openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

syncrepl findbase failed! 32 errors
by Barry Colston 12 Aug '09

12 Aug '09

I'm running OpenLDAP 2.4.17 with 3 servers configured in multi-master mode (server 1 replicates to server 2 and server 3, server 2 replicates to server 1 and server 3, and server 3 replicates to server 1 and server 2). While executing shell scripts to test replication, all 3 slapd instances began returning error code 32 to all requests. No information could be retrieved from any of the 3 LDAP servers using ldapsearch, Apache Directory Studio, LDAP Administrator tool, or the LDAP Browser tool. The slapd log records with debug level = sync contained numerous "findbase failed! 32" errors. Starting and restarting the slapd instances still resulted in error code 32 being returned for any LDAP request. I had to restore the LDAP databases to be able to view/update records in any of the 3 LDAP databases. Server 1 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3892 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3893 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Server 2 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3893 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Server 3 configuration snippet: overlay syncprov syncprov-checkpoint 100 15 syncprov-sessionlog 5000 syncrepl rid=001 provider=ldap://localhost:3891 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" syncrepl rid=002 provider=ldap://localhost:3892 type=refreshAndPersist retry="60 60 300 +" searchbase="dc=authentx" scope=sub schemachecking=off bindmethod=simple binddn="cn=xroot,dc=authentx" credentials="980170contact" mirrormode on Snippets from log file from server 1 around the slapd error 32 problem time: syncprov_sendresp: to=002, cookie=rid=001,sid=001,csn=20090811143737.466654Z#000000#001#000000 syncprov_sendresp: to=003, cookie=rid=001,sid=001,csn=20090811143737.466654Z#000000#001#000000 slap_queue_csn: queing 0xa2452d98 20090811143737.567781Z#000000#001#000000 syncprov_sendresp: to=002, cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa17098a8 20090811143737.567781Z#000000#001#000000 syncprov_sendresp: to=003, cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 connection_input: conn=456 deferring operation: binding findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 findbase failed! 32 connection_input: conn=461 deferring operation: binding Snippets from log file from server 2 around the slapd error 32 problem time: slap_queue_csn: queing 0xa1709520 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa1709650 20090811143737.567781Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (32) do_syncrepl: rid=001 rc 32 retrying (59 retries left) syncprov_sendresp: to=003, cookie=rid=002,sid=002,csn=20090811143737.567781Z#000000#001#000000 do_syncrep2: cookie=rid=002,sid=003,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=002 be_search (32) syncrepl_entry: rid=002 (null) slap_queue_csn: queing 0xa1714320 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa1716558 20090811143737.567781Z#000000#001#000000 do_syncrepl: rid=002 rc 32 retrying (59 retries left) findbase failed! 32 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=001 (32) No such object do_syncrepl: rid=001 rc -2 retrying (59 retries left) do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 rc -2 retrying (59 retries left) findbase failed! 32 Snippets from log file from server 3 around the slapd error 32 problem time: slap_graduate_commit_csn: removing 0x835e498 20090811143737.466654Z#000000#001#000000 do_syncrep2: cookie=rid=001,sid=001,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=001 be_search (0) syncrepl_entry: rid=001 dc=authentx slap_queue_csn: queing 0xa160ee80 20090811143737.567781Z#000000#001#000000 syncprov_matchops: skipping original sid 001 slap_graduate_commit_csn: removing 0xa16134f8 20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=001 be_delete dc=authentx (0) slap_queue_csn: queing 0xa160ee80 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0xa16134f8 20090811143737.567781Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (32) do_syncrepl: rid=001 rc 32 retrying (59 retries left) syncprov_sendresp: to=002, cookie=rid=002,sid=003,csn=20090811143737.567781Z#000000#001#000000 do_syncrep2: cookie=rid=002,sid=002,csn=20090811143737.567781Z#000000#001#000000 syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_DELETE) syncrepl_entry: rid=002 be_search (32) syncrepl_entry: rid=002 (null) slap_queue_csn: queing 0x8338688 20090811143737.567781Z#000000#001#000000 slap_graduate_commit_csn: removing 0x8360318 20090811143737.567781Z#000000#001#000000 do_syncrepl: rid=002 rc 32 retrying (59 retries left) do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object do_syncrep2: rid=002 (32) No such object do_syncrepl: rid=002 rc -2 retrying (59 retries left) findbase failed! 32 I have been unable to reproduce this problem. Any suggestions on how to prevent this problem from occurring and how to recover when this problem occurs? Thanks, Barry Colston

2 3

Changing the top object
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

In the slapd.conf file of a provider server I have the following suffix parameter: suffix "dc=example,dc=org" And with slapcat I see the followind: dn: dc=example,dc=org objectClass: top objectClass: dcObject objectClass: organization o: example.org dc: example structuralObjectClass: organization entryUUID: ead90d7a-c02b-102c-8c00-cb58049f9ef6 creatorsName: modifiersName: createTimestamp: 20080527112930Z modifyTimestamp: 20080527112930Z entryCSN: 20080527112930.000000Z#000000#000#000000 I wanted to set a consumer but I set the suffix parameter wrong: suffix "dc=corp,dc=example,dc=org" So this was created: dn: objectClass: top objectClass: dcObject objectClass: organization o: corp.example.org dc: corp structuralObjectClass: organization entryUUID: 29af5532-1abb-102e-9f19-896497a83f9b creatorsName: createTimestamp: 20090811120636Z entryCSN: 20090811120636.425151Z#000000#000#000000 modifiersName: modifyTimestamp: 20090811120636Z Is there any way to change this? I also don't know why the dn in the second case is empty (I thought it should be dc=corp,dc=example,dc=org). If this can't be easily fixed, is there any way of starting from scratch? Regards.

4 13

RE: syncrepl findbase failed! 32 errors
by Quanah Gibson-Mount 12 Aug '09

12 Aug '09

--On Wednesday, August 12, 2009 3:29 PM -0400 Barry Colston <bcolston(a)xtec.com> wrote: > BDB 4.6.21. I'm checking with the person who built BDB/LDAP to see what > patches have been applied. > Please keep replies on the list, thanks. :) --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

unique
by Márcio Luciano Donada 12 Aug '09

12 Aug '09

Hi, Currently I'm using the unique to the mail, but I would also add other attributes, is this possible? overlay unique unique_uri ldap:///?mail?sub? -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 1

Entry not listed when requesting all entries with ldapsearch
by Yeray Gutiérrez Cedrés 12 Aug '09

12 Aug '09

I've added a new entry with ldapadd like this: I've got this in a file (myfile.ldif): dn: mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com cn: Mr Someone mail: someone(a)example.com maildrop: someone(a)corporative.example.com sn: Boss objectClass: CourierMailAlias objectClass: person objectClass: top objectClass: inetOrgPerson $>ldapadd -D "cn=admin,dc=example,dc=com" -w secret -x -h "localhost" -f myfile.ldif I can see it if I search specifically for it with ldapsearch (no problem with this): $> ldapsearch -x -b "mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com" # extended LDIF # # LDAPv3 # base <mail=someone(a)example.com,ou=alias,ou=postfix,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # someone(a)example.com, alias, postfix, someone.com dn: mail=someone(a)example.com,ou=alias,ou=postfix,dc=someone,dc=com cn: Mr Someone mail: someone(a)example.com sn: Boss objectClass: CourierMailAlias objectClass: person objectClass: top objectClass: inetOrgPerson maildrop: someone(a)corporative.example.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Howerver, when I try to search for this entry with ldapsearch I can't see it if I list all the entries: $> ldapsearch -x -b "ou=alias,ou=postfix,dc=example,dc=com" | grep "someone" $> I have some other entries that were previously there and they are all listed. It's very extrange that in the complete list the new etnry doesn't get listed. Any idea? Regards.

2 1

openldap 2.4.16, rwm, syncrepl
by mkappe 12 Aug '09

12 Aug '09

Hello everybody, I'm front a problem with my openldap 2.4.16 server and i hope you can give me help to solve it. The problem is the following one: I use a schema for email addresses but i need to make it compliant with another one. I found some matching fields from my current model to the other one but i wouldn't like to duplicate them or define a schema for the new model. I tried to use rwm module in this way: include /usr/local/../schema/core.schema include /usr/local/../schema/cosine.schema include /usr/local/../schema/inetorgperson.schema include /usr/local/../schema/my_email.schema ... ... database bdb suffix "dc=mydomain,dc=it" rootdn "cn=manager,dc=mydomain,dc=it" rootpw xxxxxx directory /openldap/data/mydomain index objectClass,uid eq index entryCSN eq index entryUUId eq overlay rwm rwm-map attribute myemail theNewEmail rwm-map attribute mypassword theNewPassword ... Searching for theNewEmail in dc=mydomain,dc=it nothing appears. What do i wrong? Another question: are there any problem if i use rwm overlay in a delta-syncrepl mode? Thank you! M.

1 0

OpenLDAP Virtual File System
by Jon Rascal 12 Aug '09

12 Aug '09

Hi, I want to create a virtual file system where metadata is stored in an LDAP repository. Metadata includes owner, mod-time, create-time, access-control-lists, pysical file path, and, of course, LDAP's hierarchy instead of a file-system directory base. Files are to be stored on physical medium and (preferably pyton) code used to bridge the request (over https), the metadata, and the physical file stream. Users and Keys are also stored in the LDAP directory. Is this a bad use for LDAP? I'm also looking for an LDAP guru to consult for this particular project. JR

2 1

LDAP stopping without apparent reason
by Márcio Luciano Donada 11 Aug '09

11 Aug '09

Hi list, We have a service ldap, version 2.4.11-1, debian lenny, but the times have been falling and does not even have a message in the log about the fall of it. Use it for e-mail service, jabber, ftp, and website. In the logs I have the following message: Aug 8 09:34:41 ldap slapd[15338]: connection_input: conn=1332300 deferring operation: binding Aug 8 09:34:42 ldap slapd[15338]: connection_input: conn=1332301 deferring operation: binding Aug 8 09:47:46 ldap slapd[15338]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 My configuration allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/qmail.schema include /etc/ldap/schema/authldap.schema include /etc/ldap/schema/RADIUS-LDAPv3.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 1024 modulepath /usr/lib/ldap moduleload back_hdb TLSVerifyClient demand TLSCACertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem tool-threads 16 threads 32 backend hdb database hdb suffix "dc=auroraalimentos,dc=com,dc=br" rootdn "cn=suporte,dc=auroraalimentos,dc=com,dc=br" rootpw secret directory "/var/lib/ldap" idletimeout 30 timelimit 320 schemacheck on checkpoint 1024 5 cachesize 100000 dbconfig set_cachesize 0 2097152 0 lastmod on sizelimit unlimited index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uniqueMember eq index uidNumber eq index gidNumber eq index memberUID eq index mailAlternateAddress eq index MailForwardingAddress eq index mail pres,eq index default sub index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq index sambaSIDList,sambaGroupType eq index givenName eq access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * none access to * by self write by users read by * read when the service to have a big problem, mainly because the e-mail service is affected. thanks -- Márcio Luciano Donada <mdonada at auroraalimentos dot com dot br> Aurora Alimentos - Cooperativa Central Oeste Catarinense Departamento de T.I.

2 10

ppolicy and ACLs of pwdAccountLockedTime?
by Jiri Bohac 11 Aug '09

11 Aug '09

Hi, I am having troubles making the ppolicy overlay to prevent password guessing attacks with pwdLockout with slapd-2.4.11-1 in Debian Lenny. I set pwdMaxFailure to 3. In the user object I am testing with, I never get more than two entries for pwdFailureTime and pwdAccountLockedTime is never added at all. I tracked the problem down to the ACL settings in slapd.conf. With my default access to * by dn="cn=admin,dc=example,dc=net" write by * read , I get the above result. When I rewrite the last line to "by * write", it works. The pwdFailureTime is updated, because it is defined as NO-USER-MODIFICATION, which bypasses te ACL checks for write. The problem happens when pwdMaxFailure failed logins are reached, and ppolicy.c tries to update pwdFailureTime and pwdAccountLockedTime in a single request. How is this supposed to work? - Shouldn't pwdAccountLockedTime also be defined with NO-USER-MODIFICATION? - couldn't the update request in ppolicy.c be executed with higher privileges? I tried to set up an non-anonymous bind in pam_ldap but this did not help. - is there some recommended ACL setting to grant the necessary privileges so that ppolicy.c can update pwdAccountLockedTime, but users can't? I am a splapd newbie, so maybe I don't see something obvious, but in the log below, I see: "acl_mask: to all values by "", (=0)" -- that looks like an anonymous bind, right? Allowing write for the pwdAccountLockedTime attribute to anyone does not seem a good idea ;-) Thanks for any insight! Jiri P.S.: some detailed notes from my debugging are attached below: I am authenticating with pam-ldap. When I mis-type the password of a user and do a search on the user object (with a +, to see the operational attributes), the pwdFailureTime is created. This is good. When I preform the bad login again, I get a second value for pwdFailureTime. Still good. But on the next login, instead of getting a third value for pwdFailureTime and an updated value for pwdAccountLockedTime, nothing happens. I put some more debug info into ppolicy_bind_response() like this: ----- * We only count those failures * which are not due to expire. */ Debug(LDAP_DEBUG_ANY, "xxx: counting pwdFailureTime %i/%d\n", i, fc, 0); } } if ((ppb->pp.pwdMaxFailure > 0) && (fc >= ppb->pp.pwdMaxFailure - 1)) { Debug(LDAP_DEBUG_ANY, "xxx: trying to insert pwdAccountLockedTime\n", 0, 0, 0); ----- ... in the logs (with loglevel 65535), I really see: ------ Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 0/1 Aug 8 00:05:42 localhost slapd[15416]: xxx: counting pwdFailureTime 1/2 Aug 8 00:05:42 localhost slapd[15416]: xxx: trying to insert pwdAccountLockedTime [snip] Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: delete access to "uid=j.bohac,ou=users,dc=example,dc=net" "pwdAccountLockedTime" requested Aug 8 00:05:42 localhost slapd[15416]: => acl_get: [2] attr pwdAccountLockedTime Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: result not in cache (pwdAccountLockedTime) Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: access to entry "uid=j.bohac,ou=users,dc=example,dc=net", attr "pwdAccountLockedTime" requested Aug 8 00:05:42 localhost slapd[15416]: => acl_mask: to all values by "", (=0) Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: cn=admin,dc=example,dc=net Aug 8 00:05:42 localhost slapd[15416]: <= check a_dn_pat: * Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] applying read(=rscxd) (stop) Aug 8 00:05:42 localhost slapd[15416]: <= acl_mask: [2] mask: read(=rscxd) Aug 8 00:05:42 localhost slapd[15416]: => slap_access_allowed: delete access denied by read(=rscxd) Aug 8 00:05:42 localhost slapd[15416]: => access_allowed: no more rules ------

2 1

ldapsearch is not able to show Japanese chars
by anish patil 11 Aug '09

11 Aug '09

Hi All, I am using openldap-2.4.11 I have added localized that is japaneese use names into ldap database .Format(ldif) that i have used was UTF-8. However when i run ladearch it shows me invalid values in dn and uid filed. I want there values in localized format? how can i achieve this ? Thanks in advance -- Anish Patil -- Anish Patil

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical