openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Slow LDAP
by sgmayo＠mail.bloomfield.k12.mo.us 01 Sep '09

01 Sep '09

Is there some way to speed up LDAP? I am guessing this has to do with it searching the database on ldap? This is a new server and my old one did not take that long. It is not as slow if just one or two people are logging in with ldap, but when many login, it seems to bring ldap to a bottle neck, I guess while searching the directory for all the names. There are probably about 1000 users in my LDAP. Is that too large? I assume it isn't since most of the other schools around have AD which is basically Microsoft LDAP if I understand correctly and they have no problems and have many more users than I have. Can multiple schema's in the config file cause this? I know that on my old server I had the following in slapd.conf: core cosine inetorgperson nis samba On my new one it has the above plus: corba duaconf dyngroup java misc openldap ppolicy collective Those were just in there when I installed it so I left them. Should I take them out or would that not have any affect on logins at all? I am guessing that they wont' affect anything and it is more related to some sort of configuration in my ldap configs. Is there something else I need in a config? Here are my configs. slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema loglevel -1 sizelimit -1 allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=school,dc=bloomfield.k12.mo.us" checkpoint 1024 15 rootdn "cn=Manager,dc=school,dc=bloomfield.k12.mo.us" rootpw ***** directory /var/lib/ldap index objectClass eq index cn,sn,uid,displayName eq,pres,sub index uidNumber,gidNumber eq index memberUid eq index sambaSID,sambaPrimaryGroupSID eq index sambaDomainName eq index default sub database monitor ldap.conf SIZELIMIT 200 HOST 127.0.0.1 10.0.0.5 BASE dc=school,dc=bloomfield.k12.mo.us I have a DB_CONFIG file that contains the following, but not sure if it needs anything else or not: set_cachesize 0 268435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 Thanks for any info. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565 Question: Because it reverses the logical flow of conversation. Answer: Why is putting a reply at the top of the message frowned upon?

3 6

Samba + ldap questions
by Allgood, John 01 Sep '09

01 Sep '09

Hey All I am having a problems with using openldap and samba. We have been having issues with samba passwords expiring and I have tried several things to resolve the issues. The ldap server was setup using the smbldap-tools. When the password expires the only thing I have been able to do is to reset the password. I have tried the smbldap-usemod -B -1 &username to disable the SambaPwdMustChange. Also tried to set the SambaAcctFlags to UX. We set this ldap server up in hurry and did not have a chance to implement a proper password policy. This is using the stock version of Samba that came with RHEL5. Best Regards John Allgood Senior Systems Administrator Turbo, division of OHL 2251 Jesse Jewell Pky. NE Gainesville, GA 30507 tel: (678) 989-3051 fax: (770) 531-7878 jallgood(a)ohl.com www.ohl.com ______________________________________________________ This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you are not the intended recipient or their designee, please notify the sender immediately by return e-mail and delete all copies.

2 1

LDAPcon 2009
by Dieter Kluenter 01 Sep '09

01 Sep '09

Hi, the 2nd. International Conference on LDAP, LDAPcon 2009 will be held on September 20th and 21st at Waterfront Marriott Hotel, Portland. Oregon, *please register now*. http://www.symas.com/ldapcon2009/ Proceedings are available at http://www.symas.com/ldapcon2009/papers.shtml The 1st LDAPcon 2007 had been helt at Cologne, Germany, proceedings can be found here http://www.guug.de/veranstaltungen/ldapcon2007/further_readings.html The Organization Committee -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:8EF7B6C6 53°37'09,95"N 10°08'02,42"E

1 0

recreating DB from ldiff
by Tihomir Culjaga 31 Aug '09

31 Aug '09

Hello, I have an issue when adding entries to DB. for some reason im getting this autput: [root@ldap]# slapadd -f /etc/openldap/slapd.conf -l /home/tculjaga/export.ldif -q -c str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=38512331810,ou=redirec" and "uniqueID=38512322963,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=1727833) str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=385138" and "uniqueID=38513899170,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=10487774) str2entry: entry -1 has multiple DNs "lbsID=100,uniqueID=38514552151,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" and "uniqueID=38514558227,ou=redirecting,ou=sipDirektor,dc=ot,dc=hr" slapadd: could not parse entry (line=10895623) Can someone please explain whats wrong ? also, i went to lines listed above and found nothing strange at all ... any help ?

3 7

Select subtree with access filter
by Torsten Rehn 31 Aug '09

31 Aug '09

I have a number of objects scattered around my DIT that I want to dynamically "tag" for access by a certain user by giving them a memberOf attribute pointing to that user. Now here's the fun part: Is it possible to also give that user access to the subtree starting at the "tagged" object? E.g. I have an office manager who manages a random number of rooms around the building. I assign the rooms to him via memberOf, but the rooms also have people in them that he should have access to. For that I would need something like this: access to filter.subtree="(memberOf=managerguy)" by managerguy read Is there any way to do this today? Otherwise make it a feature request :) -- Torsten Rehn

1 1

the way to calculate the cache size.
by Huynhn, Nguyen Dac 31 Aug '09

31 Aug '09

Hi All, Im tuning my LDAP DB (BDB type). Im reading at http://www.openldap.org/doc/admin24/tuning.html#Berkeley%20DB%20Cache At 21.4.1.1 #(Number of hash buckets + number of overflow pages + number of duplicate pages) * page size / 2 #The objectClass index for my example database is 5.9MB and uses 3 hash buckets and 656 duplicate pages. So: # ( 3 + 656 ) * 4KB / 2 =~ 1.3MB. #With only this index enabled, I'd figure at least a 4MB cache for this backend. (Of course you're using a single cache shared among all of the database files, so the cache pages will most likely #get used for something other than what you accounted for, but this gives you a fighting chance.) I understand that: with each index ( in this case only objectclass is indexed), we must calculate their cache size individually and sum every them. (1) - I can specify Number of hash buckets & Cache Size (2)by command Shell> db_stat-4.4 -m | head -n 25 32771 Number of hash buckets used for page location Pool file: <index>.bdb <number> page size - I can specify Number of overflow pages & Number of duplicate pages by command Shell> db_stat-4.4 -d *.bdb (3) 0 Number of tree duplicate page 0 Number of tree overflow pages (1) Did I understand right? (2) Which page size will we use, some of index file use 4K page size, others use 16K page size? (3) Do must I run for each index or *.bdb is still ok? Could anyone help me? This chapter is not clearly huh? Thank for reading

1 0

Re: top-level data entries not replicating, 2.4.15, now 2.4.17
by Brian Neu 28 Aug '09

28 Aug '09

> Well, we'd need to see the config file for the replica as > well. > > --Quanah > Was in a previous post, but here you go.

2 11

ldapadd error while adding localized users
by anish patil 27 Aug '09

27 Aug '09

Hi all, I am trying to add localized users into ldap i.e LANG=ja_JP.SJIS while creating ldif file i am converting SJIS chars into UTF-8 format. if i give value attribute "gecos:" in ldif file in localized format I am not able add the user its giving me following error <error> additional info: gecos: value #0 invalid per syntax </error> If i am giving rest of the attributes in localized format it works fine Only problem is with gecos field can anyone tell is this the desired behavior or Am i missing something? OpenLDAP version:2.4.11 O.S: RHEL 4.3 Thanks in advance -- Anish Patil

3 3

Replicate AD User and Group accounts
by James A. Cleland 25 Aug '09

25 Aug '09

Hi, I need to simulate an Active Directory server to an LDAP client application using openldap. I am only interested in retrieving users and groups from openldap, but I need to have attributes match those in AD. I have found a number of guides on how to migrate from AD to OpenLDAP, but my application is not quite this complicated. At least I don't think it is. Here's what I've got so far. My AD server is Windows Server 2008. I have dumped ldif using ldifde: ldifde -d "CN=Users,DC=[domain],DC=com" -f export.ldif This returns me an ldif of Users and Groups, which is what I want. I have set up OpenLDAP as suggested in numerous migration docs to include core, cosine, and nis schemas. I am able to access the LDAP server and browse it using a manager DN and a clear password for now. I have attempted to import my ldif using the following: Ldapadd -H ldap://<server> -f export.ldif -x -D "cn=Manager,dc=[domain],dc=com" -W The reply from the server is: ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I believe this error is due to the second (#1) record in the ldif which is the first group and has an objectClass: group. "group" does not appear to be a defined object class in any of the aforementioned schema. Can I obtain schema for this ldif? I can't find any docs on doing this or any schema files that contain this objectClass. BTW, I am a complete LDAP newbie, so please forgive any terminology misuse, etc. Thanks!

2 1

Replace Active Directory with OpenLDAP and Others
by Serge Fonville 25 Aug '09

25 Aug '09

Both, Thanks for the info > To get a drop-in replacement for AD you probably should ask in a Samba forum; AD does a lot more than just LDAP service and you need Samba to bring all the pieces together. If you only need directory service, then we can talk about it more here. But when migrating off MS, you typically need more than just LDAP to work... I will ask there then, thanks for the tip >> I was wondering if there is an uptodate guide/tutorial/howto to >> replace Active Directory. >> I found http://www.bayour.com/LDAPv3-HOWTO.html but that was last >> updated in 2005. >> >> Also I could not find any references to people actually having >> replaced Active Directory. >> In my head it should be possible, but replacing MS products does not >> always make sense in practice. ;-) >> >> I have not yet had the time to fully work through the howto. but >> either way I will give it a try (well a couple probably) >> > There is currently no drop-in replacement for Active directory in open > source world. Samba in conjunction with LDAP gets as close as replacing > NT4.0 domain controller. This is a legacy in MS world and has it's > disadvantages over Active directory. > I recommend reading the following SAMBA docs > http://us3.samba.org/samba/docs/man/Samba-HOWTO-Collection/ > http://us3.samba.org/samba/docs/man/Samba-Guide/ I've been looking at samba a couple of times in the last couple of years. But in it's current form, it is only suitable for SMB/CIFS imho Thanks for the help and the info! Regards, Serge Fonville

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical