openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

Extend Schema correctly
by Techie 17 Jul '09

17 Jul '09

Hello List, I want to correctly extend schema but I have a question regarding the OID assignment of the custom objectClass and attributes I have created. I want to know if the OID number is absolutely necessary and if I do not use an OID number, what are the repercussions if any. For example will it cause any issues say with syncing with Active Directory or any other directory down the line if I go that route , I created a custom schema extension file to extend my schema so I can associate server names containing resources to my user accounts in LDAP. This schema file has a single auxiliary objectClasses entry and three (MAY) attributeTypes entries. I added the schema file to my Directory with schema checking on and it starts up correctly. I can add this objectClass and the 3 associated attributes to any account in my directory with no issue. I have not assigned an OID to these entries only names. Does this mean the OID is not necessary? Is there a suggested base OID I can use without requesting a company specific OID from IANA? Would be for for inter company use only. My company has an OID name space through IANA but the people that managed that are long gone and I do not want to overlap anything or cause issues. So basically I am looking to give this object class and associated attributes OID numeric assignments and am unsure how to do that. Thank you

1 0

syncrepl configuration possibilities
by Laurence Field 15 Jul '09

15 Jul '09

Hi, I am investigating the use of syncrepl to improve the efficiency of the transport mechanism that we are currently using in a world-wide distributed OpenLDAP deployment. If LDAP server A has information under "cn=my_resource,dc=example,dc=com" is it possible to replicate this information to LDAP server B but slightly modify the DN so that this becomes a sub tree of a larger tree eg. "cn=my_resource,cn=my_group,dc=example,dc=com"? Alternative suggestions are welcome and I would be happy to explain what we are trying to do in more detail if anyone is interested. Thanks, Laurence

2 3

auth works with cn=My Name but not with uid=myname
by Arne Schirmacher 15 Jul '09

15 Jul '09

This is probably trivial but I can't figure it out: my OpenLDAP entry has an attribute of cn=My Name, an attribute of uid=myname and a password. I can successfully log in using JXplorer using cn=My Name,ou=people,o=my company but not using uid=myname,ou=people,o=my company (error code 49 - Invalid Credentials) However searching with that dn is successful and returns 1 entry, so the uid attribute is in fact there. Please advise how I could enable the second login method which I need for exim authentication. Thanks!

3 2

Re: Multi master topology.
by Gavin Henry 14 Jul '09

14 Jul '09

----- "Alejandro Leyva" <alex.leyva(a)gmail.com> wrote: > Hi all. > > We are implementing a solution with multi master LDAP, we have 11 > instances at different locations, and maybe we will grow to 21 or 31 > instances before the end of the year, expecting to hold something > like > 200,000 or 300,000 user entries. What topology would be the best? > Right now each server synch to all the other servers, is it possible > to configure each server to synch only to a central LDAP? is it > convenient? Then that is not Multi-Master, but normal Provider/Consumer replication. Depending on your client requirements for writing, you may be better served using MirrorMode and numerous consumers/slaves with the chaining overlay to push writes back to the master. This would be simpler for monitoring write propagation. See the diagram here http://www.openldap.org/doc/admin24/replication.html#MirrorMode -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html

2 2

slapd proxy
by Sergio Cioban Filho 13 Jul '09

13 Jul '09

Hi all, I'm trying to configurate an OpenLdap proxy for high availability, with ldap backend. My problem is the timeout. When the first server in URI is gone down, my ldapsearch delay 3 minutes, how do I change this timeout? Server 192.168.166.171 UP TIME: real 0m0.036s user 0m0.002s sys 0m0.003s Server 192.168.166.171 DOWN TIME: real 3m8.957s user 0m0.003s sys 0m0.004s I want the ldap-proxy immediately redirect the ldapsearch to the server 192.168.166.172 when server 192.168.166.172 gone down. My back-ldap configuration:* database ldap suffix "dc=digitro,dc=com,dc=br" rootdn "cn=axs,dc=digitro,dc=com,dc=br" uri "ldap://192.168.166.171/ ldap://192.168.166.172/" conn-ttl 0 idle-timeout 0 timeout 1 * Thanks, Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ----------------------------------------------------------------- | Linux :: servidores :: firewall :: VPN :: segurança | OpenLdap :: virtualização :: VoIP :: ShellScript :: PHP | http://cioban.googlepages.com | +55 48 9989-8733 ----------------------------------------------------------------- ..:: Seja livre, use LiNuX!! ::.. ----------------------------------------------------------------- SOLISC - Não perca o maior evento de Software Livre de Santa Catarina - http://www.solisc.org.br

1 0

syncrepl randomly failing to sync
by Jay Christopherson 13 Jul '09

13 Jul '09

Hi- First of all, I hope I am not rehashing a topic that has been endlessly discussed. I know that syncrepl gets discussed a lot from my searches, but I have not found a specific topic on my issue. I started out with OpenLDAP 2.3, with a single provider and two consumers doing syncrepl using a refreshAndPersist type of replication. Periodically, I would see that one or more of the consumers would fail to synchronize a change made to the provider. A restart of the consumer would fix this and we could move on. It was annoying, but not critical at this point. Since then, I have become more dependent on OpenLDAP and syncrepl. I have upgraded to 2.4 to try to fix the replication issue, but it seems worse than ever. I now have one provider and six consumers. The consumers randomly fail to synchronize (as evidences by contextCSN monitoring). This happens several times a day. I'm thinking that maybe there is something wrong with my configuratiuon. This is what I am using: Provider: overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replica,o=users,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Consumers (all consumers have the exact same config): syncrepl rid=123 provider=ldap://ldap.sea.corp.domain.com:389 binddn="uid=replica,o=users,dc=domain,dc=com" bindmethod=simple retry="10 +" credentials=secret searchbase="dc=domain,dc=com" schemachecking=off type=refreshAndPersist interval=00:00:00:05 updateref ldap://ldap.sea.corp.domain.com A few "weird" things: * After the upgrade, I notice that the Directory Type on the Root DSE is still OpenLDAP 2.3 * I notice that where previously I could simple create a new consumer by installing a fresh copy of openldap, copying the config from another consumer over, and starting up to get a full copy of the directoy, it now fails to completely replicate and I have to do a full slapcat/slapadd to do the initial population. Like I said, I hope it's just something stupid I am doing...

3 2

Problem with unusual tree structure ...
by Garry Glendown 11 Jul '09

11 Jul '09

Hi, I'm trying to authenticate users against an LDAP database ... now, I already have that running on several servers that use the "normal" tree setup, something like "cn=username,ou=somebranch,ou=domain,ou=tld", with a search_base of ou=domain,ou=tld. The place I'm trying to configure it for now is using a - AFAICT - rather unusal schema, as they have a tree that uses multiple top level o=, and start underneath there, so there may by user entries like cn=user1,ou=USERS,o=branch1 and cn=user2,ou=USERS,o=branch2 (historically, ldap trees from several locations were just merged together, which led to this) How can I get SASL to search in such a configuration? I already tried a "ou=USERS,o=*" syntax, which I didn't expect to work (and it didn't) Also, I know that saslauthd or other apps will need to check the resulting username/pw, so I tried binding with the DN and PW of an account, resulting in a "Confidentiality required" ... using ldaps:// notation didn't work, as the remote server (Novell eDirectory) probably isn't configured for that, and -Z for TLS also fails with ldap_start_tls: Server is unavailable (52) additional info: TLS services are not available >From what I can find, the message should come up if the server is configured for requiring secure queries, but then I would expect it to also be configured to SUPPORT either one of the methods ... Help appreciated, -garry

1 0

Multi master topology.
by Alejandro Leyva 11 Jul '09

11 Jul '09

Hi all. We are implementing a solution with multi master LDAP, we have 11 instances at different locations, and maybe we will grow to 21 or 31 instances before the end of the year, expecting to hold something like 200,000 or 300,000 user entries. What topology would be the best? Right now each server synch to all the other servers, is it possible to configure each server to synch only to a central LDAP? is it convenient? Thanks in advance.

1 0

bindmethod and credentials in slurpd replication.
by Sai 10 Jul '09

10 Jul '09

Hi All - Our server team does not want to update our openldap version beyond 2.2 because redhat supports 2.2 as the latest and greatest for RHEL4. So I am trying to configure slurpd replication for them. I got the replication to work. But when defining "replica", I got the following questions. 1) For credentials, can I use hashed password like for rootpw 2) If we could use hashed password, what should the bindmethod be? replica uri=<URL> binddn=<Bind DN> bindmethod=simple --> ??? credentials=XXXXXXXXX Thanks in advance. -Sai

3 5

ldapmodify is modifying my code
by Darryl Moore 10 Jul '09

10 Jul '09

HELP I've been able to replace nis.schema with rfc2307bis.schema so that I can have groups with both member and memberUID attributes. when I try using ldapmodify to add members to the group such as: echo "dn: cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid=newuser1,ou=People,dc=moores,dc=ca" | /usr/bin/ldapmodify -v -y /etc/ldap.secret -D cn=admin,dc=moores,dc=ca -xH ldap://localhost it returns the following error message: ldap_initialize( ldap://localhost:389/??base ) modifying entry "cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid=newuser1,ou=People,dc=moores,dc=ca" ldap_modify: No such object (32) matched DN: ou=People,dc=moores,dc=ca The group and the user both exist. What is most interesting is that ldapmodify appears to modify my request because slapd itself gives this message: hdb_referrals: tag=102 target="cn=newgrou1,ou=Groups,dc=moores,dc=ca changetype: modify add: memberUid memberUid: newuser1 replace: member member: uid\3Dnewuser1,ou=People,dc=moores,dc=ca" matched="ou=People,dc=moores,dc=ca" bdb_dn2entry("cn=newgrou1,ou=groups,dc=moores,dc=ca changetype: modify add: memberuid memberuid: newuser1 replace: member member: uid\3Dnewuser1,ou=people,dc=moores,dc=ca") => hdb_dn2id("dc=ca changetype: modify add: memberuid memberuid: newuser1 replace: member member: uid\3Dnewuser1,ou=people,dc=moores,dc=ca") <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) notice that the "uid=newuser" part of my request has been changed to "uid\3Dnewuser". I've tried a number of different combinations and it appears to me that the first '=' is always replace with \3D and then the silly thing tries to look up that element, and low and behold it does not exist. If I can make this work, then I think I will have group permissions for unix groups working on LDAP. Does anybody have any idea why ldapmodify would be doing this??????

3 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical