openldap-technical

openldap-technical@openldap.org

1 participants
9989 discussions

Re: Help needed with opeLDAP configuration
by sim123 25 Feb '11

25 Feb '11

Thanks for your response, I did ignore the error. However, the search result is empty, not sure what could go wrong. my sladp.conf file is same as described in quick start guide. Thanks. On Fri, Feb 25, 2011 at 12:36 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, February 25, 2011 11:36 AM -0800 sim123 <Sim3159(a)gmail.com> > wrote: > > Dear All, >> >> >> I am new to LDAP and openLDAP, just installed and configured openLDAP >> 2.4.23 with Berkeley DB 4.8 on CentOS 5.4 >> using http://www.openldap.org/doc/admin24/quickstart.html >> >> make test gave an error on replication similar to >> this http://www.openldap.org/lists/openldap-technical/201006/msg00256.ht >> ml >> >> So I think installation is correct but when I try to do a search as >> described in the article, result is : >> > > As noted repeatedly, even by the test itself, you should ignore any errors > from test058. That's why it exists with success. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

sortvals oddities - with more information and hopefully to the right list
by Andrew Elble 25 Feb '11

25 Feb '11

We are using sortvals on both member and memberUid. We have been seeing duplicate member/memberUid attributes on some objects that have been modified (as well as a lack of sorting on those attributes). It seemed that there was a correlation between modifies to objects that experienced deadlocks and the objects that had duplicate member/memberUid attributes on them. We put the seqmod overlay in place - and this reduced the number of occurrences of the issue but did not eliminate them. Upon further investigation, I discovered that it was possible to bypass the sorting behavior if the object was not created with an instance of the attribute with sorting enabled as a part of it. It would seem that attr_merge() (in attr.c) should have something like this: if ( *a == NULL ) { *a = attr_alloc( desc ); if (desc->ad_type->sat_flags & SLAP_AT_SORTED_VAL) { (*a)->a_flags |= SLAP_ATTR_SORTED_VALS; } } else { Further pursuing the issue, I started to focus on the index deletion code that was changed as a part of ITS#5183. Specifically, the portion of code within bdb_modify_internal() (in back-bdb/modify.c) that is commented: /* Move deleted values to end of array */ This code modifies save_attrs, which is actually apparently a pointer to memory that resides within the cache. If a deadlock occurs, these changes are not reverted, thereby corrupting the entry in the cache. I replaced this code with the pre-ITS#5183 code and I am no longer able to 'break' the object and insert duplicate member/memberUids. I also found it surprising that the call to bdb_idl_cache_del() in bdb_idl_delete_key() in back-bdb/idl.c occurred prior to any calls to the database? I can answer any questions about the specifics of the environment in which where we are seeing this - it is a somewhat difficult problem to reproduce outside of our production environment. I'm not terribly familiar with the code - I'm looking to see if I have collected enough data here to open an ITS to have this fixed. (or if I'm just way off base) Thanks, Andy -- Andrew W. Elble aweits(a)discipline.rit.edu Infrastructure Engineer, Communications Technical Lead Rochester Institute of Technology PGP: BFAD 8461 4CCF DC95 DA2C B0EB 965B 082E 863E C912 CONFIDENTIALITY NOTE: The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.

2 1

Migrating from Sun DSEE & Boolean values question
by Simon Fraser 25 Feb '11

25 Feb '11

Hi, We're planning to migrate to OpenLDAP from Sun Directory Server. So far the test setup works fine, with one potential problem. Sun's directory server treats boolean values as case-insensitive, while the RFC (and OpenLDAP) require upper-case TRUE and FALSE values. Is there a way of forcing case insensitivity on boolean values with OpenLDAP, so that any clients who are applying filters like "(foo=true)" will continue to work? Or is the only way to maintain stats logging and try to locate particular scripts on the machines that connect, and fix each one in turn? I realise the former option is not RFC compliant, but for me, it'll be very convenient to be permissive. Thanks, Simon. -- The Wellcome Trust Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is 215 Euston Road, London, NW1 2BE.

2 1

Advise on distributed directory service
by Germ van Ek 25 Feb '11

25 Feb '11

Hello, I am asked to design a replicated OpenLDAP implementation for use on 1500 of our customers servers who are now use a non-replicated configuration using the standard passwd/shadow backend combined with a PostgreSQL database. Our customers consist of primary schools and will use the database for authentication through Samba. The reason we want to replicate the data is so that we can offer email and other services from a central datacentre. Having considered several options ( Multi-Master, MirrorMode ), after some consulting in our team, I've decided we'll opt for the 'simple' Master-Slave setup, with a Master at each customer site and 7 (virtualised) servers each handling an everage of 215 customer databases. Having 7 servers however has the disadvantage of not knowing on which server a customer's database will be when a user is trying to authenticate on their email for example. My first thought was that I would configure a special 'redirection' server only containing referrals. I 'hoped' all common clients would cache these referrals so that load on this redirection server would be low. I'm now doubting this choice for 2 reasons: - The following of this referrals seams highly unstandardized. The biggest users of the referral functionality will probably be PHP, in the PHP manual the documentation on rebinding / referral chasing is not very thorough. Any automation of this is also not present, and I would need to implement any caching myself too. ( http://www.php.net/manual/en/function.ldap-set-rebind-proc.php ) This is 'annoying' for me, but I highly doubt third party applications will all implement this in a reasonable way, and I was not planning on customizing all of the software we use... - In the notes on the documentation of referrals for OpenLDAP 2.4 ( http://www.openldap.org/doc/admin24/referrals.html ), the following note is present: Note: the use of referrals to construct a Distributed Directory Service is extremely clumsy and not well supported by common clients. If an existing installation has already been built using referrals, the use of the chain overlay to hide the referrals will greatly improve the usability of the Directory system. A better approach would be to use explicitly defined local and proxy databases in subordinate configurations to provide a seamless view of the Distributed Directory. Though I am usually very stubborn, I try to avoid designing systems in a way the documentation says is not recommended. The use of 1 single proxy cache server seams to 'ease the pain' a bit, but does not seam like a very scalable approach. The use of proxy-overlays would make the server the client connects to function as a kind of non caching proxy, and in general 'be involved' in all of the requests, which again doesn't seam very desirable, and very single-point-of-failure. All servers that are configured (customer servers excluded unless they opt/pay for it) will be configured in a failover way, I didn't mention this above to avoid too much complication. What do you recommend for distributing the databases and still be able to easily use them? Do I overestimate the amount of traffic/work a server has in the proxy overlay method? Germ van Eck Engineer Station to Station B.V. --

3 3

Using OpenLDAP and Kerberos with linux instead of OpenDirectory with MacOSX
by Fabien COMBERNOUS 25 Feb '11

25 Feb '11

Hi the list, I would like to change my MacOSX server with a Debian server. Any experience report about this is appreciated. I searched on the web but informations are pretty old. Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

1 0

complex characters in UID attribute
by Vinay Kalkoti 25 Feb '11

25 Feb '11

Hi, I wanted to know what all complex characters can be included for an UID attribute. I have the following user names (uid). Please let me know which which of the following uid's are invalid - test_user: IT (LOC) sup_12$ test_user:IT(LOC) test_user-IT test_user IT test_user:IT test_user(IT) test_user.IT test_user/IT test_user/IT test_user#IT test_user*IT test_user@IT Thanks, Vinay

4 5

OpenLDAP performances on AIX?
by Marco Pizzoli 24 Feb '11

24 Feb '11

Hi all, on the same line of previous mail about openldap performances on Solaris, I would like to know if someone has experience about AIX. I'm evaluating a deploy on this platform and I would like to know about any performance comparison/experience between AIX (5.3/6.1/7.1) and Linux. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 2

Re: Poor performance on Solaris
by jekvb＠gmx.co.uk 24 Feb '11

24 Feb '11

<quote Quanah> Some time ago, I did benchmarks of Linux 2.6 vs Slowaris-x86 on identical hardware, and it still was noticeably slower, although not as bad as when using the sparc architecture. <quote Quanah /> Could you state what Solaris-x86 version that was? Thanks, Kuba ----- Original Message ----- From: Quanah Gibson-Mount Sent: 24/02/11 07:28 PM To: Juergen.Sprenger(a)swisscom.com, openldap-technical(a)openldap.org Subject: Re: Poor performance on Solaris --On Thursday, February 24, 2011 3:53 PM +0100 Juergen.Sprenger(a)swisscom.com wrote: > Hi, > > we had some performance issues on our ldap servers running Solaris 10 > sparc. > > I did some tests using slamd http://www.slamd.com/ and got disturbing > results: > > ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, > identical content. > > box1: > hardware: Sun Microsystems sun4v SPARC Enterprise T5120 > memory:32 GB RAM > os: Solaris 10 s10s_u9wos_14a > searches (avg/second): 1521 Slowaris is always tedious with OpenLDAP. At a previous job, I was able to replace 9 slowaris boxes with 4 linux boxes, and even then, just one of the Linux boxes could handle the complete load it took the 9 slowaris boxes to run. I will note that if you are going to use slowaris, I highly advise you set a memory key rather than using on disk cache for BDB if your DB is any size over about 4 GB. Other than that, you'll generally just have to deal with the fact it will be significantly slower than Linux. Some time ago, I did benchmarks of Linux 2.6 vs Slowaris-x86 on identical hardware, and it still was noticeably slower, although not as bad as when using the sparc architecture. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Poor performance on Solaris
by Omer Faruk SEN 24 Feb '11

24 Feb '11

Hi, I totally agree with you about Solaris + OpenLdap issues. Just use Linux if you will use openldap if possible of course .. Regards. On Thu, Feb 24, 2011 at 8:28 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 24, 2011 3:53 PM +0100 Juergen.Sprenger(a)swisscom.com > wrote: > >> Hi, >> >> we had some performance issues on our ldap servers running Solaris 10 >> sparc. >> >> I did some tests using slamd http://www.slamd.com/ and got disturbing >> results: >> >> ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, >> identical content. >> >> box1: >> hardware: Sun Microsystems sun4v SPARC Enterprise T5120 >> memory:32 GB RAM >> os: Solaris 10 s10s_u9wos_14a >> searches (avg/second): 1521 > > Slowaris is always tedious with OpenLDAP. At a previous job, I was able to > replace 9 slowaris boxes with 4 linux boxes, and even then, just one of the > Linux boxes could handle the complete load it took the 9 slowaris boxes to > run. > > I will note that if you are going to use slowaris, I highly advise you set a > memory key rather than using on disk cache for BDB if your DB is any size > over about 4 GB. Other than that, you'll generally just have to deal with > the fact it will be significantly slower than Linux. > > Some time ago, I did benchmarks of Linux 2.6 vs Slowaris-x86 on identical > hardware, and it still was noticeably slower, although not as bad as when > using the sparc architecture. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

idle_timelimit - idletimeout - nscd
by ldap＠mm.st 24 Feb '11

24 Feb '11

We run a few ldap servers (RH5, openldap 2.3) for our Linux systems to authenticate against. Using the netstat command we notice that a large number of established connections are always present on our ldapservers. We currently do not use idle_timelimit in any of the client ldap.conf files and we also do not use idletimeout in slapd.conf on our servers. We have seen a few remarks stating that if idletimeout is used in slapd that it may adversely affect replications. We are trying to decide if we should use the server based idletimeout or the client idle_timelimit to close the idle connections. Any recommendations? If so, what are some sane values to start with? We currently do not use ncsd on the clients, but are considering it if that makes a difference in the above settings.

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical