openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

German Umlauts are converted and also not accepted
by Götz Reinicke - IT-Koordinator 11 Nov '10

11 Nov '10

Hallo, I'v searched for an answer but did not found one yet. I do have a openldap-2.3.43 server (centos 5.5.) in test and tried to add a ldif-file with my data using the apache directory studio (on mac os x). As my name contains a german umlaut I do get an error adding 'Götz Reinicke' for the gecko. Also for 'displayName', 'cn' and 'givenName' the 'ö' is automatically replaced by 'oe'. If I change the entry in the ldap by hand in the apache DS, the 'ö' is accepted accept for the geckos. An 'ü' in 'o' is manually accepted to. Any hints, explanations, suggestions? Thanks and best regards, Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

3 3

olcDbURI error
by Jaap Winius 11 Nov '10

11 Nov '10

Hi folks, After applying some changes to a consumer server used for testing purposes, my attempts to run slapcat result in the following error: #################################### slapd-chain: first underlying database "olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={1}hdb,cn=config" cannot contain attribute "olcDbURI". config error processing olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={1}hdb,cn=config: slapcat: bad configuration file! #################################### (Debian squeeze, slapd v2.4.23-6) After having configure syncrepl on the same host, I used slapcat to compare its newly replicated database to the one on the provider. At that point it still worked and the databases proved to be identical. I then proceeded to configure chaining and a referral. The above slapcat error appeared after I made the following changes (which applied successfully): ########################################################################### # 1. dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcUpdateref olcUpdateref: ldap://ldaps.example.com # 2. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}back_ldap # 3. dn: olcOverlay={0}chain,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE # 4. dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={1}hdb,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: ldap://ldaps.example.com olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=simple binddn="cn=ldaps2,dc=example,dc=com" credentials=bilineatus mode=self ########################################################################### Afterwards, slapd could no longer be restarted either, with the same error showing up in the syslog. I am aware that this is a known bug: http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6540;selectid=6540 According to the report, a patch was made available on April the 29th, but I'm not sure if it actually fixed anything. At any rate, my Debian slapd version is dated from the 23rd of September and still has this problem. However, Followup 17 (31 July) in the bug report refers to a "simple fix". Unfortunately, I haven't yet been able to find what that's supposed to be. This seems to me to be a serious bug, but for the time being I'd be happy with simple workaround. Can anyone help? Thanks, Jaap

2 3

Asynchronicity
by William Ahern 11 Nov '10

11 Nov '10

Excepting DNS, is the latest release of OpenLDAP fully asynchronous-capable, even with TLS? Perusing the source code I can't find any obvious places other than DNS where things might block, but it's harder to prove the negative. I remember many years ago this wasn't the case, and I had to thread the connect phase, but the ChangeLog suggests that things have changed considerably.

3 5

number of contextcsn entries per database
by PJunod＠mediageneral.com 11 Nov '10

11 Nov '10

I have setup two ldap servers for authentication and access control in a multi-master configuration. I am concerned about the number of contextcsn entries that are supposed to be present in each database. Right now there are two servers participating in the multi-master configuration. From my understanding, there should be one contextCSN entry per database per host. My cn=config database has two contextCSN entries as I would expect. One for each syncrepl rid configured. My bdb database only has one contextCSN entry though, with an rid of just "000". (my rid's are 001, 002, 101, and 102) Replication seems to work fine on both databases. I can write to either one and the changes are replicated over immediately. I am just curious about this discrepancy in the number of contextCSN entries. Could someone confirm the number of contextCSN entries per database and if it should match the number of hosts participating in the multi-master replication? Here are some relevant settings for the replication: dn: cn=config olcServerID: 1 ldap://<server1> olcServerID: 2 ldap://<server2> ####################### # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap2.4 olcModuleLoad: {0}syncprov.la ####################### # {0}config, config dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=ldap://<server1> binddn="cn=Ma nager,cn=config" bindmethod=simple credentials=<password> searchbase="cn=config " type=refreshAndPersist retry="5 500 5 +" timeout=1 starttls=yes olcSyncrepl: {1}rid=002 provider=ldap://<server2> binddn="cn=Ma nager,cn=config" bindmethod=simple credentials=<password> searchbase="cn=config " type=refreshAndPersist retry="5 500 5 +" timeout=1 starttls=yes olcMirrorMode: TRUE ####################### # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov ####################### # {1}bdb, config dn: olcDatabase={1}bdb,cn=config olcSyncrepl: {0}rid=101 provider=ldap://<server1> binddn="cn=Ma nager,dc=mgcorp,dc=net" bindmethod=simple credentials=<password> searchbase="dc =mgcorp,dc=net" type=refreshAndPersist interval=00:00:00:10 retry="5 500 5 +" timeout=1 starttls=yes olcSyncrepl: {1}rid=102 provider=ldap://<server2> binddn="cn=Ma nager,dc=mgcorp,dc=net" bindmethod=simple credentials=<password> searchbase="dc =mgcorp,dc=net" type=refreshAndPersist interval=00:00:00:10 retry="5 500 5 +" timeout=1 starttls=yes olcMirrorMode: TRUE ############################## Here are the results of searches for contextCSN in cn=config and dc=mgcorp,dc=net: ldapsearch -x -W -s base -D "cn=Manager,cn=config" -h "<server2>" -b "cn=config" contextCSN contextCSN: 20101110214932.998233Z#000000#000#000000 contextCSN: 20101028121213.444193Z#000000#001#000000 ldapsearch -x -W -s base -D "cn=Manager,dc=mgcorp,dc=net" -h "<server2>" -b "dc=mgcorp,dc=net" contextCSN contextCSN: 20101110213409.736943Z#000000#000#000000

2 1

Attributes for filtering OS logins
by Anton Chu 11 Nov '10

11 Nov '10

I have a scenario where I want to setup two LDAP groups where one group can access a file on the server while the other one cannot after they login. Can some PAM tweaks make this happen if not on the ldap side?

3 3

Re: ldapsearch performance degradation
by Tim Dyce 11 Nov '10

11 Nov '10

Hi Dieter, Thanks for the tips on tuning, sadly the problem is still haunting us :( Andrey Kiryanov at CERN has been doing a lot of work on this performance degradation problem as well. He has tried BDB 4.8.30 and OpenLDAP 2.4.23 but the problem is still apparent. The basic test we are running (sent earlier) creates 100 ou entries in the root, each with 250 child ou entries, then deletes 20-35% of these and re-adds them. For each deletion cycle the ldapsearch performance degrades, taking longer to complete the search each time. The performance is consistent, across restarts of slapd, and tied to the current state of the database. I have tried rsyncing out the database, and returning it later, and the performance is consistent with the number of deletion cycles the database has undergone. The only clue I have is that when dumping the databases which db_dump it's clear that the ordering of the database becomes increasingly less aligned with the order of the output data when doing a full tree search as we are. Which suggests that the database is writing frequently accessed entires too often instead of holding them in cache? I have run cachegrind against the server at 2, 20 and 1000 deletion iterations and the results are very different - http://www.ph.unimelb.edu.au/~tjdyce/callgrind.tar.gz The number of fetches grows massively over time. Anything you guys can suggest would be much appreciated, it's started to affect quite a number of our grid sites. Cheers, Tim > On 04/11/10 02:56, Dieter Kluenter wrote: >>> Hi Dieter, >>> >>> I've done some more testing with openldap 2.3 and 2.4, on Redhat and >>> Ubuntu. >>> I even went as far as placing the BDB database directory in a ramdisk. >>> But the performance still seems to degrade over time as data is added >>> then deleted repeatedly from the ldap server. >>> >>> It looks like the BDB database starts to fragment or lose structure >>> over time? >>> I've tried a few DB options that seem to have some impact. >>> >>> Any ideas on what I can do from here? >> Quite frankly, I have no clue, all i can do is guessing. First let's >> define the problem: you have measured the presentation of search >> Results the client side, and you observered an increase of time >> required to present the results. >> Mostlikely it is either a caching problem, a disk problem or a network >> problem. >> As far as openldap related, there are four caches to watch: >> 1. the bdb/hdb database (DB_CONFIG, cachesize) >> 2. the DN cache (dncachesize) >> 2. the cache of searched and indexed attribute types (idlcachesize) >> 3. the frontside cache of search results (cachesize) >> >> please check slapd.conf whether appropriate sizes are configured, see >> man slapd-bdb(5) and slapd.conf(5) for more information. >> >> But I must admit, a misconfiguration of any of this caches would not >> lead to such a degrading in presenting search results. >> >> An other approach would be to check the caching behaviour of clients, >> to check the network cache and the disk cache. >> >> -Dieter >> > -- ---------- Tim Dyce Research Computing EPP Group The School of Physics The University of Melbourne +61 3 8344 5462 +61 431 485 166

2 7

LDAPCon 2011?
by xsun 10 Nov '10

10 Nov '10

Hi there, There is something planned to 2011 about an LDAP Conference? I couldn't attend at 2009 and I think is too late for the conference on this year. Thanks, Matheus Morais

2 2

pamL-dap configuration guide
by Tim Dunphy 10 Nov '10

10 Nov '10

Hey List, I was just wondering if anyone happened to know of a good guide to use for configuring centos clients to authenticate pam modules (such as su, sudoers, ssh, system authentication and the like) against openLDAP? I am running a FreeBSD openLDAP server, but I believe that shouldn't affect the clients ability to log in via pam/ldap. At the moment I am googling this to not much avail! Thanks! -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

3 3

tls
by Christian Bösch 10 Nov '10

10 Nov '10

Hi Can someone tell me if it's possible to require strong encryption like TLS except from one IP address? /chris

3 5

uniqueMember attribute is not suffixmassaged if attribute is not mapped and changed
by Arvo Jari-Pekka 09 Nov '10

09 Nov '10

Hi. My configuration is like this: --------- database meta suffix "ou=a,dc=c,dc=b" uri "ldap://host:port/ou=a,dc=c,dc=b" suffixmassage "ou=a,dc=c,dc=b" "dc=a,dc=b" ... --------- This works fine in everything else but the uniqueMembers of groupOfUniqueNames gets not rewritten (they are still in dc=a,dc=b domain). If I however add a mapping --------- map objectClass groupOfNames groupOfUniqueNames map attribute member uniqueMember --------- then the "member" attributes are correctly rewritten. The problem of course is that I do not want to change the objectclass. Mapping the attribute to itself does not help either. So --------- map objectClass groupOfUniqueNames * map attribute uniqueMember * --------- does not have any effect. I must have missed something crucial on the documentation. Can someone please tell me what it is and how can I get uniqueMembers rewritten without changing the objectclass. OpenLDAP version is 2.4.11 for both the real and the meta server. BR, Jari-Pekka Arvo

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical