openldap-technical

openldap-technical@openldap.org

4 participants
9898 discussions

Problem updating cn=config directory
by Bram Cymet 28 Oct '10

28 Oct '10

Hi, I am having problems updating the cn=config datebase as shown in the following output: ldapmodify -Y external -H ldapi:/// <<EOF > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 > EOF SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Referral (10) referrals: ldap://ottauth1.test.cbn/cn=config Does anyone know what this referral (10) error means. The URI listed there is the local box. For some reason I am only getting these errors on Master servers not on slaves. This really confused me because I am not replicating the cn=config directory. Any help you be great. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

2 2

ldapsearch performance degradation
by Tim Dyce 28 Oct '10

28 Oct '10

Hi all, I am trying to track down what causes ldap searches to slow down over time, especially if content is added and removed. We are having issues with this as a grid site in the EGEE/EGI computing grid. Attached is a graph of search performance over time, and a basic test I did to get it (runs from /opt/bdii_test_core). This test only uses the core schema and operates on organizationalUnit. Can anyone tell me what's causing this? It's causing us some serious grief, as the searches slow down, some sites start to disappear off the grid and jobs start to fail. I've tried restarts and slap_index, but no love. Any help/advice would be much appreciated. Thanks, Tim -- ---------- Tim Dyce Research Computing EPP Group The School of Physics The University of Melbourne +61 3 8344 5462 +61 431 485 166

2 3

LDAP Schema Changes During Replication
by Anton Chu 27 Oct '10

27 Oct '10

Hi Everyone, I've setup a basic consumer,provider model replication. I've added a new schema eduPerson to my provider server and now the consumer server cannot replicate. Here's the error I'm getting on my consumer server: Oct 21 22:32:08 webtest110 slapd[31984]: slapd starting Oct 21 22:32:08 webtest110 slapd[31984]: syncrepl_message_to_op: rid=000 mods check (objectClass: value #3 invalid per syntax) Oct 21 22:32:08 webtest110 slapd[31984]: do_syncrepl: rid=000 rc 21 retrying I have delete the eduPerson schema on my provider server, deleted the person (uid=jim) using those attributes in my DIT , and restarted the slapd process on both server but error still persists. Any insights appreciated.

2 3

Structure LDAP
by Alejandro Rodriguez Luna 27 Oct '10

27 Oct '10

Hi all, how can I find the complete structure of my LDAP server, I mean dc=example,dc=com Users Groups Application uid=1 gid=group1 app=app1 uid=2 gid=group2 app=app2

1 0

Re: Authenticating OpenLDAP client with AD
by Benjamin Griese 27 Oct '10

27 Oct '10

oops, forgot the ML On Wed, Oct 27, 2010 at 17:06, Benjamin Griese <der.darude(a)gmail.com> wrote: > @Vinay > > I've found another solution that maybe fits your needs: > > http://lsc-project.org/wiki/ > > On Sat, Oct 23, 2010 at 15:26, Quan Nguyen <qnguyen(a)ayr1.com> wrote: >> >> >> Send from IPhone >> >> >> On Oct 23, 2010, at 5:55 AM, Benjamin Griese <der.darude(a)gmail.com> wrote: >> >>> Hi, >>> >>> yes that is another possibility I wanted to show you. >>> By searching I found another, but probably not open, method to do it. >>> http://www.likewise.com/ >>> >>> Good luck. >>> >>> On Sat, Oct 23, 2010 at 14:52, Vinay Kalkoti <kalkoti.vinay(a)gmail.com> >>> wrote: >>>> >>>> Hi Benjamin, >>>> >>>> Are you hinting at running the openldap server instead of openldap >>>> client and sync the required accounts using replication and >>>> authenticate againt the openldap server locally ? >>>> >>>> Thanks, >>>> Vinay >>>> >>>> On 10/23/10, Benjamin Griese <der.darude(a)gmail.com> wrote: >>>>> >>>>> Hi vinay, >>>>> >>>>> you may take a look at this: >>>>> http://sourceforge.net/projects/acctsync/ >>>>> >>>>> It's not exactly what you want, but can help you reaching the goal. :) >>>>> >>>>> Bye, Benjamin. >>>>> >>>>> On Sat, Oct 23, 2010 at 12:22, Vinay Kalkoti <kalkoti.vinay(a)gmail.com> >>>>> wrote: >>>>>> >>>>>> Hi, >>>>>> >>>>>> I am working on authenticating OpenLDAP client with AD server. I saw >>>>>> lots of examples which map the rfc2307bis schema using nss_schema >>>>>> attribute in ldap.conf file >>>>>> >>>>>> # Enable support for RFC2307bis (distinguished names in group >>>>>> # members) >>>>>> nss_schema rfc2307bis >>>>>> >>>>>> and also, map the attributes of the rfc2307bis to the AD server schema >>>>>> attributes. >>>>>> >>>>>> nss_map_attribute uid msSFU30Name >>>>>> nss_map_attribute uidNumber msSFU30UidNumber >>>>>> nss_map_attribute gidNumber msSFU30GidNumber >>>>>> nss_map_attribute loginShell msSFU30LoginShell >>>>>> nss_map_attribute gecos name >>>>>> nss_map_attribute userPassword msSFU30Password >>>>>> nss_map_attribute homeDirectory msSFU30HomeDirectory >>>>>> >>>>>> >>>>>> Isn't there a way I can fetch the schema from the AD server and set it >>>>>> using nss_schema ?. >>>>>> >>>>>> Basically, I am looking at fetching the schema/objectClass/Attributes >>>>>> from the LDAP/AD server and make them as a client schema's so that I >>>>>> don't have to keep doing the mapping using nss_map_attribute and >>>>>> nss_schema. >>>>>> >>>>>> I am new to LDAP world, and I am sorry if I my question doesn't make >>>>>> any >>>>>> sense. >>>>>> >>>>>> I have seen lots of enterprise products which integrate with LDAP/AD. >>>>>> They provide a user interface to map the server side schema >>>>>> objectClass and attributes. I am trying to see if I can get rid of >>>>>> this and do it internally. >>>>>> >>>>>> Thanks, >>>>>> Vinay >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To >>>>> be is to do -- Sartre | Do be do be do -- Sinatra >>>>> >>>> >>> >>> >>> >>> -- >>> To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To >>> be is to do -- Sartre | Do be do be do -- Sinatra >>> >> >> > > > > -- > To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To > be is to do -- Sartre | Do be do be do -- Sinatra > -- To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To be is to do -- Sartre | Do be do be do -- Sinatra

1 0

Attribute Aliasing
by Russell Harmon 27 Oct '10

27 Oct '10

I'm trying to reconfigure my existing OpenLDAP server to expose personal information under multiple attributes. I'm doing this so that both Apple's contact application and my custom software will work. I've read about rwm-map in slapo-rwm, but although it makes the new attribute accessible, it hides the old one. I need both the new and old to be accessible. For example: I have an existing attribute for a cellular phone number "cellPhone". I want to make this accessible under both the attributes "cellPhone" and "mobile" Is this possible with OpenLDAP? Thanks Russell Harmon

3 5

bindpw in SSHA/MD5/CRYPT/...
by Frederic Hornain 27 Oct '10

27 Oct '10

Dear all, For already few weeks, I search for a mean to have an encypted bindpw password in /etc/ldap.conf on my Fedora Linux Ldap client. OK, I have perfectly understood a simple bind requires that the client has the *cleartext* password. Nonetheless, it seems it exists a SASL method which could permit without using Kerberos to have this functionality. - http://www.openldap.org/lists/openldap-technical/200809/msg00145.html - If someone could give me a hand on that, I would appreciate; Thanks a lot in advance for your time and your help. Best Regards Frederic ;) ----------------------------------------------------- Fedora-ambassadors-list mailing list Fedora-ambassadors-list(a)redhat.com

2 1

LDAP Backup and Restore
by Anton Chu 27 Oct '10

27 Oct '10

Hi All, I'm in need of figuring out how I can effectively backup my ldap server then restore it in case of crisis. I have a master and consumer ldap server running in replication mode with latest ldap 2.4 version on ubuntu 10. I have an idea on backup and restore procedures but I need verification. Backup procedures: 1. /etc/init.d/slapd stop 2. tar the following directories /etc/ldap /var/lib/ldap # tar -pczf compressed.tar.gz /etc/ldap/ /var/lib/ldap/ 3. convert the configs and dit to ldif sudo slapcat -n 0 > backup/config.ldif sudo slapcat -n 1 > backup/users.ldif 4./etc/init.d/slapd start Restore procedures: 1. Reinstall a fresh vanilla ubuntu ldap server 2. untar the compessed.tar.gz to original location 3. /etc/init.d/slapd stop sudo slapadd -n 0 -l backup/config.ldif sudo slapadd -n 0 -l backup/users.ldif sudo cp backup/ldap.secret /etc/ldap.secret /etc/init.d/slapd start Just a brainstorm and I'm sure it needs revising. TIA, Anton

2 1

ldapsearch problem
by Darouichi, Aziz 26 Oct '10

26 Oct '10

Hi All, I inherited openldap-2.2.13-12.el4. that was built by a vendor few years ago, This is running in a production. I built a new openldap-2.3.43-12.el5_5.2. I run a backup of production LDIF file. Imported to the new openldap-2.3.43-12.el5_5.2. deleted all files from /var/lib/ldap except alock and DB_CONFIG file after I stopped services. I run slapadd -v -c -l backup_filename.ldif -f /etc/openldap/slapd.conf > import.log After the import is done I changed owner to be ldap. I started services. Now when I run a search for users passwords ldapsearch -x -D "cn=company,dc=company dc=edu" -w "Password" userPassword > file.txt This is the output in file.txt : # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (objectclass=*) # requesting: userPassword # # search result search: 2 result: 32 No such object # numResponses: 1 If I run same in production server I get user's passwords. Thanks

3 4

Syncrepl not replicating userPassword
by Robert Klopotoski, Jr. 26 Oct '10

26 Oct '10

Hello, I'm running into a problem with syncrepl that I hope someone can help with. I'm hoping it's a simple config problem. There was another thread similar to this one, and I have tried the solutions and still failed. Running slapd 2.4.11 on both the consumer and the provider. The provider has thousands of records with numerous attributes including 'userPassword'. The consumer got it's start from a direct copy of the database files from the provider. All existing accounts have the userPassword attribute on both the consumer and provider. Any time a new record is added to the provider, it synchronizes all attributes other than the userPassword field. The provider has an account on it "dc=replica,dc=domain,dc=edu" for the syncrepl to use from the consumer. An ldap search to the provider using this account shows that it can see userPassword: ldapsearch -x -LLL -b dc=endicott,dc=edu -W -D cn=replica,dc=endicott,dc=edu returns the dn of dn: uid=112232584,ou=Students,ou=People,dc=endicott,dc=edu including the attribute of: userPassword:: e0NSWVBUfSQxJFZ5TXdTJHJJdS85L0EvWjl6UlZnZ3lKYjNtMjE= The consumer for whatever reason is not adding this attribute to any records it syncs. All other attributes come over fine. If I do a complete cleanout of the consumer and have it start it's database directly from the provider, it does the same thing and pulls over everything but userPassword. The config of the consumer is listed below. Where could the problem lie? Thanks, Rob The config files on the consumer look like this: **** Start slapd.conf ***** include /etc/ldap/schema/core.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/endicott.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap moduleload back_bdb sizelimit 15000 tool-threads 1 backend bdb database bdb suffix "dc=endicott,dc=edu" checkpoint 512 30 rootdn "cn=admin,dc=endicott,dc=edu" rootpw password directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=endicott,dc=edu" write by dn="cn=replica,dc=endicott,dc=edu" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=endicott,dc=edu" write by dn="cn=replica,dc=endicott,dc=edu" write by * read index entryUUID eq index userPassword eq syncrepl rid=123 provider=ldap://10.1.55.196:389 type=refreshAndPersist interval=00:00:02:00 searchbase="dc=endicott,dc=edu" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=replica, dc=endicott, dc=edu" credentials="password" retry="60 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog updateref ldap://10.1.55.196 **** end slapd.conf ****

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical