openldap-technical

openldap-technical@openldap.org

21 participants
9802 discussions

suitable of ldap and openldap
by Ian Willis 27 Mar '11

27 Mar '11

Hi All I'm involved with a project where we're exporting information from a couple of bespoke systems for analytics purposes however there is a degree of sensitivity associated with some of the information. The developers of the analytics system have requested 3 API associated which they would like to have for accessing objects which are as follows. The first two API's would be interactive. 1 Input (user_id, object) output bool whether a user can access the object 2 Input (user_id, (set of objects) output (set of objects a user can access) 3 Input (user_id) output (the set of objects a user can access) or possibly the set that a user can't access. (This API can be a couple of orders of magnitude slower than the previous two as it will only be provided as a response once per session.) We have been considering a URL/URI formal for the object identification. The object will be associated with either a set of users or groups and we're leaning towards groups. Initially there may only be two groups sensitive and general however over time a finer grained model has some longer term business appeal. Rather than create yet another bit of bespoke infrastructure I was considering recommending that the API is implemented using LDAP. The kicker is that there could be up to 2 or 3 hundred million objects split across 4000 or so users broken up into 500 groups. Most of these users currently exist in a Oracle backend for a bespoke app and most of the objects will be exported as rows from the database so essentially a row is an object. The shop is a mixed windows unix/linux shop where the directory is currently AD. The internal developers are primarily MS and one has already suggested putting the objects into AD however I've said that this would probably hose operational systems and wouldn't be such a bright idea. ADAM will be the next suggestion from the MS side and if that occurs I will be suggesting that openldap should be thrown into the mix for a bakeoff on the grounds that the best performing system should provide the service. If this comes to pass I will also be making sure that load times are in scope as well. Based upon the information above 1 Is this completely insane. 2 Any thoughts or suggestions as to the appropriate schemas for implementing this, database backends ie BDB, HDB, malloc replacement etc. LDIF scripts for loading object would be welcome :) On the bright side I do have a 16core sun 4600 at home for doing some initial feasibility work with 32G of RAM. In production I would expect that the limits on memory would be driven by response times and the amount of memory that AMD/intel hardware can support. I would expect that commercial support would need to occur as well however everything is too embryonic at present to push that barrow. My background is from the unix/linux open source area however I haven't really played enough with openldap to be confident of any concepts that I have the opportunity to push. Cheers Ian

2 1

Writing overlays: examples available?
by Marco Pizzoli 26 Mar '11

26 Mar '11

Hi all, I would like to learn how to write an overlay. I'm looking at overlay sources as available in the OpenLDAP package, but they appear to be too complex to me, particularly in not having clear comments/descriptions and, most of all, considering that I'm an occasional C programmer. I ask if someone could send to me their overlay written for very simple goals or even for fun. Some code that I can easily follow and so have an idea of which hook use to do a specific thing. Commented source would be great! :-) Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

How to obtain Operations Attributes
by Suneet Shah 25 Mar '11

25 Mar '11

Hello, I am using the Java JDK 1.6.x to query ldap. I am using the query below. However, I need to be able to pull out the operational attributes as well. Any thoughts on how I can obtain the list of operational attributes without having to specify them? SearchControls searchCtls = new SearchControls(); searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE); NamingEnumeration results = ctx.search( config.getBaseDn(), searchFilter, searchCtls); while (results != null && results.hasMore()) { SearchResult sr = (SearchResult)results.next(); Attributes searchAttrs = sr.getAttributes(); if (searchAttrs != null ) { NamingEnumeration values = searchAttrs.getAll(); while (values.hasMore()) { javax.naming.directory.Attribute atr = (javax.naming.directory.Attribute)values.next(); thanks for your help

3 4

Multimaster ldap related questions
by Cannady, Mike 25 Mar '11

25 Mar '11

I have implemented a multi-master two node ldap with openldap 2.4.22 and Berkely DB 4.8.26 on Redhat enterprise 5.4 with several readonly replicas off of the masters. I have a need to add several optional attributes to a schema and probably should upgrade to 2.4.24 as well. If this was a single-master server, it would be easy to do; just slapcat the ldap store, update software, change schema, slapadd the ldap store back, and resume slapd. I'm not sure how to do that with multi-master. One reason for using multi-master was if one master was down, the other would keep running. One should be able to upgrade one server, have it catch up with the changes that the other master had done while the first master is down and then repeat for the 2nd master. Is this possible? Has anyone done this and how was it done? I know in the near future, a high-level branch on my DIT will be purged and bulk reloaded. I have tested the load with a test setup of multi-master ldap. If I do it via ldapadd, it takes over 6 hours to load. With slapadd (and slapd down) it only takes 25 minutes plus the time for the other master to get up-to-date. Is there any way that I can speed-up the update with ldapadd? I have pieces of my slapd.conf for the 1st master at the end of this email. Slapadd has two options that appear to be needed when dealing with multi-master or replicate nodes. The first is the "-S sid" option, the second is "-w". I'm a little confused what is used where. If you are doing a dump and restore operation (slapcat, delete database, slapadd) the only option you need is the "-w" option? If you are adding new entries offline then do both options need to be specified? Is there a multi-master best practice quide somewhere? Thanks for any help, ============== slapd.conf extract ==============: ServerID 001 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args sizelimit unlimited moduleload ppolicy.1a database bdb suffix "dc=htc,dc=com" rootdn "cn=Manager,dc=htc,dc=com" rootpw XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx directory /usr/local/var/openldap-data cachesize 50000 dncachesize 50000 idlcachesize 150000 checkpoint 1024 5 dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_bsize 2097152 dbconfig set_lg_regionmax 262144 dbconfig set_flags DB_LOG_AUTOREMOVE monitoring on index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq index uniqueIdentifier eq overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=htc,dc=com" syncrepl rid=002 provider=ldap://vmldapdev2.htc.external:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=htc,dc=com" attrs="*,+" bindmethod=simple binddn="uid=vmldapdev1,ou=replicants,ou=admin,dc=htc,dc=com" credentials=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX mirrormode TRUE overlay syncprov syncprov-checkpoint 1000 1 database monitor ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

3 3

deleting values from multivalued attribute
by Hugo Monteiro 25 Mar '11

25 Mar '11

Hello list, is it possible to perform the deletion of only a certain number of values, from a multivalued attribute, without having to perform full deletion and then adding the ones we'd like to keep? example, entry has: mail: user(a)example.com mailAlternateAddress: first.last(a)example.com mailAlternateAddress: flast(a)example.com mailAlternateAddress: firstl(a)example.com I would like to be able to remove flast(a)example.com but keep the rest of the addresses, using a single ldap operation, ending up with mail: user(a)example.com mailAlternateAddress: first.last(a)example.com mailAlternateAddress: firstl(a)example.com Best Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

4 7

Re: syncrepl and mass deletes
by LALOT Dominique 25 Mar '11

25 Mar '11

Yes, but I believe this is not the same case. We are replicating differents datbases instead of subtree into a single database. In case you have two providers, whole refresh is not working. What can I do more to file a report? Thanks Dom 2011/3/24 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Thursday, March 24, 2011 11:44 AM +0100 LALOT Dominique < > dom.lalot(a)gmail.com> wrote: > > Well, >> >> To resume my tests: >> >> provider and consumer in 2.4.24 -> same behaviour >> Get rid of session log -> same behaviour >> >> If I removed one of the providers of my consumer, everything went fine. >> Even, if I stop the consumer during mass deletes, it sync very fast as >> soon as it starts again >> That's related to several providers for one consumer and may be something >> else I don't see. >> The second provider (first rid in my conf) has less that 15 entries and >> no updates at all. >> >> I changed the order of the providers in my slapd.conf. There is no >> difference. >> > > Have you looked at the report in ITS#6872? > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

audit or accesslog remote IP
by Omer Faruk SEN 25 Mar '11

25 Mar '11

Hi, Is there a way to also log IP address of remote system at audit and/or accesslog events. Regards.

2 1

syncrepl and mass deletes
by LALOT Dominique 24 Mar '11

24 Mar '11

Hello, I am testing the replication feature in a multimaster environment replicating into a single database. As stated before, I added serverid to my providers. I just have two providers for test purpose. I tested mass updates on a provider, stopped my replica during updates, then start again and it's OK, it updates the entries If I do the same for mass deletes. I deleted 40000 entries while stopping the consumer. My consumer is still with 30000 undeleted entries. I left the consumer for hours, restarting it twice. It seems there is no regular compare between consumer or provider in such situation. I'll simplify to test in a single provider setup, to see if it works. All servers are 2.4.23 consumer side. A script is populating the DIT via slapadd first to create the dc entries. database bdb suffix "dc=fr" serverid 0x40 ldap://ldapmaitre.univ-yy.fr syncrepl rid=040 provider=ldap://ldapmaitre.univ-yy.fr/ type=refreshAndPersist searchbase="dc=univ-yy,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,+" schemachecking=off bindmethod=simple serverid 0x20 ldap://anutest.univ-xx.fr syncrepl rid=020 provider=ldap://anutest.univ-xx.fr/ type=refreshAndPersist searchbase="dc=univ-xx,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,+" schemachecking=off bindmethod=simple Mar 23 13:29:11 ldaprelay slapd[24319]: @(#) $OpenLDAP: slapd 2.4.23 (Nov 19 2010 17:41:28) $#012#011buildd@allspice :/build/buildd/openldap-2.4.23/debian/build/servers/slapd Mar 23 13:29:11 ldaprelay slapd[24320]: slapd starting Mar 23 13:29:11 ldaprelay slapd[24320]: do_syncrep2: rid=040 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 23 13:29:11 ldaprelay slapd[24320]: do_syncrep2: rid=020 LDAP_RES_INTERMEDIATE - REFRESH_DELETE root@ldaprelay:/etc/ldap# ldapsearch -x -LLL -s base contextcsn dn: dc=fr contextCSN: 20110323101636.221613Z#000000#040#000000 contextCSN: 20110323100346.844382Z#000000#020#000000 Thanks for any hints Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

3 8

Efficient Searching for Groups & its members
by sim123 24 Mar '11

24 Mar '11

Hi All, I am designing LDAP schema and the structure looks like : --ROOT ---- ou = people ------- cn = john smith ---- ou = groups ------ ou = group1 -------- member:john smith ------ ou = group2 -------- member: john smith I would like to find out what all groups john smith belongs to (I have full dn) and all the members of a group. I am wondering about the performance of such search, since one person can be part of multiple groups and there can be thousands of groups in the server. If its a relational database I can create a relationship table and put indexes in place. How can I get best performance with OpenLDAP? Or is there any other way I should design this? Thanks for the help.

3 4

How to compile slapd as static binary
by Marco Pizzoli 23 Mar '11

23 Mar '11

Hi list, could someone tell me how can I obtain a binary slapd with all libraries linked statically in it? I tried mixing many --enable-static / --enable-shared=no etc... without no luck. I also tried invoking make with LTFLAGS="-static" Thanks Marco --

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical