openldap-technical

openldap-technical@openldap.org

1 participants
9898 discussions

Re: Advice/comments on deploying openLDAP in a VirtualBox
by Arun Khan 23 Sep '09

23 Sep '09

> Date: Tue, 22 Sep 2009 16:59:30 -0400 > From: Adam Tauno Williams <awilliam(a)opengroupware.us> > Subject: Re: Advice/comments on deploying openLDAP in a VirtualBox > appliance. > To: openldap-technical(a)openldap.org > Message-ID: <1253653170.5317.24.camel@linux-m3mt> > Content-Type: text/plain > > On Wed, 2009-09-23 at 00:23 +0530, Arun Khan wrote: >> I have completed the prototyping of openldap, samba/pdc, on a >> VirtualBox appliance. The setup works fine with 4-5 different >> desktop clients connecting to >> the services. >> Appliance details: VirtualBox 3.0.6 - 512MB RAM, 8MB Video RAM, 9GB >> VDI with 1GB Swap and CentOS 5.3 64bit). >> I am considering deploying this appliance into production with 1GB >> RAM. The no. of clients connecting to the server will be approx. 150. >> Has anyone deployed openLDAP + Samba/PDC in a VirtualBox appliance? > > I don't know anything about Virtual Box but I operate an OpenLDAP + > Samba/PDC for 300+ used on an ESX VM with roughly the allocated > resources you specify [although I have no idea about "Video RAM" or > "VDI"]. I imagine the performance of the underlying host may matter > more than your specific allocations so long as process fit into the > allocated memory. Much thanks for sharing your experience and validating the deployment openLDAP+Samba/PDC in a virtual environment. The VirtualBox VideoRam is applicable only for graphical display and VDI == VirtualDiskImage (it is the file that contains the VM). -- Arun Khan

1 0

bdb checkpoints
by Oliver Henriot 23 Sep '09

23 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list users, I'm trying to get my DB_CONFIG file sorted out and I'm getting confused. If I follow the documentation available on zytrax.com (http://www.zytrax.com/books/ldap/ch6/bdb.html#db-config), if I have a DB_CONFIG file it should contain a txn_checkpoint directive instead of the checkpoint directive in slapd.conf file which indeed does nothing no matter if I change it or not. But if I put a txn_checkpoint in the DB_CONFIG file I get a "unrecognized name-value pair: txn_checkpoint" error and everything dies miserably. So, as Howard suggests (http://www.openldap.org/lists/openldap-software/200605/msg00091.html), I set off on a quest to read the BerkeleyDB documentation. I'm finding reading it not very useful for several reasons. Firstly txn_checkpoint directive sometimes occurs (http://www.oracle.com/technology/documentation/berkeley-db/db/programmer_re… so at least version 3.1, and up?, should understand txn_checkpoint) and sometimes not (http://www.oracle.com/technology/documentation/berkeley-db/db/api_reference…). Secondly, there is scarce, if any, reference to the versions of BDB concerned in the documentation I have found and now I have spent an awful amount time (well, ten minutes maybe) trying to find out exactly which version of BDB I have I'd like to make some intelligent use of that information if at all possible. Well, I'm lost. The only thing I've found is a gigabyte of bdb logs created when I populate my directory wich are not removed by dbconfig set_flags DB_LOG_AUTOREMOVE, and even more as my directory lives it life (several gigabytes after a week or two). So I'd like to reduce their volume if at all possible rather than having to regularly remove them using slapd_db_archive manually. So, what's the story with BDB transaction checkpoint logs? How can I get this mess sorted out? I'm using Openldap 2.3.43-3.el5 with BDB 4.3.29 on CentOS 5.3. Thanks. Best regards, Oliver -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkq5+hoACgkQSWuBJnHIHdIZxACg1kcPx90oHYn8G/D33HWf+dzE 0OAAnRgckB9Nbre0Z7azx15YFLOMOCR4 =OYos -----END PGP SIGNATURE-----

3 4

LDAPCon slides
by Howard Chu 23 Sep '09

23 Sep '09

For those of you who weren't able to attend the conference, most of the submitted talks now have their slides/papers online on the web site. http://www.symas.com/ldapcon2009/papers.shtml You missed a lot of great discussions, and a live demo of probably the world's smallest LDAP server installation - OpenLDAP 2.4.18 running on my G1 phone, serving queries from Ludovic Poitou's iPhone address book. OpenLDAP doesn't just scale up to massive multi-processor deployments, it also works well at the smallest of scales. Even the "embedded directory" guys haven't gotten here yet... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Advice/comments on deploying openLDAP in a VirtualBox appliance.
by Arun Khan 23 Sep '09

23 Sep '09

I have completed the prototyping of openldap, samba/pdc, on a VirtualBox appliance. The setup works fine with 4-5 different desktop clients connecting to the services. Appliance details: VirtualBox 3.0.6 - 512MB RAM, 8MB Video RAM, 9GB VDI with 1GB Swap and CentOS 5.3 64bit). I am considering deploying this appliance into production with 1GB RAM. The no. of clients connecting to the server will be approx. 150. Has anyone deployed openLDAP + Samba/PDC in a VirtualBox appliance? I'd appreciate if you could share your experience, gotchas etc with respect to an appliance environment as well as resources allocated to the appliance e.g. amount of RAM. TIA Regards, -- Arun Khan

3 2

rwm-overlay, adding attributes
by Jeroen Berning 23 Sep '09

23 Sep '09

Hi, Can I with the rwm-overlay also introduce new static attribute? (Or change the content of an existing attribute and its name to use it for something new). Or do I need to combine it with the translucent overlay to gets things added? If it can be done and somebody has an example it would be appreciated. Jeroen

1 0

LDAP authentication + replication
by Maxime Gaudreault 22 Sep '09

22 Sep '09

Hi list I configured my 2 tests server to replicate with syncrepl using this website: https://help.ubuntu.com/9.04/serverguide/C/openldap-server.html It works well. If I create a new user on any servers it's immediately replicated to the other. However I have some error in the log files: (these 2 messages appears every 10 seconds on the first server (vmlinux01)) Sep 22 11:53:56 vmlinux01 slapd[12072]: <= bdb_equality_candidates: (entryCSN) not indexed Sep 22 11:53:56 vmlinux01 slapd[12072]: <= bdb_inequality_candidates: (entryCSN) not indexed Sep 22 11:24:51 vmlinux02 slapd[10596]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 22 11:24:51 vmlinux02 slapd[10596]: do_syncrepl: rid=001 retrying (4 retries left) Also, when I configure the server to authenticate using LDAP (pam-auth-update) I can connect to the system using an LDAP account (say maxime) but look at the prompt and whoami result : administrator@vmlinux01:~$ whoami administrator Do I need to create the users on both LDAP and Linux ? Max

2 1

Reg OpenLdap on Ubuntu
by Asimananda Mohanty 22 Sep '09

22 Sep '09

Hi All, I am currently busy configuring OpenLdap on my newly installed Ubuntu 9.04. Here is what I have done till now. I followed the steps defined in https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html and installation was successful. I installed PhpLdapAdmin also. After I created certificate, key etc, I created a .ldif file (enable-ca.ldif) with the following content : *dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/server.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/server.key* Then I executed the command : *ldapmodify -D "cn=admin,cn=config" -x -w 12345678 -f enable-ca.ldif* and it was a success. But after this, when I tried to restart slapd, I got errors like the following : *main: TLS init def ctx failed: -1* I noticed that after I executed "ldapmodify -D "cn=admin,cn=config" -x -w 12345678 -f enable-ca.ldif", 3 lines are added to /etc/ldap/slapd.d/cn=config.ldif and when I commented the last two lines like the following, slapd started successfully. *olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem #olcTLSCertificateFile: /etc/ssl/certs/server.crt #olcTLSCertificateKeyFile: /etc/ssl/private/server.key* This looks quite strange. Please help me resolving the same. -Asimananda

6 48

Syncrepl choking on case sensitive DN ?
by Emmanuel Kasper 22 Sep '09

22 Sep '09

Hello I noticed today that my syncrepl consumer was not up to date with the last change contained in the provider. (I am using slapd 2.4.11-1 from debian ) Looking at /var/log/syslog I see Sep 16 13:49:37 ur slapd[8172]: syncrepl_entry: rid=100 be_search (0) Sep 16 13:49:37 ur slapd[8172]: syncrepl_entry: rid=100 dc=webmail,ou=friends.openforce.com,ou=CNAME,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com Sep 16 13:49:37 ur slapd[8172]: syncrepl_entry: rid=100 be_modrdn (32) Sep 16 13:49:37 ur slapd[8172]: do_syncrepl: rid=100 quitting and in debug mode bdb_modrdn: new parent "ou=friends.openforce.com,ou=CNAME,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com" requested... bdb_dn2entry("ou=friends.openforce.com,ou=cname,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com") => bdb_dn2id("ou=friends.openforce.com,ou=cname,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_modrdn: newSup(ndn=ou=friends.openforce.com,ou=cname,dc=openforce.com,ou=private,ou=dns,dc=openforce,dc=com) not here! see the cname/CNAME case difference ? the provider dn is indeed written CNAME. EK -- openForce Information Technology GesmbH http://www.openforce.com/ It is a book about a Spanish guy called Manual. You should read it. -- Dilbert

2 2

can't bind in subtree
by mkappe 21 Sep '09

21 Sep '09

Hi all, i'm having a problem that i can't understand: i create an openldap tree with a subtree called studenti. when i add an entry in the main tree i can bind correctly. when i insert an entry in the studenti subtree i can't bind. In attachment you will find the log files. What can i do? Thanks Marco

2 1

Proxy from Active Directory to OpenLdap
by Giacomo Calisse 21 Sep '09

21 Sep '09

Hello to everybody, I need an help... I have an Antivirus Server (Appliance) that performs requests to Active Directory. I don't have installed Active Directory but I have installed Open Ldap 2.3, so I have to convert the request from Active Directory format to Open Ldap format. In other words I have to create a Proxy. E.g. The structure where to take the data has this form: # extended LDIF # # LDAPv3 # base <dc=unina,dc=it> with scope subtree # filter: uid=rciotola # requesting: ALL # # xxxx yyyy (xxxx.yyyy(a)unina.it), CSI - CENTRO DI ATENEO PER I SERVIZI INFORMATIVI (295550), ALTRA STRUTTURA (100000), PersonaleT.A., istituzionali , unina.it dn: cn=xxxy yyyy (xxxx.yyyy(a)unina.it),ou=CSI - CENTRO DI ATENEO PER I SE RVIZI INFORMATIVI (295550),ou=ALTRA STRUTTURA (100000),ou=PersonaleT.A.,ou=is tituzionali,dc=unina,dc=it businessCategory: N employeeType: PersonaleTA mailLocalAddress: xxxx.yyyy(a)unina.it givenName: xxxx objectClass: inetOrgPerson objectClass: inetLocalMailRecipient objectClass: posixAccount objectClass: shadowAccount mailRoutingAddress: xxxx.yyyy(a)unina.it ou:: Y2lvdG9sYSByYWZmYWVsZSAocmNpb3RvbGFAdW5pbmEuaXQpIA== departmentNumber: CODICEFISCALE uid: xxxx.yyyy mail: xxxx.yyyy(a)unina.it mail: matzzzzz(a)unina.it mail: otheralias(a)unina.it mail: otheralias2(a)unina.it uidNumber: nnnnn cn:: Y2lvdG9sYSByYWZmYWVsZSAocmNpb3RvbGFAdW5pbmEuaXQpIA== physicalDeliveryOfficeName: 295550 physicalDeliveryOfficeName: CSI - CENTRO DI ATENEO PER I SERVIZI INFORMATIVI loginShell: /bin/false gidNumber: 100 employeeNumber: zzzzzz homeDirectory: /home/xxxx.yyyy sn: yyyy title: Personale tecnico amm.vo # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 These data should be tranformed in Active Directory format and should have the fields sAMAccountName, mail, group and ProxyAddresses; both that concerns data and authentication. I hope that you can help me... cheers Giacomo

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical