openldap-technical

openldap-technical@openldap.org

9951 discussions

slapd_db_archive log rotation
by Andrew Hall 24 Apr '09

24 Apr '09

Hi there. I'm using slapd_db_archive with the -a flag to identify BDB logs which can be safely deleted. I've recently noticed my logs are building up and -a does not produce any output. However the -l flag does successfully list the log files. Therefore any use of the -d flag to remove them does nothing. I'm almost certain these old logs are not being used (there's about 20 going back for several months now) but still slapd_db_archive does not pick up on them. Can anyone advise what may be happening here or how I can debug this further ? Thanks very much.

2 1

openldap as slave server to windows AD
by Aleksander Kamenik 24 Apr '09

24 Apr '09

Hi, This is my first experience with ldap, there are lots of different approaches to configuring openldap and I'm a bit lost. I'm about to setup a windows domain server with AD for some 50 windows pc's. The windows pc's will use the windows server directly and that's settled. However I also have lots of different services running on linux servers which require the same user authentication and could be configured to use ldap based authentication instead of each having their own account database. It's a hassle to maintain accounts for each service separately. Also, if the windows server should be unavailable, I'd still like to be able to login and use the services running on linux servers. So I imagine having openldap act a slave server (like in DNS) the for the windows active directory service's "User" space. Is this possible and which configuration path should I take? The manual mentions proxy configurations as well as something called chaining. Please point me to the correct chapter and any other hints are appreciated. Regards, -- Aleksander Kamenik System Administrator Krediidiinfo AS an Experian Company Phone: +372 665 9649 Email: aleksander(a)krediidiinfo.ee http://www.krediidiinfo.ee/ http://www.experiangroup.com/

2 1

Missing CSN in do_syncrep2 cookie log line
by Sean Burford 24 Apr '09

24 Apr '09

Hi, I'm new to 2.4 (2.4.16) and I don't know if empty CSNs are expected. The provider restarted and the syncrepl consumer kept sync, however part way through the reconnection the consumer got an empty CSN and decided to do an additional reconnect. This may be a side effect of the provider running 2.3.39. The provider has a syncrepl accesslog and an auditlog that both agree with the CSNs below (no changes were skipped by the sync). The accesslog database has syncprov-nopresent and syncprov-reloadhint set to TRUE. The main database has these values set to FALSE (syncprov-reloadhint will be toggled to TRUE shortly on the main database). At 13:20:42 username1 has an attribute removed. The change is replicated at that time. This is the last entry replicated before the provider is shut down: do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xf966560 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0x155621b8 20090424132042Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username1,dc=example,dc=com (0) slap_queue_csn: queing 0xd2f6cf8 20090424132042Z#000000#00#000000 slap_graduate_commit_csn: removing 0xec0a758 20090424132042Z#000000#00#000000 At 13:25:18 slapd on the syncrepl provider is shut down and the consumer notices: do_syncrep2: rid=100 (-1) Can't contact LDAP server do_syncrepl: rid=100 rc -1 retrying At 13:26:12 slapd on the replication provider is restarted. The consumer connects 6 seconds later and receives the same attribute delete again (I assume it isn't an entry delete since there are no entry deletes in the hours bracketing this log): do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100* do_syncrep2: cookie=csn=,rid=100* do_syncrepl: rid=100 rc -1 retrying At 13:27:18 slapd on the replication consumer reconnects and receives the same attribute delete again before continuing normal replication a little later when another user is modified: do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=csn=20090424132042Z#000000#00#000000,rid=100 do_syncrep2: cookie=csn=20090424133119Z#000000#00#000000,rid=100 slap_queue_csn: queing 0xc9fdb67 20090424133119Z#000000#00#000000 slap_graduate_commit_csn: removing 0xf610488 20090424133119Z#000000#00#000000 syncrepl_message_to_op: rid=100 be_modify uid=username2,dc=example,dc=com (0) -- Thanks, Sean Burford

2 1

synrepl delete over 90% of ldap entries
by Monika Strack 24 Apr '09

24 Apr '09

Hallo all, in this week, the syncrepl in RefreshOnly mode has delete over 90% of the ldap entries at the consumer. It is the secont time in last month, it make this mistake. The other time it work ok. After I have remove the database and slapd restart, all entries are back. The consumer is my mailserver, so no user can receive mail in the time his entries are removed. I work with debian, at the consumer with lenny and slapd 2.4.11-1 and at the Provider with entch and slapd 2.3.30-5+etch2 . I use gosa 2.5.16 to adminstrate ldap. Here are the log entries of the consumer: Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064823Z#000003#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae7069c0 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72dc78 20090421064823Z#000003#00#000000 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete uid=nutzera,ou=people,ou=arbgrp,ou=abt,ou=my,o=domain,c=de (0) : : slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 33fdb48e-c28c-102d-9d8a-c5d1aca5fa09 Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=tz,o=fal,c=de Apr 21 08:48:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_add (0) Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:48:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421064845Z#000000#00#000000,rid=101 Apr 21 08:48:45 dcs slapd[7236]: slap_queue_csn: queing 0xae715640 20090421064845Z#000000#00#000000 Apr 21 08:48:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae702e40 20090421064845Z#000000#00#000000 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 inserted UUID 8b82805e-0867-102b-8021-e9137c6ded0b Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_search (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 cn=mygrp,ou=groups,ou=my,o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 be_modify (0) Apr 21 08:58:45 dcs slapd[7236]: syncrepl_entry: rid=101 Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: rid=101 LDAP_RES_SEARCH_RESULT Apr 21 08:58:45 dcs slapd[7236]: do_syncrep2: cookie=csn=20090421065817Z#000003#00#000000,rid=101 Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5d17de-0867-102b-9fad-e9137c6ded0b, dn c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5e5f86-0867-102b-9fb0-e9137c6ded0b, dn o=domain,c=de Apr 21 08:58:45 dcs slapd[7236]: nonpresent_callback: rid=101 not UUID 8a5ed024-0867-102b-9fb2-e9137c6ded0b, dn ou=my,o=domain,c=de : (90% of ldapr entries) pr 21 08:58:45 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xae72cf50 20090421065817Z#000003#00#000000 Apr 21 08:58:45 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete cn=b9d1d7db1b3bc592e9b7b57acc40041e,ou=gosa,ou=configs,ou=systems,ou=my,o=domain,c=de (0) : (90% of entries) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete ou=my,o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete o=domain,c=de (66) Apr 21 08:58:46 dcs slapd[7236]: syncrepl_del_nonpresent: rid=101 be_delete c=de (66) Apr 21 08:58:46 dcs slapd[7236]: slap_queue_csn: queing 0xae72c058 20090421065817Z#000003#00#000000 Apr 21 08:58:46 dcs slapd[7236]: slap_graduate_commit_csn: removing 0xb4d03ff0 20090421065817Z#000003#00#000000 I now, that the logs no show errors, but why can the consumer say no entry found and delete. My colleague has delete 3 user, this change was made right and the al the other entriies are delete. How can I prevent this in the future? The configurations: Provider: slapd 2.3.30-5+etch2 Config: .... moduleload back_bdb moduleload syncprov : : # Fuer syncreply index entryCSN,entryUUID eq : overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: slapd 2.4.11-1 (lenny) Config: ..... index entryCSN,entryUUID eq : : syncrepl rid=101 provider=ldaps://ldap.my.local:636 type=refreshOnly searchbase="c=de" retry="60 10 300 3 600 +" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,ou=my,o=domai,c=de" credentials=ReSumpti0n regards Monika -- ________________________________________________________________________________ Monika Strack Institut fuer Nutztiergenetik Friedrich-Loeffler-Institut 31535 Neustadt e-mail: monika.strack(a)fli.bund.de Germany Tel: +49 5034 /871 154 Fax: +49 5034 /871 239 _______________________________________________________________________________

2 1

invalid credential
by owen nirvana 24 Apr '09

24 Apr '09

debian lenny openldap-2.4.11 , "rootpw 123456 " in /etc/ldap/slapd.conf I try to search in Apache Directory Studio, perl , java, but in term , I input "ldapsearch -D "cn=admin.dc=xxx,dc=org" -b "dc=xxx,dc=org" "(objectClass=*)" -W echo: >> Digest/SASL MD5 start invalid credential I am not user md5 password, and it's not right even if I use md5 password. I don't know how to configure slapd.conf to solve the problem gtalk:freeespeech@gmail.com

3 2

how to paginate the dataset from ldap
by owen nirvana 24 Apr '09

24 Apr '09

I'm a newbie, sometime a query might get hundreds of data from the LDAP server, I could not find a way to display these data by paginating, thanks for help gtalk:freeespeech@gmail.com

3 2

ldapadd: Invalid syntax (21)
by François Mehault 24 Apr '09

24 Apr '09

Hi All I am a novice with openldap. I just install on a freeBSD 7.0 with ports. I configure slapd.conf as best as i can. I configure rc.conf, I test my slapd daemon with slapdtest and it's ok. I start slapd with /usr/local/etc/rc.d/slapd start. Well, I create a little .ldif file to test. And I add at my database with : ldapadd -x -D "cn=root,dc=toto,dc=fr" -W -f test.ldif And I have : Enter LDAP Password: adding new entry "dc=toto,dc=fr" ldapadd: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax The content of my test.ldif : dn: dc=toto,dc=fr objectClass: dcObject objectClass: organizationUnitName ou: test dc: toto My slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #Radius include /usr/local/etc/openldap/schema/RADIUS-LDAPv3.schema schemascheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args #loglevel 4 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb #Basic ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=root,dc=toto,dc=fr" write by * none access to * by dn="cn=root,dc=toto,dc=fr" write by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=toto,dc=fr" rootdn "cn=root,dc=toto,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}ERk1pX08CCoUT2Hixj/kR9Zx8NpJmx+0 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data # Indices to maintain index objectClass eq Why I can't add my ldif ? If someone can help me, thanks If I put organisation instead of organisationalUnit in my ldif, it works ! (and o instead ou of course) Regards François

3 3

Re: Setting up LDAP server
by Santosh Balan 23 Apr '09

23 Apr '09

Hi, My Server is a RHEL 5.0 i386 Architecture and the Clients are RHEL5.0 WS or RHEL4 WS or Thin Client which has minimal installation of Linux. I need information how those schemas will look and what data will it have. Thanks and Regards Santosh Balan +91-9819419509 ----- Original Message ----- From: "Andrew Findlay" To: "Santosh Balan" Cc: openldap-technical(a)openldap.org Subject: Re: Setting up LDAP server Date: Thu, 23 Apr 2009 11:15:04 +0100 On Thu, Apr 23, 2009 at 02:41:58AM -0500, Santosh Balan wrote: > I am on the look out for free support and advise. I have implemented a > basic LDAP server such that it authenticates for my mail server. However > this time I have been given a project wherein my LDAP works as an > authentication server for user login as well as mails. Also it should > have policies while authentication viz. it should disable USB ports for > the user, it should set a background wallpaper and screensaver which > should start within 20 secs. of the PC's idle time. It should also if > possible mount automatically a partition which will be user dependent > rather that PC dependent. You do not say what operating system you are using. I think you need to start by looking at the mechanisms available on the target OS to implement these policies. This is much more of an OS issue than an LDAP one. For example, with most Linux distros you can use PAM and NSS modules to link authentication and authorisation to LDAP. Solaris has similar mechanisms, and the *BSD systems too (but they are not identical). I suspect that you will do better to ask about this in OS-specific groups or mailing lists. Controlling the wallpaper and screensaver will require configuration of the window system: Gnome, KDE and MSWindows all have ways to do this but they are different. It may be possible to link them to LDAP-hosted policies, but again you need to look at the mechanisms first. You cannot just setup some data in an LDAP server and expect it to magically control user desktops. Once you have identified some control mechanisms you will be able to look at the way they interact with LDAP. This may require new schema, which this group certainly is qualified to discuss. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | ----------------------------------------------------------------------- -- It's News. It's Reviews. It's Interviews. It's Free. What Are You Waiting For? www.movieline.com

2 1

Syncrepl connections failing
by John Kane 23 Apr '09

23 Apr '09

I am having a problem with what appears (to me) to be 'stale' TCP connections for syncrepl between the master and a pair of slaves. After restarting all, I see changes on the master replicated to both slaves. BUT, if I wait about 30 minutes or more, then make a change, the replication fails (most of the time). netstat on the LDAP port show the connections still established, but queued packets at the master server. After about 15 minutes, the master server drops the connection. An overnight tcpdump on the master showed LDAP occasionally sending a keep-alive, with 2hrs between the keep-alive messages (these keep-alives are inconsistent, though, some nights I see none). I am running Red Hat EL5 and Openldap 2.3.43 on all servers with no TLS or SASL (in our integration/test facility). I don't see anything in the documentation pertaining to keep-alives, other than ITS#4708 for 2.3.38. Here's the syncrepl for one slave: syncrepl rid=004 type=refreshAndPersist provider=ldap://172.24.1.191 retry="30 10 300 3" searchbase="o=partner_x,dc=ourcompany-int,dc=net" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=syncRepl,o=partner_x,dc=ourcompany-int,dc=net " credentials="secret" updateref ldap://172.24.1.191 The other slave's slapd.conf is indentical except rid=002. On the master I have: overlay syncprov syncprov-checkpoint 100 30 syncprov-sessionlog 100 Note: The 2 slaves are running on blades in an IBM chassis, and the master is on a 1U Linux server, just 'one-hop' away. Prior to this, when I had a master/slave pair running on the blades, syncRepl was working fine for several months. It was not until I moved the master to the another server did the failures start. Thanks in advance for any help or info. John Kane This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

1 0

editing objects with back-sql
by Marcel Berteler 23 Apr '09

23 Apr '09

While trying to understand the whole process that makes back-sql work, the following quote was really useful: Pierangelo Masarati wrote on Fri, 4 Jun 2004 16:03:39 +0200 > I'm talking about 2.2.X (2.2.11 at present). > > - slapd uses the structuralObjectClass of the entry to look up the > objectClass mapping according to ldap_oc_mappings; > - it does some sanity checks (I'll discuss these later) > - it checks for the existence of the entry's parent > - it uses the ldap_oc_mappings create_proc to create the objectClass > entry in ldap_entries > - then, for each attribute, the corresponding values are inserted if > possible. I'll discuss later how to decide whether an add should succeed > or not if some (required?) attribute mapping is not available; now I > really have to go :) Q1: Is this process still correct and is there more documentation around this process? Q2: What is the process for editing or remove data? When I add an OU, the ldap_entry_objclasses shows the oc_name of the OU object to be 'top', while the ldap_entries table shows the oc_map_id to be that of organizationalUnit. When I now try to edit the name of this object, I get the following error, which I get as well on trying to edit any other object: Could not rename the entry / Could not perform ldap_modify operation. LDAP said: Object class violation Error number: 0x41 (LDAP_OBJECT_CLASS_VIOLATION) Description: You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass. Any clue what that could be? Marcel

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical