openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

installation query
by ashok kumar 12 Jun '09

12 Jun '09

Hi, I am trying to install openldap 2.4.16 and bdb 4.7.25 on my CentOS linux OS 64bit. I was wondering that the setups available on websites use 32bit libraries or 64 bit libraries. If they use 32bit libraries by default then how do i make them use 64 bit libraries. Regards, Ashok Kumar

1 0

Translucent Proxy & Schemas
by Stéphane Jeanjean 12 Jun '09

12 Jun '09

Hello, I would like to know if it's possible to add a schema in the local database which is not in the remote one with Translucent Proxy. Is it possible to add objects in local database without adding the schema to the remote db ? It looks ok when the attributes of the new class are added to the entries in the local db but when a search request is done, only atttributes from the classes declared in the remote db are returned :( Thanks for your help, Stéphane

2 2

count the number of registered users in ldap
by KALPANA ANANTH 12 Jun '09

12 Jun '09

Hi , Is there any specific command to count the number of registered entries/users in ldapserver todate? This will help with us with the statitistics of how many users are registered? Thanks! Kalpana _________________________________________________________________ Windows Live™: Keep your life in sync. http://windowslive.com/explore?ocid=TXT_TAGLM_WL_BR_life_in_synch_062009

3 2

Chain overlay and ACLs
by John Kane 11 Jun '09

11 Jun '09

Noob question: I've set up chaining from my slave LDAP to the master. It seemed everything was working fine, until I realize that ANY user can now make modifications in the LDAP DB if it is done from the slave. My ALCs allow full write access to the chain binddn. If I don't set this, chaining fails. But with it set, any valid, authenticated user can make DB changes (full write access). I am confused as to why this is happening. Info is below. Thanks in advance, John Version: openldap-2.3.43 ACLs on master (and slave): # Who has access to read or change the password attribute access to attrs=userPassword,shadowLastChange by self write by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous auth by * none # Keep partners out of mycompany db access to dn.sub="o=mycompany,dc=example,dc=net" by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by dn.sub="o=partner_x,dc=example,dc=net" none by anonymous none by * none # Allow the tool access to add and modify ToolAccessLevel, etc access to filter="(|(objectClass=DiagnosticsPerson)(objectClass=ToolsAccess))" by dn.base="cn=tooladmin,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read # Finally, allow the main LDAP users access to everything else access to * by group.exact="cn=admin_partner_x,o=partner_x,dc=example,dc=net" write by group.exact="cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net" read by group.exact="cn=administrators,o=mycompany,dc=example,dc=net" write by group.exact="cn=administrators_RO,o=mycompany,dc=example,dc=net" read by anonymous none by * read And the LDIFs: # admin_partner_x, partner_x, example.net dn: cn=admin_partner_x,o=partner_x,dc=example,dc=net cn: admin_partner_x objectClass: groupOfNames description: Group of Admins with full access member: cn=ldapChain,o=partner_x,dc=example,dc=net member: cn=ldapEditor,o=partner_x,dc=example,dc=net # admin_partner_x_RO, partner_x, example.net dn: cn=admin_partner_x_RO,o=partner_x,dc=example,dc=net cn: admin_partner_x_RO objectClass: groupOfNames description: Group of Admins with readonly access member: cn=simpleBind,o=partner_x,dc=example,dc=net member: cn=syncRepl,o=partner_x,dc=example,dc=net # tooladmin, partner_x, example.net dn: cn=tooladmin,o=partner_x,dc=example,dc=net sn: tooladmin cn: tooladmin userPassword:: dG9vbGFkbWlu description: To allow access for tools. Per ACLs, this guy has write access to passwords and tool levels objectClass: person # jkane2, people, partner_x, example.net dn: uid=jkane2,ou=people,o=partner_x,dc=example,dc=net objectClass: person objectClass: posixAccount objectClass: DiagnosticsPerson objectClass: ToolsAccess cn: jkane2 loginShell: /bin/bash uidNumber: 3805 uid: jkane2 homeDirectory: /jkane2 sn: jkane2 gidNumber: 950 ToolAccessLevel: subinfo ToolDomain: example.net DiagAccessLevel: DIAG_USER_T1 DiagGroup: partner_x userPassword:: xxxxxxxxxxx From the master, using some arbitrary user: [jkane2@master]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" ldapadd: Insufficient access (50) additional info: no write access to parent From the slave: [jkane2@slave]$ ldapadd -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' -W <<EOF > dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net > uid: testauserC > description: asdf > objectClass: account > objectClass: simpleSecurityObject > userPassword: testauser > EOF Enter LDAP Password: adding new entry "uid=testauserC,ou=people,o=partner_x,dc=example,dc=net" [jkane2@slave]$ ldapsearch -x -D 'uid=jkane2,ou=people,o=partner_x,dc=example,dc=net' uid=testauserC -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: uid=testauserC # requesting: ALL # # testauserC, people, partner_x, example.net dn: uid=testauserC,ou=people,o=partner_x,dc=example,dc=net uid: testauserC description: asdf objectClass: account objectClass: simpleSecurityObject # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 4

slapadd speed
by ashok kumar 11 Jun '09

11 Jun '09

Hi, I am new to openldap and I am trying to use it for 50 million records. I am using slapadd to add this data but it is processing around 1 million records in 5 hour. So this will take days to stage properly. I will have to update database every 20 days with about 10 million records. I wish to know what enhancements I have to do in my setup considering following configurations. I am using openldap 2.4.16 with Berkley DB 4.5.20 on CentOS linux OS 32 bit machine with 4GB RAM. slapd.conf : include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/xyz.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args backend bdb database bdb suffix "o=sgi,c=us" rootdn "o=sgi,c=us" checkpoint 128 15 rootpw xyz directory /usr/local/var/openldap-data index objectClass eq index attribute1 eq index attribute2 eq DBCONFIG: set_cachesize 1 268435456 1 set_flags DB_LOG_AUTOREMOVE Regards, Ashok Kumar

4 5

Re: hardware requirement
by Quanah Gibson-Mount 11 Jun '09

11 Jun '09

--On Thursday, June 11, 2009 9:19 PM +0530 mukim pathan <mukim.iitkgp(a)gmail.com> wrote: > I will be using latest openldap release with Berkley database. If 32 bit > is not capable of it then please tell me the resource requirement for 64 > bit. Keep replies on the list if you want answers. The technical limitations of 32-bit OSes are well documented. Since I have no idea how large your database is when fully loaded, I can not say for certain that you'll hit (or have hit) those limits, but I find it *highly* likely. In any case, in this day and age, there is really no excuse to be running 32-bit OSes. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

hardware requirement
by mukim pathan 11 Jun '09

11 Jun '09

Hi, I have to setup a database for storing 100million entries, each entry with 4 columns. I will be using centOS linux OS for this. I checked previous queries regarding hardware, I found that with 32 bit machine, processing might get slow for 20million above records. I want to ask what should be the hardware configuration for this? Thank you in advance. Regards, Mukim Pathan

2 1

some thoughts about RDN
by Paweł Madej 11 Jun '09

11 Jun '09

Hello, I have such RDN cn=user1,dc=example,dc=com but my webmail software knows users only by emails (which is attribute to cn=user1,dc=example,dc=com) My question is how can i authenticate in LDAP using provided email? I tried sth like mail=test(a)example.com,dc=example,dc=com but ldap refuses such login. Thanks in advance for help Greets Pawel

4 9

Howto synchronization the username and password between windows AD and OpenLDAP server?
by openbsd shen 11 Jun '09

11 Jun '09

I hve Windows AD server and OpenLDAP server, may I synchronization username and passport between them?

1 0

solaris patch vs. linux patch
by Brett ＠Google 11 Jun '09

11 Jun '09

Hello, Just wondering if anybody knows why solaris patch refuses to process the bdb 4.7 patch files, where the patch command on linux works perfectly. Ie: on solaris : patch -p0 <patch.4.7.25.1 Looks like a context diff to me... Hunk #1 failed at line 187. Hunk #3 failed at line 296. 2 out of 4 hunks failed: saving rejects to sequence/sequence.c.rej done Works fine on a linux machine ? Have tried patch 2.5.9 built from soruce on gnu.org, this fails also. (i usually end up patching on linux, and then copying the patched tarball back to solaris.. but just wondering?) Cheers Brett

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical