openldap-technical

openldap-technical@openldap.org

9951 discussions

Syncrepl - frontend database cannot be shadow
by alexander＠nautae.eti.br 15 Jul '10

15 Jul '10

Hi. I've read the following document: http://www.openldap.org/doc/admin23/syncrepl.html And this document too: http://www.openldap.org/doc/admin23/slapdconfig.html#syncrepl So, after do my configurations, I get the following error message when I start my slave: /etc/openldap/slapd.conf: line 79: frontend database cannot be shadow. That line (79) is the last line or my syncrepl directive as: moduleload syncprov rootdn "cn=admin,dc=exemple,dc=com" syncrepl rid=0 provider=ldap://10.0.0.222:389 type=refreshAndPersist retry="60 10 300 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials=!tsm!n3 Yes, I've tried to put all the syncrepl directives in the same line, and I've got the same error. I've put all those lines right below the section with 'moduleload' lines in slapd.conf. So... I've made a lot of search on the web... no clue, no help... Anyone? Please. []s Alexander Brazil

3 2

RE: DN failed to copy
by Stuart Cherrington 15 Jul '10

15 Jul '10

Hi, In an attempt to help myself, I enabled logging to 'loglevel 4' so got a lot of debug info out. During the copy of the objects under ou=group I got this error: Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(16) Jul 13 13:12:59 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(16) Jul 13 13:12:59 msldap01 slapd2.4[7156]: SRCH "cn=dba,ou=group,dc=ldn,dc=sw,dc=com" 0 0 Jul 13 13:12:59 msldap01 slapd2.4[7156]: 0 0 0 Jul 13 13:12:59 msldap01 slapd2.4[7156]: filter: (objectClass=*) Jul 13 13:12:59 msldap01 slapd2.4[7156]: attrs: Jul 13 13:12:59 msldap01 slapd2.4[7156]: Jul 13 13:12:59 msldap01 slapd2.4[7156]: base_candidates: base: "cn=dba,ou=group,dc=ldn,dc=sw,dc=com" (0x0000004e) Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(17) Jul 13 13:12:59 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(17) Jul 13 13:12:59 msldap01 slapd2.4[7156]: conn=1013 op=1 do_add: dn (cn=copydba,ou=group,dc=ldn,dc=sw,dc=com) Jul 13 13:12:59 msldap01 slapd2.4[7156]: ==> bdb_add: cn=copydba,ou=group,dc=ldn,dc=sw,dc=com Jul 13 13:12:59 msldap01 slapd2.4[7156]: send_ldap_result: err=65 matched="" text="no structural object class provided" Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(16) Jul 13 13:12:59 msldap01 slapd2.4[7156]: connection_get(17) So I tried to perform my initial task which was to add a CN to my top-level 'dc', I need to add a 'cn' for 'nisDomainObject' as SOlaris 10 expects this to be set. It fails with the same errors in phpLDAPadmin and the logfile says: Jul 14 09:13:33 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:13:33 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 14 09:13:33 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 14 09:13:33 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:13:33 msldap01 slapd2.4[7156]: SRCH "dc=ldn,dc=sw,dc=com" 0 0 Jul 14 09:13:33 msldap01 slapd2.4[7156]: 0 0 0 Jul 14 09:13:33 msldap01 slapd2.4[7156]: filter: (objectClass=*) Jul 14 09:13:33 msldap01 slapd2.4[7156]: attrs: Jul 14 09:13:33 msldap01 slapd2.4[7156]: Jul 14 09:13:33 msldap01 slapd2.4[7156]: base_candidates: base: "dc=ldn,dc=sw,dc=com" (0x00000001) Jul 14 09:13:33 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 14 09:13:33 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:14:12 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:14:12 msldap01 slapd2.4[7156]: ==> bdb_bind: dn: cn=proxyagent,ou=profile,dc=ldn,dc=sw,dc=com Jul 14 09:14:12 msldap01 slapd2.4[7156]: send_ldap_result: err=0 matched="" text="" Jul 14 09:14:12 msldap01 slapd2.4[7156]: connection_get(16) Jul 14 09:14:12 msldap01 slapd2.4[7156]: conn=1023 op=1 do_add: dn (cn=MyDomainName,dc=ldn,dc=sw,dc=com) Jul 14 09:14:12 msldap01 slapd2.4[7156]: ==> bdb_add: cn=MyDomainName,dc=ldn,dc=sw,dc=com Jul 14 09:14:12 msldap01 slapd2.4[7156]: send_ldap_result: err=65 matched="" text="no structural object class provided" Jul 14 09:14:12 msldap01 slapd2.4[7156]: connection_get(16) If someone could tell me at least where to look that'd be great. Thanks, Stuart. From: stuart_cherrington(a)hotmail.co.uk To: openldap-technical(a)openldap.org Subject: DN failed to copy Date: Tue, 13 Jul 2010 10:37:11 +0000 Hi, Not sure if this is an issue with phpLDAPadmin 1.0.1 or Openldap2.4 (on rhel 5.3). I've created posixGroup's within my openLDAP and can see these within phpLDAPadmin, I was trying to copy the objects within my 'dc' prior to some invasive work, but I cannot copy the posixGroups. I have done copies of all other objects but posixGroup copy errors with: 'Failed to copy DN: cn=copydba,ou=group,dc=ldn,dc=sw,dc=com LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass.' Having looked through countless web pages it suggests that the posixGroup definition in the rfc2037bis.schema should have a MUST clause but it already has this: objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' SUP top AUXILIARY DESC 'Abstraction of a group of accounts' MUST gidNumber MAY ( userPassword $ memberUid $ description ) ) Any advice would be great. Thanks, Stuart. Get a free e-mail account with Hotmail. Sign-up now. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

3 3

Openldap Setup Master Slave + Samba pdc
by Sachin Gopal 15 Jul '10

15 Jul '10

Hi All, I am looking at setting up a Openldap + Smba pdc at 3 different locations with replication. I have these queries: 1. The three locations should have the same database. 2. Will it be one master and 2 slaves or is there something else which can be set ? 3. Will windows users be able to changepasswords(I understand that with freeIPA, never tried, any docs) 4.How is the replication possibile ? 5. Is it possibile. Thanks in advance. --Sac

2 1

Help with developing LDAP client
by Bryan Boone 14 Jul '10

14 Jul '10

Hi everyone. I am writting an LDAP client. I am able to simple bind, and simble bind over SSL. I am having trouble with getting options. I am kinda a noob to C programming. What am I doing wrong? Here is what I have. if ((ld = ldap_init(HOSTNAME, PORTNUMBER)) == NULL) { perror("ldap_init"); return (1); } version = LDAP_VERSION3; if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_SUCCESS) { //rc = ldap_get_lderrno(ld, NULL, NULL); fprintf(stderr, "ldap_set_option: %s\n", ldap_err2string(rc)); ldap_unbind(ld); return (1); } ldap_start_tls_s(ld, NULL, NULL); char **temp; if (ldap_get_option(ld, LDAP_OPT_X_TLS_CACERTDIR, temp) != LDAP_SUCCESS) { ldap_perror(ld, "ldap_get_option"); return (1); } Everything works except I am having problems with the ldap_get_option. thanks

1 0

openldap 2.4.22 crash
by Marco Pizzoli 14 Jul '10

14 Jul '10

Hi all, I'm using Buchan's package of openldap2.4.22 x86_64 on RHEL5.3. I'm able to reproduce a crash renaming an entry in my tree. I'm doing this by using phpldapadmin. When I restart the engine I can see the entry with the name changed. I'm trying to produce a core dump and subsequently file an ITS, but I''m not able to have the core generated. I changed /etc/security/limits for the ldap user and some other RHEL specifics to not limit the size of the core. If I look to /proc/<slapd_pid>/limits I can see the following: [root@ldap04 14527]# cat limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 10485760 unlimited bytes *Max core file size unlimited unlimited bytes * Max resident set unlimited unlimited bytes Max processes 65536 65536 processes Max open files 1024 1024 files Max locked memory 32768 32768 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 65536 65536 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 After that I do the rename, the slapd crashes and the core dump isn't there... Any idea? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 2

Adding rfc schema clashes
by Stuart Cherrington 14 Jul '10

14 Jul '10

Hi, Running OpenLDAP 2.4 on RHEL 5. In order for my SOlaris 10 clients to start using the OpenLDAP service I need the objectclass 'nisDomainObject' to be declared. I found this objecttype in the 'rfc2307bis.schema' file so I've added it into the slapd.conf and now LDAP fails to restart with /usr/share/openldap2.4/schema/nis.schema: line 53 attributetype: Duplicate attributeType: "1.3.6.1.1.1.1.2" slaptest2.4: bad configuration file! I did a quick check the and "1.3.6.1.1.1.1.2" is declared in the nis.schema for the gecos attributetype. Can I alter the number within the rfc schema? Thanks, Stuart. _________________________________________________________________ http://clk.atdmt.com/UKM/go/197222280/direct/01/ Do you have a story that started on Hotmail? Tell us now

3 4

Max length of the attribute in UID attribute
by Bryan Boone 13 Jul '10

13 Jul '10

Hi everyone. How or where do I find out the max string length that I can have in the UID attribute in the inetorgperson objectclass. I assume that the length is set by the limitations of the DB, but I cannot seem to find that information anywhere. Or is the length defined in RFC 2798 somewhere? thanks

2 1

SHA2 in openldap 2.4.22
by Vernon Reilly 13 Jul '10

13 Jul '10

Have anyone managed to compile SHA2 slapd-module in openldap version 2.4.22 I am getting all sorts of errors trying to compile it after modifying the Makefile as per the README file inside: contrib/slapd-modules/passwd/sha2/ I think this code was for version 2.3 and should not be packaged with version 2.4. Anyways, any help would be appreciated. Thanks _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

2 1

bdb/hdb cachesize calculation
by openldap-ml＠stresst.net 13 Jul '10

13 Jul '10

Attached to this message you'll find a quick and dirty bash script that should determine the cachesize for an in-production bdb/hdb backend by taking dn2id and id2entry as well as all existing indexes into account. Internally the script calls the db_stat tool in combination with the formulas found in the 2.4 admin guide under: http://www.openldap.org/doc/admin24/tuning.html#Caching Based on our local production database files (run by slapd 2.4.21, bdb 4.5) which contain round about 460.000 (small) entries... # du -h dn2id.bdb id2entry.bdb 48M dn2id.bdb 755M id2entry.bdb # du -h *.bdb | grep -v dn2id | grep -v id2entry 12M cn.bdb 20M entryCSN.bdb 14M entryUUID.bdb 1.1M loginDisabled.bdb 8.6M mail.bdb 5.4M objectClass.bdb ...the attached script produces the following results: DB Cachesize Results (dn2id.bdb and id2entry.bdb): Overall DB Cachesize: 1871872 bytes Index Cachesize Results: Overall Index Cachesize: 245760 bytes (50% Index HitRatio) Overall Index Cachesize: 491520 bytes Resulting Overall Cachesize (DB and Indexes): Overall Cache Size: 2117632 bytes (50% Index HitRatio) Overall Cache Size: 2363392 bytes Including +15% bytes for growth: Overall Cache Size: 2435276.80 bytes (50% Index HitRatio) Overall Cache Size: 2717900.80 bytes Do the above results (2.4 - 2.7 MBytes?!) sound reasonable in comparison to the above bdb file sizes? As I'm currently unsure whether the result is correct or not I would appreciate your feedback for example whether the script's result makes sense within your environment or not. Thanks a lot!

3 4

2.4.22 mirrormode syncrepl credential password encryption
by Vernon Reilly 13 Jul '10

13 Jul '10

Hi, I have version 2.4.22 running with mirrormode enabled and it is working well. I have a question regarding the credentials field in the syncrepl part in slapd.conf. Must this be cleartext or can it be encrypted and what is considered good practise regarding which binddn to use. (e.g. should I create a user with cleartext password specifically for replication?) Up to now I have used the same binddn as my rootdn but I can only get this to work with a cleartext password and I don't want to have my rootpw as cleartext in slapd.conf. Here is my current slapd.conf snippet database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" moduleload syncprov overlay syncprov syncprov-checkpoint 1 1 syncprov-sessionlog 100 # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain index objectClass eq syncrepl rid=123 provider=ldap://server:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=Manager,dc=uniscope,dc=jp" credentials=secret mirrormode on Any help would be appreciated. Thanks. _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical