openldap-technical

openldap-technical@openldap.org

13 participants
9906 discussions

./Configure failed on openldap
by Challa N Kumar Reddy 22 Sep '21

22 Sep '21

While performing the configure I am not able to pass. Please find the error shown below, Could you please advise on how to fix this. Thanks in advance. [nchalla@server openldap-2.5.7]$ ./configure --prefix=/u01/ldap --disable-static --enable-debug --with-tls=auto --with-cyrus-sasl --enable-dynamic --enable-crypt --enable-spasswd --enable-slapd --enable-modules --enable-rlookups --enable-backends=mod --disable-ndb --disable-sql --disable-shell --disable-bdb --disable-hdb --enable-overlays=mod configure: WARNING: unrecognized options: --disable-shell, --disable-bdb, --disable-hdb Configuring OpenLDAP 2.5.7-Release ... checking build system type... x86_64-pc-linux-gnu checking host system type... x86_64-pc-linux-gnu checking target system type... x86_64-pc-linux-gnu checking configure arguments... done checking for cc... cc checking for ar... ar checking for strip... strip checking whether make sets $(MAKE)... yes checking how to print strings... printf checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether cc accepts -g... yes checking for cc option to accept ISO C89... none needed checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for fgrep... /usr/bin/grep -F checking for ld used by cc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... dlltool checking how to associate runtime and link libraries... printf %s\n checking for archiver @FILE support... @ checking for ranlib... ranlib checking for gawk... gawk checking command to parse /usr/bin/nm -B output from cc object... ok checking for sysroot... no checking for a working dd... /usr/bin/dd checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1 checking for mt... no checking if : is a manifest tool... no checking how to run the C preprocessor... cc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if cc supports -fno-rtti -fno-exceptions... no checking for cc option to produce PIC... -fPIC -DPIC checking if cc PIC flag -fPIC -DPIC works... yes checking if cc static flag -static works... no checking if cc supports -c -o file.o... yes checking if cc supports -c -o file.o... (cached) yes checking whether the cc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen... no checking for dlopen in -ldl... yes checking whether a program can dlopen itself... yes checking whether a statically linked program can dlopen itself... yes checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no checking how to run the C preprocessor... cc -E checking whether we are using MS Visual C++... no checking for windres... no checking for be_app in -lbe... no checking whether we are using the GNU C compiler... (cached) yes checking whether cc accepts -g... (cached) yes checking for cc option to accept ISO C89... (cached) none needed checking for cc depend flag... -M checking for afopen in -ls... no checking ltdl.h usability... yes checking ltdl.h presence... yes checking for ltdl.h... yes checking for lt_dlinit in -lltdl... yes checking for EBCDIC... no checking for ANSI C header files... yes checking for dirent.h that defines DIR... yes checking for library containing opendir... none required checking for sys/wait.h that is POSIX.1 compatible... yes checking whether termios.h defines TIOCGWINSZ... no checking whether sys/ioctl.h defines TIOCGWINSZ... yes checking arpa/inet.h usability... yes checking arpa/inet.h presence... yes checking for arpa/inet.h... yes checking arpa/nameser.h usability... yes checking arpa/nameser.h presence... yes checking for arpa/nameser.h... yes checking assert.h usability... yes checking assert.h presence... yes checking for assert.h... yes checking bits/types.h usability... yes checking bits/types.h presence... yes checking for bits/types.h... yes checking conio.h usability... no checking conio.h presence... no checking for conio.h... no checking crypt.h usability... yes checking crypt.h presence... yes checking for crypt.h... yes checking direct.h usability... no checking direct.h presence... no checking for direct.h... no checking errno.h usability... yes checking errno.h presence... yes checking for errno.h... yes checking fcntl.h usability... yes checking fcntl.h presence... yes checking for fcntl.h... yes checking filio.h usability... no checking filio.h presence... no checking for filio.h... no checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking io.h usability... no checking io.h presence... no checking for io.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking limits.h usability... yes checking limits.h presence... yes checking for limits.h... yes checking locale.h usability... yes checking locale.h presence... yes checking for locale.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for memory.h... (cached) yes checking psap.h usability... no checking psap.h presence... no checking for psap.h... no checking pwd.h usability... yes checking pwd.h presence... yes checking for pwd.h... yes checking process.h usability... no checking process.h presence... no checking for process.h... no checking sgtty.h usability... yes checking sgtty.h presence... yes checking for sgtty.h... yes checking shadow.h usability... yes checking shadow.h presence... yes checking for shadow.h... yes checking stddef.h usability... yes checking stddef.h presence... yes checking for stddef.h... yes checking for string.h... (cached) yes checking for strings.h... (cached) yes checking sysexits.h usability... yes checking sysexits.h presence... yes checking for sysexits.h... yes checking sys/file.h usability... yes checking sys/file.h presence... yes checking for sys/file.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/fstyp.h usability... no checking sys/fstyp.h presence... no checking for sys/fstyp.h... no checking sys/errno.h usability... yes checking sys/errno.h presence... yes checking for sys/errno.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/param.h usability... yes checking sys/param.h presence... yes checking for sys/param.h... yes checking sys/privgrp.h usability... no checking sys/privgrp.h presence... no checking for sys/privgrp.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for sys/stat.h... (cached) yes checking sys/syslog.h usability... yes checking sys/syslog.h presence... yes checking for sys/syslog.h... yes checking sys/time.h usability... yes checking sys/time.h presence... yes checking for sys/time.h... yes checking for sys/types.h... (cached) yes checking sys/uio.h usability... yes checking sys/uio.h presence... yes checking for sys/uio.h... yes checking sys/vmount.h usability... no checking sys/vmount.h presence... no checking for sys/vmount.h... no checking syslog.h usability... yes checking syslog.h presence... yes checking for syslog.h... yes checking termios.h usability... yes checking termios.h presence... yes checking for termios.h... yes checking for unistd.h... (cached) yes checking utime.h usability... yes checking utime.h presence... yes checking for utime.h... yes checking for resolv.h... yes checking for netinet/tcp.h... yes checking for sys/ucred.h... no checking for sigaction... yes checking for sigset... yes checking for fmemopen... yes checking for socket... yes checking for select... yes checking for sys/select.h... (cached) yes checking for sys/socket.h... (cached) yes checking types of arguments for select... int,fd_set *,struct timeval * checking for poll... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking sys/epoll.h usability... yes checking sys/epoll.h presence... yes checking for sys/epoll.h... yes checking for epoll system call... yes checking sys/event.h usability... no checking sys/event.h presence... no checking for sys/event.h... no checking sys/devpoll.h usability... no checking sys/devpoll.h presence... no checking for sys/devpoll.h... no checking for strerror... yes checking for strerror_r... yes checking non-posix strerror_r... no checking for regex.h... yes checking for library containing regfree... none required checking for compatible POSIX regex... yes checking sys/uuid.h usability... no checking sys/uuid.h presence... no checking for sys/uuid.h... no checking uuid/uuid.h usability... no checking uuid/uuid.h presence... no checking for uuid/uuid.h... no checking to see if -lrpcrt4 is needed for win32 UUID support... no checking for resolver link (default)... no checking for resolver link (-lresolv)... yes checking for hstrerror... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for gai_strerror... yes checking for inet_ntop... yes checking INET6_ADDRSTRLEN... yes checking struct sockaddr_storage... yes checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no configure: WARNING: Could not locate TLS/SSL package configure: WARNING: TLS data protection not supported! checking for _beginthread... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking POSIX thread version... 10 checking for LinuxThreads pthread.h... no checking for GNU Pth pthread.h... no checking sched.h usability... yes checking sched.h presence... yes checking for sched.h... yes checking for pthread_create in default libraries... no checking for pthread link with -kthread... no checking for pthread link with -pthread... yes checking for sched_yield... yes checking for pthread_yield... yes checking for thr_yield... no checking for pthread_kill... yes checking for pthread_rwlock_destroy with <pthread.h>... yes checking for pthread_detach with <pthread.h>... yes checking for pthread_setconcurrency... yes checking for pthread_getconcurrency... yes checking for thr_setconcurrency... no checking for thr_getconcurrency... no checking for pthread_kill_other_threads_np... no checking for LinuxThreads implementation... no checking for LinuxThreads consistency... no checking if pthread_create() works... yes checking if select yields when using pthreads... yes checking for thread specific errno... yes checking for thread specific h_errno... yes checking for ctime_r... yes checking for gmtime_r... yes checking for localtime_r... yes checking for gethostbyname_r... yes checking for gethostbyaddr_r... yes checking number of arguments of ctime_r... 2 checking number of arguments of gethostbyname_r... 6 checking number of arguments of gethostbyaddr_r... 8 checking for openlog... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for WT... no configure: error: Package requirements (wiredtiger) were not met: Package 'wiredtiger', required by 'virtual:world', not found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables WT_CFLAGS and WT_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details.

2 1

Some problems while compiling + using openldap 2.5.7 ubuntu 20.04
by frederic.goudal＠bordeaux-inp.fr 22 Sep '21

22 Sep '21

Hello, I'm begining to migrate to openldap 2.5.7 So I did compile from source. I have had one difficulty while configuring : while running ./configure '--enable-overlays' '--enable-crypt' '--with-tls' '--enable-backends' '--with-cyrus-sasl' '--disable-ndb' '--enable-modules' I did got the following error : checking for WT... no configure: error: in `/home/sgoudal/openldap-2.5.7': configure: error: The pkg-config script could not be found or is too old. Make sure it is in your PATH or set the PKG_CONFIG environment variable to the full path to pkg-config. Alternatively, you may set the environment variables WT_CFLAGS and WT_LIBS to avoid the need to call pkg-config.checking for WT... no configure: error: in `/home/sgoudal/openldap-2.5.7': configure: error: The pkg-config script could not be found or is too old. Make sure it is in your PATH or set the PKG_CONFIG environment variable to the full path to pkg-config. Alternatively, you may set the environment variables WT_CFLAGS and WT_LIBS to avoid the need to call pkg-config. It took me a while to figure out what was WT (of course google does not help). Maybe a more explicit name like... wiredtiger.. could be more informative ? After correcting, compilation and installation went ok, but... /usr/local/libexec/slapd -VV /usr/local/libexec/slapd: error while loading shared libraries: libldap-2.5.so.0: cannot open shared object file: No such file or directory The library file is well located in /usr/local/lib adding LD_LIBRARY_PATH before running slapd correct the problem, (or CFLAGS=-L/usr/local/lib before ./configure) But it would be nice that it work out of the box.. or maybe I have missed something. -- Frédéric Goudal Administrateur Systèmes et Réseaux Bordeaux-INP

3 2

Re: Is there significance in overlay order in replicated environment
by Saša-Stjepan Bakša 22 Sep '21

22 Sep '21

> Lastbind functionality integrated partially? Nice! Where can I find > > documentation about it or a description on how to extract data for each > > user? > > > See the slapd.conf(5) man page. > > Ok I have found it, make it enabled and I can't find information where this attribute is shown. I searched through this man page and through the latest Admin guide but nothing points me in the direction of this attribute location. I can see that it is loaded with schema but no object class is using it. So I must be doing something wrong or I do not understand this mechanism. Also, in latest 2.5.7* olcLastBindPrecision* is not among list of possible attributes for mdb. I Have searched for it also but only olcLastBind is inherited from olcDatabaseConfig. *olcLastBind: TRUE | FALSE* Controls whether *slapd *will automatically maintain the pwdLastSuccess attribute for entries. By default, olcLastBind is FALSE. *olcLastBindPrecision: <number>* If olcLastBind is enabled, a new value is written only if the current one is more than *number *seconds in the past. Saša

2 3

Question mark (?) in search filters
by Ángel L. Mateo Martínez 21 Sep '21

21 Sep '21

Hello, I'm configuring an application using my openldap and I'm seeing queries I didn't know them before. The queries are like this: filter="(|(objectClass=groupOfNames)(?objectClass=container)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=domain)(?objectClass=domaincomponent)(?objectClass=builtinDomain))" This may be the first time I see the ? in the search filter of a query. But when I try to reproduce it with ldapsearch command I get: $ ldapsearch '(|(objectClass=groupOfNames)(?objectClass=container)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=domain)(?objectClass=domaincomponent)(?objectClass=builtinDomain))' # extended LDIF # # LDAPv3 # base <dc=Telematica> (default) with scope subtree # filter: (|(objectClass=groupOfNames)(?objectClass=container)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=domain)(?objectClass=domaincomponent)(?objectClass=builtinDomain)) # requesting: ALL # ldap_search_ext: Bad search filter (-7) I guess the problem in the query is because of the '?' operator. So, how can I reproduce it with ldapsearch? And... what does this '?' mean? Thanks, --- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

2 1

Re: Is there significance in overlay order in replicated environment
by Saša-Stjepan Bakša 20 Sep '21

20 Sep '21

> > > Yes, it matters. Syncprov first, then accesslog. After that order should > be immaterial. > > I would note that in OpenLDAP 2.5, a bit of the lastbind functionality has > been integrated into slapd so you may not need to deploy it separately. > > --Quanah > > > I thought so but wasn't sure. Thank you for your confirmation. Lastbind functionality integrated partially? Nice! Where can I find documentation about it or a description on how to extract data for each user? Saša

2 1

Syncrepl failing after a while
by Mircea Baciu 20 Sep '21

20 Sep '21

Hi, I have an issue with a consumer replication starting to fail until OpenLDAP is restarted. My setup consists of a pair of on-prem MirrorMode replicated providers (only one is active at a given time using a virtual IP managed by Keepalived), and one off-site (AWS) consumer. The providers use a dedicated port (LDAPS on 1636) for their own replication, as well as for the consumer to connect to them, so the consumer has access to both servers, regardless of where the providers' virtual IP is residing. All the connections happen over LDAPS, and the syncrepl configs have the tls_reqcert=allow option. The providers are always in sync and I'm able to switch make one or the other one the "active" one with ease. The consumer does the initial sync and stays in sync for a while, but I find it often (almost daily) out of sync. I see error messages on both the consumer and provider side: On the consumer (every minute): Sep 20 08:19:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider1>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:19:31 <consumer> slapd[1440]: do_syncrepl: rid=001 rc -1 retrying Sep 20 08:19:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider2>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:19:31 <consumer> slapd[1440]: do_syncrepl: rid=002 rc -1 retrying Sep 20 08:20:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider1>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:20:31 <consumer> slapd[1440]: do_syncrepl: rid=001 rc -1 retrying Sep 20 08:20:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider2>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:20:31 <consumer> slapd[1440]: do_syncrepl: rid=002 rc -1 retrying On the provider (every minute): Sep 20 08:19:31 <provider1> slapd[1057]: conn=11242 fd=14 ACCEPT from IP=<consumer IP>:45438 (IP=<provider1 IP>:1636) Sep 20 08:19:31 <provider1> slapd[1057]: conn=11242 fd=14 TLS established tls_ssf=256 ssf=256 Sep 20 08:19:31 <provider1> slapd[1057]: conn=11242 fd=14 closed (connection lost) Sep 20 08:20:31 <provider1> slapd[1057]: conn=11243 fd=14 ACCEPT from IP=<consumer IP>:45458 (IP=<provider1 IP>:1636) Sep 20 08:20:31 <provider1> slapd[1057]: conn=11243 fd=14 TLS established tls_ssf=256 ssf=256 Sep 20 08:20:31 <provider1> slapd[1057]: conn=11243 fd=14 closed (connection lost) Sep 20 08:19:31 <provider2> slapd[1051]: conn=215893 fd=18 ACCEPT from IP=<consumer IP>:41706 (IP=<provider2 IP>:1636) Sep 20 08:19:31 <provider2> slapd[1051]: conn=215893 fd=18 TLS established tls_ssf=256 ssf=256 Sep 20 08:19:31 <provider2> slapd[1051]: conn=215893 fd=18 closed (connection lost) Sep 20 08:20:31 <provider2> slapd[1051]: conn=215898 fd=18 ACCEPT from IP=<consumer IP>:41726 (IP=<provider2 IP>:1636) Sep 20 08:20:31 <provider2> slapd[1051]: conn=215898 fd=18 TLS established tls_ssf=256 ssf=256 Sep 20 08:20:31 <provider2> slapd[1051]: conn=215898 fd=18 closed (connection lost) There must be something wrong on the consumer side since when the issue starts, the consumer is not able to connect to either provider. Once I restart the consumer, it quickly resyncs and works just fine, for a while. The providers are OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), running on RHEL 7. The consumer is OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), running on CentOS 7. The consumer syncrepl config is: olcSyncrepl: {0}rid=001 provider=ldaps://<provider1>:1636/ searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 +" timeout=1 bindmethod=simple binddn="uid=replication,ou=SysAccounts,dc=example,dc=com" credentials=<credentials> tls_reqcert=allow olcSyncrepl: {1}rid=002 provider=ldaps://<provider1>:1636/ searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 +" timeout=1 bindmethod=simple binddn="uid=replication,ou=SysAccounts,dc=example,dc=com" credentials=<credentials> tls_reqcert=allow The "uid=replication,ou=SysAccounts,dc=example,dc=com" DN has full read-only permissions for the entire "dc=example,dc=com" tree. Any idea on what might be my issue here? Thank you, Mircea -- Mircea Baciu | Senior Unix Systems Administrator Simmons University | 300 The Fenway | Boston, MA 02115 | 617-521-2194

3 3

Re: Syncrepl failing after a while
by Mircea Baciu 20 Sep '21

20 Sep '21

Thank you, Quanah, I didn't know about the "keepalive" option for syncrepl. Now that you mentioned, I found some old 2017 discussion on this list with a very similar issue I have, where you mentioned this option. I see it in the slapd manual page but not on 2.4 (or 2.5) admin site: https://www.openldap.org/doc/admin24/replication.html I'll try adding it to the config and will definitely consider upgrading to a newer version in some fashion. Thanks, Mircea -- Mircea Baciu | Senior Unix Systems Administrator Simmons University | 300 The Fenway | Boston, MA 02115 | 617-521-2194 On Mon, Sep 20, 2021 at 11:12 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, September 20, 2021 11:38 AM -0400 Mircea Baciu > <mircea.baciu(a)simmons.edu> wrote: > > > > The providers are OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), > > running on RHEL 7. > > The consumer is OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), > > running on CentOS 7. > > > Hello, > > The OpenLDAP 2.4.44 release is over 5 years old and numerous replication > related issues have been fixed since that time. Additionally, RedHat is > known to have made questionable modifications to libldap, particularly > around the TLS layer in RHEL7. > > I'd strongly advise you to upgrade to a current release of OpenLDAP. I > would note that Symas provides free drop-in replacement builds of OpenLDAP > for RHEL7 with optional support available > (<https://repo.symas.com/sofl/rhel7/>). > > Symas also provides free builds of the current OpenLDAP release series > (2.5) with optional support available > (<https://repo.symas.com/soldap/rhel7/>). > > I'd also note that your syncrepl stanza is missing the "keepalive" option, > which is usually essential when dealing with traffic through load > balancers. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Is there significance in overlay order in replicated environment
by Saša-Stjepan Bakša 20 Sep '21

20 Sep '21

Hi, I am moving my old LDAP setup which is now more than 8 years old to version 2.5.7 (Symas Ubuntu build). Now I use simple Master -> backup only sync configuration. On those systems I also use accesslog overlay. On new systems I would like to deploy a multi master with delta sync or maybe pure multi master since it is a small database with only few hundreds users. I have been using multi master on other systems for years without any (many) problems and those systems have more that 500 k users. Also I would like to use accesslog and lastbind overlays and maybe some other overlays in the future. My question is is there significance in which order I will add overlays to databases? Syncprov first then others or it does not have any impact. Br Saša

2 1

OpenLDAP 2.6.0 testing call
by Quanah Gibson-Mount 16 Sep '21

16 Sep '21

This is the first testing call for OpenLDAP 2.6.0 Release. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. A list of items fixed and added in 2.6 can be found at: <https://bugs.openldap.org/buglist.cgi?bug_status=RESOLVED&bug_status=VERIFI…> A major change with 2.6 is the ability to bypass syslog for logging (ITS#6949). This significantly improves slapd performance. Currently this is being adjusted so that lloadd also supports this new feature, but it can be tested with slapd at this time. Additionally, the following deprecated backends have been removed: back-ndb back-shell Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

7 14

How to create an entry, which is not returned on SEARCH
by Дилян Палаузов 15 Sep '21

15 Sep '21

Hello, How can I create an entry (in terms of ldif/ldapadd/ldapmodify), which is not returned on searches (apart from tweaking the olcAccess rules? https://www.openldap.org/devel/admin/replication.html says: > Because a general search filter can be used in the syncrepl specification, some entries in the context may be omitted from the synchronization content. The syncrepl engine creates a glue entry to fill in the holes in the replica context if any part of the replica content is subordinate to the holes. The glue entries will not be returned in the search result unless ManageDsaIT control is provided. Rationale: I want to create a directory, containing contacts under: cn=juridical persons,dc=me cn=natural persons,dc=me The LDAP clients shall query base dc=me with scope SUB. The LDAP clients shall see all subentries of Juridical Persons and all subentries of Natural Persons, but not the cn=juridical persons,dc=me cn=natural persons,dc=me and dc=me entries itself. As the latter entries do not represent Contacts (mail, phone, address), the entries shall not appear in address books. Greetings Дилян

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical