openldap-technical

openldap-technical@openldap.org

13 participants
9794 discussions

warning in SLAPO_PPOLICY(5) regarding ppolicy_hash_cleartext
by Christopher Paul 23 Mar '21

23 Mar '21

Hello, I read the warning in SLAPO_PPOLICY(5) regarding ppolicy_hash_cleartext: "It is recommended that when this option is used that compare, search, and read access be denied to all directory users". Am I correct to presume that this means that the compare, search, read access be denied for directory users' _own_ (self) userPassword attrs, right? Because compare, search, read access to _other_ users' userPassword is rightfully denied typically by any sensible access control ruleset. (Right?) And if this document does mean to say that compare, search, and read access should be denied for directory users' _own_ (self) userPassword attrs, can someone please explain why, if users can read their userPassword, it would be worse for it to be encrypted than plain text? Many thanks, Chris Paul Rex Consulting, Inc email: chris.paul(a)rexconsulting.net web: http://www.rexconsulting.net <http://www.rexconsulting.net> phone, toll-free: +1 (888) 403-8996 ext 1

3 3

-DSLAPD_MAX_FILTER_DEPTH=xxx
by Michael Ströder 22 Mar '21

22 Mar '21

HI! Looking at comments in ITS#9251 I wonder if and how one should set -DSLAPD_MAX_FILTER_DEPTH= when building OpenLDAP downstream packages. To me the default of 5000 looks way too high. It would be really helpful to have a metric of maximum filter depth sent in by clients in cn=monitor. Ciao, Michael.

2 1

OpenLDAP as AD Proxy: OpenLDAP returning seemingly random number of results?
by Doyon, Jean-François 22 Mar '21

22 Mar '21

Hello, I have been working on implementing OpenLDAP as an AD proxy. I now have a setup that I am happy with over all, except for one strange behaviour: When browsing AD via the proxy, I do not get all the results in a given OU. Notes: * The OUs never contain more than 200-250 entries, well below both AD and OpenLDAP's default limits? * Different LDAP clients end up displaying different amounts of results, though the amount seems to be consistent within a given client. So for OU X ldp.exe shows Y results always, but Apache Directory Studio shows Z results, always. * When doing a search, if I ask to return only specific attributes, the number of results returned shrinks. So when I search on objectClass=* on a given OU I get X results, if I request one attribute only, the list returned shrinks a little bit, if I add another attribute, the list shrinks again! * If I use those exact same clients to connect to AD directly, with all other things being equal, there is no such issue, and all expected results are shown. I never configure any special client limits, paging, etc. on either connection (AD or OpenLDAP). * I am using a binary build of 2.4.49 for Windows. * Authentication is done via local database with a different DN, there is no rebind-as-user. * There are ACLs on the proxy to restrict access to certain OUs. It seems as if I am hitting some sort of limit, as suggest but the fact that when I make a more complex search, the number of results shrinks ... but this does not appear to be a number of results or time limit, and either way I am well under 1000 results and under 60 seconds (The default limits I think?). So ... what's going on? Anyone have any idea? I'm stumped ... Thanks! Jean-François Doyon Gestionnaire, Opérations et sécurité des T.I. Commissariat aux langues officielles jean-francois.doyon(a)clo-ocol.gc.ca<mailto:jean-francois.doyon@clo-ocol.gc.ca> / Tél. : 613-218-0547 Manager, I.T. Operations and security Office of the Commissioner of Official Languages jean-francois.doyon(a)ocol-clo.gc.ca<mailto:jean-francois.doyon@ocol-clo.gc.ca> / Tel: 613-218-0547

1 0

data.mdb grows faster with more frequent commits
by Alec Matusis 22 Mar '21

22 Mar '21

We have an environment with no flags that contains a database with no flags. The database is append only, no deletions or modifications. It is written using a single RW transaction, in the absence of any RO transactions. We observe that when we commit and recreate the RW transaction every 2000 insertion ops, the data.mdb file size on disk is 2x larger than when committing every 64000 insertion ops. The mdb_copy -c utility shrinks the large 2k ops commit file to almost the same file size as the 64k commit one. mdb_stat -e on the data.mdb shows that when we have more commits and bigger file, we have more pages used by the same proportion. In production we will have several large DBs (>1TB) on an NVMe card and we do not have the 2x space for periodic mdb_copy -c compactifications (and we cannot stop the writing process). We also need to commit every 2000 write ops, because there will be short-lived RO transactions that need to see the DB updates every 2000 writes. 1. Why is the file size on disk dependent on the commit frequency? (I suppose because with less frequent commits it can allocate data between pages more efficiently)? 2. What can we do to reduce data.mdb, if we must commit frequently? Can we use any environment, transaction or db flags, or anything else? We are on Linux 5.4.0 / ext4 fs. The DB that grows 2x faster with more frequent commits has bytearr key -> u32 val structure (the byterarray key is between 31 and 36 bytes). Another DB that has a reverse u32 key -> bytearr structure oonly grows 10% larger in the more frequent commits regime.

2 3

OpenLDAP client api documentation
by frpinci＠cisco.com 17 Mar '21

17 Mar '21

Hi, Is there any documentation explaining how to write an LDAP client using the OpenLDAP library? If not, what is the best approach to find out what functions to use and what options should be set for a certain auth method? I am writing a client but I am having issues with ldaps. Without documentation it is hard for me to tell if I am missing something or doing something wrong. Thanks, Francesco

2 1

SLE/openSUSE packages OpenLDAP 2.4.58
by Michael Ströder 16 Mar '21

16 Mar '21

On 3/16/21 7:53 PM, project(a)openldap.org wrote: > OpenLDAP 2.4.58 is now available for download as detailed on our download page: > > https://www.openldap.org/software/download/ As usual you can find SLE and openSUSE packages here: https://build.opensuse.org/package/show/network:ldap/openldap2 Ciao, Michael.

1 0

Symas OpenLDAP for Linux 2.4.58 Released
by Quanah Gibson-Mount 16 Mar '21

16 Mar '21

The latest version of Symas OpenLDAP for Linux is now available for RHEL7, RHEL8, Ubuntu18 LTS, and Ubuntu 20 LTS. <https://repo.symas.com/sofl/> for installation instructions. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Ballem, Narayanan 16 Mar '21

16 Mar '21

Hi Team, Seeking help or guidance on this issue. we are using OpenLDAP 2.4.54 version on RHEL7.8 systems and these OpenLDAP servers are using backend Microsoft AD URI to load the User POSIX info. Clients are using SSSD software. On the client's side, we are seeing odd behavior of Group name. it's failing to fetch Group name while logging in to the LDAP clients. uid=1946***(balna**) gid=1478 groups=1478 we have to similar setup on two sites, One site is working fine and the second site is not working sure where is the exact problem both the sites' OpenLDAP configuration is intact and SSL certs are offloaded properly. the only difference I see no of clients connections the working one having fewer client around 25-30 in that site whereas non-working site OpenLDAP servers takes around 3K clients connections, I am not sure if any there is additional tuning required based on no of clients. i also checked limits 4K values set for nproc/nofile and i did not see any issue with limits. we have a similar working two sites setup of 2.4.36 on RHEL6 servers for the same no of clients and we are trying to migrate to RHEL7 with 2.4.54 version where we are seeing the issue. Can you please check and help us to see if similar kind of issue reported by any clients or any tuning in required ? Thanks Narayanan Linux Platform Engineering 500 Staples Drive, Framingham MA Office: 508-253-6909 | Mobile: 508-333-4395 [signature_1767107679]

2 1

Alternative user password attribute
by Benjamin Renard 16 Mar '21

16 Mar '21

Hello, In one of my OpenLDAP installation, I'm start using Ppolicy overlay and it's doesn't allow me to store multiple passwords in userPassword attribute as possible in regular situation. I'm looking for a solution that allowing me to keep using Ppolicy and have possibility to store an alternative user password (usually used by admins). There is a solution to define an alternative attribute password ? Regards, -- Benjamin Renard - Easter-eggsusal 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - Fax: +33 (0) 1 43 35 00 76 mailto:brenard@easter-eggs.com - http://www.easter-eggs.com

3 8

Segmentation fault from mdb_stat -a after successful mdb_copy -c
by Alec Matusis 15 Mar '21

15 Mar '21

I have an environment with one database: alecm@db0 /fusionio1/lmdb> mdb_stat -fear dbgraph-to-compress/vx_to_edg Environment Info Map address: (nil) Map size: 1200000000000 Page size: 4096 Max pages: 292968750 Number of pages used: 24631912 Last transaction ID: 69821 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) Freelist Status Tree depth: 2 Branch pages: 1 Leaf pages: 13 Overflow pages: 26338 Entries: 1801 Free pages: 13028375 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 1 Status of vx_to_edg Tree depth: 4 Branch pages: 45690 Leaf pages: 7845337 Overflow pages: 0 Entries: 3993304504 I compressed it (i.e. got rid of Free Pages) with mdb_copy -c dbgraph-to-compress/vx_to_edg/ dbgraph-compressed/vx_to_edg This command exited normaly with return status 0. After executing mdb_stat -a on the compressed database I got SIGSEGV alecm@db0 /fusionio1/lmdb> gdb --args mdb_stat -fear dbgraph-compressed/vx_to_edg GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from mdb_stat...done. (gdb) r Starting program: /usr/local/bin/mdb_stat -fear dbgraph-compressed/vx_to_edg [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Environment Info Map address: (nil) Map size: 1200000000000 Page size: 4096 Max pages: 292968750 Number of pages used: 11577185 Last transaction ID: 1 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) Freelist Status Tree depth: 0 Branch pages: 0 Leaf pages: 0 Overflow pages: 0 Entries: 0 Free pages: 0 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 1 Program received signal SIGSEGV, Segmentation fault. mdb_xcursor_init1 (node=node@entry=0x7ee891ecdfc4, mc=0x6154a0, mc=0x6154a0) at mdb.c:8556 8556 mx->mx_cursor.mc_flags &= C_SUB|C_ORIG_RDONLY|C_WRITEMAP; (gdb) bt #0 mdb_xcursor_init1 (node=node@entry=0x7ee891ecdfc4, mc=0x6154a0, mc=0x6154a0) at mdb.c:8556 #1 0x0000000000405f10 in mdb_cursor_first (mc=0x6154a0, key=0x7fffffffe400, data=0x0) at mdb.c:7279 #2 0x00000000004060fc in mdb_cursor_next (mc=<optimized out>, key=<optimized out>, data=<optimized out>, op=<optimized out>) at mdb.c:6886 #3 0x0000000000404e35 in mdb_cursor_get (mc=0x6154a0, key=key@entry=0x7fffffffe400, data=data@entry=0x0, op=op@entry=MDB_NEXT_NODUP) at mdb.c:7466 #4 0x000000000040222f in main (argc=<optimized out>, argv=<optimized out>) at mdb_stat.c:230 (gdb) #mdb_copy -V LMDB 0.9.70: (December 19, 2015) Linux db0 3.13.0-95-generic XFS filesystem

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical