openldap-technical

openldap-technical@openldap.org

9897 discussions

ldap auth from external application
by Zdenek Styblik 26 Jun '09

26 Jun '09

Hi, I'd like to ask why is auth from external applications like eg. ftp server done via proxy user, and not straight with user provided credentials. The only thing I came up with is that there is possible risk with hi-jacking session due to flaw in application, still- I'm missing the big picture here. Or return code 49 is not enough for failed auth? Could somebody, please, clarify this for me? I'm sure there are really good reasons no to so (straight auth), still I've "found" pros in not having additional user which is capable to read others (even hashed) passwords, and probably no need to be password hash dependent as whole auth would be LDAPs domain. Thanks, Zdenek -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net

2 6

openldap search configuration
by mukim pathan 26 Jun '09

26 Jun '09

Hi, I am using openldap 2.4.16 with bdb-4.5. This database has to give response to around 200 search queries at a time. I wish to know what my configuration of ldap should be so that this search queries will be answered in milliseconds. Any help will be appreciated. Regards, Mukim Pathan

1 0

Case Ignore Ordering matching rule for IA5 String sysntax ?
by Antonio Alonso 25 Jun '09

25 Jun '09

Hi ! We are trying to define (in our own ldap schema) an IA5String attribute type that is required to be managed (from our ldap clients) as "case insensitive" "greaterOrEqual" and "lessOrEqual" filters are required to be managed over this attribute, so we wanted to assigne (in its attribute type definition) an ORDERING matching requesting "case insensitive" behaviour According to RFC4517 (http://tools.ietf.org/html/rfc4517) there is NO any ordering Matching Rule for IA5String syntax AND case insensitive support. We tried with the "caseIgnoreOrderingMatch" .. but slapd returns and error (at schema loading) as attribute type syntax (IA5String) is not allowed for this "ordering match rule" We checked that defining the attribute as "PrintableString" works (as "caseIgnoreOrderingMatch" is a valid matching rule for that sysntax according to RFC4517) ... but we are really interested in IA5String syntax .... Does openLDAP server technolgy provide a "case insensitive ordering match" method for IA5String syntax ? Thanks in advance BR / Antonio Antonio Alonso Alarcón CUDB System Engineer Ericsson España, S.A. Phone: +34 91 339 3085 Via de los Poblados 13 Mobile: +34 609640579 (66215) (Millenium building, Fax: +34 91 339 1636 5th floor, B1 side, desk 61) 28033 Madrid, Spain E-mail: antonio.alonso(a)ericsson.com

1 0

Re: OpenLDAP Mirror Mode configuration
by Mathieu MILLET 25 Jun '09

25 Jun '09

On Thu, 25 Jun 2009 07:41:42 -0600, Matt Kassawara <battery(a)writeme.com> wrote: > I'm running mirror mode on a pair of VMs and haven't noticed any issues > with > replication. If you're using VMware ESX/ESXi 3.5, I recommend configuring > Linux guests with the kernel boot parameter "clocksource=acpi_pm" and > configuring VMware Tools to handle clock management in the guest. Verify > NTP isn't running in the guest. Also, making sure the Linux kernel > periodic > interrupt timer runs at 100 Hz instead of 250 or 1000 Hz can reduce timing > issues. VMware provides some documentation on best practices for > performance tuning I'd recommend reading. Yes, I have read these (but was using VM workstation). Also, My experimentation was during last summer 2008 and at the same period VMWare switch from "DO NOT USE NTP in Guest, instead VmwareTools" to "Use NTP" without any explanation ... The main trouble was when modifying on both side "too quickly". Other testings with differents applications show up that virtualization is no good for timing-picky application (but it is going off-topic ;) Thanks for the sharing. Sincerely yours, Mathieu. > On Thu, Jun 25, 2009 at 12:16 AM, Mathieu MILLET <ldap(a)htam.net> wrote: > >> On Tue, 23 Jun 2009 09:36:23 +0100, Fernando Silva >> <fernandolrsilva(a)gmail.com> wrote: >> > Hi all, >> >> Hi >> >> > I'm trying to setup a Mirror Mode configuration using 2 machines >> > running >> > OpenLDAP v2.4.11 on both. To make things easy both machines are on the >> > same (private) network. >> > >> > [snip] >> > mirrormode on >> > >> > I'm using Ubuntu 8.10 inside a VMWare image, but both images are >> > running >> > on independent machines and the network on both is Bridge Mode. >> >> >From previous experiment, especially with OpenLDAP 2.4.11, I have very >> hard >> time with making OpenLDAP N-way replication working on VM, especially >> VMWare-based ones. >> >> The main problem was with the management of the system clock, where >> VMWare >> was making the clock slower and then make a "jump" to compensate the >> slowiness. So, I got a lot of line "new modification with older timer >> value" (can't remember the precise log line, though). >> >> I had to switch to plain physical server (which was my target by then). >> >> > All >> > seems well according to OpenLDAP manual, but maybe I'm missing >> > something. I start both servers using "slapd -d sync" in order to >> > filter >> > only the sync part. >> > >> > I created a script to insert 200 employees in my directory, to force >> > the >> > servers to sync up. When I start both servers and insert the employees >> > in machine 1, I get this too much lines with this sample: >> > slap_queue_csn: queing 0xb6851b4a >> 20090623082909.571025Z#000000#000#000000 >> > slap_graduate_commit_csn: removing 0xb82165c8 >> > 20090623082909.571025Z#000000#000#000000 >> > >> > So the CSN is being created (I think), but there's no sync to machine >> > 2, >> > which makes me frustated. . . >> > >> > I'd appreciate any comments you can have, especially if you already >> > have >> > this kind of setup running. >> > >> > Best regards, >> > Fernando >> >> Hope it can help. >> Sincerely yours, Mathieu MILLET. >> >>

1 0

getnetbyaddr not working with LDAP
by Eric Ritchie 25 Jun '09

25 Jun '09

I'm running 2.3.39 under Redhat 4.0. I'm transitioning my Redhat clients from NIS to LDAP. It seems that getnetbyaddr doesn't work under LDAP. The following perl code shows the problem: #!/usr/local/bin/perl -w use Socket; $n = getnetbyname ( "nasd" ); $name = getnetbyaddr($n, AF_INET); print "$name\n"; exit 0; Host running NIS: # ./eric.pl nasd Host running LDAP: # ./eric.pl Use of uninitialized value in concatenation (.) or string at ./eric.pl line 9. The getnetbyname call works and I can print out the network IP. Can anyone help with this? Thanks -- Eric Ritchie Interactive Brokers LLC 203-618-5868

1 1

OpenLDAP Mirror Mode configuration
by Fernando Silva 25 Jun '09

25 Jun '09

Hi all, I'm trying to setup a Mirror Mode configuration using 2 machines running OpenLDAP v2.4.11 on both. To make things easy both machines are on the same (private) network. Here's a sample of both my slapd.conf: Machine 1: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 001 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.2 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on Machine 2: ----------- include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args ##### Mirror Mode serverID 002 loglevel 16384 modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov.la moduleload syncprov.so sizelimit 500 tool-threads 1 backend hdb database hdb suffix "dc=MyDomain" rootdn "cn=admin,dc=MyDomain" rootpw {SSHA}secret directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 lastmod on checkpoint 512 30 access to * by dn="cn=admin,dc=MyDomain" write by * read # Consumer syncrepl rid=001 provider=ldap://192.168.1.1 bindmethod=simple binddn="cn=admin,dc=MyDomain" credentials=secret searchbase="dc=MyDomain" attrs="*,+" schemachecking=off type=refreshOnly interval=00:00:1:00 #forcing to be only one minute retry="10 10 60 10 +" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index objectclass,entryCSN,entryUUID eq # Provider overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 mirrormode on I'm using Ubuntu 8.10 inside a VMWare image, but both images are running on independent machines and the network on both is Bridge Mode. All seems well according to OpenLDAP manual, but maybe I'm missing something. I start both servers using "slapd -d sync" in order to filter only the sync part. I created a script to insert 200 employees in my directory, to force the servers to sync up. When I start both servers and insert the employees in machine 1, I get this too much lines with this sample: slap_queue_csn: queing 0xb6851b4a 20090623082909.571025Z#000000#000#000000 slap_graduate_commit_csn: removing 0xb82165c8 20090623082909.571025Z#000000#000#000000 So the CSN is being created (I think), but there's no sync to machine 2, which makes me frustated. . . I'd appreciate any comments you can have, especially if you already have this kind of setup running. Best regards, Fernando

3 3

RHEL 5 rpms
by Adam Leach 25 Jun '09

25 Jun '09

Anyone know where to find RHEL 5 rpms that are higher than 2.4.11? -- Adam Leach BS Computer/Electrical Engineering West Virginia University Systems Administrator - Raytheon (304)677-4455

2 2

How to backup/restore on remote servers
by Josir Gomes 23 Jun '09

23 Jun '09

Hi folks, I just installed a openldap server and I want to test backup/restore routines. I have two machines, one is a clone of the second one.The first one I add several users and then my test is to restore those users in the new machine. To backup, it was easy: slapcat -l /path/to/your/backup.ldif But when I tried to restore, I shutdown the samba/ldap service with: /etc/init.d/ebox samba stop /etc/init.d/ebox slapd stop And then I issue: slapadd -l /path/to/your/backup.ldif => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30996) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) slapadd: could not add entry dn="dc=ebox" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30996) I understand that there are other records and I can't replace them. Do I have to erase everything ? Or is there a merge option ? I know that there is a replication service but those two servers will not be on the same network (ie. one server will not communicate with the other) so I think this approach does not apply. Any tip or suggestion will be very welcome. Thanks in advance, Josir Gomes

4 5

Re: ldap not finding internal CA?
by gruntler-ldap＠yahoo.com 23 Jun '09

23 Jun '09

--- On Wed, 6/17/09, Mathias Gug <mathiaz(a)ubuntu.com> wrote: > From: Mathias Gug <mathiaz(a)ubuntu.com> > Subject: Re: ldap not finding internal CA? > To: "Kurt Yoder" <ktyopenldap(a)yoderhome.com> > Cc: openldap-technical(a)openldap.org > Date: Wednesday, June 17, 2009, 9:13 PM > > [...] > >> My openldap is version 2.4.15 on Ubuntu Jaunty. Interestingly, I >> had the same message about self-signed certificates on previous >> Ubuntu versions, but querying ldap with "TLS_REQCERT demand" works >> fine. > > As Howard mentioned this should have been fixed in 2.4.16. However > could you try to put both the CA certificate *and* the server > certificate in the cert.file used by the slapd server - (that way > the whole CA chain is sent to the client by gnutls) ? Hi Mathias, How exactly does one do that? I've tried simply appending the contents of the CA file to the server certificate file and restarting slapd and it has no effect. I've tried other various combinations as well but testing against Jaunty still fails while Intrepid works. Meanwhile I built OpenLDAP 2.4.16 on Jaunty with no Ubuntu patches added to OpenLDAP and it works: gruntler@jaunty-64:~/src/openldap-2.4.16/clients/tools$ ./ldapsearch -x -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.16 (Jun 22 2009 17:04:33) $ gruntler@jaunty-64:/home/gruntler/src/openldap-2.4.16/clients/tools (LDAP library: OpenLDAP 20416) # extended LDIF # # LDAPv3 # base <dc=abcd, dc=efgh, dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # ... snip ... ldap.conf settings: BASE dc=abcd, dc=efgh, dc=com URI ldaps://auth01-test ldaps://auth02-test TLS_CACERT /etc/ssl/cacerts/my-org.cert.pem TLS_REQCERT demand TIMEOUT 4 NETWORK_TIMEOUT 2 ----- Meanwhile... gruntler@jaunty-64:~/src/openldap-2.4.16/clients/tools$ /usr/bin/ldapsearch -x -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.15 (Mar 19 2009 10:07:04) $ buildd@yellow:/build/buildd/openldap-2.4.15/debian/build/clients/tools (LDAP library: OpenLDAP 20415) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

1 0

proxy cache not really caching?
by Tyler Gates 23 Jun '09

23 Jun '09

Hello, I've been running my openldap 2.4 proxy directory server using back_ldap and pcache in front of two masters for a few days and have been a little confused about why I'm not getting more "QUERY ANSWERED" messages in the logs considering all the "QUERY CACHED" messages. According to the script I wrote to parse the log file for certain key words, I'm seeing data like this: ******************************* QUERIES ANSWERED: 26901 QUERIES NOT ANSWERED: 142386 QUERIES CACHEABLE: 114491 QUERIES NOT CACHEABLE: 27895 ------------------------------- TOTAL QUERIES: 169287 QUERIES ADDED: 114080 QUERIES STORED: 7 QUERY HIT: %15.8907653866 ******************************* As you can see my templates are catching a good majority of the queries and they appear to be added to cache. For example I see messages like this: 'Added query expires at 1244899436 (NEGATIVE)' But even though I've tried bumping the ttl up, I'm still seeing a lot of QUERY NOT ANSWERABLE messages fly by about queries that should have been in cache before. For example, this snippet below appears to cache querystr '(&(objectClass=posixGroup)(memberUid=xfs))' but then one query later the exact same query comes up and it says its not answerable and adds it to cache again. Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SRCH attr=gidNumber Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(memberUid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Entering QC, querystr = (&(objectClass=posixGroup)(memberUid=xfs)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock QC index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Not answerable: Unlock QC index=0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Added query expires at 1244899436 (NEGATIVE) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: TEMPLATE 0x8354560 QUERIES++ 1 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Unlock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=99 op=1658 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1661 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(uid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1661 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1662 SRCH base="dc=castlebranch,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=xfs))" Jun 13 09:08:56 directory-proxy slapd2.4[20842]: conn=86 op=1662 SRCH attr=gidNumber Jun 13 09:08:56 directory-proxy slapd2.4[20842]: query template of incoming query = (&(objectClass=)(memberUid=)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Entering QC, querystr = (&(objectClass=posixGroup)(memberUid=xfs)) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock QC index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Not answerable: Unlock QC index=0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY NOT ANSWERABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: QUERY CACHEABLE Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Added query expires at 1244899436 (NEGATIVE) Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Lock AQ index = 0x8354560 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: TEMPLATE 0x8354560 QUERIES++ 1 Jun 13 09:08:56 directory-proxy slapd2.4[20842]: Unlock AQ index = 0x8354560 According to the logs I currently have 7 cached queries and about a %15.8 hit rate which seems ridiculous given all the 'added query' messages I'm getting. Is there something wrong with my caching engine on the directory server or am I missing something with how the caching mechanism works? Thanks, Tyler

2 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical