openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Which backend should I use?
by Olivier PAVILLA 04 Feb '11

04 Feb '11

Hi. I need your advice again :) I have LDAP server with ldbm database on a fedora core 5 which is running for more than 3 years without any update nor upgrade neither. So now I've to migate this old LDAP on a new server with new Linux distribution (Debian Lenny). I'm tune up both /etc/ldap/slapd.conf and /var/lib/ldap/DB_CONFIG. But right now I read on a website (http://linagora.org/contrib/annuaires/documentations/openldap_guide_install…) that backend bdb will disappear. Should I use backend hdb or it doesn't make something different? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-ørleans.fr http://blog.linux-squad.com - 僕の傑作です。

4 5

Re: Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by masarati＠aero.polimi.it 03 Feb '11

03 Feb '11

> Well now the issue I run into is slapd crashing when I also configure > proxy > caching. It stops when trying to Initialize the BDB database: > > slap_sasl_init: initialized! > bdb_back_initialize: initialize BDB backend > bdb_back_initialize: Berkeley DB 4.8.30: (April 9, 2010) > hdb_back_initialize: initialize HDB backend > hdb_back_initialize: Berkeley DB 4.8.30: (April 9, 2010) >>>> dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu> > <<< dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu>, <dc=ad,dc=mydomain,dc=edu> >>>> dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu> > <<< dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu>, <dc=ad,dc=mydomain,dc=edu> > ldap_url_parse_ext(ldap://ldapadlb.mydomain.edu/dc=ad,dc=mydomain,dc=edu) >>>> dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu> > <<< dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu>, <dc=ad,dc=mydomain,dc=edu> > bdb_db_init: Initializing BDB database > slapd-ldap destroy: freeing system resources. > slapd stopped. > connections_destroy: nothing to destroy. > > overlay pcache > proxycache bdb 10000 1 50 100 > proxyattrset 0 uid > proxytemplate * 0 0 > directory /usr/local/var/openldap-data > cachesize 100 Please direct software usage questions to the list. I suspect a misconfiguration; try starting slapd -with d config. p.

2 4

ldap_bind: Invalid credentials (49)
by John Espiro 03 Feb '11

03 Feb '11

System: Ubuntu 10.10 server 64bit @(#) $OpenLDAP: slapd 2.4.23 (Nov 19 2010 17:41:28) $ buildd@allspice:/build/buildd/openldap-2.4.23/debian/build/servers/slapd Problem: I am following the guide here: http://blog.suretecsystems.com/archives/163-OpenLDAP-Quick-Tips-Change-logl… Entering: ldapmodify -x -D 'cn=config' -W -f log.ldif Gives me: Enter LDAP Password: ldap_bind: Invalid credentials (49) I enter the password (that is also stored in ldap.secret), but the error persists. I've got to be missing something obvious, but it's not clear what that is... John

5 6

"Tagging" and Data Access: a request for advice and help
by Gervase Markham 03 Feb '11

03 Feb '11

[I hope this message is on-topic for this list; if not, please can you tell me where I can get some advice?] I am writing a new bit of Mozilla software called Domesday, which is a community directory: http://wiki.mozilla.org/Domesday We hope to scale it beyond 100,000, perhaps up to 1M users eventually. The aim is to help our community know each other better. One route is to use a directory for the back end, as directories are designed to store data about people. I am investigating this. So far, it seems that the inetOrgPerson objectclass, with another auxiliary objectClass for a few extra attributes we want, would be the way to go. However, Domesday has a couple of unusual requirements. 1) Tagging Firstly, I want to support "tagging". Each user can have a number (possibly large) of user-defined tags, and it must be possible to search easily and efficiently for "all users with tag X" or "all users with a tag which has prefix Y" (so we can support multipart tags, e.g. l10n:es for Spanish localizers) but also for "all tags for user Z". I anticipate there being thousands of tags. At the moment, having read just enough to be dangerous, I think I might be able to do this using objects under a common dn (dc=org,dc=mozillians,dc=tags, say) with the groupOfNames objectclass, with cn=<tagName> and member=<dn> for each member. Is that the right way to go? Does it allow easy searching for "all tags for user Z"? 2) Data Access Domesday is a very privacy-conscious application. While the UI might not permit quite as much flexibility, I want to support attribute-level control of data access, where each attribute on a person is associated with a tag (see above) and only people with that tag can see that attribute. If there are 100,000 people and maybe 10-20 items of data per person, that's a lot of access control. Having read the Access Control documentation: http://www.openldap.org/doc/admin24/access-control.html it seems that dynamic configuration would be the only workable choice. However, I am not entirely sure this can be done or, if it can, that it can be done in a performant way. It would need a lot of olcAccess attributes! So you can see how my two problems are intertwined :-) Can people please advise me on how best to achieve these two particular goals using OpenLDAP? Thanks, Gerv

2 2

Logging to syslog
by John Espiro 02 Feb '11

02 Feb '11

I have tied in a few things such as openid-ldap and openfire to use my ldap backend for authentication. I am wondering if it is possible to collect error logs for any invalid attempt that a user tries with these various applications. Rather than handling it at the application level, can I get openldap to log these events? If so, can someone point me to a link that explains it? Thanks, John

5 7

RE: Logging to syslog
by Chris Jacobs 02 Feb '11

02 Feb '11

Please reply to all (include the thread). If you lack a slapd.conf (or slapd.d) it sounds like you're NOT working on an ldap server, but rather a client. In that case, you'd check /var/log/security, etc - where the tools you're using log (like ssh, pam, etc). If there's a slapd.d dir, then you'd need to use ldapmodify to add the loglevel to your config. To get those logs to syslog, you'd need to add to syslog.conf: # Log Openldap stuff (ldap servers only) local4.* -/var/log/openldap - chris -----Original Message----- From: John Espiro [mailto:john_espiro@yahoo.com] Sent: Wednesday, February 02, 2011 12:37 PM To: Chris Jacobs Subject: Re: Logging to syslog On 2/2/2011 9:01 PM, Chris Jacobs wrote: > John, > > Are you attempting to log on a client? > > - chris Hi Chris - I don't understand your question - in what context are you talking about? John This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

3 3

slapindex Required or Not
by ldap＠mm.st 02 Feb '11

02 Feb '11

I am in the process of rebuilding our ldap servers that are many years old to run on RH5. I basically took the existing slapd.conf file from the old server and am using it on the new server (minor changes). I did a slapcat on the old server, modified the schema a little and did a slapadd on the new. Systems seem to be able to authenticate against the new test server and things seem to function corretly. For now, the db backend is ldbm. It has the following index statements: index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial I'm unclear of when and if it is required to run slapindex on the new server. Is this something that should be done after slapadd and should it be done on a regular basis? I assume you should stop slapd when this is run.

2 3

Running back-perl and hdb/bdb in the same suffix
by José Miguel Parrella Romero 02 Feb '11

02 Feb '11

Hi, I've written a Perl class to be used with back-perl. I'm able to load this class from slapd.conf using a different suffix than my traditional hdb database. Say, for example, my hdb database is serving the dc=my,dc=net suffix, and my Perl is serving dc=perl,dc=my,dc=net. This effectively prevents me from "catching" user password modifications in dc=my,dc=net. If I use the subordinate keyword on my Perl database I'm able to see searches spanning through my dc=perl,dc=my,dc=net, but then again, modifications on users in dc=my,dc=net aren't seen by the Perl backend. I've tried different approaches for this, but as of now I guess my only chance is to actually "proxy" the LDAP operations from Perl using the LDAP library to the dc=my,dc=net suffix in order to get a seamless experience and achieve my goal of user password manipulation. This is what I've seen in (really old) projects such as acctsync in Sourceforge. So, my question is: can I use both backends in the same suffix, so only some LDAP operations get overriden in Perl and others "pass through" the physical backend? And if not, what would be your strategy to achieve this goal? My last plan is to store passwords in plaintext, create an ACL to prevent everyone but a non-human role to read userPassword and move along, but I'd feel terrible about this. By the way, thanks for making such an awesome piece of software. Jose

1 0

slapadd: could not add entry dn="cn=plc1, ou=groups, dc=orleans-tours, dc=iufm, dc=fr" (line=53343): txn_aborted! Internal error (80)
by Olivier PAVILLA 02 Feb '11

02 Feb '11

Hi everyone I met some difficulties to import ldif to my ldap On the old LDAP I did [root@luz ~]# /etc/init.d/crond stop Ce qui donne Arrêt de crond : [ OK ] [root@luz ~]# /etc/init.d/ldap stop Ce qui donne Arrêt de slapd : [ OK ] After that I did #slapindex And after [root@luz ~]# slapcat > /root/sauvegarde_luz_new.ldif I uploaded on the new server And I did that luz:~/setup# slapadd -l sauvegarde_luz_new.ldif bdb(dc=orleans-tours,dc=iufm,dc=fr): Lock table is out of available locks => bdb_idl_insert_key: c_get failed: Cannot allocate memory (12) => bdb_tool_entry_put: index_entry_add failed: Internal error (80) => bdb_tool_entry_put: txn_aborted! Internal error (80) slapadd: could not add entry dn="cn=plc1,ou=groups,dc=orleans-tours,dc=iufm,dc=fr" (line=53343): txn_aborted! Internal error (80) Someone can tell me what does this message mean? I don't understand this message error then I don't know what should I do. -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-ørleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

2 1

Do I need using slapindex?
by Olivier PAVILLA 02 Feb '11

02 Feb '11

Hi. I need your advice. I have LDAP server on a fedora core 5 which is running for more than 3 years without any update nor upgrade neither. So now I've to migate this LDAP on a new server with new Linux distribution (Debian Lenny 5.0.7 64 bits). Should I or do I need to use slapindex before I use slapcat to export in ldif file? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-orleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical