openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

openldap mirror mode
by Megan 23 Jan '10

23 Jan '10

Good Day All! I am running two boxes with CentOS 5.4 and openldap-servers-2.3.43-3.el5. I am trying to configure openldap in mirrormode. I have a third box with CentOS 5.4 and openldap-servers-2.3.43-3.el5 that I will be using as a proxy,but ldap is not yet configured on this server. Below are my two ldap servers that I want in mirror mode. If I set the standard Syncrepl configuration, the master and slave talk, I can write to the master, and the slave is updated. But when I switch to mirror mode with the below configuration, and try to write to either of them, I get: ldapadd: Server is unwilling to perform (53) additional info: shadow context; no update referral Which makes me think they are both in read-only mode???? I thought with mirrormode server 1 would be writable until server 1 went down, then server 2 would know to be writable, and they stay in sync with each other #========================== #Server1 #========================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema loglevel 256 serverID 1 allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap #moduleload accesslog.la #moduleload auditlog.la #moduleload denyop.la #moduleload dyngroup.la #moduleload dynlist.la #moduleload lastmod.la #moduleload pcache.la moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la #moduleload smbk5pwd.la #moduleload translucent.la #moduleload unique.la #moduleload valsort.la TLSCACertificateFile /etc/openldap/cacerts/server1cacert.pem TLSCertificateFile /etc/openldap/cacerts/server1crt.pem TLSCertificateKeyFile /etc/openldap/cacerts/server1key.pem TLSVerifyClient try sasl-secprops noanonymous,noplain,noactive access to * by * write by * read database bdb suffix "dc=domain" rootdn "uid=admin,ou=service,dc=domain" rootpw {SSHA}secret directory /var/ldap/databases/users index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.3 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=domain" schemachecking=off retry="60 +" filter="(objectClass=*)" attrs="*" bindmethod=simple binddn="uid=userrepl,ou=services,ou=administrative,dc=domain" credentials=password mirrormode on #=========================== #server 2 #=========================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema ##LOG Level loglevel 256 serverID 2 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap #moduleload accesslog.la #moduleload auditlog.la #moduleload denyop.la #moduleload dyngroup.la #moduleload dynlist.la #moduleload lastmod.la #moduleload pcache.la moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la #moduleload smbk5pwd.la #moduleload translucent.la #moduleload unique.la #moduleload valsort.la TLSVerifyClient try sasl-secprops noanonymous,noplain,noactive access to * by * write by * read database bdb suffix "dc=domain" rootdn "uid=admin,ou=service,dc=domain" rootpw {SSHA}secret directory /var/ldap/databases/users index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://192.168.1.2 type=refreshAndPersist interval=00:00:00:10 searchbase="dc=domain" schemachecking=off filter="(objectClass=*)" attrs="*" retry="60 +" bindmethod=simple binddn="uid=userrepl,ou=services,ou=administrative,dc=domain" credentials=password #updateref ldap://192.168.1.3 mirrormode on

2 1

Re: OpenLDAP does not seem to start
by sgmayo＠mail.bloomfield.k12.mo.us 23 Jan '10

23 Jan '10

Jaap Winius wrote: > Hi Scott, > > Did you ever manage to fix your problem? I'd be interested to hear > what the problem and the solution turned out to be, and maybe a few > other people on the mailing list would be as well. > > Cheers, > > Jaap > Yes, the problem was what I really expected from the first. It was just a corrupt DB I guess. I did a db_recover (actually on fedora it was a slapd_db_recover) and that fixed everything. Got it all back to working now. thanks for all the replies. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

1 0

Re: Server-Side Sort Overlay ordering problems
by Diego Lima 22 Jan '10

22 Jan '10

Hi, 2010/1/15 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 15, 2010 12:06 PM -0500 Edward Capriolo < > edlinuxguru(a)gmail.com> wrote: > > Diego, >> >> You and I have the same issue. UID and CN are not in the schema they >> are compiled into LDAP some how, so there is no way to apply an >> ordering rule. I can not find if this is possible, or what is involved >> in making it happen. > > I'm currently testing a quick and dirty hack that I made to servers/slapd/schema_prep.c: --- schema_prep.c.ori 2010-01-15 13:28:04.000000000 -0200 +++ /root/openldap-2.4.21/servers/slapd/schema_prep.c 2010-01-15 13:04:56.000000000 -0200 @@ -915,6 +915,7 @@ static struct slap_schema_ad_map { offsetof(struct slap_internal_schema, si_ad_name) }, { "cn", "( 2.5.4.3 NAME ( 'cn' 'commonName' ) " "DESC 'RFC4519: common name(s) for which the entity is known by' " + "ORDERING caseIgnoreOrderingMatch " "SUP name )", NULL, 0, NULL, NULL, @@ -924,6 +925,7 @@ static struct slap_schema_ad_map { "DESC 'RFC4519: user identifier' " "EQUALITY caseIgnoreMatch " "SUBSTR caseIgnoreSubstringsMatch " + "ORDERING caseIgnoreOrderingMatch " "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )", NULL, 0, NULL, NULL, By making these changes I've been able to get around my current problem, but it might not be as stable as you expect. > You can find these attributes defined in the code in servers/slapd. > > However, I will note, the definitions of these attributes are RFC defined. > They have no ORDERING rule on purpose. > > --Quanah Thanks for the input Quanah, but the problem is we have some legacy applications that used a really old LDAP server where this was allowed. I'm trying to migrate the server (that's a fedora directory from fedora 6) to a new openldap-based one. I must, however, maintain compatibility with the existing applications. Is there any problem (despite not being RFC-compliant) on enabling ordering on these attributes? -- Diego Lima

2 2

OpenLDAP does not seem to start
by sgmayo＠mail.bloomfield.k12.mo.us 22 Jan '10

22 Jan '10

Everything has been running fine for months. We had a power outage this morning and I restarted my servers and things still seemed to be fine. A bit later network drives could not be reached and so on. I tried restarting LDAP and Samba, but it seems after the LDAP daemon was stopped, it could not restart. I decided to reboot the server just in case and now the server just hangs while starting services. This is a Fedora 10, so I booted with the CD to recovery mode so I could see logs. Here is what my message log looks like. Jan 20 11:27:56 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:27:56 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:27:56 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: could not search LDAP server - Server is unavailable Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:00 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Jan 20 11:29:04 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:04 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:04 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Jan 20 11:29:12 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://127.0.0.1 Can't contact LDAP server Jan 20 11:29:12 school1 rpc.statd[1522] nss_ldap: failed to bind to LDAP server ldap://10.0.0.100 Can't contact LDAP server Jan 20 11:29:12 school1 rpc.statd[1522] nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... The 10.0.0.100 and 127.0.0.1 are the same server and is the one that LDAP is sitting on so it is not trying to contact another server with the 10.0.0.100. Is my db corrupted possibly after the electric outage? If so, is there a fix to run on it or will I just have to have a backup of it? Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

7 16

olcaccess question
by Alex Samad 22 Jan '10

22 Jan '10

Hi with cn=config if I have dn: olcDatabase={2}hdb,cn=config olcAccess: to * by * read Does this allow read access to the hdb database ie the * in to is a subset of hdb name space ? is it equal to dn: olcDatabase={2}hdb,cn=config olcAccess: to dn.subtree <hdb tree> by * read alex

1 0

cn=Subschema and acl
by Alex Samad 22 Jan '10

22 Jan '10

Hi I was wonder were do I place acl for cn=Subschema as there doesn;t seems to be a db defined for it or is it the same as cn=schmea ? thanks Alex

4 6

Berkley db error.
by Saha, Indranil 21 Jan '10

21 Jan '10

Hi I have taken the openldap 2.4.11 version.My berkley db is 4.5.20 version.When am running the configure--enable-backends script its telling like checking for db.h... yes checking for Berkeley DB major version... 4 checking for Berkeley DB minor version... 5 checking for Berkeley DB link (-ldb-4.5)... yes checking for Berkeley DB version match... no configure: error: Berkeley DB version mismatch But have checked the configure script ,and its allowing berkley version major >=4 and minor >=2 .Can anyone explain then why am getting this error.Its urgent. Regards Indranil

2 2

problem configuring overlay module and cn=config
by Alex Samad 19 Jan '10

19 Jan '10

Hi I am trying to ldapadd dn: olcOverlay={2}unique,olcDatabase={1}hdb,cn=config changetype: modify add: olcunique_uri olcunique_uri: ldap:///?uid?sub but it fails ldap_modify: Undefined attribute type (17) additional info: olcunique_uri: AttributeDescription contains inappropriate characters not sure what is going wrong I tried changing to base64 and using :: Can't seem to find any examples of using unique in cn=config Thanks

2 2

Best objectClass for an LDAP server?
by Jaap Winius 19 Jan '10

19 Jan '10

Hi folks, Busy again with the configuration of my OpenLDAP 2.4.11 test system, which includes Kerberos, SASL and GSSAPI, I now not only have replication working with Kerberos authentication and encryption), but also SASL proxy authorization, which makes chaining possible (chasing referrals on behalf of clients). For proxy authorization to work, I first had to create an LDAP object to represent the DN that the consumer server was authenticating with -- after the name of its Kerberos principal. Here it is in GSSAPI-format: uid=ldap/ldapks2.example.com,cn=gssapi,cn=auth Not wanting to use the person objectClass for this purpose, I used this instead: dn: cn=ldap/ldapks2.example.com,ou=consumers,dc=example,dc=com cn: ldap/ldapks2.example.com objectClass: simpleSecurityObject objectClass: organizationalRole description: LDAP server2 replicator saslAuthzTo: dn.regex:^uid=[^,]*,ou=users,dc=example,dc=com$ userPassword: {CRYPT}* Does this look like the best solution? It does force me to include a userPassword attribute, for which I use an invalid hash, but otherwise there are no other unnecessary attributes. Still, I wonder if I could do better. Any opinions? Thanks, Jaap

1 0

Verifying refint
by Peter Mogensen 19 Jan '10

19 Jan '10

Hi, I have a large database which I've migrated from slapd 2.3 (bdb) to slapd 2.4.20 (hdb) with: overlay refint refint_attributes member Unfortunately, after the migration I've experienced at least twice where a Group object had members referring to non-existent objects. The migration was done by stopping slapd 2.3, dumping with slapcat and then loading into 2.4.20. So the LDIF and DIT migrated should be ok. Do I have any way checking my database for other occurrences of refint violations, apart from writing a script to traverse an entire LDIF dump? /Peter

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical