openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Max number of failed attempts to connect
by Sergiy Milko 06 Jul '09

06 Jul '09

Hi guys, Is anyone aware of a configuration parameter (in slapd.conf or OpenLDAP back-end database) that specifies a maximum number of unsuccessful attempts to connect to the LDAP before any further attempts are blocked? Is there a possibility to impose this logic at all? I am using JNDI library to bind to the LDAP using 'Simple' authentication. I would appreciate any related information! Many thanks! Sergiy

2 1

how to get the source of jldap
by owen nirvana 03 Jul '09

03 Jul '09

I can't login cvs of openldap-jdap by anonymous in cvsnt, and I have not account of openldap how to get the source of jldap gtalk:freeespeech@gmail.com

5 5

Re :Re: how to get the source of jldap
by Santosh Kumar 03 Jul '09

03 Jul '09

Cheers, Santosh Kumar Sr Software Engineer Cell:09881481468 Computers can never replace human stupidity.

1 0

Re: how to get the source of jldap
by Michael Ströder 03 Jul '09

03 Jul '09

Please stay on the mailing list (Cc:-ed again). owen nirvana wrote: > cvs -d :pserver@cvs.openldap.org:/repo/JLDAP login > or cvs -d :pserver@cvs.openldap.org:/repo/OpenLDAP-JLDAP login > password: OpenLDAP > > error : No Such Repository > gtalk:freeespeech@gmail.com What's the reason you don't do *exactly* what I've posted? Please have a closer look at the commands I sent since before answering your question I've spend my spare time to test it. Basically you're using the wrong CVSROOT. Ciao, Michael. >> 2009/7/3 Michael Ströder <michael(a)stroeder.com>: >>> owen nirvana wrote: >>>> I can't login cvs of openldap-jdap by anonymous in cvsnt, and I have >>>> not account of openldap >>>> >>>> how to get the source of jldap >>> The description on this web page works for me at least on Linux: >>> >>> http://www.openldap.org/software/repo.html#AnonCVS >>> >>> $ export CVSROOT=":pserver:anonymous@cvs.OpenLDAP.org:/repo/OpenLDAP" >>> $ cvs login >>> Password: (enter OpenLDAP) >>> $ cvs co openldap-jldap >>> >>> I don't have cvsnt though. Can you please elaborate on the specific >>> problem you see? Probably it's just a cvsnt usage issue. >>> >>> Ciao, Michael.

1 0

Proxying AD : troubles with the comma character
by Emmanuel Lesouef 03 Jul '09

03 Jul '09

Hello, I'm new to openldap's meta backend and I get a strange issue. I'm able to proxy active directory via openldap using meta backend. It works well except that in my user's DN, I have a comma character which is translated with the following "\2C". How can I handle that ? Thanks. -- Emmanuel Lesouef

3 4

Prb: UID Fields Over 7 Chars - add transaction hangs
by David.CTR.Muench＠faa.gov 02 Jul '09

02 Jul '09

All, I have a problem with a new OpenLDAP configuration that is likely my own doing, but I am unable to discern the cause. Environment: Solaris 9, OpenLDAP 2.4.16, Berkeley DB 4.7.25 I installed the OpenLDAP software from the stable release at the openldap.org site. After some basic configuration and very basic tests, I did the "full" slapd.conf and DB_CONFIG configurations using various resources, including the Admin Guide and the FAQ-o-matic. All seemed to be going well until I tried to add (ldapmodify -a w/ldif files) some new "person" entries based on data I want to migrate. The first one was OK, but subsequent ones never completed. When the problem occurs, there's no return from the ldapmodify command and likewise any "db_stat" commands that I attempt. When I look at the log (local4.debug) entries, the last entry is for the "ADD dn="uid=DCM...". The daemon is *not* looping, there's just never a response. [I need to break to get my prompt back.] When I attempt to stop the daemon, I get "waiting for 1 operations/tasks to finish" and I have to kill the daemon to get it to stop. When I restart, it goes through DB recovery and everything is as it was before the ldapmodify -a started. A colleague suggested something that seems to be an indicator: - an add of "dn: uid=DCM11,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM1123,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM11234,ou=People,o=USNS" does *not* work So it seems that "uid" values with lengths over 7 characters fail. Yeah, this seems plenty odd to me, but I've created\tested\deleted DBs multiple times over and this still happens consistently. I have tried multiple levels of "debug", down to "488" anyway, but still no message that seems like an error. Not wanting to swamp anyone, here's some basic config extracts: ===DB_CONFIG=== set_cachesize 0 67108864 1 set_lg_bsize 2097152 set_lg_max 10485760 set_lg_regionmax 262144 === ===slapd_t10.conf=== [obviously stripped] ... backend bdb database bdb suffix "o=XXXX" checkpoint 128 15 index objectClass eq index uid pres,eq [Have tried taking this out & re-creating - no difference] lastmod on monitoring on ... === Anyone have any ideas? I have spent many hours looking at this, but I'm willing to believe it's something simple I can't see. Thanks in advance for you help. DCM

4 7

Re: TLS init def ctx failed: -1
by gruntler-ldap＠yahoo.com 02 Jul '09

02 Jul '09

--- On Thu, 7/2/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: TLS init def ctx failed: -1 > To: "François Mehault" <Francois.Mehault(a)netplus.fr> > Cc: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Date: Thursday, July 2, 2009, 7:02 AM > François Mehault wrote: > > > > |*openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout > > server.pem -days 365*| > > This is a terrible way to generate a server certificate. > Instead you should generate a CA, following the steps in > (the current) section 4.2. What document is being referred to here? It can't be http://www.openldap.org/doc/admin/ because section 4.2. there is "Prerequisite software". Thanks, Ken

2 1

TLS init def ctx failed: -1
by François Mehault 02 Jul '09

02 Jul '09

Hi all I contact you because I don't succeed to configure my OpenLDAP with TLS. First I create self signed certificate server.pem like I read on this page http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#5.1.1 in /usr/local/etc/openldap/tls. openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 Then I add this line in slapd.conf : TLSCertificateFile /usr/local/etc/openldap/tls/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/tls/server.pem TLSCACertificateFile /usr/local/etc/opendldap/tls/server.pem TLSVerifyClient never Then I restart slapd. /usr/local/etc/rc.d/slapd stop , start. And in my /var/log/debug.log I have Jul 2 12:18:39 labobe2 slapd[97816]: main: TLS init def ctx failed: -1 Jul 2 12:18:39 labobe2 slapd[97816]: slapd destroy: freeing system resources. Jul 2 12:18:39 labobe2 slapd[97816]: syncinfo_free: rid=001 Jul 2 12:18:39 labobe2 slapd[97816]: slapd stopped. I use FreeBSD 7. If someone can help me, I appreciate, thanks in advance Regards, François

3 4

RE: monitor mirror mode
by François Mehault 02 Jul '09

02 Jul '09

Thanks for your response. ContextCSN seems perfect but, I try on my two OpenLDAP: <10:13>[labobe2:~]# ldapsearch -x -LLL -H ldap://openldapID1:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 <10:07>[labobe1:~]# ldapsearch -x -LLL -H ldap:// openldapID2:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 As you can see I have two results by request. And I have effectively the same result on each server. Can I conclude just with this results that the replication works well ? I though I would have one contextCSN for each request instead of two. Thanks for your help. Regards, François De : Gavin Henry [mailto:ghenry@OpenLDAP.org] Envoyé : vendredi 26 juin 2009 17:14 À : François Mehault Cc : openldap-technical(a)openldap.org Objet : Re: monitor mirror mode You can use: http://blog.suretecsystems.com/archives/146-OpenLDAP-Quick-Tips-Checking-th… ----- "François Mehault" <Francois.Mehault(a)netplus.fr> wrote: > > Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found
by Andreas Krummrich 01 Jul '09

01 Jul '09

Hi all, I'm running OpenLDAP 2.4.11 on a debian lenny box and it seems that I'm having trouble with the log files. I had a corrupt database some days ago and needed to restore the database from the backup. The log said: Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": unclean shutdown detected; attempting recovery. Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": dbenv_open(/var/lib/ldap). Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Ignoring log file: /var/lib/ldap/log.0000000005: magic number 0, not 40988 Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Invalid log file: log.0000000005: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de" cannot be recovered, err -30978. Restore from backup! Jun 28 01:16:59 old slapd[17374]: ====> bdb_cache_release_all Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 28 01:16:59 old slapd[17374]: bdb_db_close: database "dc=intern,dc=domain,dc=de": txn_checkpoint failed: Invalid argument (22). Jun 28 01:16:59 old slapd[17374]: backend_startup_one: bi_db_open failed! (-30978) So I installed a new OpenLDAP server with the same versions and the same configuration. The first thing what I found out was that db_archive has some trouble: On the new box I get the following results from db_archive: root@new:/var/lib/ldap# db4.2_archive -sa /var/lib/ldap/cn.bdb /var/lib/ldap/dn2id.bdb /var/lib/ldap/gidNumber.bdb /var/lib/ldap/givenName.bdb /var/lib/ldap/id2entry.bdb /var/lib/ldap/loginShell.bdb /var/lib/ldap/objectClass.bdb /var/lib/ldap/sn.bdb /var/lib/ldap/uid.bdb /var/lib/ldap/uidNumber.bdb root@new:/var/lib/ldap# db4.2_archive -la /var/lib/ldap/log.0000000001 root@new:/var/lib/ldap# Looks good so far. On the old box I get the following results (there are the same databases) root@new:/var/lib/ldap# db4.2_archive -sa root@new:/var/lib/ldap# db4.2_archive -la db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found root@new:/var/lib/ldap# I searched the archive and googled this message, but found nothing that fits my case. Hope that someone can give me a hint, solving this issue. Thanks and kind regards, Andreas

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical