openldap-technical

openldap-technical@openldap.org

17 participants
9801 discussions

to much archive logs
by isso2＠gmx.de 27 Aug '10

27 Aug '10

Hello team, our openldap-server (OS: Redhat 5) was succesfully installed and it works. But sometimes it gets out of control, that means: every 3 minutes it generates an archive-log. Shutdown and start is not successfully. We have do to a db_recover. Any idea ? Thanks a lot. -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 3

syncrepl help
by Adam Cassar 27 Aug '10

27 Aug '10

Hi All, I would appreciate some insight with a syncrepl issue that I have. The scenario is as follows: (1) LDAP master running debian slapd v2.3.30 replicating using syncrepl to (2) LDAP master running debian slapd v2.4.11 The initial data for this node was seeded using slapcat/slapadd due to the db size. This is replicating via syncrepl to (3) LDAP slave running debian slapd v2.4.11 On (3) the slave I am receiving the error: do_syncrep2: cookie=rid=001,csn=20100825064231Z#000000#00#000000 do_syncrep2: rid=001 CSN too old, ignoring 20100825064231Z#000000#00#000000 for all replication events that are being received. What I am trying to achieve is to deprecate server (1) with as little downtime as possible, server (2) becomes the new master and (3) the new slave Replication between 1 & 2 works correctly but not between 2 & 3. The time is correct on the servers. Server (3) database is seeded using syncrepl. Configurations for 1, 2 & 3 are attached.

2 2

Supported formats of server/client certificate
by Ondrej Moriš 27 Aug '10

27 Aug '10

Hi, I am wondering what formats of server/client x.509 certificates are supported by OpenLDAP? I see that PEM is supported, but what about other formats like binary DER, PKCS#7, PKCS#12? I've tried to find answer in documentation, but it said that CA cert should be given in PEM and nothing about server/client certs. Any help greatly appreciated! -- Ondrej Moriš

2 1

Re: replicate two branches?
by Marc Patermann 27 Aug '10

27 Aug '10

Isaac, Isaac Hailperin schrieb am 27.08.2010 12:49 Uhr: > On 08/27/2010 11:12 AM, Marc Patermann wrote: >> Isaac Hailperin schrieb am 25.08.2010 17:44 Uhr: >> >>> I was wondering whether there is a way to replicate more then one >>> branch. I tried to replicate two branches using two syncrepl sections in >>> slapd.conf with different rid, but that got me an error >>> "syncrepl: database already shadowed" >>> So I suppose its at least not that easy. >> You are speaking about the provider, right? > No, the error occured on the slave side, after I put two syncrepl > directives in slapd.conf. > >> If you have o=foo with branch a ou=a,o=foo and branch b in ou=b,o=foo, >> what do you want to achieve then? Replicate branch a to server a and >> branch b to server b, or what? > I have dc=foo with ou=bar,dc=foo ou=rab,dc=foo and ou=oof,dc=foo. > I want to replicate ou=bar and ou=rab to another server, but not ou=oof. Where syncrpl is a database option, you could define a database for each branch in the consumer and define the searchbase corresponding to each branch (if you cannot reduce the replication data to a branch by setting a filter, where "dn= ..." is not a valid filter). database bdb suffix "ou=bar,dc=foo" syncrepl rid=1 searchbase=ou=bar,dc=foo ... directory ... database bdb suffix "ou=rab,dc=foo" syncrepl rid=1 searchbase=ou=rab,dc=foo ... directory ... Marc

1 0

Re: replicate two branches?
by Marc Patermann 27 Aug '10

27 Aug '10

Isaac, Isaac Hailperin schrieb am 25.08.2010 17:44 Uhr: > I was wondering whether there is a way to replicate more then one > branch. I tried to replicate two branches using two syncrepl sections in > slapd.conf with different rid, but that got me an error > "syncrepl: database already shadowed" > So I suppose its at least not that easy. You are speaking about the provider, right? If you have o=foo with branch a ou=a,o=foo and branch b in ou=b,o=foo, what do you want to achieve then? Replicate branch a to server a and branch b to server b, or what? You may have to describe your problem a bit more in detail. Marc

2 1

Getting Solaris to use Openldap
by Stuart Cherrington 27 Aug '10

27 Aug '10

Hi, I Have an OpenLDAP 2.4.18 server on RHEL 5.3. I can get Linux clients to use the master by use of the /etc/ldap.conf file. I'm now trying to get a SOlaris 10 client to use the master by initialising with the default profileName. If I run: ldapclient -v init -a proxypassword=xxxxx -a proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -a domainname=ldn.sw.com 10.2.250.15 This errors with Parsing proxypassword=5wap5proxy Parsing proxydn=cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Parsing domainname=ldn.sw.com Arguments parsed: domainName: ldn.sw.com proxyDN: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com proxyPassword: xxxxx defaultServerList: 10.2.250.15 Handling init option About to configure machine by downloading a profile No profile specified. Using "default" findBaseDN: begins findBaseDN: ldap not running findBaseDN: calling __ns_ldap_default_config() found 1 namingcontexts findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=ldn.sw.com))" rootDN[0] dc=ldn,dc=sw,dc=com NOTFOUND:Could not find the nisDomainObject for DN dc=ldn,dc=sw,dc=com found_cxt = -1 findBaseDN: Err exit Failed to find defaultSearchBase for domain ldn.sw.com So the 2 errors are the NOTFOUND nisDomainObject which is there when I check on the master: [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w xxxxx-b dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # ldn.sw.com dn: dc=ldn,dc=sw,dc=com dc: ldn o: ldn associatedDomain: ldn.sw.com nisDomain: ldn.sw.com objectClass: dcObject objectClass: organization objectClass: domainRelatedObject objectClass: nisDomainObject objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The other error is 'Failed to find defaultSearchBase for domain ldn.sw.com' [root@msldap01 openldap2.4]# ldapsearch2.4 -h 10.2.250.15 -D cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com -w 5wap5proxy -b cn=default,ou=profile,dc=ldn,dc=sw,dc=com -s base # extended LDIF # # LDAPv3 # base <cn=default,ou=profile,dc=ldn,dc=sw,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # default, profile, ldn.sw.com dn: cn=default,ou=profile,dc=ldn,dc=sw,dc=com defaultSearchBase: dc=ldn,dc=sw,dc=com authenticationMethod: simple followReferrals: TRUE profileTTL: 43200 searchTimeLimit: 30 objectClass: DUAConfigProfile defaultServerList: 10.2.250.15 credentialLevel: proxy cn: default defaultSearchScope: one # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Obviously I've missed something, anyhelp would be appreciated. Thanks, Stuart.

1 0

tnsnames in openldap
by Stuart Cherrington 26 Aug '10

26 Aug '10

Hi, I was wondering if anyone here has had a good/bad experience of getting Openldap to provision tnsnames lookup for Oracle Databases? We're thinking of removing our current OID implementation which is very old and as I'm already running OpenLDAP 2.4 is makes sense to just roll it from there. I found a VERY useful article at http://oracle-cookies.blogspot.com/2007/01/get-tnsnamesora-from-openldap.ht… which I think will help enormously. Thanks, STuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/195013117/direct/01/

3 2

Re: OpenLDAP as a proxy for Active Directory (missing attributes)
by Marius Flage 26 Aug '10

26 Aug '10

On 08/26/2010 11:10 PM, Mike Olivieri wrote: > However, when I try to search for that same user using ldapsearch, I get > no results. > ldapsearch -x \ > -a always \ > -h fqa-ldap \ > -p 9389 \ > -D "CN=mike0,OU=Service Accounts,dc=myco_ad,dc=mycompany,dc=com" \ > -w "password" \ > -b "DC=MYCO_AD,dc=mycompany,dc=com" \ > "(sAMAccountName=mikeo)" Try omitting the search filter '(sAMAccountName)', do you get any results then? If so, then you need to add the attribute declaration for sAMAccountName to your schema: attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) That's my only guess to this and I'll leave it to the experts if that's not the solution :) - Marius

1 0

access control, groups/organizationalRole
by Frederik Bosch 26 Aug '10

26 Aug '10

Hello, I am trying to setup an access control rule, but failed. All occupants of the objectClass organizationalRole which has a certain location may have read access. How do I setup this rule in slapd.conf? This is my line at the moment. This matches the dn of the occupant. But how do I match the location attribute of the organizationalRole? access to * by group/organizationalRole/roleOccupant="cn=Administrator,dc=example,dc=com" read Thanks in advance, Frederik

2 9

Problem with persistent search in OpenLDAP 2.4.23
by Tom Leach 26 Aug '10

26 Aug '10

I'm trying to write a perl script using PersistentSearch from Net::LDAP::Control::PersistentSearch against a freshly compiled OpenLDAP 2.4.23 server. I've configured/compiled the server with --enable-syncprov=yes and I have N-way multimaster setup and working. In the directory that I'm querying, I have syncrepl and mirrormode configured for the suffix dc=coas,dc=oregonstate,dc=edu. But, when I run the perl script using PersistentSearch I'm getting the following in my slapd log file when I search for something in the base ou=People,dc=coas,dc=oregonstate,dc=edu: slap_global_control: unrecognized control: 2.16.840.1.113730.3.4.3 I'm under the impression that PersistentSearch is enabled by the syncprov overlay so why would I be getting the unknown control message? Any help would be appreciated, I'm hitting dead ends everywhere I look. Tom Leach leach(a)coas.oregonstate.edu

4 11

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical