openldap-technical

openldap-technical@openldap.org

9 participants
9873 discussions

syncrepl only working in one direction
by Alister Forbes 24 Sep '10

24 Sep '10

All, I have two identical servers (RHEL based VMs, server1 and server3) running 2.4.23 openldap. built with these options: --with-tls --prefix=/etc/operator/openldap --enable-syncprov --enable-syslog --enable-crypt - I have the strangest problem, and am desperate for any insight you might provide If I make a change on server3, then everything is fine, and the change is replicated to server1 If I make a change on server1 then server1 changes, but no changes are seen on server 3. looking at the logs, on server1, Using tcpdump to sniff the connection, when a change is made on server1, it doesn't even attempt to contact server3. As far as I can tell the configs are identical, and I have no clue whats causing this. Any hint at all would be gratefully accepted. Configs from both machines attached. server1 and server3(output of ldapsearch on cn=config) Also attached, logs (olcLogLevel is Sync) of the results when I change a value (olcLogLevel) on the two servers (change-on-server1 and change-on-server3) Thanks in advance for any help you can give. Alister -- Alister Forbes TACSUNS _.|._.|._ Cisco Systems Please avoid sending me Word or PowerPoint attachments. See - http://www.gnu.org/philosophy/no-word-attachments.html

2 6

help, how to maintain the ACL dynamic by C api???
by wu johnson 23 Sep '10

23 Sep '10

If the ACLs are large , how can?

1 1

OpenLDAP session authentication
by Erik Lotspeich 23 Sep '10

23 Sep '10

Hi, I have looked around for the answer to this question and the solution wasn't obvious to me... I have an OpenLDAP installation that I use as an addressbook. I do not use OpenLDAP for authentication on my network. I am using it on an internal network with anonymous read-only access. I would like to require user-level authentication and I would like to authenticate access to the LDAP database using system users in /etc/passwd. Is this possible? For authorization, I would like a few users to have read/write access and others to be read-only. I would like to disallow anonymous access to the database. I have SSL/TLS set up now and that works; I would like to be able to turn off all non-SSL access to the database once the authentication/authorization is set up. Regards, Erik

2 1

Cache size and performance questions.
by Antonio Galindo Castro 23 Sep '10

23 Sep '10

Hi @ll, I have an OpenLDAP 2.4.21 on a Ubuntu Server 10.04. The server is used for auth, when I have more than 20 user logged the server reponds very slow and has hight load. I have my config in this way: for 60000 registers in my db olcDbCheckpoint: 1024 5 olcDbCacheSize: 180000 olcDbConfig: {0}set_cachesize 0 94371840 0 olcDbConfig: {1}set_lk_max_objects 4500 olcDbConfig: {2}set_lk_max_locks 4500 olcDbConfig: {3}set_lk_max_lockers 4500 olcDbIDLcacheSize: 540000 The server is part of a multi master squema (MMR). Where I can found a good documentation for tunning my server in this scenario? Regards. -- Luis Antonio Galindo Castro aka FunkyM0nk3y Fingerprint: 237E EFE1 6055 BCEB ACD0 7A49 30FC A883 0044 A85E

2 2

Invalid credentials (49)
by Claudio Martella 23 Sep '10

23 Sep '10

Hello, I have a windows 2008 server, serving users auth with AD. I have another windows 2003 server, serving other users. I'm trying to access them through openldap and an PHP application. I can easly access my 2003 server with this command: ldapsearch -x -D "cn=cm,cn=TIS,dc=TIS,dc=local" -W -H ldap://192.168.10.206 but when i try to access the 2008 server with the same command i get: ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 525, v1772 in this case my user is "cm" and he is in the "TIS" folder and i can login from a windows client with user TIS\cm successfully. I've tried also with -Z and -ZZ, in that case i get a service unavailable error. Do you have any idea why this would happen? Claudio -- Claudio Martella Digital Technologies Unit Research & Development - Analyst TIS innovation park Via Siemens 19 | Siemensstr. 19 39100 Bolzano | 39100 Bozen Tel. +39 0471 068 123 Fax +39 0471 068 129 claudio.martella(a)tis.bz.it http://www.tis.bz.it

2 1

openldap back-sock
by stefano vital 23 Sep '10

23 Sep '10

Hi, I have a question about a special LDAP setup , I try to use sock backend for bind user that after succesfull bind have to search on another backend, Here my slapd.conf on openldap 2.4.11 access to * by users read ##################BACKEND SOCK################################################# database sock suffix "dc=reg-bus-users-local,dc=it" #catturo le richieste riscritte da rwm bloccando richieste di lettura e scrittura dirette socketpath /tmp/ldapauthorization.sock ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=tfk,dc=tfkdatastore" rootdn "cn=Root,dc=tfk,dc=tfkdatastore" rootpw xxxxx I also made a fake bind in server listening on socket ldapauthorization.sock if ($request eq "BIND\n") { my %req = (); print "RESULT\n"; print "code: 0\n"; print "matched: cn=fratbrother,dc=reg-bus-users-local,dc=it\n"; } my ldapsearch is : ldapsearch -H ldap://localhost:389/ -D "cn=fratbrother,dc=reg-bus-users-local,dc=it" -w xxxx -x -b "dc=tfk,dc=tfkdatastore" "(objectClass=*)" "*" result : ldap_bind: Insufficient access (50) my goal if work , is to make bind = (bind + search attribute) in other ldap server check the validity of attribute and then response bind succesfull, so redirected bind with check on remote attribute , is possible to do that ? is the right usage of backend sock ? Ps : also noted that ldap does not connect to socket but make response directly "insufficient access". Ps : sorry for the bad english Thanks in Advance Stefano Vitali

1 0

problem with replication
by Craig White 22 Sep '10

22 Sep '10

never did replication and certain to be something that I did but this is the type of error I am getting... Sep 15 10:58:44 srv1 slapd[2766]: slap_client_connect: URI=ldap://srv2.ayr1.local DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) Sep 15 10:58:44 srv1 slapd[2766]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) Obviously because I didn't tell it NOT to use SASL bind for replication. Is there some simple adjustment to use something other than SASL for credentials when replicating? Craig

2 8

Setting up a chain overlay
by Bram Cymet 22 Sep '10

22 Sep '10

Hi, I am trying to setup a chain overlay to allow writes to a read-only slave to be chained up to the master. The closest ldif file I could figure out to update the cn=config directory was: dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDBURI:ldap://10.1.0.3/ olcDbIDAssertBind: bindmethod=simple binddn="cn=admin,dc=roessner-net,dc=de" credentials=********** mode=self This works until I have to restart the slave ldap server because this is an invalid config. Can anyone let me know an ldif file to set up the chain to the master? Or at least point me to the right direction. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752

4 7

Re: Problem of getpeereid.c:38: error: storage size of ‘peercred’ isn’t known
by Gavin Henry 22 Sep '10

22 Sep '10

Simply add CPPFLAGS=-D_GNU_SOURCE Don't email people directly :-) ----- Original Message ----- Hey , when i configure LDAP i got this error "getpeereid.c:38: error: storage size of ‘peercred’ isn’t known " also i saw your answer Presumably a dup of ITS#5464. > Workaround: Compile with CPPFLAGS=-D_GNU_SOURCE. what is the Presumably ? can you pls give me the full command that should i follow ??? Thx !! -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

Replicating from a mirrormode pair to a read-only server
by Andrew Findlay 22 Sep '10

22 Sep '10

I am updating an OpenLDAP installation at present, and one of the improvements is to introduce a pair of master servers running in mirror mode. There will be several read-only servers as well, and I would like those to replicate from whichever master is currently available. I did the obvious thing, and put two syncrepl clauses in the read-only server's config - one for each master server. Starting with an empty database, the read-only server chews CPU badly and generates thousands of log messages like this: Sep 2 14:57:34 nis0 slapd[9257]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: conn=-1 op=0: attribute "entryCSN" index delete failure Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:57:38 nis0 slapd[9257]: conn=-1 op=0: attribute "entryCSN" index delete failure .... Sep 2 14:56:10 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:10 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: conn=-1 op=0: attribute "localAttribute" index add failure Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) Sep 2 14:56:11 nis0 slapd[4953]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) It is very likely that each syncrepl connection will be retrieving the same entries at about the same time, so there is clearly potential for collisions. Question: is this topology sensible? If it is expected to work I will gather some debug data for an ITS. If not, I will have to drop back to plan B... OpenLDAP 2.4.22 with BerkeleyDB.4.8 running on SLES 10.3 i586 Thanks Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

3 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical