openldap-technical

openldap-technical@openldap.org

9989 discussions

ldap search hangs forever
by Jeremiah Martell 27 May '10

27 May '10

I'm using openldap-2.4.18 as a client to bind and asynchronously search an active directory server. I have a domain, example.com, that has two domain controllers: one.example.com, and two.example.com. The ip of one.example.com is 12.34.56.1 The ip of two.example.com is 12.34.56.2 The reverse mapping of 12.34.56.1 is one.example.com The reverse mapping of 12.34.56.2 doesn't exist ----- / nslookup one.example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: one.example.com Address 1: 12.34.56.1 one.example.com / nslookup two.example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: two.example.com Address 1: 12.34.56.2 / nslookup example.com Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: example.com Address 1: 12.34.56.2 Address 2: 12.34.56.1 one.example.com / nslookup 12.34.56.2 Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: 12.34.56.2 Address 1: 12.34.56.2 / nslookup 12.34.56.1 Server: 12.34.56.99 Address 1: 12.34.56.99 dns1.example.com Name: 12.34.56.1 Address 1: 12.34.56.1 one.example.com / ----- I have given openldap a "rebind proc" to use when chasing the referrals. I do a sasl gssapi bind to one.example.com, which succeeds. I do a search, which returns three referrals: DomainDnsZones.example.com ForestDnsZones.example.com example.com openldap looks up these three names and gets 12.34.56.2, which doesn't reverse map to anything. Then I get error messages for each referral: May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) May 27 16:26:18 xyz: GSSAPI Error: Miscellaneous failure (see text) (Server (krbtgt/23.56.2(a)EXAMPLE.COM) unknown) Then openldap hangs forever; I never get a LDAP_RES_SEARCH_RESULT. ----- If I modify my DNS server to return 12.34.56.1 first instead of 12.34.56.2, then everything works perfectly. If I don't chase referrals, then everything works perfectly minus chasing referrals of course. If I use "normal" binding instead of sasl gssapi, then everything works perfectly. If I use openldap's syncronous search instead of asyncronously polling with ldap_result, then the call times out and returns. I half-expected openldap to not be able to bind to the referrals, but still fail quickly and return. I don't understand why the ldap search never finishes. (I never get a LDAP_RES_SEARCH_RESULT) I did get a LDAP_RES_SEARCH_REFERENCE and a LDAP_NO_RESULTS_RETURNED, but those dont signify the search has finished, right? I've attached the ldap debugging. You'll see at the end the repeated calls to ldap_result with timeouts of 10 seconds. I don't know how to read them exactly, but the status seems to be "RequestCompleted" ? ----- 17:20:50.530 ldap_result ld 0x10097060 msgid 5 17:20:50.530 wait4msg ld 0x10097060 msgid 5 (timeout 10000000 usec) 17:20:50.530 wait4msg continue ld 0x10097060 msgid 5 all 2 17:20:50.530 ** ld 0x10097060 Connections: 17:20:50.530 * host: one.example.com port: 389 (default) 17:20:50.530 refcnt: 1 status: Connected 17:20:50.530 last used: Wed May 26 17:19:59 2010 17:20:50.530 17:20:50.530 ** ld 0x10097060 Outstanding Requests: 17:20:50.530 * msgid 5, origid 5, status RequestCompleted 17:20:50.530 outstanding referrals 0, parent count 0 17:20:50.530 ld 0x10097060 request count 1 (abandoned 0) 17:20:50.530 ** ld 0x10097060 Response Queue: 17:20:50.530 Empty 17:20:50.530 ld 0x10097060 response count 0 17:20:50.530 ldap_chkResponseList ld 0x10097060 msgid 5 all 2 17:20:50.530 ldap_chkResponseList returns ld 0x10097060 NULL 17:20:50.530 ldap_int_select ----- I got the latest 2.4.22 release and grabbed the majority of the changes, but the hang remains. You can see the full debugging information in the attached txt file. I'm asking if the forever hang could be a bug in openldap, or perhaps I'm doing something wrong? Thanks, - Jeremiah

1 0

Replication via cn=config
by Marcio Merlone 27 May '10

27 May '10

Hi all, I am setting a pair of multi-master replicated servers (venus and haumea) using Ubuntu 10.04 and OpenLDAP 2.4.21-0ubuntu5. I am following the docs at http://www.openldap.org/doc/admin24/replication.html and when I get to the part for this ldif: dn: olcDatabase={1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {1}frontend olcSuffix: dc=tld olcDbDirectory: ./db olcRootDN: cn=admin,dc=tld olcRootPW: secret olcLimits: dn.exact="cn=admin,dc=tld" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=003 provider=ldap://haumea.tld binddn="cn=admin,dc=tld" bindmethod=simple credentials=secret searchbase="dc=tld" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=004 provider=ldap://venus.tld binddn="cn=admin,dc=tld" bindmethod=simple credentials=secret searchbase="dc=tld" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov I get htis error: root@haumea:/etc/ldap# ldapadd -x -H ldap://localhost/ -D "cn=admin,cn=config" -W -f replica.ldif Enter LDAP Password: adding new entry "olcDatabase={1}frontend,cn=config" ldap_add: Object class violation (65) additional info: attribute 'olcDbDirectory' not allowed root@haumea:/etc/ldap# I googled for this but got very few useless results. Can someone point me the right direction? Thanks and best regards. -- Marcio Merlone

2 3

Re: Q: status of component matching?
by Lehnert, Hartmut 27 May '10

27 May '10

Hi Dieter! Thank you very much! I used CFLAGS=-DLDAP_COMP_MATCH when configuring the slapd and now it's able to load our component match module. But some problems are still left: When running the following LDAP search command using component matching filter /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children "(userCertificate:componentFilterMatch:=item:{ component \"toBeSigned.serialNumber\", rule integerMatch, value 449 })" against slapd it terminates: /home/openldap/openldap-2.4.21-install/libexec/slapd: symbol lookup error: /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0: undefined symbol: GenBufFreeBuf In the source code of both snacc and component match module no definition for function "GenBufFreeBuf" can be found. Where can I get it? Regards, Hartmut

3 6

WG: Q: status of component matching?
by Lehnert, Hartmut 27 May '10

27 May '10

Hello Dieter! Nevertheless I generated a core dump in the mean time - but this was only possible by adding the GenBufFreeBuf function as a dummy to init.c file of the comp match module: void GenBufFreeBuf (void *p) { } The back trace of the core: (gdb) bt #0 0x080e17d4 in slap_sl_free (ptr=0xb6f981d2, ctx=0x82d01a8) at sl_malloc.c:487 #1 0x0809ecf1 in ch_free (ptr=0xb6f981d2) at ch_malloc.c:137 #2 0x080dedae in mra_free (op=0x82cfde8, mra=0xb6f98288, freeit=1) at mra.c:43 #3 0x0808273f in filter_free_x (op=0x82cfde8, f=0xb6f982c8, freeme=1) at filter.c:556 #4 0x08080834 in do_search (op=0x82cfde8, rs=0xb7499134) at search.c:230 #5 0x0807da51 in connection_operation (ctx=0xb7499220, arg_v=0x82cfde8) at connection.c:1109 #6 0x0807df99 in connection_read_thread (ctx=0xb7499220, argv=0xb) at connection.c:1245 #7 0x08162082 in ldap_int_thread_pool_wrapper () #8 0xb7cc11b5 in start_thread () from /lib/libpthread.so.0 #9 0xb7da738e in clone () from /lib/libc.so.6 (gdb) Does this cover any new information? Thank you. Regards, Hartmut -----Ursprüngliche Nachricht----- Von: Lehnert, Hartmut Gesendet: Mittwoch, 26. Mai 2010 10:10 An: openldap-technical(a)openldap.org Betreff: AW: Q: status of component matching? Hi Dieter! I built slapd and the comp match module with CFLAGS=-g option but a core dump isn't generated. I don't think that a core dump analysis is necessary to solve the problem because the slapd output /home/openldap/openldap-2.4.21-install/libexec/slapd: symbol lookup error: /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0: undefined symbol: GenBufFreeBuf is clear enough: the symbol GenBufFreeBuf is simply missing in the source code and binary of the comp match module. So once again: do you know where I can get the missing source code? Thank you for looking at this problem. Regards, Hartmut -----Ursprüngliche Nachricht----- Von: openldap-technical-bounces+hartmut.lehnert=secunet.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+hartmut.lehnert=secunet.com@OpenLDAP.org] Im Auftrag von Dieter Kluenter Gesendet: Dienstag, 25. Mai 2010 17:38 An: openldap-technical(a)openldap.org Betreff: Re: Q: status of component matching? Am Tue, 25 May 2010 15:51:40 +0200 schrieb "Lehnert, Hartmut" <Hartmut.Lehnert(a)secunet.com>: > Hi Dieter! > > > > Thank you very much! I used CFLAGS=-DLDAP_COMP_MATCH when configuring > the slapd and now it's able to load our component match module. > > But some problems are still left: When running the following LDAP > search command using component matching filter > > > > /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p > 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children > "(userCertificate:componentFilterMatch:=item:{ component > \"toBeSigned.serialNumber\", rule integerMatch, value 449 })" > > > > against slapd it terminates: > > > > /home/openldap/openldap-2.4.21-install/libexec/slapd: symbol lookup > error: > /home/openldap/openldap-2.4.21-install/libexec/openldap/compmatch.so.0: > undefined symbol: GenBufFreeBuf > > > > In the source code of both snacc and component match module no > definition for function "GenBufFreeBuf" can be found. Where can I get > it? The function is called in comp_match/init.c, could you please build slapd with debugging symbols enabled (-g) and when installing don't strip, that is 'make install STRIP=" "', If possible create a core dump and run core and slapd in gdb in order to create a backtrace? -Dieter -- Dieter Klünter | Systemberatung sip: +49.40.20932173 http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

2 2

Re: use of server-side sorting and virtual list view controls blocks slapd
by Lehnert, Hartmut 27 May '10

27 May '10

Hi Dieter! We tried Sizelimit unlimited In slapd.conf, but the effect is the same, slapd answers "size limit exceeded". The search request command is /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s children -E!sss="sncertnr:2.5.13.3" -E!vlv="0/9/0/1:objectclass=SN-ISIS-MTT-MainCert" "objectclass=*" sncertnr Besides this effect we only have 10 records stored in the LDAP database ;-) For the supported features see the following list: openldap@ocsp-openldap24:~/openldap-snacc-2.3.6/c-lib> /home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b "" -s base + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: + # # dn: structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 supportedControl: 2.16.840.1.113730.3.4.9 supportedControl: 1.2.840.113556.1.4.473 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 entryDN: subschemaSubentry: cn=Subschema # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The OID 1.3.6.1.4.1.4203.666.8.1 is missing here but this OID is marked as kind of experimental. Why do I need this feature and how can I enable this? Regards, Hartmut

2 5

More on dynamic group searches
by Ian Collins 26 May '10

26 May '10

Hello, This is my first post here, so if I'm going over old ground, please let me know (I have searched). I have looked through the archives and reached the conclusion that there isn't a convenient means of searching for groups based on a dynamic entry. For example, if I have a dynlist entry containing olcDlAttrSet: {0}groupOfURLs memberURL uniqueMember uniqueMember is dynamically added to search results, but can't be part of the search. Is this conclusion correct? I am migrating a client over from Sun's directory manager (which does allow searching on dynamic attributes) to OpenLDAP, so I have to support all the client applications that currently authenticate against and use LDAP. For example: filter="(&(objectClass=posixGroup)(uniqueMember=cn=Admins,ou=groups,o=staff,dc=company))" attrs="gidNumber" -- Ian.

4 9

Re: choosing replication strategies
by Chris Jacobs 26 May '10

26 May '10

The admin guide really does a pretty good job of covering the different replication methods, I'd check it out a bit more. :) - chris PS: I'm no guru, and have recently identified an issue with mirror-mode and ppolicy. I'll be reviewing them again myself. Chris Jacobs, Systems Administrator Apollo Group | Apollo Marketing | Aptimus 2001 6th Ave Ste 3200 | Seattle, WA 98121 phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 email: chris.jacobs(a)apollogrp.edu ----- Original Message ----- From: openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org <openldap-technical-bounces+chris.jacobs=apollogrp.edu(a)OpenLDAP.org> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> Sent: Wed May 26 06:35:50 2010 Subject: Re: choosing replication strategies On Wed, May 26, 2010 at 09:03:03AM +0200, Nikola Radovanovic wrote: > Is the N-way multimaster replication best bet, or is it possible to > use some other strategy, like mirroring? See MirrorMode replication in OpenLDAP admin guide. Regards, Luka This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

Openldap with back-sql (Oracle)
by honey bajaj 26 May '10

26 May '10

Hi All, I have configured Openldap 2.3.32 with back-sql, have followed the readme and http://www.easysoft.com/applications/openldap/back-sql-odbc.html to create test and metadata. But while performing search i am receiving following errors ldapsearch -x -b dc=example,dc=com name=Mitya # extended LDIF # # LDAPv3 # base with scope subtree # filter: name=Mitya # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 May 25 10:23:12 ldap1p slapd[7211]: backsql_load_schema_map("inetOrgPerson"): autoadding 'objectClass' and 'ref' mappings May 25 10:23:12 ldap1p slapd[7211]: backsql_close_db_conn(4294967295) May 25 10:23:12 ldap1p slapd[7211]: slap_listener(ldap:///) May 25 10:23:29 ldap1p slapd[7211]: daemon: listen=8, new connection on 9 May 25 10:23:29 ldap1p slapd[7211]: daemon: added 9r (active) listener=(nil) May 25 10:23:29 ldap1p slapd[7211]: conn=0 fd=9 ACCEPT from IP=127.0.0.1:32793 (IP=0.0.0.0:389) May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=7 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=8 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: daemon: activity on 1 descriptor May 25 10:23:29 ldap1p slapd[7211]: daemon: activity on: May 25 10:23:29 ldap1p slapd[7211]: 9r May 25 10:23:29 ldap1p slapd[7211]: May 25 10:23:29 ldap1p slapd[7211]: daemon: read active on 9 May 25 10:23:29 ldap1p slapd[7211]: connection_get(9) May 25 10:23:29 ldap1p slapd[7211]: connection_get(9): got connid=0 May 25 10:23:29 ldap1p slapd[7211]: connection_read(9): checking for input on id=0 May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=7 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: daemon: epoll: listen=8 active_threads=0 tvp=NULL May 25 10:23:29 ldap1p slapd[7211]: do_bind May 25 10:23:29 ldap1p slapd[7211]: >>> dnPrettyNormal: May 25 10:23:29 ldap1p slapd[7211]: > dnPrettyNormal: May 25 10:23:29 ldap1p slapd[7211]: backsql_search(): base="dc=example,dc=com", filter="(name=mitya)", scope=2, May 25 10:23:29 ldap1p slapd[7211]: deref=0, attrsonly=0, attributes to load: all May 25 10:23:29 ldap1p slapd[7211]: ==>backsql_get_db_conn() May 25 10:23:29 ldap1p slapd[7211]: ==>backsql_open_db_conn(0) May 25 10:23:29 ldap1p slapd[7211]: conn=0 op=0 RESULT tag=97 err=0 text= May 25 10:23:29 ldap1p slapd[7211]: do_bind: v3 anonymous bind May 25 10:23:29 ldap1p slapd[7211]: backsql_open_db_conn(0): connected, adding to tree. May 25 10:23:29 ldap1p slapd[7211]:

2 1

openldap & outlook 2007 browsing
by Mark Bojara 26 May '10

26 May '10

Hey OpenLDAP Gurus! Im sure the above mentioned topic has been discussed a million times but with my hours of googling I have not been able to find anything conclusive.. I know this isnt directly related to OpenLDAP and you dont really support 3rd party software but Im running out of places to ask this question & time. I have gotten Openldap running with MS Outlook 2007 as a client, I am able to search for entries found on my openldap server however when I open the main addressbook window it does not display all the entries at once (aka Browsing). I have started Openldap with debug 256 mode and I can see connections made before clicking the Find button (proving that the "Enable Browsing" option in Outlook does do something) however still doesnt display anything. Does anyone know where I can go from here or atleast point me to the right place I can ask this question? Thanks alot Mark

2 1

choosing replication strategies
by Nikola Radovanovic 26 May '10

26 May '10

hi, i am new to the OpenLDAP and this is my first post here, so if i missed out the listing - please, tell me. i read admin guide, and also got LDAP system administration book (unfortunately, it is outdated for the replication part) i am in search of the best replication strategy for the following scenario: we have 2 geographically distant 'sites' (between two of them is WAN), and each of these needs to have 2 (or sometimes more) OpenLDAP servers. if some data is to be changed, it is done only on one 'site' (our software will redirect client calls to the specific one, based on our business logic). 'sites' must replicate data between them, and that should be done via exactly one dedicated OpenLDAP server in each 'site' (or at least it seems right :) ) Is the N-way multimaster replication best bet, or is it possible to use some other strategy, like mirroring? Naturally, servers will contain mostly some personal data which is rarely changed (but often read)... regards nikola

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical