openldap-technical

openldap-technical@openldap.org

9 participants
9866 discussions

Syncrepl cn=config from another context ...
by Mads Freek Petersen 06 Mar '09

06 Mar '09

Is it possible to have a server with multiple cn=config templates (for other servers) in a non cn=config context and then "translate" them into cn=config on the consumer side using a bootstrap config and olcsyncrepl? Regards Mads Freek ------------------------------------------------------ Mads Freek Petersen Special Consultant IT-Campus Roskilde University Building 42-1, P.O. Box 260, DK-4000 Roskilde, Denmark Phone: +45 4674 3882 Fax: +45 4674 3072 E-mail: freek(a)ruc.dk

2 2

Nway multimaster sync cn=config doesn¹t make cn=config look the same...
by Mathew Rowley 06 Mar '09

06 Mar '09

I have spent the past couple of days setting up nway multimaster in my lab. I was thinking it was not working because the first step (in the admin guide) was syncing up the cn=config. When doing that, I would look at both servers to see if the cn=config was the same they were, and are not. First box has (under cn=config): Cn=schema OlcDatabase={-1}front OlcDatabase{0}config OlcDatabase={1}bdb OlcDatabase={2}bdb Second box has (under cn=config): Cn=schema OlcDatabase={-1}front OlcDatabase{0}config OlcDatabase={1}bdb My question is: is this normal, or did I do something wrong? The sync on my dc=comcast,dc=com is working fine. Here are the steps I went through to get this working. Set up slapd.conf sure to include the directory config¹ in order to have a rootd for cn=config On both servers remove old directory/config ( rm -rf /usr/var/openldap-data/* /usr/etc/openldap/slapd.d/* ) On both servers run slapd with f and F options to sync to new config mode ( /usr/sbin/slapd -h ldap://10.252.152.76 -u ldap -F /usr/etc/openldap/slapd.d/ -f /usr/etc/openldap/slapd.conf -d 1 ) On both servers run slapd with F option - made sure that it was run with ldap://<ip> (/usr/sbin/slapd -h ldap://10.252.152.76 -u ldap -F /usr/etc/openldap/slapd.d/) On both servers run ldapmodify to add initial syncrepl, and sync the two cn=config directories: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://10.252.152.76 olcServerID: 2 ldap://10.252.152.77 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://10.252.152.76 binddn="cn=root,cn=config" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://10.252.152.77 binddn="cn=root,cn=config" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE On first server run ldapadd to sync the dc=comcast,dc=com directory: dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcbdbConfig olcDatabase: {1}bdb olcSuffix: dc=comcast,dc=com olcDbDirectory: /usr/var/openldap-data/ olcRootDN: cn=Manager,dc=comcast,dc=com olcRootPW: {SSHA}kJTEcfOmPf7fKv71AtxDjlUZNPqN9pIT olcLimits: dn.exact="cn=Manager,dc=comcast,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncRepl: rid=004 provider=ldap://10.252.152.76 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://10.252.152.77 binddn="cn=Manager,dc=comcast,dc=com" bindmethod=simple credentials="<RAW PASSWORD>" searchbase="dc=comcast,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Now, at this point is where I look at the cn=config to see if they were the same... -- MAT DESK: 720.267.7767

2 1

Multi-master vs. MirrorMode
by Sergio Cioban Filho 05 Mar '09

05 Mar '09

Hi all, I've read about ldap replication and I changed my replication from slurp to syncrepl. I want configure an failover Ldap Server, but I've read that in the multi-master replication configuration, I'll have problems with data consistency, is is true? When I'll have data inconsistency? In MIrrorMode, can I have much of two servers? What is the limit number of servers (nodes)? What is the better configuration for failover (Without a hardware proxies/load-balancing or dedicated proxy software)? ** Sorry for my poor english... ;) Thanks Regards, --- Sérgio Cioban Filho | Tecnólogo em Gestão de TI | Linux Professional Institute Certified - Level 1 ------------------------------------------------------------ | Linux - Servidores - Firewall - VPN | Virtualização - VoIP - ShellScript - C - PHP | http://cioban.googlepages.com | +55 48 9989-8733 ------------------------------------------------------------ ..:: Seja livre, use LiNuX!! ::.. ------------------------------------------------------------ Vendo GOL G3 PLUS 1.0 8V 4P 2002 - Branco - COMPLETÍSSIMO - Só R$ 18.500,00 http://cioban.googlepages.com/vendogolg38v

1 0

Openldap, kerberos backend, and SASL
by Da Rock 05 Mar '09

05 Mar '09

Sorry to barge in straight away with a question like this, but my time is running out and I have not been able to get a straight answer out of google. I'm going through the hypotheticals for using ldap as the backend for kerberos, and I've hit a chicken and egg problem with SASL- can someone untangle my mind? IF kerberos is using ldap as a backend store for keys, users, etc, and one can set the rootdn and leave the rootpw for later entry in the database itself, and the password can use SASL auth- what happens if you use kerberos as the auth mechanism? According to the book, slapd needs to set up the access to the key from startup, and kerberos in this scenario will need ldap up to provide the key. Is ldap up enough that kerberos can provide this? Or does ldap retry or something so that this problem is overcome? Thoughts? Cheers

4 15

syntax error in my ldif file
by Ken Perl 05 Mar '09

05 Mar '09

I got the error like below and can not fix it, could anyone help me? ldap_add: Invalid syntax (21) additional info: ObjectClass: value #0 invalid per syntax $cat lv1.ldif dn: mail=lv1(a)colinux.my, dc=colinux, dc=my ObjectClass: CourierMailAccount cn: ldap_vitural1 mail: lv1(a)colinux.my mail: lv1 userPassword: {MD5}$1$RnorJ$uVjJOT1I//zCCoFAYvP8t0 homeDirectory: lv1 uidNumber: 1000 gidNumber: 100 -- perl -e 'print unpack(u,"62V5N\"FME;G\!E<FQ`9VUA:6PN8V]M\"\@`` ")'

2 2

2.3 -> 2.4 upgrading advice
by Rex Roof 04 Mar '09

04 Mar '09

I'm currently running a fairly simple LDAP environment of two OpenLDAP 2.3 servers with a Master & Slave relationship using syncrepl. These servers are currently being used for authentication and for sendmail routing. I'm hoping to upgrade these two OpenLDAP 2.4 and create some sort of multi-master environment so that I can accept writes when one or more of the servers is down. I'd also like to add 2 more servers to the pool. I have two questions: 1) does anyone have any advice for things to watch out for when updating from 2.3 to 2.4? 2) what should I use for replication? Can I use some combination of MirrorMode and Multi-Master replication? This statement worries me: "Breaks the data consistency guarantees of the directory model" what does it mean? I found that here: http://www.openldap.org/doc/admin24/replication.html is that only a concern when the servers get out of sync as far as time goes? Any advice would be appreciated.

1 0

Security issues when authenticating from multiple sites
by Einar S. Ids� 04 Mar '09

04 Mar '09

Hello, We have a number of different community sites that will use a single central OpenLDAP-server for authentication. We want each site to provide its users with a logon-box for that site, just as any forum or portal you can find out there. Each site has its own admins with full access to everything related to their specific site. This makes it possible for them to edit their own logon mechanism to capture passwords for users that log on to their site. Thus an admin on one site can capture the password of an admin on another site, which is an obvious security issue. We can of course redirect logons to a common secure webpage, or monitor files in the respective sites' webroot to detect modifications to logon procedures, but we'd really prefer a cleaner solution if at all possible. Do any mechanisms exist to avoid this problem? Cheers, Einar S. Idsø Norsk eSport DA

2 1

can't change password with ldappaswd on Solaris 10 SPARC
by Marius Paulauskas 04 Mar '09

04 Mar '09

Hello, Is anyone successfully running openldap 2.4.15 on Solaris 10 SPARC? I cannot make it change passwords using ldappasswd if hash is set to smd5, ssha or crypt. Using latest Sun Studio 12. Same problem reveals if compiling with gcc 3.4.3 or 3.4.6. Somebody suggested it is due to flawed old gcc compiler version. I installed Sun Studio 12 but problem just wouldn't go away. Compiles without any problem both 32 or 64 bit memory models. I just can't believe that Sun Studio is flawed too. I must be missing some kind of setting or option or flag but seem to run out of ideas. any input greatly appreciated. /Marius

1 0

Can not modify cn=conf - openldap 2.4.15
by Mathew Rowley 04 Mar '09

04 Mar '09

I am trying to configure an n-way multi master following the tutorial in the admin guide (18.3.3 in http://www.openldap.org/doc/admin24/replication.html). When trying to add/modify anything in the cn=config, I get the following error: atlantis:~/comcast/authentication/ldif $ ldapadd -v -x -W -h 10.252.152.78 -D 'cn=Manager,dc=comcast,dc=com' ldap_initialize( ldap://10.252.152.78 ) Enter LDAP Password: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 add objectClass: olcGlobal add cn: config add olcServerID: 1 adding new entry "cn=config" modify complete ldap_add: Insufficient access (50) After looking through the test050 script, I see that this is done using the slapd Ta instead of a slapadd. I tried doing this, and get this error: [root@kdc01 scripts]# slapd -Ta bdb_db_open: warning - no DB_CONFIG file found in directory /usr/var/openldap-data: (2). Expect poor performance for suffix "dc=comcast,dc=com". bdb_monitor_db_open: monitoring disabled; configure monitor database to enable dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" slapadd: line 1: database (dc=comcast,dc=com) not configured to hold "cn=config" I am using 2.4.15 built from source, with the only config option of changing the prefix directory. Any ideas on whats going on? Thanks. -- MAT

2 9

slapadd thank you!
by William Jojo 03 Mar '09

03 Mar '09

Thanks to all for the meter recently added to slapadd! Yeah, I know it's a small detail, but it really is the little things that matter sometimes. :-) Cheers, Bill

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical