openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

Re: 2.4.16 performance issues
by jakjr 02 Jun '09

02 Jun '09

Thanks again, just one more question. Openldap 2.4.16 depends on BDB 4.4 or higher, right ? ( http://www.openldap.org/doc/admin24/appendix-recommended-versions.html) Best Regards, João Alfredo On Mon, Jun 1, 2009 at 4:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 3:50 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling >> options: >> >> >> --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do >> not use these options. >> >> Correct ? >> > > With the exception of BDB 4.3, which should never be used, yes, that is > correct. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 2

Re: 2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Thanks for your reply, Quanah I red some links: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421946 http://www.mail-archive.com/openldap-software@openldap.org/msg15013.html http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg627930.html So, the abstract is: bdb 4.2 is good. bdb 4.3, 4.4, 4.5, 4.6 and 4.7: should be used with the compiling options: --enable-posixmutexes --with-mutex=POSIX/pthreads and debian packages do not use these options. Correct ? Thanks again. On Mon, Jun 1, 2009 at 2:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, June 01, 2009 12:11 PM -0300 jakjr <joao.alfredo(a)gmail.com> > wrote: > > > My suspecion is about debian etch and its packages version (berkley db, >> gcc). >> > > Rebuild BDB with the correct mutex options, since Debian refuses to do > this. > > --Quanah > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

2.4.16 performance issues
by jakjr 01 Jun '09

01 Jun '09

Hello Guys, Last week we upgraded our openldap server from version 2.3.30-5 (debian lenny package) to 2.4.16 (compilation). There wasn't any big changes on config files (slapd.conf and DB_CONFIG). Our server is heavily used (samba + webservices + web applications) in a total of 15 millions operations per day. After the upgrade the new openldap server presented some strange behavior. The ports (389 and 636) sometimes were in a filtered state, denying any new connections and the load of the server was incredibly high. No index or memory problem was detected. My suspecion is about debian etch and its packages version (berkley db, gcc). Any tips ? Best regards, João Alfredo

2 1

server redundancy setup
by Rex Roof 01 Jun '09

01 Jun '09

I'm migrating our existing openLDAP 2.3 servers into a new setup running openLDAP 2.4. I will eventually have 4 or 5 servers, hopefully all having the same synchronized data, and all accepting writes, if need be. Can anyone suggest a configuration where I have 4 servers, all keeping themselves in sync, and all accepting writes? Can multimaster replication work with more than two servers? Is that the right solution here? -Rex

2 3

using -y option for ldapsearch
by Sai 01 Jun '09

01 Jun '09

Hi All, I am trying and writing a script to use ldapsearch. But I want to create a password file and use the "-y" option. I am unable to figure out how to create one. ================================== ldapsearch -x -h <Machine> -p <port> -s one -D <CN> -b <BASE_DN> -y pwdfile -v "(&(cn=fm*))" cn ================================== I tried the following. 1) I tried putting the plaintext password for <CN> in the file and it did not work. 2) I ran slappasswd to generate the hashed password for <CN> and directed the output to this file and it did not work. 3) The file permissions I tried are 700 and 600. What is this "-y" option and am I interpreting it correctly? Is there a specific format that this file should be in? Version Info: ================================== $ rpm -qa|egrep openldap openldap-clients-2.2.13-12.el4 openldap-2.2.13-12.el4 openldap-devel-2.2.13-12.el4 openldap-servers-2.2.13-12.el4 $ ================================== Any help is greatly appreciated. -Sai

2 3

Deleting records while iterating through ldap_result
by Stephen 31 May '09

31 May '09

Hi everyone, I'm using the C SDK and writing a program to prune old directory records. The core logic of the program could go something like this:- rc = ldap_search_ext( ld, .. <rest of parameters> ); while (!done) { rc = ldap_result( ld, .. <rest of parameters>, &searchResult) ; //Delete records matching criteria dn = ldap_get_dn( ld, searchResult ); rc = ldap_delete_ext_s( ld, dn, .. <rest of parameters>); } ------- I have two questions and they are probably related:- Firstly: Can I delete records while iterating through the results of the ldap search? (In higher level languages deleting an item from a collection while navigating through a collection is often bad form. Is that the case here?) Secondly: Can I use the same session handle to delete the records as is used for the search? In the logic above, the session handle is ld, and ld is used for both the search and for the deletion. (I'm expecting I would need to use a different session handle for the logic above to work. Alternatively one could save all the records to be deleted in an array and then after the search loop, the same session handle can be used for all the deletes). Thank you Stephen

2 1

Cannot bind/connect to server outside the LAN
by Stelios A. 28 May '09

28 May '09

Hello all, I need help in three problems that I'm facing with my OpenLDAP implementation please. First problem: I'm able to connect to my LDAP server on 636 port without a problem from the same subnet but not outside the Internet. What I want to achieve is to be able to connect from a particular range of static IP's. The ACL part of my slapd.conf is: access to attrs=userPassword,shadowLastChange by dn="uid=authenticate,ou=System,dc=example.com" read by dn="uid=myusername,ou=Users,ou=bca,dc=example.com" read by anonymous auth by self write access to attrs=givenName,sn,cn,mail by dn="uid=syncrepl,ou=system,dc=example.com" read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by self read by users auth by anonymous auth access to attrs=uid by anonymous read by users read access to dn.regex="^.*,uid=([^,]+),ou=Users,dc=example.com$" by dn.exact,expand="uid=$1,ou=Users,dc=example.com" write access to * by dn.exact="uid=authenticate,ou=System,dc=example.com" none by users none break by self read by users read by * none 2nd problem: The following ACL does not work at all or I'm doing something wrong: access to attrs=givenName,sn,cn,mail by dn="uid=syncrepl,ou=system,dc=example.com" read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by anonymous peername.ip=some_static_ip read by self read by users auth by anonymous auth I can't bind as anonymous from 'some_static_ip' in order to fetch the mail, givenName etc into the Thunderbird address book for example. 3rd problem and last! If I reboot the master server then the slave does not bind correctly and email etc does not work at all even though it is configured on that server (slave). Also when I reboot the servers, master must come up first as otherwise I'm not able to connect until I reboot the slave server. Both servers running on Ubuntu 9.04 if that matters in any way. See output: root@masterldap:/etc/ldap# dpkg -l slapd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Cfg-files/Unpacked/Failed-cfg/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad) ||/ Name Version Description +++-==============-==============-============================================ ii slapd 2.4.15-1ubuntu OpenLDAP server (slapd) I have also attached the whole slapd.conf file of my master server in case that helps more. Any help, suggestion is much appreciated.

1 0

Host and group of users authentication
by Tech Only 28 May '09

28 May '09

Hello, I am trying to make group of users to log on to a particular server depending on LDAP credentials. Telnet , ssh work just fine to the host with out any issues. Once I make changes to the ldap.conf file on the client to use the base dc=test,dc=org uri ldap://1.1.1.1 pam_groupdn cn=ldap,ou=hosts,dc=test,dc=org pam_member_attribute member The server is Debian Openldap and the client is Centos 5.* I get You must be a memeber of cn=ldap,ou=hosts,dc=test,dc=org to login And here are the ldif files I used to create the entries. users.ldif dn: cn=Test1 User1,ou=people,dc=test,dc=org givenName: Test1 sn: User1 cn: Test1 User1 userPassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA== uidNumber: 1001 gidNumber: 1000 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uid: test1 homeDirectory: /home/users/test1 dn: cn=Test2 User2,ou=people,dc=test,dc=org givenName: Test2 sn: User2 cn: Test2 User2 userPassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA== uidNumber: 1002 gidNumber: 1000 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uid: test2 homeDirectory: /home/users/test2 Hosts.ldif dn: cn=ldap,ou=hosts,dc=test,dc=org objectclass: ipHost objectclass: device objectclass: extensibleObject ipHostnumber: 1.1.1.2 cn: ldap member: uid=test1,ou=people,dc=test,dc=org member: uid=test2,ou=people,dc=test,dc=org

1 0

Recommendations for adding "MUST" attribute to in-production objectclass?
by Christopher DeMarco 28 May '09

28 May '09

Greetings, list! I have a custom schema, which defines an objectclass to which all of my "users" belong. I'd like to add a required ("MUST") attribute to that objectclass, but I'm frightened of destroying my users :-) Is the following procedure safe? 1. Add the desired attribute as optional ("MAY") to the objectclass in my schema. Restart slapd. 2. Apply an LDIF change to every node with that particular objectclass, setting that new attribute to some acceptable value. 3. Ensure that my "create a new user" tools will set that attribute. 4. Change my schema to require ("MUST") that attribute within that objectclass. Restart slapd. If not, what is the safe procedure? Is there a better way of adding a required attribute to an in-production objectclass? Thanks! -- Christopher DeMarco <demarco(a)maya.com> IT Director MAYA Group +1-412-708-9660

6 8

ACI and OpenLdap 2.4.11 un debian lenny
by Sebastien Cramatte 27 May '09

27 May '09

Hello How can I use ACI with Openldap 2.4.11 ? I'm running debian lenny and seems that debian package by default has the option --enable-aci I don't have any OpenLDAPAci attribute and OpenLDAPAcl object in core.schema Thank your help Best regards

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical