openldap-technical

openldap-technical@openldap.org

11 participants
9876 discussions

ITS#6607 to be fixed in 2.4.24?
by Eric Lakin 08 Jan '11

08 Jan '11

With 2.4.23, i ran into the bug in IDS#6607 "Forwarded bind failure messages cause success", but was able to fix it by applying the minor diff of back-ldap/chain.c rev 1.77 (as was mentioned in the bug follow-up). I've downloaded RE24 as of today & compiled it up. However, the bug is still there. Is this fix going to make it into 2.4.24 by any chance?

2 1

Dynamic list overlay and search filters
by James Bagley Jr 08 Jan '11

08 Jan '11

Maybe I¹m just being delusional in thinking that this should work... I¹m running OpenLDAP 2.4.23 on IBM AIX for authentication on a variety of AIX, Linux and web applications. As we need to use both Posixgroup and groupOfNames objects with the same membership, the dynamic list overlay seems like an ideal approach. This configuration appeared to work fine for our linux hosts and web applications, but not so well for our AIX hosts: In slapd.conf: overlay dynlist dynlist-attrset posixGroup labeledURI memberUid:uid Ldap object: dn: cn=testgroup,cn=testgroup,ou=unix,ou=groups,ou=unix,st=or,c=us cn: testgroup objectClass: top objectClass: posixGroup objectClass: labeledURIObject gidNumber: 1000 labeledURI: ldap:///ou=unix,st=or,c=us?uid?sub?(memberof=cn=testgroup,ou=unix,ou=groups, ou=unix,st=or,c=us) memberUid: chogensen memberUid: jbagley However, the AIX hosts do a search for (memberUid=jbagley)¹ to determine group membership and the ldap server does not return the above object. I¹m guessing that I was wrong in assuming the overlay would handle this type of application and that I will have to find another way. Anyone have any helpful tips? Advice? Condolences if I now have to manage twice as many group objects? Thanks! James Bagley Jr State of Oregon Data Center

2 1

Unable to install OpenLdap in GNU/Linux
by Maria Sanchez 07 Jan '11

07 Jan '11

I am trying to install OpenLDAP in GNU/Linux: uname -a Linux jupnms1 2.6.18-164.el5 #1 SMP Thu Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux I downloaded openldap version 2.4.23 I also installed BerkelyDB version 5.1.19 . Since the location of this db is not the default I set the proper environment variables for configure to find it: LDFLAGS=-L/usr/local/lib -L/usr/local/BerkeleyDB.5.1/lib CPPFLAGS=-I/usr/local/include -I/usr/local/BerkeleyDB.5.1/include LD_LIBRARY_PATH=/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.5.1/lib/ Additionally, I have updated the link to db.h to propperly point to the new Berkely DB: /usr/include/db.h -> /usr/local/BerkeleyDB.5.1/include/db.h because it was pointing to an old one. However after all these changes I still get an error. The command I ran is: ./configure --prefix /opt/COTS/ldap The results is attached. I really appretiate your help on this matter. I am currently evaluating different options for Authentication/Authorization data storage and have never worked with LDAP. LDAP is being proposed as the prefered way to store this data, however I need to prototype some solutions to present to management. Thanks, Maria

2 1

Emergency recovery strategy needed by novice
by Richard Troy 07 Jan '11

07 Jan '11

Hello All, I've got a bit of a problem.... Management chose a software product that depends on OpenLDAP's SLAPD service and had us put it into production without our quite understanding the software well enough to be clueful. The deployment is across virtual and real servers, the virtual servers handling the web stack and other user-oriented functionality while "real" servers handle data management. Regarding the data management, one system was chosen as a replication master, and another as slave, but being understaffed, we never quite got the replication of the OpenLDAP data configured when, today, some serious networking problems cropped up. The symptom is that we can establish an OpenLDAP (slapd) connection from the virtual side to the master, and a postgres connection - our RDBMS, but we can't get the rest of our primary application to connect properly so it's down. And it is absolutely not clear what's wrong with the master anyway. I can't get to the physical hardware because it's off in some data center somewhere that the founder located near him - and he's off traveling. So, we're "dead in the water." I was thinking that we might salvage the situation by dumping the data from the Postgres and OpenLDAP databases and restoring them to the slave system - promoting it to master - and while I've succeeded in moving over the Postgres data, I haven't a CLUE how to get started unloading and reloading the OpenLDAP data. ...I'm very competent with most things related to computing but I am _completely_ inexperienced with OpenLDAP. I've never issued any commands to or with OpenLDAP / slapd and have no idea what's normal for dealing with it. Are there dump and reload utilities? Any and all pointers / help GREATLY appreciated. Richard

4 5

Strange behavior with TLS with self-signed certs
by Michael Starling 07 Jan '11

07 Jan '11

I'm running openldap-2.3.43-12.el5 on a RHEL 5.5 system: I find that TLS will not work if I use uri ldap://10.3.5.207/ in /etc/ldap.conf on my clients. TLS magically starts working if I use the deprecated host directive instead: So if I use host 10.3.5.207 instead everything starts working: Any insight as to what might be going on?..Possibly a bug? Here are my TLS directives on my clients: #TLS settings ssl start_tls ssl on tls_cacertdir /etc/openldap/cacerts tls_cacertfile /etc/openldap/cacerts/slapdcert.pem tls_checkpeer no -Mike

4 8

Re: Index for objectclass does not work...
by Steeg Carson 07 Jan '11

07 Jan '11

2011/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, January 04, 2011 1:43 AM +0100 Steeg Carson > <steeg.carson(a)googlemail.com> wrote: > >> I simulate this on my database just right now: > > I suggest you read: > > <http://www.openldap.org/lists/openldap-technical/201011/msg00146.html> > > to understand how indices and their slots work. > As I now understand, the entire index for one attribute (e.g. objectClass) is "split" in several indexes. They holds for each path/node (resp. DN, but not leaf) an separate index for this attribute with all "hits" for his subtree (and for onelevel too). If I do an ldapsearch with -b "cn=ownPath,ou=root" the slapd takes the index which is bound on this node/DN? In my DIT are 470812 entires. The objectClass=subEngine exists 104384 times in the entire directory (ou=root). The objectClass=subEngine exists only 1 time under "cn=ownPath,ou=root", The following test I made with BDB, because each node holds an index for subtree and one for onelevel (hdb only for onelevel) When I search (loglevel 33): ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"cn=ownPath,ou=root" "(ObjectClass=subEngine)" I get in the logfile: ================================================ => key_read <= bdb_index_read 470601 candidates <= bdb_equality_candidates: id=-1, first=228, last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=228 last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=40595 last=470825 <= bdb_filter_candidates: id=-1 first=40595 last=470825 bdb_search_candidates: id=-1 first=40595 last=470825 => test_filter EQUALITY <= test_filter 5 bdb_search: 40595 does not match filter . . . ================================================. . Should the index at this level not hold only one entry: ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"cn=ownPath,ou=root" "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l 1 thanks Steeg!

3 7

Re: slow ldap authentication
by bluethundr 07 Jan '11

07 Jan '11

Hi list, It's been a few days and I just wanted to check back to see if anyone had any troubleshooting tips that might help to solve this situation that I'm dealing with as I'm still a relatively new LDAP admin. I really appreciated your advice in the past and have overcome some very significant technical hurdles with your assistance on a number of occasions. Thanks in advance!and I would like to wish you a belated happy new year! Tim On Sun, Jan 2, 2011 at 12:58 AM, bluethundr <bluethundr(a)gmail.com> wrote: > Hello list!! > > I would greatly appreciate your help with an issue I am having here. > It seems that when you log into hosts on the network via ldap > authentication, said authentication is extremely sloooowww... on the > order of up to 30 seconds to log in! I could use some assistance in > correlating the information in the logs with the way that slapd.conf > is configured. > > What I did to capture the event in the logs was to (after backing > them up) empty them with cat /dev/null > /var/log/openldap.log and > then log into a host on the network via an ldap account. Right after > login was finished I copied the log file to another location on the > nas and enclosed it here. Therefore it reflects only what happened > during the login. I've also enclosed my slapd.conf and ldap schema as > attachments for your perusal. > > I've attempted adding some indexes to the configuration to alleviate > the situation but unfortunately this had no effect. The ones I added > were uid and uidNumber which I've read can help address this sort of > situation. > > > [root@LBSD2:~]#grep -i index /usr/local/etc/openldap/slapd.conf > index objectClass,uid,uidNumber eq > index sudoUser eq > > thanks in advice with any assistance you can provide. > > best regards > > -- > GPG me!! > > gpg --keyserver pgp.mit.edu --recv-keys F186197B > -- GPG me!! gpg --keyserver pgp.mit.edu --recv-keys F186197B

2 1

Re: Index for objectclass does not work...
by Steeg Carson 06 Jan '11

06 Jan '11

> > I have written up documentation on performance tuning OpenLDAP 2.4 that > covers most other areas, for my work @ Zimbra, you can find it at: > > <http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning_6.0> > > It's based on you using Zimbra's tools to automatically update the > configuration database, but you can easily tweak what it's talking about > directly. Hello Quanah, I know this page. Its really very helpful! As talked, I tested openldap with shared memory and found, that this can accelerate the load of the LDAP-Database with slapadd a lot :-) Thanks for your help. Kindly regards, Steeg

1 0

Automated testing routines?
by Jaap Winius 06 Jan '11

06 Jan '11

Hi folks, Compiling the Debian sources for the OpenLDAP packages can take over an hour on my relatively fast workstation. Much of that time seems to be spent running a slapd server with all kinds of test routines. Is that what's actually going on? Whatever, perhaps someone could explain. Thanks, Jaap

5 6

users, groups, etc. for posix authentication?
by Christ Schlacta 05 Jan '11

05 Jan '11

is there any reason that a posix usernames, groups, passwords, etc. must be stored in distinct locations in a directory ? I realize this mostly applies to the padl pam/nis and the libnsspam-ldapd module specific. can they be stored in other structures effectively and usefully? can they be stored on a department by department basis, or in any other organizational scheme? (ou=arbitrary1,dc=... having groups and users, while ou=arb2,ou=arb3,dc=... also has users and groups?) if a scheme like the above is used, will all users and groups be available on a system? must they be free of naming conflicts, or will group=users,ou=arbitrary1,... be different from group=users,ou=arb2,ou=arb3,... ? if they're different, how would this be indicated by the systems?

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical