openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Error: CSN too old and replication fails
by Jérémy Wagner 17 Feb '11

17 Feb '11

Hello, I'm facing some issues with syncrepl... The simplest situation in which I was able to reproduce the problem consists of 1 provider and 1 consumer. I have configured syncrepl to do a partial replication : olcSyncrepl: {0}rid=105 provider=ldaps://****:636 bindmethod=simple timeout=0 network-timeout=0 starttls=no filter="(mail=*)" searchbase="ou=groups,o=mydir" scope=sub schemachecking=off attrs="cn description mail member +" type=refreshAndPersist retry="60 +" tls_cert=**** tls_cacert=**** tls_key=**** olcSyncrepl: {1}rid=107 provider=ldaps://****:636 bindmethod=simple timeout=0 network-timeout=0 starttls=no filter="(objectclass=*)" searchbase="ou=operators,o=mydir" scope=sub schemachecking=off type=refreshAndPersist retry="60 +" tls_cert=**** tls_cacert=**** tls_key=**** olcSyncrepl: {2}rid=104 provider=ldaps://****:636 bindmethod=simple timeout=0 network-timeout=0 starttls=no filter="(uid=mytestuser)" searchbase="ou=people,o=mydir" scope=sub schemachecking=off type=refreshAndPersist retry="60 +" tls_cert=**** tls_cacert=**** tls_key=**** The initial sync (i.e. from an empty base) is fine, but then when I modify an entry (uid=mytestuser), it is not updated on the consumer, and I get the following messages: Feb 16 15:42:32 do_syncrep2: rid=107 NEW_COOKIE: rid=107,csn=20110216144232.222152Z#000000#000#000000 Feb 16 15:42:32 do_syncrep2: rid=104 cookie=rid=104,csn=20110216144232.222152Z#000000#000#000000 Feb 16 15:42:32 slap_graduate_commit_csn: removing 0x7fb58c0227d0 20110216144232.222152Z#000000#000#000000 Feb 16 15:42:32 do_syncrep2: rid=104 CSN too old, ignoring 20110216144232.222152Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=105 LDAP_RES_INTERMEDIATE - NEW_COOKIE Feb 16 15:43:05 do_syncrep2: rid=105 NEW_COOKIE: rid=105,csn=20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 slap_queue_csn: queing 0x7fb58c020b50 20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=107 LDAP_RES_INTERMEDIATE - NEW_COOKIE Feb 16 15:43:05 do_syncrep2: rid=107 NEW_COOKIE: rid=107,csn=20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=104 cookie=rid=104,csn=20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 slap_graduate_commit_csn: removing 0x7fb58c0227d0 20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=104 CSN too old, ignoring 20110216144305.545784Z#000000#000#000000 (both servers are perfectly in sync with an NTP daemon) It looks like ITS #6619 is quite similar, and unresolved. What do these messages mean ? Is there a way to force the update ? Regards, Jeremy W.

3 6

ACL Issues
by Troy Knabe 17 Feb '11

17 Feb '11

I am attempting to be very granular in the access that I give to my directory, but I seem to be struggling with the implementation. I have several proxy accounts that I want to grant the access to that they need, no more, no less. But I seem to have to put a line in like: access to dn.children="dc=company,dc=com" by * read in order to authenticate. What I thought I wanted was something like this: access to attrs=userPassword by dn.exact=proxy,dc=company,dc=com write by self write by anonymous auth But without read access above, it does not work. How can I allow proxy users/groups access w/out granting read access to everyone? Or does the dn.children allow read access to all attributes?

3 5

Queries regarding pam_groupdn.
by Meghanand Acharekar 17 Feb '11

17 Feb '11

Hi, I'm using pam_groupdn for restricting access to some for my servers, by defining user groups as follows. /etc/ldap.conf (Redhat 5.5) # Group to enforce membership of pam_groupdn cn=group1,ou=Group,dc=example,dc=com # Group member attribute pam_member_attribute memberUid This works only if the pam_member_attribute is in following format. memberUid: uid=user1,ou=People,dc=example,dc=com memberUid: uid=user2,ou=People,dc=example,dc=com Simply memberUid: user1 is not working, is there any way to fix this. Second, if a user which dose not belong to this group tries to login server, access is denied by displaying following message. You must be a memberUid of cn=group1,ou=Group,dc=example,dc=com to login. Connection closed by x.x.x.x Is it possible to change this message ? Thanks & Regards, Meghanand N. Acharekar

2 2

Aliasing entries with reserved characters
by MJ Hughes 17 Feb '11

17 Feb '11

Hi, I'm an LDAP newbie who has inherited the maintenance of an LDAP system, and am learning on the fly. Until now I've been able to puzzle out all the issues I've faced, but finally my google fu has failed me, so I'm seeking more human assistance. My problem is with reserved characters, such as , (comma). The system wasn't coping with RDNs that contained these characters, but this was easy enough to fix by simply escaping these characters with a backslash. My problem now involves trying to alias entries that contain these escaped characters - I am consistently getting "Invalid DN syntax". This is what the code to add the alias looks like: $operationDN = "aliasedObjectName=" . $this->aliasSafe($aliasDN) . "," . $locDN; $aliasParameterArray = array( "objectClass" => "alias", "aliasedObjectName" => $aliasDN ); $result = ldap_add($this->LDAPcon, $operationDN, $aliasParameterArray); The aliasSafe() function converts "=" => "\3D" and "," => "\," (unless the commas have already been escaped). This produces DNs that have the following (hypothetical) format: $aliasDN: cn=Tomorrow\, When The War Began,cn=books,dc=library,dc=com $operationDN: cn\3DTomorrow\, When The War Began\,cn\3Dbooks\,dc\3Dlibrary\,dc\3Dcom,cn=titles,cn=John Marsden,cn=authors,dc=library,dc=com I've tried every encoding of the comma (in the book name) that I can think of (eg, a single backslash, a double backslash, a triple backslash, and even '\2C') but everything I've tried so far has given me the "Invalid DN syntax" error. Could someone please help me with the syntax and encoding these DNs should have? Thanks, MJ

4 9

Conflict resolution on Syncrepl
by Diego Lima 16 Feb '11

16 Feb '11

Hello all, This is mostly a theoretical question. I currently have some OpenLDAP multimaster clusters (using syncrepl and mirrormode) and although it never happened before, what would happen if two (or more) masters received a write request exactly at the same time? The entry would have the same entryCSN on both servers and the contextCSN would be updated at the same time? Would this lead to a situation where the servers were actually out of sync but they would "think" they had the same entries? -- Diego Lima http://www.diegolima.org

3 4

seeking guidance with back-shell setup
by Elle Y Suzuki 16 Feb '11

16 Feb '11

hello, my thunderbird does not appear to be using back-shell's searchexample.sh..? i have compiled openldap on a desktop windows xp machine with the back-shell backend enabled without threads. slapd.conf is configured as suggested in the file searchexample.conf at http://tinyurl.com/47t9ets. i have added the file searchexample.sh from http://tinyurl.com/4823rtf in the appropriate directory. i start up slapd, /usr/local/libexec/slapd -d 256 -h ldap://localhost and it appears to fire up: $ /usr/local/libexec/slapd -d 256 -h ldap://localhost @(#) $OpenLDAP: slapd 2.4.24 (Feb 14 2011 09:29:58) . . . WARNING: No dynamic config support for database shell. slapd starting i configured thunderbird with a localhost ldap directory server (localhost, port 389), leaving 'base dn' and 'bind dn' blank. in attempting to test this searchexample.sh script, i open a new message and type an entry that i know appears in the /etc/passwd file. i see output in my cygwin window that is running slapd with lines including "BIND", "SRCH", "SEARCH RESULT", etc., but the tbird compose message window's "To:" field shows a "<LDAP server search problem>" which i click on and produces a pop-up with "Error code 32: No such object Verify that the Base DN is correct, and then try again, or else contact your System Administrator. To verify that the Base DN is correct, from the Edit menu, choose Preferences, then choose Mail & Newsgroups, and then choose Addressing. Click Edit Directories, and select the LDAP server being used. Click Edit to display the Base DN." however, if i were to include 'base dn' info in tbird, slapd output reports a 'fatal error' with a stack trace. meanwhile, the slapd output is as follows: conn=1002 op=3 SRCH base="" scope=2 deref=0 filter="(|(cn=suzuki*)(mail=suzuki*) (sn=suzuki*))" conn=1002 op=3 SRCH attr=cn mail conn=1002 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= several questions arise: 1. should 'base dn' and/or 'bind dn' in tbird remain blank for localhost ldap? 2. aside from what is noted in searchexample.conf above, are any of the other lines necessary in slapd.conf (rootdn, index, directory -- slapd complains if directory is made available, despite the referenced file existing). 3. what else can i do to get tbird to make use of the searchexample.sh file and report as such in the slapd output? 4. in running slapd, i see the message, "WARNING: No dynamic config support for database shell" From this (similar) thread, http://tinyurl.com/457tra6 do i understand correctly that i should still be able to utilize a shell backend, then? my current goal is the following: get slapd to run with a shell backend and thunderbird on my local desktop. our team's overall goal is to enable this setup on a linux server: we'd like to eliminate our ldap server and utilize this slapd+back-shell mechanism to access our oracle db for our ldap clients. once we are able to get this all working with back-shell, we'd like to replace the shell role with php scripts. any guidance on this task in general is greatly appreciated. my apologies in advance for any silly questions: i am new to playing with (open)ldap, and have been staring at this problem for much too long. thank you in advance.

2 2

ldap design
by Hendrik van der Ploeg 16 Feb '11

16 Feb '11

Hello People, I'm in doubt what design I need to use for openldap This is the situation; We have 1200+ customers using LDAP. We want to replicate all these ldap server to 1 big ldapserver in a datacentre with a multi-master config. So all the customers are a master-ldap who replicate to the datacentre. My idea was to build in the datacentre a ldapcluster of about 4 server My question is: Will this be stable, because there will be 1200+ ldapservers replicating to 4 ldapserver in the datacentre. I know this depends on the number of write actions at the customers. All I can say is that write actions at the customers isn't THAT much. I really hope somebody can give me an answer or maybe there's somebody else with the same config Best Regards -- Hendrik van der Ploeg

4 3

ldap not respoding
by Prathyush 16 Feb '11

16 Feb '11

HI, Will huge size of slapd.log cause slapd service to hang -- *Regards, Prathyush*

1 0

search LDAP back-sql entry with two objectclasses (structural and auxiliary)
by Andreas Härtel 16 Feb '11

16 Feb '11

Hello, I am running a LDAP server on a debian system with a mySQL database as backend. slapd-version: $OpenLDAP: slapd 2.4.11 (Jul 24 2010 08:14:20) $@murphy:/build/buildd-openldap_2.4.11-1+lenny2-i386-H5BDjb/openldap-2.4.11/debian/build/servers/slapd mysql-version: mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (i486) using readline 5.2 Everything is running fine if I am searching the LDAP tree for data containing only one objectClass (inetOrgPerson). Now I have add a second auxiliary objectClass (mozillaAbPersonAlpha) to my data via ldap_entry_objclasses table in the mySQL database, but a search only results in the three inetOrgPerson fields I have set: ldapsearch -LLL -s sub -b 'ou=contacts,ou=contacts,dc=...' 'objectclass=*' -D 'cn=USER' -w unsafe-password -x dn: ou=contacts,ou=contacts,dc=... objectClass: organizationalUnit objectClass: inetOrgPerson objectClass: mozillaAbPersonAlpha ou: contacts dn: cn=Name Firstname,ou=contacts,ou=contacts,dc=... objectClass: inetOrgPerson cn: Name Firstname sn: Name givenName: Firstname If I switch the dependency in the ldap_entries table from inetOrgPerson to the mozilla scheme, I get the mozilla fields but - e.g. in phpldapadmin - I can not see any data (also in my thunderbird addressbook). My opinion: mozilla scheme is not structural. Perhaps this old mailing-list entry gives an answer but - for me myself - no solution: http://www.openldap.org/lists/openldap-software/200403/msg00303.html Hope, someone has any idea about this problem ... !? Tanks a lot, Andreas My /etc/ldap/slapd.conf file (parts of it): ################################################################# include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/extension.schema include /etc/ldap/schema/mozillaAbPersonAlpha.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_sql sizelimit 500 tool-threads 1 backend hdb backend sql database sql suffix "ou=contacts,ou=contacts,dc=... dbname contacts dbhost localhost dbuser myuser dbpasswd mypassword lastmod off has_ldapinfo_dn_ru no upper_func "upper" access to dn.subtree="ou=contacts,ou=contacts,dc=... by dn="cn=admin,dc=..." peername.ip=127.0.0.1 write by dn="cn=user" read by * none ################################################################# I thought about ataching my database entries but this could be too long. If there should be questions about it, please let me know.

1 1

Re: ldap auth does not works after openldap upgrade
by Andrew Findlay 15 Feb '11

15 Feb '11

On Tue, Feb 15, 2011 at 02:13:40PM -0200, Leonardo Carneiro wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep replies on the list so that other people can benefit from the discussion in future. > > Aha! How many entries did that search return? Was is about the same > > number that you would expect given your users and groups? > yep. they are all there. > > Did you previously have the LDAP server set up to refuse data to > > anonymous users? > No, it could bind as anonymous and read any data. In that case leave the database alone: the problem is in the configuration. Please post the slapd config. We need to see all of it except for any passwords. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical