openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

questions about openldap replication
by plug bert 07 Oct '10

07 Oct '10

Hi All, i've read through the replication section of the admin guide, but i'm still not clear on the ff: 1. For push-type setups, do i really need to set up a sync proxy? the docs seem to imply this is necessary only if there are firewall restrictions, yet i haven't seen any examples of a push setup w/o a proxy. 2. Is it possible to set up a push delta-syncrepl scheme? 3. In a syncrepl/delta-syncrepl push setup, how does the master know where the replicas are? Things were a bit simpler with slurpd...ah, progress B) tia

4 4

subordinate + translucent
by Wouter D'Haeseleer 07 Oct '10

07 Oct '10

This is what I would like todo: - Have a local DB which contains only groups under ou=Groups,OU=example,DC=com - Have a translucent conection to Active Directory - using subordinate gue this 2 databases together This should make it possible to administrate local Groups And add the needed Posix stuff to our ActiveDirectory users. This seems to work exept for the translucent stuff. I see both my databases (The AD and the Local one) I can write to my local one (adding a group for example) But when I want to add extra attributes to an ActiveDirectory use (using the translucent) I can't do this I Receive the following error "No Such Object" It seems that I'm not able to write to the glued translucent DB. Here is the config. database bdb suffix "ou=ActiveDir,OU=example,DC=com" subordinate directory "/var/lib/ldap-translucent" overlay translucent uri "ldap://remotehost" acl-bind bindmethod=simple binddn="cn=readonlyuser,OU=example,DC=com" credentials=secret idassert-bind bindmethod=simple binddn="cn=readonlyuser,OU=example,DC=com" credentials="secret" mode=none flags=non-prescriptive database bdb suffix "OU=example,DC=com" overlay glue directory "/var/lib/ldap" rootdn "cn=admin,OU=example,DC=com" rootpw supersecure index cn,sn,uid pres,eq,approx,sub index objectClass eq

1 0

RE: memberOf module install on ubuntu 10.04 slapd package gives:"Insufficient access" using admin interface
by Jon Skarpeteig 07 Oct '10

07 Oct '10

To clarify some: As I understand it, the interface I use is for admin purposes only, doing changes from root@localhost without any cn credentials. In fact, I created an admin account from the same interface, which could import schemas, create OU and CN entries, and generally behaving like expected for everything except enabling modules. I used this guide: http://albanianwizard.org/ubuntu-10-0-4-lucid-lynx-ldap-configuration-th e-working-how-to.albanianwizard to get this working as I expected. (Note the modifications to cn=config here, which worked fine for me) Openldap no longer have any config file, so all config changes is done through this interface. Using the CN=admin,DC=domain,DC=com created from the guide above return the same insufficient error message. I have also attempted to force the use of a slapd.conf file, which I ported from 8.04 conf file, without success. I also attempted an strace to follow the login procedure without getting any other message than the generic 'Insufficient access', or any reference to what permissions it checks. What I can't figure out is why the admin account doesn't have access by default, or how/what to change in order to allow access. But I suspect there is something other than simple missing admin permissions going on here. I also attempted to change permissions and ownership of any files related to slapd, also with the same result. Any ideas on what to look for? From: openldap-technical-bounces(a)openldap.org [mailto:openldap-technical-bounces@openldap.org] On Behalf Of Jon Skarpeteig Sent: 5. oktober 2010 10:41 To: openldap-technical(a)openldap.org Subject: memberOf module install on ubuntu 10.04 slapd package gives:"Insufficient access" Attempting to enable memberOf module, following http://dimaj.net:1784/blog/2010/07/howto-verify-that-a-member-is-part-of -a-secondary-group-in-openldap/ gives me: ldap_modify: Insufficient access (50) - I am root on Ubuntu 10.04 using slapd package. What am I doing wrong?

1 0

Re: OpenLDAP session authentication
by Dan White 07 Oct '10

07 Oct '10

On 29/09/10 10:19 -0500, Erik Lotspeich wrote: >Hi Dan, > >I hope that I don't mind if I ask a follow-up question: > >root@starfish:/usr/local/etc/openldap# testsaslauthd -u erik -p XXX -s >slapd >0: OK "Success." > >That works, but when I run ldapwhami, it doesn't: > >root@starfish:/usr/local/etc/openldap# ldapwhoami -Y login -U erik -H >ldap://localhost >ldap_sasl_interactive_bind_s: Unknown authentication method (-6) > additional info: SASL(-4): no mechanism available: No worthy >mechs found > >I did a search on the internet, and I ran this command: > >root@starfish:/usr/local/etc/openldap# ldapsearch -x -ZZ -s base -b "" ># extended LDIF ># ># LDAPv3 ># base <> with scope baseObject ># filter: (objectclass=*) ># requesting: ALL ># > ># >dn: >objectClass: top >objectClass: OpenLDAProotDSE > ># search result >search: 3 >result: 0 Success > >In other examples I've seen, mechanisms such as PLAIN or LOGIN or listed >here. Make sure you have the appropriate sasl shared libraries installed on both your server and your client (which appears to be the same according to your examples from above). Use plugingview/saslpluginviewer to see which server/client mechanisms you do have installed. For instance, on a Debian system you'd need to have the libsasl2-modules package. If you do have those mechanisms installed but are still not seeing them in the '-s base -b ""' search, make sure you've added 'sasl-secprops none' to your openldap slapd.conf. -- Dan White

3 4

best practice and account management (passwd)
by tangonights＠yahoo.it 07 Oct '10

07 Oct '10

Hi everybody! I'm a openldab absolute beginner so.. I started my training with user management, and was wondering if it was a good practice to move the whole /etc/passwd to ldap and let nsswitch jusst to 'ldap' the passwd,group,shadow items passwd: ldap group: ldap shadow: ldap I tried and I faced some obvious issues like client's boot errors etc. It worked but at the cost of a looong timeout.. - Is there any point in moving the whole /etc/passwd and groups, or is maybe better to move the root and other 'human' accounts, leaving local just the system users and groups? - was it better to keep the user's home directories (including /root) locally on the client, or better to move them on the ldap server, letting them be net- mounted on the client fs? Is it theoretically (and practically :-) ) possible to use ldap and remove from clients all the account management related binaries (useradd etc.) and /etc/passwd and /etc/groups? maybe naive questions..sorry :-) bye, Stefano.

2 1

High memory usage in provider server
by Claudio Cuqui 06 Oct '10

06 Oct '10

Hi there ! We are using two LDAP servers providers (openldap 2.4.23) in mirror mode: one just to receive modifies and the other, just to be "consumed" by 11 consumer servers. Both servers have almost 1MM objects with 10kb in size each. Id2entry.bdb has 21Gb and dn2id.bdb has 286Mb in size. When checking the first server we note that slapd is using ~4.0Gb of memory (RES). The problem is the second server, where all 11 consumers points to. Slapd in this server is using ~18.0Gb of memory (RES). We are using syncrepl to synchronize the 11 consumers with the 2nd server (RefreshandPersist). Openldap´s compile options are identical in both servers. Same for OS (Fedora 13 - x86_64 fully updated) and packages. Any ideas to reduce memory usage in the second server ? Regards, Claudio Cuqui

2 2

Checking compile options
by Bryan Payne 05 Oct '10

05 Oct '10

I compiled two ldap servers quite some time ago and I can't remember what options I compiled in. I need to compile a new server and was wondering if there is a way to see what options I used previously?

2 1

What attributes to authenticate (or) How to block the ldap tree for anonymous users
by Holger Schier 05 Oct '10

05 Oct '10

Hey guys, I am working with the LSEE 11 and trying to run a LDAP server. From scratch on everything went fine. With the standard configuration I can login, but if I use the LDAP Browser and hit anonymous access, I can see my whole LDAP tree. User name, mailaddresses and so on. And I am not happy with it. So I tried to change the access control from access to * by * read to access to * by * auth or access to * by * search The user password is already in auth mode. But with every other configuration instead of read, I cannot login anymore. Insufficient access. After the first try with auth I read the log files and saw that there is a search operation. So i switched to search. Now the server denies some read operations. So, my questions are: Is it just normal that anyone can see the LDAP tree? Is there any other option to hide my tree? And what attributes have to be readable to login? Thanks a lot. Holger

2 5

How can I monitore a mirror mode?
by Tiago Cruz 05 Oct '10

05 Oct '10

Hello folks, I have 2 OpenLDAP 2.4.11 running as Mirror Mode very well. But I would like to make sure that everything was replicated how should be forever :) so I would like to write some script to monitor it. I've searched around web, but I only found some about LDAP 2.2 and 2.3 (syncrep). Can you give me some tip about how I can do this? Many thanks! -- -- Tiago Cruz

2 2

openldap vs. 389
by Matt Juszczak 05 Oct '10

05 Oct '10

Hi all, We are currently evaluating which directory server to use for our authentication implementation, pdns backend, and puppet backend. We have a proof of concept working with openldap but have recently begun looking into 389. For those who have worked with these two, which do you find to be better for your needs? Which has better replication options? What about community and active development? Any major features in one that isn't in the other that are important to you? Thanks, Matt

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical