openldap-technical

openldap-technical@openldap.org

17 participants
9801 discussions

Re: multi / standby master: incomplete replication after downtime (?) [SOLVED]
by Elmar Marschke 26 Aug '10

26 Aug '10

On 18.08.2010 17:16, Rein Tollevik wrote: > On 08/18/2010 04:28 PM, Elmar Marschke wrote: > >> Here's the logfile of MASTER: >> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ >> ===_BEGIN_CHANGES_WHILE_BOTH_UP_=== >> Aug 18 15:30:04 ldapmaster slapd[8017]: slap_queue_csn: queing >> 0x7f00f317b580 20100818133004.663851Z#000000#000#000000 > > Your ServerID setting is incorrect, and you are using the default > ServerID=0 on both systems. The ServerID is included in the csn value, > the second to last number (#000# here). Ensure that the ServerID URL is > the exact hostname of the systems it runs on, or that slapd is able to > select the correct sid based on its -h listener argument. > > Start slapd with -d config and verify that both logs lines with > differing SID= values. > > Rein > Hi all, thanks to your hints i think i got it working now :) Several details had to be changed. Perhaps someone has similar problems, so in the following i give a detailed description what had to be done in my case. Everything was executed on two freshly out-of-the-box installed openSuSE 11.3 x86_64 with SuSE-shipped openldap 2.4.21. First; according the inaccurate time on my testmachines: i deleted the openSuSE ntp.conf and additionally now i use other ntp servers as timesync source. Complete ntp.conf on ldapmaster and ldapslave now is: ----------------------------------------------------- server ptbtime1.ptb.de prefer server ptbtime2.ptb.de tinker panic 0 driftfile /var/lib/ntp/drift/ntp.drift This results in less different offset values: --------------------------------------------- ldapmaster:/etc/openldap # ntpq -p; ssh ldapslave ntpq -p remote refid offset ======================================== *ptbtime1.ptb.de .PTB. -1.218 +ptbtime2.ptb.de .PTB. -1.305 remote refid offset ========================================== *ptbtime1.ptb.de .PTB. -0.381 +ptbtime2.ptb.de .PTB. 0.203 ldapmaster:/etc/openldap # Second problem: the missing or wrong serverID in the csn values. To make clear what obviously helped i will describe how i create(d) my slapd.d/ online configuration. (My original slapd.conf was taken from the "openldap 2.4" book by Oliver Liebel & John Martin Ungar -- thanks Oliver :)! ------------------------------------------------------------ ldapmaster:/etc/openldap # slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/ hdb_db_open: database "dc=local,dc=site": db_open(/var/lib/ldap//id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=hdb, suffix="dc=local,dc=site"): bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) ------------------------------------------------------------ The following rcldap start every time resulted in: -------------------------------------------------- ldapmaster:/etc/openldap # rcldap start Starting ldap-serverstartproc: exit status of parent of /usr/lib/openldap/slapd: 1 failed ------------------------------------- and in /var/log/messages was written: -------------------------------------- Aug 26 15:47:22 ldapmaster slapd[7805]: @(#) $OpenLDAP: slapd 2.4.21 (Jul 5 2010 13:35:22) $#012#011abuild@build16:/usr/src/packages/BUILD/openldap-2.4.21/servers/slapd Aug 26 15:47:22 ldapmaster slapd[7805]: olcSyncrepl: value #0: <olcSyncrepl> invalid URL Aug 26 15:47:22 ldapmaster slapd[7805]: config error processing olcDatabase={0}config,cn=config: <olcSyncrepl> invalid URL Aug 26 15:47:22 ldapmaster slapd[7805]: slapd stopped. Aug 26 15:47:22 ldapmaster slapd[7805]: connections_destroy: nothing to destroy. I greped for "olcSyncrepl" in slapd.d: --------------------------------------- ldapmaster:/etc/openldap # grep -r olcSyncrepl slapd.d/ slapd.d/cn=config/cn=schema.ldif:olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatc slapd.d/cn=config/cn=schema.ldif: olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN slapd.d/cn=config/olcDatabase={0}config.ldif:olcSyncrepl: rid=003 provider=ldap://ldapmaster.local.site uri="" bindmethod=s slapd.d/cn=config/olcDatabase={0}config.ldif:olcSyncrepl: rid=004 provider=ldap://ldapslave.local.site uri="" bindmethod=si slapd.d/cn=config/olcDatabase={1}hdb.ldif:olcSyncrepl: rid=001 provider=ldap://ldapmaster.local.site uri="" bindmethod=s slapd.d/cn=config/olcDatabase={1}hdb.ldif:olcSyncrepl: rid=002 provider=ldap://ldapslave.local.site uri="" bindmethod=si ldapmaster:/etc/openldap # Some internet research told me, that the empty uri="" should be the problem, and that it would help to remove it. BEFORE i always removed it; and right; starting of openldap worked then. BUT apparently this also leads to the missing serverID in my csn values (respectively that they all had default "000"). NOW i changed those config.ldif and hdb.ldif files from slapd.d (in which grep found the string "olcSyncrepl"), to give uri an appropriate value. Open each file, search for "uri". It's found two times in every file. Before each occurence there's a variable "provider", which is set to something. For example in slapd.d/cn=config/olcDatabase={0}config.ldif : provider=ldap://ldapmaster.local.site uri="" and provider=ldap://ldapslave.local.site uri="" The value of provider ALSO has to be put into uri, that afterwards it looks like: provider=ldap://ldapmaster.local.site uri="ldap://ldapmaster.local.site" and provider=ldap://ldapslave.local.site uri="ldap://ldapslave.local.site" I did it on every machine (no file copy from one to another). After that; "rcldap start" (also) works without problems. But that still was not enough... Third thing to do: additionally on each machine make slapd start with "-h" parameter correctly set; like Rein and Jonathan wrote. According to the SuSE-way of configuration (like it or not, but in this case i don't have a choice ;)) this can be done in /etc/sysconfig/openldap: set OPENLDAP_SLAPD_PARAMS correctly on every machine; e.g. on master: OPENLDAP_SLAPD_PARAMS="-h ldap://ldapmaster.local.site" And, by the way, to make sure that ONLY online configuration style (slapd.d) is used; one can set OPENLDAP_CONFIG_BACKEND from "" to: OPENLDAP_CONFIG_BACKEND="ldap" This all together seems to solve the problem. Now LDAP-Objects can be altered, removed and added on one of both machines while the other one is down; and all changes are replicated as soon as the "downed" machine comes back up again. (At least in my tests until now ;))! Thanks for your time, and best regards.. elmar

1 0

OpenLDAP and Load Balance F5 issue
by Matheus Morais 26 Aug '10

26 Aug '10

Hi there, We were having some performance troubles using OpenLDAP and F5 load balance solution from BigIP at a high concurrent enviroment. We faced the problem for one month after I discovered that those problems didn't happen when applications was pointed directly to OpenLDAP server instead of load balance VIP. After a tcpdump analysis of the packages we realize that are too many ACK comming from each request. Last week we solved the problem unsetting Nagle's algorithm on the load balance virtual server which was causing this issue. So, if you look yourself on a similiar situation, please check the Nagle's algorithm on the F5 configuration! Thanks, Matheus Morais

3 4

Re: Samba, Openldap and ppolicy
by smainklh＠free.fr 26 Aug '10

26 Aug '10

Hi Dieter, I did a "slaptest -f $configfile -F $path" command, here are the results : /etc/ldap/slapd.d/cn=config/cn\=module\{0\}.ldif ---- ... olcModuleLoad: {0}back_bdb olcModuleLoad: {1}ppolicy.la olcModuleLoad: {2}smbk5pwd.la ... /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}bdb/olcOverlay\=\{2\}smbk5pwd.ldif --- dn: olcOverlay={2}smbk5pwd objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig olcOverlay: {2}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdMustChange: 0 olcSmbK5PwdCanChange: 0 structuralObjectClass: olcSmbK5PwdConfig entryUUID: 4fffa030-4543-102f-8b00-5f29b421ba43 creatorsName: cn=config createTimestamp: 20100826095158Z entryCSN: 20100826095158.762397Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20100826095158Z I still have the following errors : smbk5pwd: unable to find "krb5KDCEntry" objectClass. Aug 26 11:52:03 deathnote2 slapd[13165]: config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config: <olcSmbK5PwdEnable> handler exited with 1 Aug 26 11:52:03 deathnote2 slapd[13165]: slapd stopped. I thought that if i specify "olcSmbK5PwdEnable" parameter, it doesn't look for the krb5KDCEntry attribute... Thanks for your help, Smaine ----- Mail Original ----- De: "Dieter Kluenter" <dieter(a)dkluenter.de> À: openldap-technical(a)openldap.org Envoyé: Jeudi 26 Août 2010 11h12:47 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: Samba, Openldap and ppolicy smainklh(a)free.fr writes: > Now another error :( > > @(#) $OpenLDAP: slapd 2.4.23 (Aug 24 2010 14:56:29) $ root@myserver:/root/openldap-2.4.23/debian/build/servers/slapd > slapd[11666]: UNKNOWN attributeDescription "OLCSMBK5PWDENABLE" inserted. > slapd[11666]: config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config,olcDatabase={1}bdb,cn=config: The module smbk5pwd has not been loaded > > Old fashion configuration file : > --- > include /etc/ldap/schema/samba.schema > ... > > moduleload smbk5pwd.la > ... > overlay smbk5pwd > smbk5pwd-enable samba > > > > Overlay configuration : > --- > dn: olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcSmbK5PwdConfig > olcOverlay: {2}smbk5pwd > olcSmbK5PwdEnable: samba You didn't provide a cn={x}module,cn=config entry, so most likely you have not added an entry to load the module. -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 5

LDAP backend: schema synchronization?
by Mark J. Reed 26 Aug '10

26 Aug '10

OK, so I've got the ldap backend set up to talk to a couple different servers, and it's working, but I can only see attributes that exist in slapd's local schema. any way to import the schemas of the backends? automatically would be great, manually would be ok... -- Mark J. Reed <markjreed(a)gmail.com>

3 3

Re: Samba, Openldap and ppolicy
by smainklh＠free.fr 26 Aug '10

26 Aug '10

Now another error :( @(#) $OpenLDAP: slapd 2.4.23 (Aug 24 2010 14:56:29) $ root@myserver:/root/openldap-2.4.23/debian/build/servers/slapd slapd[11666]: UNKNOWN attributeDescription "OLCSMBK5PWDENABLE" inserted. slapd[11666]: config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config,olcDatabase={1}bdb,cn=config: Old fashion configuration file : --- include /etc/ldap/schema/samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd smbk5pwd-enable samba Overlay configuration : --- dn: olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig olcOverlay: {2}smbk5pwd olcSmbK5PwdEnable: samba ----- Mail Original ----- De: smainklh(a)free.fr À: smainklh(a)free.fr Cc: openldap-technical(a)openldap.org Envoyé: Jeudi 26 Août 2010 10h12:54 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: Samba, Openldap and ppolicy Ok, now i followed the documentation and configured my slapd server like that : include /etc/ldap/schema/samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd smbk5pwd-enable samba But i still have the following error : config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config: Regards, Smaine Selon smainklh(a)free.fr: > > Hi, > > I already have an openldap server configured with a password policy. > Now, i need to implement a samba server in order to authenticate my alfresco > users. > > I would like to know how to keep my password policy working with these two > authentication services. > I've heard of the smbk5pwd but i don't know how to configure it. > > I upgraded to slapd 2.4.23. > > my slapd configuration : > include samba.schema > ... > moduleload smbk5pwd.la > ... > overlay smbk5pwd > > But when i start the slapd service, it complains that some ObjectClass are > missing. > Maybe Samba needs to be upraded too ? ... > > I need your advices please. > > Regards, > Smaine

2 1

Re: Samba, Openldap and ppolicy
by smainklh＠free.fr 26 Aug '10

26 Aug '10

Ok, now i followed the documentation and configured my slapd server like that : include /etc/ldap/schema/samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd smbk5pwd-enable samba But i still have the following error : config error processing olcOverlay={2}smbk5pwd,olcDatabase={1}bdb,cn=config: Regards, Smaine Selon smainklh(a)free.fr: > > Hi, > > I already have an openldap server configured with a password policy. > Now, i need to implement a samba server in order to authenticate my alfresco > users. > > I would like to know how to keep my password policy working with these two > authentication services. > I've heard of the smbk5pwd but i don't know how to configure it. > > I upgraded to slapd 2.4.23. > > my slapd configuration : > include samba.schema > ... > moduleload smbk5pwd.la > ... > overlay smbk5pwd > > But when i start the slapd service, it complains that some ObjectClass are > missing. > Maybe Samba needs to be upraded too ? ... > > I need your advices please. > > Regards, > Smaine

1 0

Samba, Openldap and ppolicy
by smainklh＠free.fr 25 Aug '10

25 Aug '10

Hi, I already have an openldap server configured with a password policy. Now, i need to implement a samba server in order to authenticate my alfresco users. I would like to know how to keep my password policy working with these two authentication services. I've heard of the smbk5pwd but i don't know how to configure it. I upgraded to slapd 2.4.23. my slapd configuration : include samba.schema ... moduleload smbk5pwd.la ... overlay smbk5pwd But when i start the slapd service, it complains that some ObjectClass are missing. Maybe Samba needs to be upraded too ? ... I need your advices please. Regards, Smaine

3 2

filter to find attributes with multiple values
by Tim Gustafson 25 Aug '10

25 Aug '10

Hi, Is there any way to search for records that have multiple attributes? For example, I'd like to know how many users have multiple userPassword values. Is there some filter syntax that can find that out for me? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 2

stats2 and stats level logging
by Derek Yarnell 25 Aug '10

25 Aug '10

Hi, So a while back we had to go away form stats (256) level debugging because it was spiking our Spunk traffic so much and go to stat2 (512). Even now 1 days worth of LDAP logs on one replica is 1.5G. Now the problem is that stat2 never gives a way to map the connection to a host. Is there anyway to do this? We seem to have one host that might be misbehaving in the amounts of ldap queries it is making but I can't exactly pin point it. Thanks, derek Derek Yarnell UNIX Systems Administrator University of Maryland Institute for Advanced Computer Studies

2 1

replicate two branches?
by Isaac Hailperin 25 Aug '10

25 Aug '10

Hi, I was wondering whether there is a way to replicate more then one branch. I tried to replicate two branches using two syncrepl sections in slapd.conf with different rid, but that got me an error "syncrepl: database already shadowed" So I suppose its at least not that easy. The alternative would be to move all the branches into the same subtree and just replicate that subtree. Which raises the question: Is there a simpler way to move branches other then dumping to ldif, do an intelligent search and replace for all the dns, and then add the ldif again? Isaac

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical