openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

openLDAP C++ API
by sim123 04 Mar '11

04 Mar '11

Hi, I am evaluating openLDAP and need to perform ldapsearch from C++ program. I looked at openLDAP C++ API, however README says its an unstable release. So just wanted to understand, is it ok to use that API in production environment? Is anyone using it? If there is any other library for C++ and openLDAP, please point me to that. Would really appreciate any suggestions! Thanks.

2 1

objectclasses as part of schema file
by Aleksandar Stoisavljevic 03 Mar '11

03 Mar '11

Hi all, as a almost newby with openLDAP, I encounter following problem and would like if there is someone to help me to clarify few things. So the state of a problem follows. I have request from a client (e.g. client name as foo) to establish LDAP provider at my office while we are in process of development and once we are ready for acceptance then we will move our software to client machines. Therefore I have a requirement to support user management using IBM Tivoly DS. Since I am not willing to pay for such solution and having in mind that LDAP providers should support common LDAP protocol and last I have a little knowledge how to set-up openLDAP I've decided to go with openLDAP while we are at development. Now since they have some legacy directory structure, I've asked them to export existing data and to give me that file so I can import in LDAP. But as may guessed that would be the easy and often in practice this is not the case. I've noticed that exported LDIF file contain some "custom" objectClasses and was under impression that this was something related to Tivoly DS. But after further investigation I was wondering if it is the case why I can have those objectClasses as well ??? Reading more on this theme, and in a communication with a client (legacy code was done by some external 3rd party company) I've came to conclusion that client has custom schema files. Let's call them foo.schema and foo_v3.schema So two of them and now I thought that all of my problems are gone. My intention was to change slapd.conf file so that these two are now included (include directive in the the top of the slapd.conf file). So I have places these two files in /etc/openldap/schema directory and added these two lines in slapd.conf include /etc/openldap/schema/foo.schema include /etc/openldap/schema/foo_v3.schema As I've learned on my previous project that I have worked with openLDAP, now I have started slaptest command: slaptest -d 4095 -f /etc/openldap/slapd.conf And I've got following error (this is just a example, please be aware that names are different due to NDA): eading config file /etc/openldap/schema/foo_v3.schema line 1 (objectClasses {) /etc/openldap/schema/foo_v3.schema: line 1: unknown directive <objectClasses> inside backend database definition (ignored). And if I post here you the start of this foo_v3.schema the first line really starts with: objectClasses { ( 1.3.18.0.2.6.398 NAME 'os400-root' DESC 'Root node for OS/400 system projection suffix.' SUP top STRUCTURAL MAY os400-sys ) ( 1.3.18.0.2.6.399 NAME 'os400-usrprf' DESC 'Projected OS/400 user profile.' SUP top STRUCTURAL MUST os400-profile MAY userPassword ) ... To be honest, all examples that I have encounter (openLDAP and Apache DS) that was addressing customizing schema NEVER HAD objectClasses, but rather objectClass. And finally my question is, Is this what I am trying to do really feasable, and if it is what is wrong with this foo_v3.schema file and why this is not working ? Thank you for help -- Aleksandar dipl. ing. Stoisavljevic Software Developer mobile: +381 (0) 64 211 50 40 Web: http://www.staleksit.in.rs E-mail:staleks@gmail.com SkypeId: staleks_ns Mail: Branislava Nusica 10, 21000 Novi Sad, Serbia

3 2

Problem unexpected failing slapd
by Ruud Baart 03 Mar '11

03 Mar '11

Problem: For a customer we use LDAP for many years. Last year suddenly the slapd service just stopped without any traces in the logfiles. After a restart of slapd everything works fine again. But the problem was there: it was not an incident, now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server. Environment: - Several (debian squeeze) servers , several windows servers. We use bdb database backend. - There is one master LDAP server which provides syncprov and two replica's LDAP servers (syncrepl). The master server is most intens used (mainly samba as primary domain controller: a few hundred useraccounts, lot of groupaccounts, workstations, acl's, etc.), one of the replica's is not very busy but handles the mail for all users (lookup: amavis, postfix, courier-imap, mailaccount settings etc). The third replica is not busy at all, it is a remote location. - Total LDAP is 3700 dn's, slapcat produces a file of 7,3 Mb. - It is only the master LDAP with stops suddenly. I have never seen a failure of a replica LDAP. Because I have no clear idea about the problem I have no idea which technical details are relevant: DB_CONFIG =========== set_cachesize 0 10485760 1 set_lk_max_objects 10000 set_lk_max_locks 10000 set_lk_max_lockers 10000 set_lg_dir /home/ldap-dbd The database is stored on a ext3 filesystem, kernel 2.6.32. The server has no problems, plenty of memory and a fast diskarray (SAS->SATA). Never technical problems with this server. And it worked without problems for a long period. Nothing has changed to the environment or the LDAP setup (except of course with the upgrade to debian squeeze but the problem was already there). What we have tried: - upgrade from openldap 2..4.17 (debian lenny+backports) to openldap 2.4.23 (debian squeeze). I saw in the release notes that problems related to syncrepl were solved. Therefor we waited for version 2.4.23 te become available in debian. This upgrade made no difference. - reindex, rebuilt the directory. When I rebuilt the LDAP with a clean LDIF file on the master LDAP or an other machine with ldapadd there is not one error or warning. The workaround for the moment: I have written a process monitor (perl daemon) which monitors the slapd daemon and if it suddenly stops, slapd is restarted. It is of course not a solution but the 300 user can work. If slapd stops without a restart within 1 minute a few hundred people can't work because samba stops working. I would like to receive suggestions what we can do to find the problem. Because there is no pattern, nothing in the logfiles I don't know where to start. -- Regards, Ruud Baart

5 12

Re: Slapd restarting slowly
by Buchan Milne 02 Mar '11

02 Mar '11

----- "Joe Tseng" <joe_tseng(a)hotmail.com> wrote: > I found the link below that sounds exactly like my problem: > > https://bugzilla.redhat.com/show_bug.cgi?id=553032 Seems RH hasn't figured it out yet ... > > I did notice httpd was hung. I configured it so it'd auth against > LDAP for > my SVN repos; It has nothing to do with whether the service itself does anything with LDAP, only if it runs as non-root and your nss_ldap configuration is broken. > it started right up by hand after slapd was running. My > > rpcidmapd also hung - is there a dependency there too? With 'bind_policy hard', or without 'bind_policy soft', and the LDAP host/uri configured in /etc/ldap.conf not available, compare the behaviour of: $ getent passwd nobody and $ groups nobody (BTW., some distros default bind_policy to 'soft' ...) Regards, Buchan

1 0

Slapd restarting slowly
by Joe Tseng 02 Mar '11

02 Mar '11

I recently set up a file server using Fedora and I configured it to run as a PDC with Samba and OpenLDAP. It had been running very smoothly until just last night when I discovered when I tried to restart the slapd service it would just sit there for a few minutes. After it did start I looked in /var/log/messages to see if I could glean some clues; it seems as part of "service slapd start" the system would request information from slapd in order to restart slapd. Seems pretty circular to me... I did not note any type of success message when slapd finally did wake up from suspended animation. I did not set slapd to generate a log file previously but after I put in that parameter in slapd.conf and restarted the service I still didn't get any output. I did get this from /var/log/messages: $ sudo tail -f /var/log/messages Feb 28 21:00:11 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Feb 28 21:00:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:00:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:00:15 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Feb 28 21:00:23 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:00:23 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:00:23 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Feb 28 21:00:39 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:00:39 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:00:39 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)... Feb 28 21:01:11 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:01:11 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:01:11 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... Feb 28 21:02:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:15 server0 slapd: nss_ldap: could not search LDAP server - Server is unavailable Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Feb 28 21:02:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:19 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Feb 28 21:02:27 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:27 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:27 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Feb 28 21:02:43 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:43 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:43 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)... Feb 28 21:02:50 server0 smbd_audit: jtseng|10.1.0.106|create_file|fail (Is a directory)|0x20089|pictures Feb 28 21:02:50 server0 smbd_audit: jtseng|10.1.0.106|create_file|fail (Is a directory)|0x20089|pictures/porsche918 Feb 28 21:03:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:03:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:03:15 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... Feb 28 21:04:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:04:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:04:19 server0 slapd[5555]: nss_ldap: could not search LDAP server - Server is unavailable I stopped the log when slapd was up and running: $ sudo service slapd restart Stopping slapd: [ OK ] Starting slapd: [ OK ] $ sudo service slapd status slapd (pid 5726) is running... $ ps -ef | grep slapd ldap 5726 1 0 21:04 ? 00:00:00 /usr/sbin/slapd -h ldap:/// -u ldap jtseng 5756 5501 0 21:05 pts/2 00:00:00 grep slapd My includes for slapd are as follows: include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/autofs.schema include /etc/openldap/schema/ldapns.schema I imagine I won't need all of those but aside from core, inetorgperson, openldap, samba, autofs and ldapns I wouldn't know what I can discard. I know including various schemas can add to the boot time but this has not shown itself to be a problem in the recent past. As far as users are concerned it's just me, the wife, my son and three workstations. I hope someone can clue me in... Thanks. - Joe

3 3

OpenLDAP, Kerberos, Samba, PAM, How Do They Work Together?
by Nan Meng 02 Mar '11

02 Mar '11

Dear list members, I hope amateur questions could be tolerated. I would make it professional if I could. I'm a newbie to OpenLDAP and probably even Linux, but I have to take care of an office network (Linux servers with Linux and PC workstations) that features email server, domain control, file/printer sharing, user account management, web servers and so forth, on my own without anyone's help. Yesterday morning the power went down and so did our servers. After I turned the servers back on, the account information system was no longer working. Users weren't able to login with their credentials anymore, even the root. What I did was I logged in the server (the Samba PDC, LDAP server, Kerberos server, domain controller, email server) with single mode, reseted the root password, and added accounts for other individual users on the server. I know it was a bad idea. Although I got some things working (emails, file/printer sharing), but there are still other problems (PHP ldap_bind() from web servers fails, domain user accounts and profiles fail to load correctly). I know there is a centralized mechanism that handles user accounts with the help of OpenLDAP, Kerberos, Samba, BerkeleyDB (and possibly other things), but I don't have a clue of how they work together. I've been trying to learn from docs and books for a long time before this power issue, but not very successful. My greatest problem is that I don't know how these things are working together on my system. I believe I also lack some fundamental system knowledge. I've been reading the docs available, but they're so abstract to me and none of them seems to match our system configuration. I'm hoping that I can get some help from here. Maybe some one can give me some suggestions on how to troubleshoot in such a scenario as a newbie, or an entry point that I can follow in order to explore the system. I believe you can tell that I'm totally confused here without being able to give much useful information about the problem and the system. I'm sorry for my ignorance, but I really tried to deal with it myself. If this thread turns out to be annoying or ridiculous, please ignore, and I do apologize. However, while I'm still struggling on the problem, if anyone could help, I would really appreciate it. Thank you so much. N.M.

3 2

slapd 2.2.24 will not start as non root user
by Iain M Conochie 02 Mar '11

02 Mar '11

Good Afternoon, I am attempting to upgrade my openldap 2.4.x installation to the latest release 2.4.24. I am compiling from source. I can start slapd as the root user but I am unable to start as a non-root user (e.g. ldap). I am receiving the following error message: /opt/openldap/libexec/slapd -u ldap -g ldap -h ldap://XXXXX.XXXXXXXX.XXX slapd: sbind.c:76: ldap_simple_bind: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed. Aborted Is the server attempting to bind to another ldap server? This is the "secondary" server on the network an I have the main LDAP server in /etc/ldap.conf. Running an strace I do see slapd referencing this file: open("/etc/ldap.conf", O_RDONLY) = 8 fstat64(8, {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 fstat64(8, {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fa1000 read(8, "#\n# LDAP Defaults\n#\n\n# See ldap."..., 4096) = 919 read(8, "", 4096) = 0 close(8) = 0 munmap(0xb7fa1000, 4096) = 0 stat64("/etc/ldap.conf", {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 geteuid32() = 0 brk(0x82b2000) = 0x82b2000 stat64("/etc/ldap.conf", {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 geteuid32() = 0 write(2, "slapd: sbind.c:76: ldap_simple_b"..., 95slapd: sbind.c:76: ldap_simple_bind: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed. ) = 95 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(9691, 9691, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 9691 detached Does anyone have any ideas here? Regards Iain M Conochie

4 10

openldap does not want to write log files?
by Mauricio Tavares 01 Mar '11

01 Mar '11

I am feeling rather confused here. I installed openldap in a solaris10/sparc box but I do not seem to persuade it to write to a log file. FYI, right now I am running slapd as root so permissions AFAIk should not be the issue. FYI, syslog here is the old, non-rsyslog/syslog-ng variety. So, in the /etc/syslog.conf file I have: local4.info /var/log/ldap.log local4.err /var/log/ldap.log local4.notice /var/log/ldap.log which makes me think I should be covering every possible message sent by slapd. Now /var/log/ldap.log is created as -rw------- 1 root sys 0 Feb 28 16:21 ldap.log and in the slapd.conf file I have loglevel 11560 logfile /var/log/slapd.log which not only should mean slapd is blabbing a lot to the log file. Also note I am telling it to write to /var/log/slapd.log, -rw------- 1 root sys 0 Mar 1 07:39 slapd.log When I start slapd (after restarting syslog just in case), nothing is written to those two log files. In fact, the only clue that something happened is the data in slapd.log changed: -rw------- 1 root sys 0 Feb 28 16:21 ldap.log -rw------- 1 root sys 0 Mar 1 07:40 slapd.log Anything I am missing here?

5 8

multiple certificates on one LDAP server
by Yann CUEFF 01 Mar '11

01 Mar '11

Hello, Is someone know how to use multiple certificates on one LDAP Server ? I need to use Thawte/Verisign SSL certificate and self signed SSL certificate on one LDAP server. I don't find any information about that. Regards, Yann Ce message et toutes les pièces jointes (ci-après le 'Message') sont établis à l'intention exclusive des destinataires et les informations qui y figurent sont strictement confidentielles. Toute utilisation de ce Message non conforme à sa destination, toute diffusion ou toute publication totale ou partielle, est interdite sauf autorisation expresse. Si vous n'êtes pas le destinataire de ce Message, il vous est interdit de le copier, de le faire suivre, de le divulguer ou d'en utiliser tout ou partie. Si vous avez reçu ce Message par erreur, merci de le supprimer de votre système, ainsi que toutes ses copies, et de n'en garder aucune trace sur quelque support que ce soit. Nous vous remercions également d'en avertir immédiatement l'expéditeur par retour du message. Il est impossible de garantir que les communications par messagerie électronique arrivent en temps utile, sont sécurisées ou dénuées de toute erreur ou virus. ____________________________________________________ This message and any attachments (the 'Message') are intended solely for the addressees. The information contained in this Message is confidential. Any use of information contained in this Message not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. If you are not the addressee, you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return message. E-mail communication cannot be guaranteed to be timely secure, error or virus-free.

1 0

Poor performance on Solaris
by Juergen.Sprenger＠swisscom.com 01 Mar '11

01 Mar '11

Hi, we had some performance issues on our ldap servers running Solaris 10 sparc. I did some tests using slamd http://www.slamd.com/ and got disturbing results: ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, identical content. box1: hardware: Sun Microsystems sun4v SPARC Enterprise T5120 memory:32 GB RAM os: Solaris 10 s10s_u9wos_14a searches (avg/second): 1521 box2: hardware: AMD 64 phenom 9850 memory: 8 GB RAM os: Linux dsv00000 2.6.36.2 #1 SMP Mon Dec 27 10:09:29 CET 2010 x86_64 AMD Phenom(tm) 9850 Quad-Core Processor AuthenticAMD GNU/Linux searches (avg/second): 22968 I am looking for some hints to improve performance on box1 to a similar level as on box2 or an explanation why on box1 performance is so bad. As slapd.conf, ldap.conf and DB_CONFIG are identical there should not be such a big gap in performance. Juergen Sprenger

7 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical