openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

N-way replication config file help
by Mike Simonton 09 Feb '09

09 Feb '09

Hello everyone, I'm trying to convert my two node replicated OpenLDAP pair to a three-way pair and am having trouble with configuring the slapd.conf files. Can anyone tell me what I need to add here? Below is my newly modified slapd.conf file with the system03 addition: ----- slapd.conf on system01 replicating to system02 and system03 ----- include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/promptu.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args serverID 001 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=mydomain,dc=local" rootdn "cn=Manager,dc=mydomain,dc=local" rootpw secret directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=0 provider=ldap://sys02 type=refreshAndPersist interval=00:00:00:30 retry="5 5 300 +" searchbase="dc=mydomain,dc=local" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=local" credentials="secret" updateref ldap://sys02 syncrepl rid=0 provider=ldap://sys03 type=refreshAndPersist interval=00:00:00:30 retry="5 5 300 +" searchbase="dc=mydomain,dc=local" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=local" credentials="secret" updateref ldap://sys03 mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 Thank you for your help! Mike

2 3

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/9 Quanah Gibson-Mount <quanah(a)zimbra.com>: > I'm not sure why you feel it is necessary to set the server read-only before > you run slapcat anyway. It was purely in relation to point 18.1.2 in this doc... http://www.openldap.org/doc/admin24/maintenance.html To quote... "Slapcat can be run while slapd is active. However, one runs the risk of an inconsistent database- not from the point of slapd, but from the point of the applications using LDAP. For example, if a provisioning application performed tasks that consisted of several LDAP operations, and the slapcat took place concurrently with those operations, then there might be inconsistencies in the LDAP database from the point of view of that provisioning application and applications that depended on it. One must, therefore, be convinced something like that won't happen. One way to do that would be to put the database in read-only mode while performing the slapcat."

2 1

Re: How to set BDB "read-only" before slapcat command ?
by William Jojo 09 Feb '09

09 Feb '09

---- Original message ---- >Date: Mon, 09 Feb 2009 08:08:32 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: How to set BDB "read-only" before slapcat command ? >To: Andrew Hall <whippyhubbles(a)googlemail.com>,Michael Ströder <michael(a)stroeder.com> >Cc: openldap-technical(a)openldap.org > >--On Monday, February 09, 2009 3:44 PM +0000 Andrew Hall ><whippyhubbles(a)googlemail.com> wrote: > > >> The possible problem I see with that setup is what happens if the >> slapcat occurs during an update from the provider to the consumer ? > > >I'm not sure why you feel it is necessary to set the server read-only >before you run slapcat anyway. Do you actually have a process that knows >exactly what changes occurred in any given second, so that, if say, your >backup starts at 1:00:00, you can then replay all the changes from that >point in time? > >If you do, then it doesn't matter whether or not it was in read-only. >Simply replay the changes. If you don't, then it doesn't matter whether or >not it was in read-only, because you don't know what changes happened after >that point. > >I honestly am not aware of anyone who bothers to put their DB into >read-only before slapcatting, although they may be out there. > Admittedly we stop one slapd in our group of servers (usually a master) to take a point in time snapshot with slapcat, then simply restart it. It is used solely as part of our disaster recovery. In the event of BDB corruption that is unrecoverable, we can build a new server from the full-text export. Just basic DBA paranoia policy. :-) :-) Cheers, Bill

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/9 Michael Ströder <michael(a)stroeder.com>: > No matter what you do at the LDAP server's side it could happen in > between a series of related write operations leading to inconsistent > state of data (from the application's point of view). > > If you want better hints then you have to provide more details about > your deployment. > > Ciao, Michael. We have a primary "hidden" master and two replicating secondaries which both get queried in a round-robin DNS fashion. Applications such as phpLDAPadmin are configured to connect to these secondaries which pass writes to the primary via an updateref chain overlay. At the moment I am using slapcat on the primary for backups but am open to other suggestions. Perhaps I should just create a third read-only replicating secondary which no applications connect to and backup from that ? The possible problem I see with that setup is what happens if the slapcat occurs during an update from the provider to the consumer ?

2 1

LDAP - Password and userId length
by yukti kaura 09 Feb '09

09 Feb '09

Hi, I required to perform length validation on the credential used to log in to LDAP. Could you please help me with the *length *of userId & password used to log in to LDAP Thanks for all your help Yukti

2 1

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

Dieter KlÃnter writes... > man slapd.conf(5), readonly on Thanks for the info. So I would need to edit the .conf file and restart the service for this to take effect ? Is there no "on the fly" solution similar to "FLUSH TABLES WITH READ LOCK;" for example ? Thanks.

2 2

Re: How to set BDB "read-only" before slapcat command ?
by Andrew Hall 09 Feb '09

09 Feb '09

2009/2/8 Michael Ströder <michael(a)stroeder.com>: > Note that this is only needed if you have to ensure the integrity of > inter-related LDAP entries. So this depends on your deployment, > especially the writing LDAP client applications. > > But thinking more thoroughly about this it could be also a problem if a > client application trys to modify several entries and you're switching > to read-only mode in between as preparation for a backup. Even if the > application would theoretically be capable of rolling back all the > changes it wouldn't help since the LDAP server is read-only then. > > So the solution would be rather to really make sure that no > admin/provisioning application is running anymore. > > I think the admin guide could clarify this. I can't really close client applications unless I gracefully terminate all connections on the LDAP server perhaps ? I guess that could be one option.

1 0

How to set BDB "read-only" before slapcat command ?
by Andrew Hall 08 Feb '09

08 Feb '09

Hi there. According to this doc... http://www.openldap.org/doc/admin24/maintenance.html#Directory Backups Prior to slapcat being used for a backup the DB should be set to read-only. How exactly is this done ? I am using a BDB backend and all I can find is in this doc... http://www.oracle.com/technology/documentation/berkeley-db/db/ref/transapp/… Which also doesn't describe how. Is there an OpenLDAP or BDB command / tool which I can use to do this ? Thanks very much.

2 1

ldap_search_s hangs with ms active directory
by Sankhadip Sengupta 07 Feb '09

07 Feb '09

Hi, I have written a C ldap client to interact with a MS Active Directory in Win Server 2003. When I search for the base DNs from scope LDAP_SCOPE_BASE I get all the results perfectly.But when I try to search for an existing user anonymously( I set all the permissions in the ACLS ) it hangs indefinitely. Now, surprisingly when I search with the ldapsearch tool it works fine. I use this : attrs[0]=LDAP_ALL_USER_ATTRIBUTES; attrs[1]=NULL; attrsonly=0; ldap_search_s(ld,"dc=test,dc=com",LDAP_SCOPE_SUBTREE,"uid=test",NULL,0,&msg) After a long period when it returns, I get return code 0 (Success) but there is no entry in that. Can anyone help me? This works fine with slapd server 2.4.12.I am totally confused. Thanks, Sankhadip

4 5

Access to a sync provider via back-meta
by ali.pouya＠free.fr 07 Feb '09

07 Feb '09

Hi, I need to connect my replica to a sync provider via an intermediate slapd configured with back-meta. My goal is to use the rewrite/map functions of back-meta. But I find that slapd crashes each time the replica is started. May be back-meta does not support LDAP controls ? or LDAP partial responses ? Does any one have an experience with this ? I precise that I cannot use the RWM overlay for many reasons : -The RWM overlay has to be installed in the remote sync provider server that is managed by another team. -the overlay is incompatible with the other uses of that server. -The overlay is still experimental but back-meta is not. -And finally, when I configure the overlay on my test server (by simply adding the line "overlay rwm" in the config) slapd crashes each time I make an LDAP search ! (I'm using OpenLdap 2.4.13). I do not send an issue (ITS) for theses crashes because I think that I'm not using a standard feature of slapd. Can any one help me ? Thanks & best regards Ali

2 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical