openldap-technical

openldap-technical@openldap.org

9851 discussions

Prb: UID Fields Over 7 Chars - add transaction hangs
by David.CTR.Muench＠faa.gov 02 Jul '09

02 Jul '09

All, I have a problem with a new OpenLDAP configuration that is likely my own doing, but I am unable to discern the cause. Environment: Solaris 9, OpenLDAP 2.4.16, Berkeley DB 4.7.25 I installed the OpenLDAP software from the stable release at the openldap.org site. After some basic configuration and very basic tests, I did the "full" slapd.conf and DB_CONFIG configurations using various resources, including the Admin Guide and the FAQ-o-matic. All seemed to be going well until I tried to add (ldapmodify -a w/ldif files) some new "person" entries based on data I want to migrate. The first one was OK, but subsequent ones never completed. When the problem occurs, there's no return from the ldapmodify command and likewise any "db_stat" commands that I attempt. When I look at the log (local4.debug) entries, the last entry is for the "ADD dn="uid=DCM...". The daemon is *not* looping, there's just never a response. [I need to break to get my prompt back.] When I attempt to stop the daemon, I get "waiting for 1 operations/tasks to finish" and I have to kill the daemon to get it to stop. When I restart, it goes through DB recovery and everything is as it was before the ldapmodify -a started. A colleague suggested something that seems to be an indicator: - an add of "dn: uid=DCM11,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM1123,ou=People,o=XXXX" works fine - an add of "dn: uid=DCM11234,ou=People,o=USNS" does *not* work So it seems that "uid" values with lengths over 7 characters fail. Yeah, this seems plenty odd to me, but I've created\tested\deleted DBs multiple times over and this still happens consistently. I have tried multiple levels of "debug", down to "488" anyway, but still no message that seems like an error. Not wanting to swamp anyone, here's some basic config extracts: ===DB_CONFIG=== set_cachesize 0 67108864 1 set_lg_bsize 2097152 set_lg_max 10485760 set_lg_regionmax 262144 === ===slapd_t10.conf=== [obviously stripped] ... backend bdb database bdb suffix "o=XXXX" checkpoint 128 15 index objectClass eq index uid pres,eq [Have tried taking this out & re-creating - no difference] lastmod on monitoring on ... === Anyone have any ideas? I have spent many hours looking at this, but I'm willing to believe it's something simple I can't see. Thanks in advance for you help. DCM

4 7

Re: TLS init def ctx failed: -1
by gruntler-ldap＠yahoo.com 02 Jul '09

02 Jul '09

--- On Thu, 7/2/09, Howard Chu <hyc(a)symas.com> wrote: > From: Howard Chu <hyc(a)symas.com> > Subject: Re: TLS init def ctx failed: -1 > To: "François Mehault" <Francois.Mehault(a)netplus.fr> > Cc: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Date: Thursday, July 2, 2009, 7:02 AM > François Mehault wrote: > > > > |*openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout > > server.pem -days 365*| > > This is a terrible way to generate a server certificate. > Instead you should generate a CA, following the steps in > (the current) section 4.2. What document is being referred to here? It can't be http://www.openldap.org/doc/admin/ because section 4.2. there is "Prerequisite software". Thanks, Ken

2 1

TLS init def ctx failed: -1
by François Mehault 02 Jul '09

02 Jul '09

Hi all I contact you because I don't succeed to configure my OpenLDAP with TLS. First I create self signed certificate server.pem like I read on this page http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#5.1.1 in /usr/local/etc/openldap/tls. openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 Then I add this line in slapd.conf : TLSCertificateFile /usr/local/etc/openldap/tls/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/tls/server.pem TLSCACertificateFile /usr/local/etc/opendldap/tls/server.pem TLSVerifyClient never Then I restart slapd. /usr/local/etc/rc.d/slapd stop , start. And in my /var/log/debug.log I have Jul 2 12:18:39 labobe2 slapd[97816]: main: TLS init def ctx failed: -1 Jul 2 12:18:39 labobe2 slapd[97816]: slapd destroy: freeing system resources. Jul 2 12:18:39 labobe2 slapd[97816]: syncinfo_free: rid=001 Jul 2 12:18:39 labobe2 slapd[97816]: slapd stopped. I use FreeBSD 7. If someone can help me, I appreciate, thanks in advance Regards, François

3 4

RE: monitor mirror mode
by François Mehault 02 Jul '09

02 Jul '09

Thanks for your response. ContextCSN seems perfect but, I try on my two OpenLDAP: <10:13>[labobe2:~]# ldapsearch -x -LLL -H ldap://openldapID1:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 <10:07>[labobe1:~]# ldapsearch -x -LLL -H ldap:// openldapID2:389 -s base -b 'dc=netplus,dc=fr' contextCSN dn: dc=netplus,dc=fr dn: dc=netplus,dc=fr contextCSN: 20090629115508.383110Z#000000#002#000000 contextCSN: 20090702080926.118569Z#000000#001#000000 As you can see I have two results by request. And I have effectively the same result on each server. Can I conclude just with this results that the replication works well ? I though I would have one contextCSN for each request instead of two. Thanks for your help. Regards, François De : Gavin Henry [mailto:ghenry@OpenLDAP.org] Envoyé : vendredi 26 juin 2009 17:14 À : François Mehault Cc : openldap-technical(a)openldap.org Objet : Re: monitor mirror mode You can use: http://blog.suretecsystems.com/archives/146-OpenLDAP-Quick-Tips-Checking-th… ----- "François Mehault" <Francois.Mehault(a)netplus.fr> wrote: > > Hi all I use 2 openldap with mirror mode replication. And in fact I want to monitor both with Nagios. I want to be sure that replication works, So I ask myself if there is some numerous version on each OpenLDAP that I could check if they are equal. This value would be update after each replication. Something like that exist ? Or, how can I monitor the replication ? If you have some lead, I am interested. Thanks for your help Have a good week end. François -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found
by Andreas Krummrich 01 Jul '09

01 Jul '09

Hi all, I'm running OpenLDAP 2.4.11 on a debian lenny box and it seems that I'm having trouble with the log files. I had a corrupt database some days ago and needed to restore the database from the backup. The log said: Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": unclean shutdown detected; attempting recovery. Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de": dbenv_open(/var/lib/ldap). Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Ignoring log file: /var/lib/ldap/log.0000000005: magic number 0, not 40988 Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): Invalid log file: log.0000000005: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: Invalid argument Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): PANIC: DB_RUNRECOVERY: Fatal error, run database recovery Jun 28 01:16:59 old slapd[17374]: bdb_db_open: database "dc=intern,dc=domain,dc=de" cannot be recovered, err -30978. Restore from backup! Jun 28 01:16:59 old slapd[17374]: ====> bdb_cache_release_all Jun 28 01:16:59 old slapd[17374]: bdb(dc=intern,dc=domain,dc=de): txn_checkpoint interface requires an environment configured for the transaction subsystem Jun 28 01:16:59 old slapd[17374]: bdb_db_close: database "dc=intern,dc=domain,dc=de": txn_checkpoint failed: Invalid argument (22). Jun 28 01:16:59 old slapd[17374]: backend_startup_one: bi_db_open failed! (-30978) So I installed a new OpenLDAP server with the same versions and the same configuration. The first thing what I found out was that db_archive has some trouble: On the new box I get the following results from db_archive: root@new:/var/lib/ldap# db4.2_archive -sa /var/lib/ldap/cn.bdb /var/lib/ldap/dn2id.bdb /var/lib/ldap/gidNumber.bdb /var/lib/ldap/givenName.bdb /var/lib/ldap/id2entry.bdb /var/lib/ldap/loginShell.bdb /var/lib/ldap/objectClass.bdb /var/lib/ldap/sn.bdb /var/lib/ldap/uid.bdb /var/lib/ldap/uidNumber.bdb root@new:/var/lib/ldap# db4.2_archive -la /var/lib/ldap/log.0000000001 root@new:/var/lib/ldap# Looks good so far. On the old box I get the following results (there are the same databases) root@new:/var/lib/ldap# db4.2_archive -sa root@new:/var/lib/ldap# db4.2_archive -la db_archive: DB_ENV->log_archive: DB_NOTFOUND: No matching key/data pair found root@new:/var/lib/ldap# I searched the archive and googled this message, but found nothing that fits my case. Hope that someone can give me a hint, solving this issue. Thanks and kind regards, Andreas

4 6

LDAP user cannot login
by Richard Gillman 01 Jul '09

01 Jul '09

Hi, I'm moving an LDAP server from one system to another. Data I copied using slapcat -l ldapdata; slapadd -c -q -l ldapdata on new system, then start ldap. But I can't log in as an ordinary user. I've tried resetting the user password using JXplorer, but no luck. Can anyone spot something wrong in what I'm trying to do? Suggestions appreciated. thanks in advance, Dick slapd.conf contains access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.exact="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.exact="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read slapd -d acl gives at startup (#) $OpenLDAP: slapd 2.3.43 (Jan 21 2009 03:59:37) $ mockbuild@builder10.centos.org:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd Backend ACL: access to attrs=SambaLMPassword,SambaNTPassword by dn.base="cn=manager,dc=nerc-sf,dc=ac,dc=uk" write by * none Backend ACL: access to dn.base="" by * read Backend ACL: access to dn.base="cn=subschema" by * read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" attrs=userPassword,sambaLMPassword,sambaNTPassword by anonymous auth by self write by dn.base="cn=replica,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by dn.base="cn=proxyagent,ou=profile,dc=nerc-sf,dc=ac,dc=uk" read Backend ACL: access to dn.subtree="ou=admins,dc=nerc-sf,dc=ac,dc=uk" by dn.regex="cn=[^,]+,ou=admins,dc=nerc-sf,dc=ac,dc=uk" read by anonymous auth Backend ACL: access to dn.subtree="dc=nerc-sf,dc=ac,dc=uk" by peername.ip="192.171.172.0%255.255.255.0" read by peername.ip="192.171.159.192%255.255.255.192" read by peername.ip="127.0.0.1" read => bdb_entry_get: found entry: "dc=nerc-sf,dc=ac,dc=uk" => access_allowed: search access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "entryCSN" requested <= root access granted slapd starting When I try to login, slapd gives => access_allowed: read access to "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk" "userPassword" requested => dn: [1] dc=nerc-sf,dc=ac,dc=uk => acl_get: [1] matched => acl_get: [1] attr userPassword access_allowed: no res from state (userPassword) => acl_mask: access to entry "uid=susa,ou=people,dc=nerc-sf,dc=ac,dc=uk", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: anonymous <= acl_mask: [1] applying auth(=xd) (stop) <= acl_mask: [1] mask: auth(=xd) => access_allowed: read access denied by auth(=xd) send_search_entry: conn 1 access to attribute userPassword, value #0 not allowed -- Richard Gillman ITC UNIX Systems Group, Maclean Building, Wallingford OX10 8BB Tel: 01491 - 692 339 Fax: 01491 - 692 424

1 0

RE: MirrorMode VS load balancing
by Brett Maxfield 30 Jun '09

30 Jun '09

Yes simple is a good thing, but you have to decide for yourself what risk and downtime is acceptable, how long to recover and how many writes is acceptable to lose. E.g. Is a one daily backup acceptable for recovery (and you lose changes since then), or do you need every single write to the hour/minute ? The more continously/frequently you write to both nodes, the more likely are sync errors, and also less recoverability of your bdb logs in the event of catastrophic power failure or inproper shutdown. I dont think anyone can decide this for you.. You need to evaluate your level of risk and what loss / downtime is acceptable to you / your employer / your customers etc., Cheers Brett -----Original Message----- From: Hideo NAKAMITSU <nomo(a)bluecoara.net> Sent: Monday, 29 June 2009 11:51 AM To: openldap-technical(a)openldap.org Subject: Re: MirrorMode VS load balancing and how about 1write/sec, 10writes/sec, 50writes/sec, 100writes/sec... I want to know this threshold like, - if writes happen 0-5/sec, it's 99% safe (at the worst unlucky case, only 2writes at the same time may break something) - 6-50/sec, may safe or not. - more than 50/sec, danger.

5 4

ppolicy and syncrepl aclaration
by Jordi Espasa Clofent 30 Jun '09

30 Jun '09

Hi, According to http://www.openldap.org/lists/openldap-software/200701/msg00149.html, the "In general, ppolicy related state values are not replicated; each replica is on its own as far as state-related attributes in enforcing password policy." ¿Is it means that of I've one provider and two consumers, the changes made in ppolicy statements in provider are not sync againt the consumers as other kind entries/attributes are? I need to know because of I've change my userPassword in provider and: * I can use without problems the new password using the provider * I cannot use the new password against the two consumers. I use LVS balancer in front of the 3 openldap servers (one provider and two consumers), so it's important that ANY change made in provider will be always synced. -- Thanks, Jordi Espasa Clofent

3 5

openldap+sasl confusion
by Seau Yeen Su 30 Jun '09

30 Jun '09

Hi, I am trying to install OpenLdap with SASL. The version of openldap i installed is openldap-2.4.16 whereas the cyrus-sasl version installed is cyrus-sasl-2.1.23. The BerkeleyDB version installed is 4.4. I followed the guidance in this link to do the installation : http://tldp.org/HOWTO/LDAP-HOWTO/sasl.html However, when i tried to add users defined in ldif file, I received ldap_sasl_interactive_bind_s: Invalid credentials (49) error when i keyed in the password generated for admin using saslpasswd2 command. I have a few questions: 1. After using saslpasswd2 to create the username and password in sasl database, do i need to add the entry into ldap database with slappasswd command? When i used slapadd command and it prompts for password, does it authenticate against sasl database or ldap database? 2. Do i need to issue saslpasswd2 for each and every user that i want to add into ldap database and to be authenticated via ldap? 3. In the slapd.conf file, under rootpw, am i supposed to use the word "secret" or the cleartext password that i keyed in using saslpasswd2 or some encrypted password? 4. What is the difference between sasl-regexp and authz-regexp? 5. Let's say i issued saslpasswd2 -c admin to create admin as the LDAP administrator. Does this mean in the slapd.conf, the rootdn should be admin or can it be another name, that will be mapped via sasl-regexp/authz-regexp? (Which does it use anyway between these 2 : sasl-regexp & authz-regexp?) 6. Previously I set up without sasl and it was rather straightforward, merely using slappasswd and save the encyrpted pasword into slapd.conf. Now, i am totally lost with its concept. I do know that names in ldap database has to be mapped to the names in sasl database. Hopefully you can enlighten me on the whole concept and how the configuration should be done. Thank you. Hope to receive some advice and guidance. -- Warmest Regards, Seau Yeen

3 5

MirrorMode VS load balancing
by Hideo NAKAMITSU 29 Jun '09

29 Jun '09

Guys, I've already read this, and understand the difference between MirrorMode and Multi Master. http://www.openldap.org/doc/admin24/replication.html Actually, when I setup 2-nodes MirrorMode and add too much entries to both nodes, at the same time, sometimes both databases weren't syncrhonized correctly. (I made a script to add 10,000 entries, and run it on both nodes at the same time.) In this case, we shouldn't update both nodes at the same time. and of course this is already discribed in the document as following. -------------------------------------------------------- MirrorMode is not what is termed as a Multi-Master solution. This is because writes have to go to just one of the mirror nodes at a time -------------------------------------------------------- but on some cases(including my environment), UPDATE happens 3-10 times in a day. it's much less than SEARCH. in this case, I think we can just put loadbalancer, and enable "load balancing" and "redundancy" (I understand UPDATE isn't load balanced.) -------------------------------------------------------- CLIENT | SLB(RoundRobin) | +-----+ SRV1 SRV2 * MirrorMode is enabled on SRV1 and SRV2 -------------------------------------------------------- My question is, MirrorMode document says "writes have to go to just one of the mirror nodes at a time." but if the writes don't happen very often, I think "writes can be done on every nodes at a time." When I did some tests, it could be done. but I'm not sure developer's thoughts. How do you think guys ?

5 9

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical