openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

OpenLDAP to replace Oracle Internet Directory
by Matheus Morais 26 Jun '10

26 Jun '10

Hi there, I would like to share with this list my experiences with OpenLDAP implementation at one financial company, which is currently my job, and they use Oracle Internet Directory as their solution for LDAP service. This is my third year at the company and in my early days I was responsible to make the 'dirty work' in order to keep OID (I will use acronym from now because the name of the software is too large for keep writing :) working when the senior analysts were too busy with other projects to fix or request a fix for OID problems. At some day those senior analysts left the company and I was blessed as the 'LDAP guy' by the managers. From that day I started to think by my own on that and as a free software enthusiast plus my previous small experiences with LDAP infrastructure turned my ideas for an obvious project, the OpenLDAP. I will talk more about OpenLDAP later. They have an interesting LDAP tree which has some design problems but in a general way it is useful and support the company business process. From infrastructure perspective its painful and the main reason is because the replication technique which is absolutely inefficient in almost every aspect, from performance to scalability. OID by itself is also a great problem, it didn't respect RFC, has tons of stupid bugs that take an eternity to get resolved, has a relational database as 'backend' and the installation process is even worst. The replication is based on OID changelog at database level and small applications, called agents written in Java, are responsible to take that changes from database and replicate the modifications across the slaves. So for each slave we have an java agent querying Master and some thousand aditional rows at OID database. I don't know much about why they decided to write their own replication tool instead of using from OID but the old guys told me that Oracle replication software (DIP) didn't work well and was a very bad piece of softaware, just as OID BTW. With that architecture we basically started to suffer from the following problems: 1 - Performance with the Master 2 - Slave scalability 3 - Information integrity The performance problem with Master was generated by the replication agents which consume database resources to perform the replication. This first problem also generates the second because we couldn't increase the number of salves due to performance problems. OID bugs was also generating a increadible number of inconsistencies in the tree. >From that point I started a small project with first objetctive to avoid the performance problems with Master. The project was based on OpenLDAP adoption as replacements for OID slaves, an OpenLDAP Master would be created with two more OpenLDAP slaves using Delta-syncrepl to replication. With OpenLDAP slaves we could shutdown some replication agents and also the OID slaves giving more 'air' to Master database breath. The first OpenLDAP tests showed an unbelievable perfomance, 23560 entries returned from a search in exaclty 4 seconds in average. The same operation search against OID returned in 30 seconds average. The machine configuration is almost the same, the only difference is that OID infrastructure require two machines, one for oidldapd and other for Oracle DB and we also need a DBA support BTW. We've made a presentation to the managers showing the quality of OpenLDAP, the overlay concept and how we could use that to improve in service reliability and availability. We showed everything on our performance comparisions and asked them to support us in that 'migration' project. Two weeks ago we replaced the first OID infrastructure for OpenLDAP 2.4.22 and everyone here is enjoying how fast is the system response and how stable is delta-syncrepl. I have evaluated with current numbers, that we will be able to replace 4 OID to just 1 OpenLDAP infrastructure and that is really pleasant. The entire migration is planned to happen in next november. I want thank every one responsible to keep OpenLDAP project with that high level of quality and I am really proud about that kind of quality has been produced by a free software project (free as in freedom). Thanks, Matheus Morais

1 0

Fwd: ldapsearch using entryCSN
by Pierre Laporte 25 Jun '10

25 Jun '10

Hi, I'm trying to search entries in an OpenLDAP (v2.4.7) directory using their last modification date as a criteria. Digging in the schemas, I couldn't find an attribute that contained such a value. The only thing I found was the internal attribute "entryCSN" used by OpenLDAP to manage synchronization. I tried to do several ldapsearch queries, but I couldn't manage to obtain a decent result. Using "(&(objectClass=groupOfUniqueNames))" => I get every group of the directory. I can see that lots of them were modified in 2009 Related problem : Using "(&(objectClass=groupOfUniqueNames)(entryCSN<=20091224))" => The slapd2.4 process stops without returning anything. Using "(&(objectClass=groupOfUniqueNames)(entryCSN <= 20091224))" (The same query with spaces) => I don’t get any result. Shouldn't I retrieve the entries modified before 2010/12/24 ? Using "(&(objectClass=groupOfUniqueNames)(entryCSN >= 20091224))" => I don’t get any result. Shouldn't I retrieve the entries modified after 2010/12/24 ? - Does anyone know how to filter entries using their entryCSN? - Btw, is it even possible? Best regards -- Pierre Laporte

5 6

Migration from Novell eDirectory to OpenLDAP
by Stefan-Michael Guenther 25 Jun '10

25 Jun '10

Hello, has anyone on this list migrated the data of a Novell eDirectory into an OpenLDAP Server? Our first problem is that the schemas files of the eDirectoy contains nearly the same information as the schema files of OpenLDAP, but the structure of these files is completly different. Thanks for any hints or suggestions, Stefan -- ******************************************** in-put GbR - Das Linux-Systemhaus Stefan-Michael Guenther Geschaeftsfuehrer Moltkestrasse 49 D-76133 Karlsruhe Tel./Fax : +49 (0)721 / 6 80 32 88 - 0 / 3 http://www.in-put.de/ ******************************************** Schulungen Installationen Beratung Support Voice-over-IP-Loesungen ********************************************

3 2

limits based on the base being searched (rather than doing the searching)
by Francis Swasey 25 Jun '10

25 Jun '10

I have been requested to open up a specific branch of our DIT to allow more than the default number of entries to be returned for searches by anyone that get results from that branch. My reading of the slapd.conf manual page indicates the requested limits adjustment is not possible in the currently available OpenLDAP software (I am running 2.4.22). Have I missed something in my reading? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

1 0

Windows 7 users's authentication with openldap ?
by Frank Bonnet 25 Jun '10

25 Jun '10

Hello Anyone knows if it is possible to authenticate users of a windows 7 client machine as we do with UNIX clients with pam_ldap + nss_ldap to our openldap server ? Thank you. F

4 5

How to change openldap database directory
by Mail Admin 25 Jun '10

25 Jun '10

Hello Team, I am very new to Linux and Openldap. We have setup a mail server on CentOS, Postfix, Dovecot, etc witth OpenLDAP as backend. 1) We want to change the daabase directory of Openldap from /var/lib/ldap to /var/vmail/ldap . Could someone please let me know the settings I need to make to achieve this? 2) I tried to creae /var/lib/ldap as a linked folder (actual database located under /var/vmail/ldap). Permissions to the files and folders under this were set exactly the same. when I start ldap service, i get the following error: backend_startup_one: bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) [FAILED] stale lock files may be present in /var/lib/ldap/dbname [WARNING] If I remove the linked folder and copy the contents to /var/lib/ldap, everything works perfectly fine. Is linked folder not going to work for ldap? or am I missing something here? (Please note that the folder /var/vmail is a separate LUN in the SAN). I would like to achieve any one of the scinario mentioned above. Any help on this would be highly appreciated. Best Regards PineMail Admin

3 2

Unique Overlay Help
by Piyush Joshi 25 Jun '10

25 Jun '10

Dear Expert, I have used unique overlay with my openldap install and that's working now i want two of my attributes to be unique and that's not possible currnetly. Can it be added in following openldap releases or can any one make change in unique overlay to perform the same. -- Regards ****************************** Piyush Joshi System administrator 9415414376 ****************************** "Ability is what you're capable of doing. Motivation determines what you do. Attitude determines how well you do it"

3 3

Overlays and OpenLDAP multi-threading model
by Lucas Brasilino 25 Jun '10

25 Jun '10

Hi! I'm starting to see how overlays works to write one. But I've got a doubt and I'm asking to be sure: Is the overlay stack called within each thread ? If so, I think it can't block an entire thread pool, right ? My concern is about performance. The overlay I'm writing will only take place in some backend data modifications but it can be quite slow in terms of OpenLDAP connection handling, because it will be communicating via IPC with another process... If this overlay blocks only one connection, it's ok. But if it's blocks an entire thread pool, I'll have to figure out another solution. Thanks a lot in advance Lucas Brasilino

2 5

LDAP Account Manager
by Foo Bar 24 Jun '10

24 Jun '10

hi thanks for your answers. I have begin to test with the *LDAP Account Manager and it works. :-) know my question. **i** have create a user with a standard password. i will when the user make his first login than the client make a request to cange his password. how can i create this on **LDAP Account Manager* or must i do this on the openldap? * * * * thx m.enderlein -- Mit freundlichen Grüßen / Best Regards fooCCfoo

3 2

Re-investigating ppolicy + chain issues on a consumer: chain configuration
by Siddhartha Jain 24 Jun '10

24 Jun '10

I am still stuck at the same place where a chained consumer allows a client to auth with a bad password. Remove chaining and bad passwords are no longer accepted. To troubleshoot from scratch, I am curious about how chaining should be configured in the new ldif-based configuration scheme? Initially, I created a slapd.conf with the appropriate chaining statements and converted that file to "slapd.d". The conversion places all the chaining config under the "frontend" database. : [0115] root@ldaps01:olcDatabase={-1}frontend # ; ls -lR .: total 8 drwxr-x--- 2 ldap ldap 4096 Jun 24 00:30 olcOverlay={0}chain -rw------- 1 ldap ldap 433 Jun 22 23:00 olcOverlay={0}chain.ldif ./olcOverlay={0}chain: total 8 -rw------- 1 ldap ldap 591 Jun 23 23:53 olcDatabase={0}ldap.ldif -rw------- 1 ldap ldap 893 Jun 24 00:30 olcDatabase={1}ldap.ldif Interestingly, it creates two "ldap" databases for a single "chain" overlay. Can someone please explain why/how is this so? Why does chaining go to "frontend" db instead of being under the database that is chained? I tried to create the "ldap" databases under a "bdb" database but OpenLDAP won't allow that. Thanks, Siddhartha

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical