openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

I've broken my installation
by Stuart Bailey 22 Feb '11

22 Feb '11

Hello, I had a working openldap installation that I was developing some PHP to manage. I'm using the ldap_bind PHP call without username & password, so it is an anonymous bond. I decided to have a clean install to verify everything was ok, so copied my ldap config files, and reinstall on a clean system. the problem is that now the anonymous bind will not work. I turned on all debugging, and found the entry: ... do_bind: v3 anonymous bind in the log. I'm guessing this means that anonymous bind is enabled, but still my PHP code will not bind. I'm not sure where to start to look for the problem. Could someone please point me in the right direction. I can supply logs and configs once I know where to look and what to send. Many thanks, Stuart -- Stuart Bailey BSc (hons) CEng CITP MBCS LinuSoft (Managing Director) Linux Specialist & Software Developer ~~~~~~~~~~~~~~~~~~~~~~~ Phone: (0845) 658 3563 Direct: +44 (0)1953 878162 Fax: +44 (0) 1603 858583 ~~~~~~~~~~~~~~~~~~~~~~~ http://www.linusoft.co.uk http://www.bluetoothadvertising.org.uk -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

merging local and remote attributes
by Hugo Monteiro 22 Feb '11

22 Feb '11

Hello list, I have been trying to use translucent overlay to merge attributes between a remote and a local server (both 2.4.23). From the slapo-translucent man page i read: "Attributes may be specified as both local and remote if desired." and "In any case, both the local and remote entries corresponding to a search result will be merged before being returned to the client." The thing is that if i specify an attribute (objectclass) to be both local and remote, i can only get/search for the local entries. Choosing either separately will work as advertised though. Again, i ask if this is a bug, a subtlety i have missed or this is not supposed to work with objectClass attribute? Please advise, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 3

Ipad/iPhone ldap setup
by Chris Jackson 21 Feb '11

21 Feb '11

I am having trouble accessing my openldap server over SSL using an iPhone/iPad/iPod Touch using ios 4.2.1. If I check the SSL box in the client setup on the iPhone/iPad/iPod Touch I get an error in the slapd log -- TLS negotiation Failure. With logging level 9 I get TLS accept failure error=-1 id=1. Other clients work fine over SSL/StartTLS. Outlook, addressbook in osX 10.6, jxplorer. I am using openldap 2.4.19-15 on RHEL6 with a comodo wildcard SSL cert. Chris Jackson

2 1

Re: BDB performance issue
by amolkulkarni＠gmx.com 21 Feb '11

21 Feb '11

Hi, I was not certain abt what info to put so I've given below all the info that I could gather. Kindly tell me if you require anything else. openldap = symas-openldap-silver-2.4-12.1 bdb = bundled with symas ( 4.6 ) configuration in slapd.conf *cachesize 427275* *idlcachesize 427275* (there are approx 427275 entries in the db so i've that as the cachesize.) *threads 2* (this is a server which has web applications also running. so we have reduced openldap threads to 2.) *sizelimit 1000 checkpoint 10240 10 lastmod on idletimeout 120 timelimit 360 gentlehup on* in DB_CONFIG, *set_cachesize 0 1985642496 1* (The total size of all .bdb files is 1813643264 bytes) cat /proc/cpuinfo shows 7 cpus. It has 4gb ram and 8gb swap. Thanks and Regards, Amol. ----- Original Message ----- From: Quanah Gibson-Mount Sent: 02/18/11 11:20 PM To: Amol Kulkarni, openldap-technical(a)openldap.org Subject: Re: BDB performance issue --On Friday, February 18, 2011 7:00 AM +0000 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > Hi All, > I'm a newbie with bdb - and I have a server not performing well - > openldap shows high cpu usage and iowait of server is high. So I got > stats of bdb but I'm not sure what to make out of it. With help of > google I could see that the basic parameters like requested pages and > locks are ok. But there are other parameters which are suspect. > The output of db_stat -c is as follows : > Are the lines in red really prbs or just side effects ? How do I go abt > it ? Yes, those are definitely issues that need addressing. Unfortunately, you don't really provide any useful information that would help with resolving it. You also completely fail to note: OpenLDAP version BDB version --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Add GSSAPI to RootDSE ?
by Fabien COMBERNOUS 21 Feb '11

21 Feb '11

Hi the list, I want to add a supportedSASLMechanisms in my rootDSE : Today, i have all of this : ldapsearch -LLL -b "" -s base -x '(objectclass=*)' supportedSASLMechanisms dn: supportedSASLMechanisms: NTLM supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 I want to add GSSAPI. To add this i created the following ldif file : cat /tmp/rootDSE dn: changetype: modify add: supportedSASLMechanisms supportedSASLMechanisms: GSSAPI Then with simple autentication (-x) i used my testing olcRootDN to modify the rootDSE : ldapadd -f /tmp/rootDSE -x -D "cn=admin,dc=server,dc=lan" -W Enter LDAP Password: modifying entry "" ldap_modify: Server is unwilling to perform (53) additional info: modify upon the root DSE not supported What i'm missing ? Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

3 3

slapd will not start with inetorgperson
by Tim Dunphy 20 Feb '11

20 Feb '11

hello list!! I am building an ldap server on freebsd 8.1. For some reason if I include the inetorgperson schema in my slapd.conf slapd will not start here is the listing in slapd.conf # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/inetorgpreson.schema I do not know why this is the case as I can ls the file: [root@LBSD2:/usr/local/etc/openldap] #ls -l /usr/local/etc/openldap/schema/inetorgperson.schema -r--r--r-- 1 root wheel 6360 Feb 21 03:13 /usr/local/etc/openldap/schema/inetorgperson.schema If I comment out the inetorg schema slapd starts. And it looks like the ownership and permissions are the same as they are on the schema that is currently working: [root@LBSD2:/usr/local/etc/openldap] #ls -l /usr/local/etc/openldap/schema/core.schema -r--r--r-- 1 root wheel 20583 Feb 21 03:13 /usr/local/etc/openldap/schema/core.schema Boy would I love to get this working again! :) thanks for your help! -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 2

Re: ldap auth does not works after openldap upgrade
by Andrew Findlay 20 Feb '11

20 Feb '11

On Tue, Feb 15, 2011 at 04:04:57PM -0200, Leonardo Carneiro wrote: > Hmm, still did not worked. > > If i do a ldapsearch specifying '-D cn=root,dc=dominio,dc=com,dc=br" and the > password, the search goes ok. if i do not specify, is asks me for a sasl/md5 > authentication and fails, and just asks for a password. if i include a '-x' > parameter, also does not work: > > chester@reploid:~$ ldapsearch -v -h 192.168.0.2 -b "dc=dominio,dc=com,dc=br" > '(objectclass=*)' -LLL -x > ldap_initialize( ldap://192.168.0.2 ) > filter: (objectclass=*) > requesting: All userApplication attributes > No such object (32) You always need the -x flag. (You can only leave it out if you supply SASL credentials, and that is a complexity we do not need right now). It seems that anon users still cannot see the suffix entry at all. Try adding this line just under your 'lastmod off' line: access to * by * read Make sure that you restart the slapd process after doing this. Then try the search: ldapsearch -x -v -h 192.168.0.2 -b "dc=dominio,dc=com,dc=br" '(objectclass=*)' If you still get nothing, set SLAPD_OPTIONS="-d 128" in /etc/default/slapd and restart the server. It should not go into the background, and should produce some output on the screen. DO NOT REBOOT with this setting in place. Now retry just the search above, and post the debug output along with the new state of the slapd config file. Remove the "-d 128" again. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

8 30

Slapd Security based on port
by Chris Jackson 20 Feb '11

20 Feb '11

Is it possible to prevent anonymous and unauthenticated binds to ldaps:// 636 but allow them on ldap:// 389? I want to allow staff to query my ldaps:// outside of my network while requiring them to login to do so but allow anyone to bind (anonymous, unauthenticated, or authenticated) internally on ldaps//: 389. I know: Anonymous bind can be disabled by "disallow bind_anon" and Unauthenticated bind mechanism is disabled by default. But if I use "disallow bind_anon it stops in on both ports. I want to stop it just on ldaps://. Chris Jackson

8 13

Ldap with GroupOfUniqueNames + PosixGroups
by Alejandro Gándara Álvarez 20 Feb '11

20 Feb '11

Hi list, I´m using slapd 2.4.11-1+lenny1, until now I was being using posixgroup as objectclass for my groups, now we need to integrate ldap with a new application which requires GroupofUniquesnames as objectclass. My question is, can I have mix groups?. I mean, a group with two objectclass as posixgroup and GroupofUniquenames. I´ve tried but I always get errors because of conflict with both objectclass. And I cant delete posixgroup objectclass because I need it to integrate with samba and other services. Could someone head me to the right way? Thanks for all Alejandro Gándara

3 5

Re: threads and concurrency
by Omer Faruk SEN 19 Feb '11

19 Feb '11

Hi, This system has 32 GB of RAM additionally OS is RHEL 5. And this system is 16 core. I see new threads are created as the load increases and I have re-checked my system and thread count is now 28. So I think at most 32 threads is fine for me Regards. On Sun, Feb 20, 2011 at 5:03 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, February 19, 2011 6:32 PM -0800 Howard Chu <hyc(a)symas.com> > wrote: > >> Omer Faruk SEN wrote: >>> >>> Hi , >>> >>> I have and ldap server (openldap-2.4.23 ) in slapd.conf I set >>> >>> concurrency 8192 >>> threads 256 > >> Keep in mind that each thread uses a thread stack of 4MB on 32 bit >> systems, 8MB on 64 bit systems. So you're looking at 1-2GB of RAM >> dedicated to the threads with a setting like this. Make sure you don't >> configure more threads than you have RAM for... > > I would add that your threads setting is likely a rather insane value unless > you have 256*4 cores (1024 core box). You generally don't need to set the > threads value higher than 8 or 16. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical