn't do the trick. Is such occasional re-building of the backend database recommended in OpenLDAP 2.4.25 with Berkeley DB 4.8.30? Thank you, Mark

4 6

"best" way to check if OpenLDAP replication is working
by Tim Gustafson 01 Jun '11

01 Jun '11

Hi, Is there a "best" way to check to see if OpenLDAP replication is working? I have one script that checks the ContextCSN of the root of the database, which works to a certain degree. However, even when that matches it seems that sometimes a "deep inspection" (actually traversing the whole database and comparing each entry individually) of the directory shows differences even when the ContextCSN of the directory root matches. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Tim Gustafson tjg(a)soe.ucsc.edu Baskin School of Engineering 831-459-5354 UC Santa Cruz Baskin Engineering 317B -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

8 11

Re: Should Berkeley DB backends be reloaded occasionally?
by Mark 01 Jun '11

01 Jun '11

Thank you both for your quick response. I understand non-indexed reads will always be slower than indexed, but it was a batch process and I didn't want to incur the overhead of another write-impacting index. I've recently come back to OpenLDAP and so wasn't sure whether the new version's backend became 'fragmented' (for lack of a better term) like the old ones (<=2.1.25) seemed to. I hoped they did not, but I wanted to confirm as I haven't been running 2.4.25 w/BDB 4.8.30 long enough or under enough load yet to tell. I'm glad to hear 'defraging' is not required in newer versions. I will begin testing BDB 5.x as a replacement to our current BDB 4.8.30 backend. Is anyone aware of any technical reasons why one should use 5.1.25 over 4.8.30? On Tue, May 31, 2011 at 5:27 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 31, 2011 4:49 PM -0500 Mark <mah042(a)gmail.com> wrote: > > Back in the days of OpenLDAP 2.1 with Berkeley DB 4.1.25.3 we used to >> have to 'reload' out backend database occasionally as non-indexed reads >> would get slower and slower over time. The 'reload' entailed: >> >> • stop slapd >> • slapcat the contents to an .ldif file >> >> • remove the database files >> • slapadd the .ldif file to create a new, fresh db instance >> • start slapd >> >> Then our performance problems went away. Re-indexing didn't do the trick. >> >> Is such occasional re-building of the backend database recommended in >> OpenLDAP 2.4.25 with Berkeley DB 4.8.30? >> > > No. You are having this problem by running ancient releases of OpenLDAP > and BDB. BTW, BDB 5.x (5.1 and 5.0) are also fully supported by OpenLDAP > 2.4.23 and later. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

slapcating multi-master database to add new multi-master
by Mark 31 May '11

31 May '11

If I wanted to add another multi-master with a unique ServerID to a current set, I've read that in most instances it's best to slapcat one of the current multi-master's data, then slapadd that data into the new multi-master rather than wait for the new mmaster to 'catch up'. Q: Should I do something with the contextCSN at the top of the tree before I import it or will the new server create a new contextCSN using it's own ServerID? Q Should all multi-master instances include a contextCSN for each of the multi-master instances or just a contextCSN for itself? I have a 2-way mmaster duo where each mmaster only has it's own contextCSN. And another 4-way mmaster setup where each mmaster has a 4 contextCSNs, one for each of the mmasters in the group. Thank you, Mark

1 0

replace running LDAP-server in multimaster configuration
by Andreas Haubod 31 May '11

31 May '11

Hello, at the moment, I have running two LDAP-Server (2.4.23) on two sites (AP and Europe) with multi master replication. All is running very well. On both sites will be written from applications to the local LDAP-server and the complete database is replicated to the other site (syncrepl/push). A third LDAP-server (read-only replica) on one site is used to make a backup hourly. The LDAP is stopped an the database is saved with slapcat. Now I want replace one of the LDAP-Server because of better Hardware. So I know, I have two choices: 1) Only setup the new LDAP-Server with a empty Database and wait till the replication is finished 2) Fill the Database with one of the hourly backup and start the server and wait till the replication is finished. What will happen, when I use method 1) and the application write during the (initial) replication to the (for explamle only 2% filled) Database? (I checked the initial replication. It needs about one hour because of the old slow hardware.) Does this work without expecting any problems or should I avoid the writing till the initial replication has finished? When I use method 2) and for example the saved database is 10h old and during this time are many (>10000) changes made in the productive system? Is then this method then recommended or is method 1) better in this situation? Are there any comparison or recommendations for backup/recover and migration in such multi master setups? A second Question I have. Is it possible, to mix the openldap (minor) versions (eg. 2.4.23 and 2.4.25)? I ask this, because I want update the servers on different times. Thanks for help and the great openLDAP !!! Andreas

2 1

Last Bind (Last logon) attribute
by Andy Carlson 31 May '11

31 May '11

As far as I am aware, there is no attribute in the OpenLDAP shema that holds the last logon (or last bind) time or built-in slapd functionality to do so. If I am incorrect, please let me know. If I am correct, I am wondering if there is any way to implement triggers that can be executed when a successful bind operation happens such as executing a shell script that will modify a user-defined attribute that holds a timestamp. Thanks much, Andy Carlson Identity Administrator | Information Systems 312-329-4385

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical