openldap-technical

openldap-technical@openldap.org

9897 discussions

OpenLDAP multi master replication
by Bujji S 07 May '09

07 May '09

Hi, i have openldap(2.4.9) installed in ubuntu 8.04 server. i want to create a multi master set up with two such servers(2 or more than 2) first i tried to follow http://www.openldap.org/doc/admin24/replication.htmlto form n-way master setup. but in starting only i got a problem saying database(dc=mytest,dc=com) is not configured to hold "cn=config" then i tried setting up cn=config using http://www.zytrax.com/books/ldap/ch6/slapd-config.html but that doesn't help me meaning even after configuring that cn=config as he mentioned in the site i got the same error so i removed everything(slapd.d) what i did earlier so now i have slapd.conf in both of my servers finally i found one more link http://itsecureadmin.com/wiki/index.php/OpenLDAP_Multi-Master_Replication that displays sample config file so i followed that you can check the slapd.conf below so now i set up the same configuration in the second server too. after writing these slapd.conf i just restared slapd on both servers. for the first time when i add some data the first server it got replicated on the other server only when restart slapd on second server. that is fine. when i tried to add some other data on second server its not getting replicated on the other server even if i restart slapd. after that wherever i add data not getting replicated adding locally only. what could be the problem. plz check my slapd.conf file and suggetst me how to do multi master replication on ubuntu 8.04 server. so my slapd.conf is below. # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel none # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload ppolicy.la moduleload syncprov.la moduleload back_monitor.la # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for hdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend hdb ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> database config rootdn "cn=admin,cn=config" rootpw admin123 database monitor rootdn cn=monitor rootpw admin123 ####################################################################### # Specific Directives for database #1, of type hdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database hdb # The base of your directory in database #1 suffix "dc=mytest,dc=com" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=mytest,dc=com" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" serverid 3 ldap://192.168.7.88:389 serverid 4 ldap://192.168.7.89:389 cachesize 1000 checkpoint 256 5 syncrepl rid=003 provider=ldap://192.168.7.88:389 binddn="cn=admin,dc=mytest,dc=com" bindmethod=simple credentials=admin123 searchbase="dc=mytest,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 syncrepl rid=004 provider=ldap://192.168.7.89:389 binddn="cn=admin,dc=mytest,dc=com" bindmethod=simple credentials=admin123 searchbase="dc=mytest,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 mirrormode true overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # The dbconfig settings are used to generate a DB_CONFIG file the first # time slapd starts. They do NOT override existing an existing DB_CONFIG # file. You should therefore change these settings in DB_CONFIG directly # or remove DB_CONFIG and restart slapd for changes to take effect. # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 for more # information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq index cn,mail,surname,givenname eq # Save the time that the entry gets modified, for database #1 lastmod on # Checkpoint the BerkeleyDB database periodically in case of system # failure and to speed slapd shutdown. checkpoint 512 30 # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=mytest,dc=com" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=mytest,dc=com" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=mytest,dc=com" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be hdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org" --------------------------------------------------------------------- so now i set up the same configuration in the second server too. after writing these slapd.conf i just restared slapd on both servers. for the first time when i add some data the first server it got replicated on the other server only when restart slapd on second server. that is fine. when i tried to add some other data on second server its not getting replicated on the other server even if i restart slapd. after that wherever i add data not getting replicated adding locally only. what could be the problem. plz check my slapd.conf file and suggetst me how to do multi master replication on ubuntu 8.04 server. Thanks Visu

2 1

ldap users in local groups
by Justin Lintz 06 May '09

06 May '09

Hi, I'm running into an interesting problem in that when I try to add more than one ldap account to a local group, both users of that group no longer show membership in that group when running "groups" or "id". If I just add one of the users to the group, it works without a problem. I apologize if this is not the correct list of this issue. Does anyone have any ideas on what may be causing this? - Justin Lintz

3 2

Occasional corrupt DN in be_add logs under 2.4.16
by Sean Burford 06 May '09

06 May '09

Hi, As an interim measure while deploying 2.4.16 I am canarying 2.3.43 on a replication provider. As a result the current replication path is: master (2.3.39) -> provider (2.3.43) -> replica (2.4.16) The master will be upgraded in short order once the 2.3.43 canary is successful. I've been seeing occasional corrupt DNs in some be_add log lines on the 2.4.16 replica: May 5 09:35:46 host slapd[31817]: syncrepl_message_to_op: rid=100 be_add <90>Y1 ntry,ou=subtree,dc=example,dc=com (0) I've modified the DN in this log line. The missing text is "cn=l" in this example. The original DN was 65 characters long. I have performed the following search against each host with the following results. It shows that the entry replicated fine but capitalisation of the DN differs (which may be a red herring since I was already aware that DN capitalisation differed across servers): $ ldapsearch -x -b cn=lntry,ou=subtree,dc=example,dc=com -s base dn master: dn is cn=lntry,ou=Subtree,dc=example,dc=com provider: dn is cn=lntry,ou=subtree,dc=example,dc=com replica: dn is cn=lntry,ou=Subtree,dc=example,dc=com slapcat shows no problems with the entry on the 2.4.16 host. Since the database looks fine I wonder if this is just a logging issue. Should this Debug statement in syncrepl.c actually use op->ora_e->e_name.bv_val or some other attribute? rc = op->o_bd->be_add( op, &rs ); Debug( LDAP_DEBUG_SYNC, "syncrepl_message_to_op: %s be_add %s (%d)\n", si->si_ridtxt, op->o_req_dn.bv_val, rc ); With the exception of si->si_rid becoming si->si_ridtxt (and %d->%s) this Debug statement has not changed since 2.3. -- Thanks, Sean Burford

3 5

slapd-meta and paged results control
by Lajos Boróczki 06 May '09

06 May '09

Hi, I'm trying to set up an openldap proxy server using slapd-meta. Everything worked so far, but after the backend database grew bigger and bigger, searches with a fixed page size started to give strange results. Tracing the problem led me to the following: If I set a page size of 300 in my ldapsearch (where localhost:3890 is my slapd running slapd-meta): ldapsearch -x -W -D "CN=admin,DC=example,DC=org" -E pr=300 -H "ldap://localhost:3890/" -b "dc=a,dc=example,dc=org" "(objectClass=inetOrgPerson)" uid I get at most 300 results and the paging information is lost on the way. If I set 300 to 1000 I get all of the results, because I have ~500 entries. Doing an ldapsearch to the backand servers: ldapsearch -x -W -D "CN=admin,DC=example,DC=org" -E pr=300 -H "ldap:// dc1.a.example.org/" "dc=a,dc=example,dc=org" "(objectClass=user)" userPrincipalName I get 300 results and a prompt to press enter, after pressing some enters I can get every entries. My backends are Active directories... :( Thanks for your help, Lajos Config: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/ad_attr.schema include /etc/ldap/schema/ad_class.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 8 modulepath /usr/lib/ldap moduleload back_meta moduleload back_ldap moduleload rwm moduleload pcache moduleload back_bdb sizelimit 1000 tool-threads 1 database meta suffix "dc=example,dc=org" norefs yes rebind-as-user yes chase-referrals no uri "ldap://dc1.example.org/dc=example,dc=org" "ldap:// dc2.example.org/" uri "ldap://dc1.a.example.org/dc=a,dc=example,dc=org" "ldap:// dc2.a.example.org/" uri "ldap://dc1.b.example.org/dc=b,dc=example,dc=org" "ldap:// dc2.b.example.org/" overlay rwm rwm-rewriteEngine on rwm-map attribute uid userPrincipalName rwm-map objectclass inetOrgPerson user

4 5

ppolicy pwdcheckmodule...
by JDaniel Jimenez 06 May '09

06 May '09

Hello everyone, I have installed openldap about two months ago, everything went ok and now I need passwords policies. Theese are working as spected but pwdCheckModule. In `man slapo-ppolicy` I have read this is an user-defined module... This is a problem for me... A long time ago I think I was able to do this without too much problems but now by now I must read "C++ Bible" to understand this... Is there any sample, or configurable module for this? Every body do this bi itself? thanks in advance ;) -- JDani

1 0

[Openldap2.4.11-Ubuntu8.10] Configuration Problem: ldap.conf missing, not possible to create slapd.d using slaptest
by Ket Zal Dev 06 May '09

06 May '09

Hi All I'm on Ubuntu 8.10, and using openldap 2.4.11. I successfully installed openldap on my server. I was a little bit surprised because i didn't found slapd.conf on /etc/ldap/ like in older releases, but I found a tuto explaining how to use slapd.d. On this howto, they sepcified it is possible to convert slapd.conf to slapd.d using slaptest. Because I don't have slapd.conf, I cannot convert anything. So, How can I do??? Secondly, on the tutorial, I used slaptest to create a ldif for a schema. I successfully added the ldif schema to openldap using ldapadd, and schema is working. It was mozillaorgperson, and I'm now able to create, read and modify users. My problem is that I need to use a new schema "rfc2703bis.schema" because my openldap server is for egroupware, and there is a problem with PosixGroup...... So I need to add it. This schema should replace nis schema. BUT, I cannot delete NIS schema, because used by open ldap. And cannot add rfc2703bis because I have errors "already exists" <--- it is logical because entries are on NIS which is active on openldap at this time. So I tried a lot of things, like using slaptest to create de ldif, copying it widely to slapd.d and removing by hand the NIS schema.... Not working, the result is that now, the openldap server cannot start.... Is there a clean way to do that??? Is it possible for me to create a slapd.conf, put inside all my configuration, do the slaptest, have a clean slapd.d and run openldap???? in a simple way. What to put inside...??? Thanks a lot for you help Best Regards

1 0

Syncrepl connections failing
by John Kane 05 May '09

05 May '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

2 3

Re: Berkeley DB V ersion
by Gustavo Mendes de Carvalho 05 May '09

05 May '09

Hi All, I was checking Oracle Berkeley site, and I found many versions available to download. I will compile Berkeley database on my own, and I would like to know which version is most recommended to use with OpenLDAP 2.4.x http://www.oracle.com/technology/software/products/berkeley-db/db/index.html 4.7.25 is the Latest Production Release. -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

1 0

Check for existence of a group
by Alex Chen 05 May '09

05 May '09

I am new to LDAP so please bear with me if my question sounds too basic. I want to make sure if a group already exist in the directory before a member is allowed to be added. I guess the API to use would be ldap_search_s (I want to sue synchronous search). What kind of filter syntax should I use? Alex

3 2

Berkeley DB V ersion
by Gustavo Mendes de Carvalho 05 May '09

05 May '09

Hi All, I was trying to compile openldap 2.4.x and I was surprised because this version _requires_ BDB version 4.4. I am installing it in a Red Hat AS 4 up7 machine and RedHat has only version BDB 4.3 available to download. Is there any doc on OpenLDAP site regarding upgrading BDB, from 4.2.x to 4.4.x ? Is there any problem running openldap 4.4.x using BDB 4.2 ? Tanhks in advance -- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical