openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

Help reading db_printlog
by Peter Palmreuther 13 Jan '11

13 Jan '11

Hello, I had soem problems with a MirrorMode set up OpenLDAP cluster (version 2.4.20) and after some replication trouble I lost some data. I could restore it by using "db_restore" on the data directory (it's a 'hdb' backend). Now I'm trying to get as much information as possible about when exactly, and as far as possible why, the data got lost / was deleted. Unluckily I don't get far with reading the output of "db_printlog". I found " http://download.oracle.com/docs/cd/E17076_02/html/installation/debug_printl…" but this does not really help in getting the meaning of all the output. Is there any more help / documentation / whatever available to "dissect" the output and get an idea about what happend (and when, if possible)? Thanks in advance, -- Peter

1 0

Hello, how
by Alexey Shalin 13 Jan '11

13 Jan '11

Good afternoon, Tell me how to exclude the user's "search" from thesecurity policies The user is located in the ou =users Ou=policy also located in ou=users The reason that I need to exclude the user, is that when I set the pwdMaxAge and pwdGraceAuthNLimit. I can not log into the application at any login. In the openldap logs have a message bdb_dn2entry("uid=search,ou=users,ou=db") bdb_entry_get: rc=0 ppolicy_bind: Entry uid=search,ou=users,ou=db has an expired password: -39 grace logins send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 52 bytes to sd 13 tls_write: want=73, written=73 0000: 17 03 01 00 44 c3 ec 7b f6 fb 12 85 2d 87 57 6c ....D..{....-.Wl 0010: 6c 8c 36 ec 6f d3 39 1d 91 4b 1a db 53 d6 99 0e l.6.o.9..K..S... 0020: e8 94 85 93 b0 9a 3e 38 18 ab 00 fc 0f 3f d6 b4 ......>8.....?.. 0030: 39 a8 2d 8f 84 7f 46 09 90 cf 1d d2 28 a3 6e eb 9.-...F.....(.n. 0040: e8 ac f0 ad 66 44 7b 4f 47 ....fD{OG ldap_write: want=52, written=52 0000: 30 32 02 01 01 61 07 0a 01 31 04 00 04 00 a0 24 02...a...1.....$ 0010: 30 22 04 19 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0"..1.3.6.1.4.1. 0020: 34 32 2e 32 2e 32 37 2e 38 2e 35 2e 31 04 05 30 42.2.27.8.5.1..0 0030: 03 81 01 00 .... conn=1 op=0 RESULT tag=97 err=49 text= If I set pwdGraceAuthNLimit to 100. I'm able to login into the application. I can not change password for user "search" :-( Thank you ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: a.shalin(a)ipc.kg

1 0

Evolution Contacts Schema
by Peter L. Berghold 13 Jan '11

13 Jan '11

Hi folks, I've been running in circles trying to locate something and I've had Epic Fail. Quick background: I've been setting up a new email/calendering system for my family. My wife and I both run our own small businesses and just keeping our schedules in sync is nuts. The "nice to have" my wife asked for was being able to have one central email contacts place to work with. This is where Evolution comes in. Unfortunately Evolution seems to do contacts differently than say Thunderbird and I need a "special schema" to get it to work. I've done a Google looking for the schema files and found lots of dead links and schema files that don't seem to play well. Anyone know of a more reliable source? Thanks in advance... -- Peter L. Berghold <peter(a)berghold.net>

3 4

Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, OpenLDAP version: 2.3.43-12 (CentOS 5.5), 64-bit. In order to enable ppolicy overlay, I am trying to create the relevant entries, as specified in http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies I import two LDIFs, first: dn: ou=Policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Policies and second dn: cn=default,ou=Policies,dc=example,dc=com cn: default objectClass: top objectClass: pwdPolicy objectClass: person pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 2 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value The first loads OK. When I try to import the second, I receive this diagnostics: Could not add object cn=default,ou=Policies,dc=itelsib,dc=com Message: Invalid syntax Error code: 0x15 (LDAP_INVALID_SYNTAX) Error description: An invalid attribute value was specified. Could someone suggest what's wrong with the attribute name? the ppolicy.schema is specified in /etc/slapd.conf. Thanks. Sincerely, Konstantin

6 15

LDAP and PAM: account is expired, but pam_ldap allows authentification
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is still allowed to login. How pam_ldap should be instructed to take the expiration attributes ito account? Thanks. Sincerely, Konstantin

4 7

unique overlay
by Christian Bösch 12 Jan '11

12 Jan '11

hi, i want to use unique overlay with the following config: objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {6}unique olcUniqueURI: ldap:///ou=People,dc=abc,dc=net?mailLocalAddress,mail,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=abc,dc=net?gid?one the attribute uniqueness for the people tree's uri works, but not the one for the group tree. i found out the when i do an ldapsearch for a group and filter for gid=xy i get an empty result ldapsearch -Y EXTERNAL -b 'ou=Groups,dc=abc,dc=net' 'gid=32011' the log file says: conn=18817 op=1 SRCH base="ou=Groups,dc=abc,dc=net" scope=2 deref=0 filter="(?gid=32011)" why is the filter ?gid=32011 could this be the problem? thanks for any hint. /chris

2 2

Re: using of shared memory with slapadd
by tim stone 11 Jan '11

11 Jan '11

> Run slapadd as the same user that slapd runs as. This is no different than > running slapadd without shared memory segments, where you will have the same > issue with the created BDB caching files (i.e., same results whether it is > in memory or on disk). > Thanks, yes you are right. This issue I've never seen on my server, because SuSE automatically makes automaticly (via start script) a chown in the different backend database directorys ... Thanks Steeg

1 0

using of shared memory with slapadd
by Steeg Carson 11 Jan '11

11 Jan '11

Hello, I use shm_key in my database definition and its working fine. But after using slappadd (stopped slapd), the process use the same shm_key like the slapd (read from slapd.conf) After the slapadd is finished, the shared memory remains reserved in RAM with owner root. (ipcs -m) So after slapadd, I cant start slapd, I have to delete these shared memory with ipcrm. Is there a possibility, that the slapadd deletes the shared memory before ending or is there a reason that it remain? Thanks Steeg

2 1

dynlist overlay searching in a different server
by Angel L. Mateo 11 Jan '11

11 Jan '11

Hello, I have two different LDAP servers containing different information about my users. In one of them, I'm trying to configure dynlist overlay to dinamically add attributes for users, so I have configured dynlist. I'm using the labeledURI attribute with a value like this: labeledURI: ldap://<the_other_server>:389/dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>) Whenever I look for a user I get the error: Jan 10 13:07:07 canis12 slapd[12689]: dynlist_prepare_entry("<userDN>"): illegal URI "ldap://<the_other_server>:389/dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>)" If I remove the server part of the URI, like: labeledURI: ldap:///dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>) but, obviously, I'm not getting the additional attributes (because this LDAP directory doesn't have them). What am I doing wrong? Could I use a LDAP URI directed to another LDAP server? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 5

Re: RE24 testing call #1 (OL 2.4.24)
by Brett Maxfield 09 Jan '11

09 Jan '11

There is a discussion of solaris threads socket read/write locking issues and some workarounds at: http://omniorb.sourceforge.net/omni40/omnithread.html See "6 Threaded I/O shutdown for Unix" Cheers Brett On 08/01/2011, at 9:55 AM, Howard Chu <hyc(a)symas.com> wrote: > Doug Leavitt wrote: >> >> On 01/ 7/11 08:01 AM, Rein Tollevik wrote: >>> On 06.01.11 22.48, Quanah Gibson-Mount wrote: >>>> --On Thursday, January 06, 2011 7:40 PM +0100 Rein Tollevik >>>> <rein(a)OpenLDAP.org> wrote: >>>> >>>>> On 04.01.11 23.34, Quanah Gibson-Mount wrote: >>>>>> Please test RE24 heavily. >>>>> >>>>> test039 deadlocks for me on 64bit solaris10, both x86 and sparc :-( It >>>>> hangs in the monitor, triggered by the new swamp -SS option added to >>>>> slapd-tester. It works if run with -S or -SSS. It is the third server >>>>> that hangs, and it does so quite consistently with the same stack trace >>>>> every time. A gdb trace is at at: >>>>> >>>>> ftp://ftp.openldap.org/incoming/rein-test039-gdb-trace.txt >>>> >>>> Does this happen on both HEAD and RE24, or RE24 only? >>> >>> Both, as well as when running the head tests suite with the 2.4.23 >>> release. Looks as if the swamp additions have tripped into an >>> existing problem, not anything new. Leave it out of RE24 until if >>> have been resolved? >>> >>> Btw, any other Solaris test runs out there? I´t like to know if it is >>> a real Solaris problem or just me.. > > I'm seeing a similar failure on 32 bit Sparc Solaris 10. But it actually locks up in test036 for me, I never get as far as test039. The gdb trace looks much the same as what you posted. > > Looks like for some reason threads that are blocked waiting for their sockets to become writable are never getting waken up. A regular SIGINT shuts down slapd cleanly so it doesn't appear to be a problem with the condvars being used to manage the threads. That kinda points to select() simply not returning the writable status. > > I haven't used this Solaris machine much, but in fact (looking at the remnants of other files in my source tree on this box) this appears to have been a problem since at least last August. (I.e., it looks like I was investigating this same problem back then but dropped it and never got back to it.) > >>> Rein > >> I'm currently testing Solaris11 (Nevada) and not seeing any issues in >> either 32 or 64 >> bit builds using both RE24 and HEAD. I have not had any failures on >> x86 yet. >> Testing is still underway for sparc and other internal system testing on >> both platforms. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical