openldap-technical

openldap-technical@openldap.org

13 participants
9794 discussions

Multi-master vs. MirrorMode
by Sergio Cioban Filho 05 Mar '09

05 Mar '09

Hi all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------ Vendo GOL G3 PLUS 1.0 8V 4P 2002 - Branco - COMPLETÍSSIMO - Só R$ 18.500,00 http://cioban.googlepages.com/vendogolg38v

1 0

Openldap, kerberos backend, and SASL
by Da Rock 05 Mar '09

05 Mar '09

Sorry to barge in straight away with a question like this, but my time is running out and I have not been able to get a straight answer out of google. I'm going through the hypotheticals for using ldap as the backend for kerberos, and I've hit a chicken and egg problem with SASL- can someone untangle my mind? IF kerberos is using ldap as a backend store for keys, users, etc, and one can set the rootdn and leave the rootpw for later entry in the database itself, and the password can use SASL auth- what happens if you use kerberos as the auth mechanism? According to the book, slapd needs to set up the access to the key from startup, and kerberos in this scenario will need ldap up to provide the key. Is ldap up enough that kerberos can provide this? Or does ldap retry or something so that this problem is overcome? Thoughts? Cheers

4 15

syntax error in my ldif file
by Ken Perl 05 Mar '09

05 Mar '09

I got the error like below and can not fix it, could anyone help me? ldap_add: Invalid syntax (21) additional info: ObjectClass: value #0 invalid per syntax $cat lv1.ldif dn: mail=lv1(a)colinux.my, dc=colinux, dc=my ObjectClass: CourierMailAccount cn: ldap_vitural1 mail: lv1(a)colinux.my mail: lv1 userPassword: {MD5}$1$RnorJ$uVjJOT1I//zCCoFAYvP8t0 homeDirectory: lv1 uidNumber: 1000 gidNumber: 100 -- perl -e 'print unpack(u,"62V5N\"FME;G\!E<FQ`9VUA:6PN8V]M\"\@`` ")'

2 2

2.3 -> 2.4 upgrading advice
by Rex Roof 04 Mar '09

04 Mar '09

I'm currently running a fairly simple LDAP environment of two OpenLDAP 2.3 servers with a Master & Slave relationship using syncrepl. These servers are currently being used for authentication and for sendmail routing. I'm hoping to upgrade these two OpenLDAP 2.4 and create some sort of multi-master environment so that I can accept writes when one or more of the servers is down. I'd also like to add 2 more servers to the pool. I have two questions: 1) does anyone have any advice for things to watch out for when updating from 2.3 to 2.4? 2) what should I use for replication? Can I use some combination of MirrorMode and Multi-Master replication? This statement worries me: "Breaks the data consistency guarantees of the directory model" what does it mean? I found that here: http://www.openldap.org/doc/admin24/replication.html is that only a concern when the servers get out of sync as far as time goes? Any advice would be appreciated.

1 0

Security issues when authenticating from multiple sites
by Einar S. Ids� 04 Mar '09

04 Mar '09

Hello, We have a number of different community sites that will use a single central OpenLDAP-server for authentication. We want each site to provide its users with a logon-box for that site, just as any forum or portal you can find out there. Each site has its own admins with full access to everything related to their specific site. This makes it possible for them to edit their own logon mechanism to capture passwords for users that log on to their site. Thus an admin on one site can capture the password of an admin on another site, which is an obvious security issue. We can of course redirect logons to a common secure webpage, or monitor files in the respective sites' webroot to detect modifications to logon procedures, but we'd really prefer a cleaner solution if at all possible. Do any mechanisms exist to avoid this problem? Cheers, Einar S. Idsø Norsk eSport DA

2 1

can't change password with ldappaswd on Solaris 10 SPARC
by Marius Paulauskas 04 Mar '09

04 Mar '09

Hello, Is anyone successfully running openldap 2.4.15 on Solaris 10 SPARC? I cannot make it change passwords using ldappasswd if hash is set to smd5, ssha or crypt. Using latest Sun Studio 12. Same problem reveals if compiling with gcc 3.4.3 or 3.4.6. Somebody suggested it is due to flawed old gcc compiler version. I installed Sun Studio 12 but problem just wouldn't go away. Compiles without any problem both 32 or 64 bit memory models. I just can't believe that Sun Studio is flawed too. I must be missing some kind of setting or option or flag but seem to run out of ideas. any input greatly appreciated. /Marius

1 0

Can not modify cn=conf - openldap 2.4.15
by Mathew Rowley 04 Mar '09

04 Mar '09

I am trying to configure an n-way multi master following the tutorial in the admin guide (18.3.3 in http://www.openldap.org/doc/admin24/replication.html). When trying to add/modify anything in the cn=config, I get the following error: atlantis:~/comcast/authentication/ldif $ ldapadd -v -x -W -h 10.252.152.78 -D 'cn=Manager,dc=comcast,dc=com' ldap_initialize( ldap://10.252.152.78 ) Enter LDAP Password: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 add objectClass: olcGlobal add cn: config add olcServerID: 1 adding new entry "cn=config" modify complete ldap_add: Insufficient access (50) After looking through the test050 script, I see that this is done using the slapd Ta instead of a slapadd. I tried doing this, and get this error: [root@kdc01 scripts]# slapd -Ta bdb_db_open: warning - no DB_CONFIG file found in directory /usr/var/openldap-data: (2). Expect poor performance for suffix "dc=comcast,dc=com". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" I am using 2.4.15 built from source, with the only config option of changing the prefix directory. Any ideas on whats going on? Thanks. -- MAT

2 9

slapadd thank you!
by William Jojo 03 Mar '09

03 Mar '09

Thanks to all for the meter recently added to slapadd! Yeah, I know it's a small detail, but it really is the little things that matter sometimes. :-) Cheers, Bill

2 1

error in modifying subordinate entries
by Rakesh Yadav 03 Mar '09

03 Mar '09

Hi, I want to establish communication between two ldap servers at different machines. For this i have used "ref attribute of ldap" by using this attribute, i am able to retrieve entries of second ldap server. Means i can read or search entries of second server from first ldap server. But the problem comes when i want to modify any attribute of an entry of second server from the first server. Definitely i am having some access permissions related error. Here i am attaching slapd.conf files of both ldap servers. *First Server* *slapd.conf:* # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample access control policy: # Root DSE: allow anyone to write it # Subschema (sub)entry DSE: allow anyone to write it #Other DSEs: allow update_anon # Allow * write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: access to * by * write ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" rootpw secret index objectClass eq *access to * by * write* -------------------------------------------------------------------------------------------------------------------------------- *Second server's slapd.conf:* # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/gfsUserManage.schema include /usr/local/etc/openldap/schema/gfsFileMetaData.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=cdac,dc=in" rootdn "cn=Manager,dc=cdac,dc=in" rootpw secret directory /usr/local/var/gfsMetaData index objectClass eq *access to * by * write* ----------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------- *FIRST LADP SERVER DN*: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in where *test_ref* is having *ref* attribute dn: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in objectClass: referral objectClass: extensibleObject fn: test_ref ref: ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in *NOW SECOND LDAP SERVER is having DN*: dn: fn=test1,fn=test_ref,dc=cdac,dc=in Now i want to delete "*fn=test1,fn=test_ref,dc=cdac,dc=in*" this entry. I have used ldap command line tool "*ldapdelete*" and executed this tool on *first LDAP machine*. Then the result of command is: **[root@tapti LDIF]# ldapdelete -x -h "tapti" -D "cn=Manager,dc=cdac,dc=in" \"fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" -w "secret" ldap_delete: Referral (10) matched DN: fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in referrals: ldap:// 192.168.5.243/fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in *And slapd debug statements:* do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Manager,dc=cdac,dc=in> <<< dnPrettyNormal: <cn=Manager,dc=cdac,dc=in>, <cn=manager,dc=cdac,dc=in> do_bind: version=3 dn="cn=Manager,dc=cdac,dc=in" method=128 do_bind: v3 bind: "cn=Manager,dc=cdac,dc=in" to "cn=Manager,dc=cdac,dc=in" send_ldap_result: conn=2 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 69 contents: ber_get_next do_delete ber_scanf fmt (m) ber: >>> dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> <<< dnPrettyNormal: <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in>, <fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in> bdb_dn2entry("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") => bdb_dn2id("fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) bdb_referrals: op=74 target="fn=test1,fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" matched="fn=test_ref,fn=bioinfo,fn=gstorage,fn=gfs,dc=cdac,dc=in" ldap_url_parse_ext(ldap://192.168.5.243/fn=test_ref,dc=cdac,dc=in) send_ldap_result: conn=2 op=1 p=3 send_ldap_response: msgid=2 tag=107 err=10 ber_flush: 160 bytes to sd 11 connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next do_unbind connection_closing: readying conn=2 sd=11 for close connection_resched: attempting closing conn=2 sd=11 connection_close: conn=2 sd=11 * ----------------------------------------------------------------------------------------------------------------------------------------- * Please do me a favour suggest any solution as soon as possible through which i can update slave ldap server entries from master ldap server. -- Rakesh Yadav Pune.

2 4

limits in openldap 2.3
by Oliver Henriot 03 Mar '09

03 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear list members, Is there a mechanism to control acces limits in openldap 2.3 similar to what can be achieved with the openldap 2.4 limits directive (http://www.openldap.org/doc/admin24/limits.html)? Appart from sizelimit and timelimit, which are not dn specific and therefore do not allow the same fine tuning as the limits directive, I haven't found anything. Maybe I missed it? Thanks, - -- Oliver Henriot B.Sc. Ph.D. | Technicien de Maintenance Moyens Informatiques et Multimédia | UMS MI2S | http://mi2s.imag.fr/ Domaine universitaire BP53 | 38041 Grenoble cedex 9 | France tel.: +33 4 76 51 43 48 | fax: +33 4 76 51 47 15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmr+a4ACgkQSWuBJnHIHdJYLQCgr2G31lT6KUAF8VsJDj56Jqdy OMQAnRZzU69ff3o94cGfJSgV0PlpGW0F =TEBl -----END PGP SIGNATURE-----

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical