openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Possible workaround to slapo-ppolicy sync limitations
by Jordi Espasa Clofent 06 Aug '09

06 Aug '09

Hi, This post is because of: http://www.openldap.org/lists/openldap-technical/200906/msg00221.html http://www.openldap.org/lists/openldap-technical/200908/msg00028.html So, if you're using ppolicy-slapo in a load-balanced environment, you pool servers never will be sync completely; at least, the ppolicy state atributes will be not replicated. I know isn't really a slapo-ppolicy limitation rather than RFC especification consequence. Well... I want my load-balancing environment and I want also the ppolicy overlay. So ¿how to make an effective workaround? At first, I've thinked in next scenario: * 1 provider and 2 consumers * every 5 minutes the consumers rsync the contents of master ddbb (/var/lib/ldap/* in my case, Debian Lenny boxes) ¿It will be enough? I wonder if consumers slapd can accept these data change "on the fly" or maybe restarting the service is mandatory. -- Thanks, Jordi Espasa Clofent

3 2

Problems with heimdal ldap backend
by Andreas Roth 06 Aug '09

06 Aug '09

Hello, i've a heimdal (1.2) server which uses the OpenLDAP (2.4.15) directory for data storage. When i run the following script: #!/bin/sh for i in `seq 1 10000`; do kinit --password-file=passwd && echo "ok $i" || break; done At some point the kinit fails, because heimdal cannot connect to the LDAP server. heimdal-kdc server fails at ldap_sasl_bind_s with 'Can't contact LDAP server'. Heimdal access the LDAP directory is using the ldapi:///. When i 'slow-down' the LDAP server with strace or by enable debug log to console the number of successful kinit runs increase. It seems to be a some kind of timing problem, but i don't have a clue to find out what's the reason for it. Maybe someone here on the list can help me. Thanks in advance, Andreas

1 0

error when setting an alias entry.. (ldap_add: Naming violation (64))
by Michael March 05 Aug '09

05 Aug '09

I'm following this: http://www.openldap.org/faq/data/cache/1111.html I'm getting this error: ldap_add: Naming violation (64) additional info: value of naming attribute 'uid' is not present in entry Here are the sample ldif entries: dn: uid=luzer,ou=main,dc=acme,dc=com uid: luzer objectClass: top objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash userPassword: {SSHA}8Sz/X2Fv1S1COqD46K5kEwFS2Lyj4h2I shadowWarning: 7 uidNumber: 1000 shadowMax: 99999 gidNumber: 1000 sn: De Torre homeDirectory: /home/luzer mail: luzer givenName: Bob shadowLastChange: 14007 cn: luzer dn: uid=luzer,ou=alternate,dc=acme,dc=com objectclass: alias objectclass: extensibleObject uid: alias aliasedobjectname: uid=luzer,ou=main,dc=acme,dc=com -- <admiral> Michael F. March

4 7

How to detect a corrupt database?
by Jordi Espasa Clofent 05 Aug '09

05 Aug '09

Hi folks, I've experienced some problems in one of my 3 OpenLDAP servers. First glance suggests a ppolicy overlay problem, but, at the end, the problem was resolved, simply, deleting the bbdd (BDB4) and restarting the system (is a consumer server, so the ddbb was automatically regenerated). So, my questions are * ¿How I can detect a corrupt database? * ¿Is there any tool/command to check the ddbb health (DBD4)? * ¿What can I do if the corrupted database is the provider database? -- Thanks, Jordi Espasa Clofent

4 5

ldap database directory permission denied
by yilmaz 05 Aug '09

05 Aug '09

Hello, I have a problem to run openldap in a different directory other than /var/lib/ldap I am using Redhat AS 4 (update 4) with selinux disabled. Openldap version is 2.4.13 . The message written into syslog is "line 24: invalid path: Permission denied " . Line 24 specifies is a different directory than /var/lib/ldap and directory has the 755 permission of the user running ldap daemon. Google search has revealed some issues on ubuntu and on redhat with selinux enabled but I have neither of these. If I change the directory to /var/lib/ldap everything works fine. I hope someone could shed me light on this issue. thanks a lot.

2 1

objectclass glue problem
by Steinmetz, Robin 05 Aug '09

05 Aug '09

Hi, I created some records with phpldapadmin but now they look like this: dn: ozsSys=aaaaa,o=bbbb,ozsDir=APO-patient,o=ozs,c=nl objectClass: top objectClass: glue structuralObjectClass: glue ozsSys=aaaaa instead of dn: ozsSys=aaaaa,o=bbbb,ozsDir=APO-patient,o=ozs,c=nl objectClass: ozsSystem structuralObjectClass: ozsSystem ozsSys=aaaaa Is There a way to change these glue entries without reloading a complete tree? The normal ldapmodify doesn't allow to change this and ldapsearch can't find these records. Ldapdelete won't delete them either. Entries loaded under this dn can be found/modifies/deleted as normal Regards, Robin

1 0

value-based modify operation on binary attribute fails
by Kay.Kirchhoefer＠t-systems.com 05 Aug '09

05 Aug '09

Hi, I´m trying to remove the attribute "userCertificate;binary" from an entry, if it (attr) contains a special value (certificate). I´m trying this operation with perl ldap modules and also with Gawojar ldap browser. Both were working for me when I was using OpenLDAP 2.3.20. Now I´m using OpenLDAP 2.4.12 and I get an error message MOD attr=userCertificate;binary RESULT tag=103 err=16 text=modify/delete: userCertificate;binary: no such value but I send the modify request by using exactly the same value as I get from the ldap server (I compared the bytes sent across the network with wireshark) when requesting it with a ldapsearch. As I already wrote the same function worked for me with the older OpenLDAP version. I also tried to modify text attributes; that´s working. I didn´t found anything in the change log which is pointing to a fix regarding the comparison mechanism. Has anybody else had that problem ? Yours sincerely, Kay

2 2

Re: ldap PDC -- Failed to issue the StartTLS instruction
by Quanah Gibson-Mount 05 Aug '09

05 Aug '09

--On August 4, 2009 4:20:06 PM -0700 Ivan Ordonez <iordonez(a)nature.berkeley.edu> wrote: > Sorry Quanah, I am not following you on what you want me to do. Can you > please elaborate? > > Thank you for all your help. Keep replies on the list please. I was saying, I would have kept the ldaps:// URI in your config file, and drop the start TLS bit, and seen whether or not that works. In either case, I would use the ldapsearch binary to test against your server, both with ldaps:// URIs, and with ldap:// URIs using the -ZZ or -ZZZ flags to ldapsearch. ldapsearch with ldap:/// and -ZZ(Z) will use startTLS. ldapsearch with ldaps:// will try an SSL connection to the LDAP server. This way, you can hopefully get more meaningful error messages. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ldap PDC -- Failed to issue the StartTLS instruction
by Ivan Ordonez 05 Aug '09

05 Aug '09

Hello, We've been using an ldap based PDC from quite a while. Now we're suddenly having trouble getting our main fileserver to talk with the PDC. samba-3.2.13 on solaris 10. Here is our smb.conf global defs: Server role: ROLE_DOMAIN_MEMBER [global] workgroup = CNRDOM server string = nature (Samba %v) security = DOMAIN passdb backend = ldapsam:ldaps://169.229.xxx.yyy log level = 5 log file = /var/log/samba/log.%m name resolve order = wins host lmhosts os level = 65 local master = No domain master = No dns proxy = No wins support = Yes ldap ssl = start tls When we start up samba, we see many lines like these in log.smbd: [2009/08/03 15:40:40, 1] lib/smbldap.c:another_ldap_try(1170) Connection to LDAP server failed for the 4 try! and these: [2009/08/03 15:51:56, 0] lib/smbldap.c:smb_ldap_start_tls(595) Failed to issue the StartTLS instruction: Can't contact LDAP server [2009/08/03 15:51:56, 5] lib/smbldap.c:smbldap_search_ext(1199) smbldap_search_ext: base => [], filter => [(&(|(objectclass=sambaGroupMapping)(sambaGroupType=4))(|(sambaSIDList=S-1-22-1-97)(sambaSIDList=S-1-22-2-97)(sambaSIDList=S-1-1-0)(sambaSIDList=S-1-5-2)(sambaSIDList=S-1-5-32-546)))], scope => [2] [2009/08/03 15:51:56, 5] lib/smbldap.c:smbldap_close(1103) The connection to the LDAP server was closed But over on the PDC (gentoo linux 2.6.29, samba-3.2.13 , openldap-2.4.27) we see this in tcpdump: $ tcpdump -vv -c 4 port ldaps tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 15:51:29.736629 IP (tos 0x0, ttl 61, id 60609, offset 0, flags [DF], proto TCP (6), length 52) nature.Berkeley.EDU.56299 > xxxyyy.CNR.Berkeley.EDU.ldaps: S, cksum 0x6a18 (correct), 1637042825:1637042825(0) win 49640 <mss 1380,nop,wscale 0,nop,nop,sackOK> 15:51:29.736651 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) xxxyyy.CNR.Berkeley.EDU.ldaps > nature.Berkeley.EDU.56299: R, cksum 0x6c68 (correct), 0:0(0) ack 1637042826 win 0 15:51:30.746803 IP (tos 0x0, ttl 61, id 60610, offset 0, flags [DF], proto TCP (6), length 52) nature.Berkeley.EDU.56302 > xxxyyy.CNR.Berkeley.EDU.ldaps: S, cksum 0xa6d9 (correct), 2235230749:2235230749(0) win 49640 <mss 1380,nop,wscale 0,nop,nop,sackOK> 15:51:30.746827 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) xxxyyy.CNR.Berkeley.EDU.ldaps > nature.Berkeley.EDU.56302: R, cksum 0xa929 (correct), 0:0(0) ack 2235230750 win 0 It appears that there is indeed an ldaps conversation going on. We created new certificate on the PDC to see if certificate is the problem to no avail. Same message, and same problem. We disable firewall on the PDC as well and make sure that LDAP ports are all open. The Solaris 10 machine (ROLE_DOMAIN_MEMBER) and the PDC are on two different subnets. We're hoping someone will recognize this behavior and reveal our mistake to us. Or perhaps point out where we should check/debug/RTFM next.

2 3

olcDbConfig: value #14 provided more than once
by Matthew Edlefsen 04 Aug '09

04 Aug '09

Hello, I'm trying to do multi-master replication and after following the directions in the User Guide I came across the error: Aug 3 20:21:38 gabbro slapd[81578]: syncrepl_message_to_entry: rid=001 mods check (olcDbConfig: value #14 provided more than once) This is from the logs when it is syncing the cn=config tree. The especially odd thing about this error is that olcDbConfig is one of the numbered entries (the ones with {#} prepending each value), not to mention that the line is question is blank. This isn't the first time I've encountered this error when trying to do this type of thing (alas, I never got around to trying to fix it before :) ), so I'm hoping that means either I'm doing something obviously wrong or somebody has seen this before. Both servers are freebsd jails running FreeBSD 7.2 Stable. Here are some of the relevant configs. These are not the full entries, just the important bits. They are identical on both servers and they do sync parts of the config (everything up to the value that fails). dn: cn=config olcServerID: 1 ldap://rock.earlham.edu/ olcServerID: 2 ldap://gabbro.earlham.edu/ dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=dap://rock.earlham.edu/ binddn="<snip>" bindmethod=simple credentials=<snip> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://gabbro.earlham.edu/ binddn="<snip>" bindmethod=simple credentials=<snip> searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcDatabase={1}bdb,cn=config olcDbConfig: {0}# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/12/18 11:53:27 ghenry Exp $ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co…> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig: {8}# <http://www.openldap.org/faq/index.cgi?file=2> olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon rebuilding olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 1 GB cache olcDbConfig: {16}set_cachesize 0 1073741824 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 104857600 olcDbConfig: {24}set_lk_max_locks 100000 olcDbConfig: {25}#set_lg_dir logs olcDbConfig: {26} olcDbConfig: {27}# Note: special DB_CONFIG flags are no longer needed for "quick" olcDbConfig: {28}# slapadd(8) or slapindex(8) access (see their -q option). Thanks! Matt Edlefsen Earlham College

5 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical