openldap-technical

openldap-technical@openldap.org

4 participants
9898 discussions

Samba failed to bind Ldap
by Emil Sicad - ISD 27 Nov '08

27 Nov '08

Good day to all, Im new to LDAP, I've been working with SAMBA-LDAP implem. and i have these messages logs: Nov 25 17:56:59 smbldap slapd[9974]: sql_select option missing Nov 25 17:56:59 smbldap slapd[9974]: auxpropfunc error no mechanism available Nov 25 17:56:59 smbldap ldap: slapd startup succeededs Nov 25 17:57:07 smbldap smbd[9987]: [2008/11/25 17:57:07, 0] lib/smbldap.c:smbldap_connect_system(850) Nov 25 17:57:07 smbldap smbd[9987]: failed to bind to server with dn= cn=Manager,dc=fcb.net,dc=. Error: Can't contact LDAP server Nov 25 17:57:07 smbldap smbd[9987]: (unknown) Nov 25 17:57:23 smbldap smbd[9987]: [2008/11/25 17:57:23, 0] lib/smbldap.c:smbldap_search_suffix(1155) Nov 25 17:57:23 smbldap smbd[9987]: smbldap_search_suffix: Problem during the LDAP search: (unknown) (Timed out) Question 1) Is my ldap working fine? 2) Why can't samba bind to Ldap? Pls teach me to understand those kind errors. Emil Sicad Cebu Mitsumi Inc Information Systems Division

3 5

schema design and schema restrictions
by Mansour Al Akeel 27 Nov '08

27 Nov '08

Hello all, I an new to LDAP, and I have a need to migrate the existing system to ldap as this will ease a bit the management for the new system implementation. I need to authenticate users for a web site, and for the internal system ( linux, windows stations .... etc). Now the available account objectclass is structural so I can not user inetorgperson with account as both are structural. In this case I decided to extend inetOrgPerson, and add username and password as a MUST attributes. This is because all the users have access to the web site and they need authentication, but some users will need to have access to the machines. In this case I will create a new objectClass (ie. accountInfo) which containts the info I need (home directory, shell, loginScript, .... etc). The issue here is how do I restrict the accountInfo to be added under User ? This is in fact not only specific to this senario. I couldn't find any docs about how to prevent objectClass domain to be added under group ! Finally, how do other ldap admin deal with similar cases ? Any advice ? thank you.

4 13

Tracking down persistent OpenLDAP corruption
by Gilbert Wilson 26 Nov '08

26 Nov '08

So... I'm having a problem with persistent corruption in Apple's Open Directory. I believe this corruption is related to OpenLDAP and the BerkeleyDB. I was hoping that folks here might be able to help me track down whether this is the problem or not. Essentially, what is happening is that user accounts will "disappear" from workgroup manager and dscl[1]. Accounts that have maintained a persistent connection will continue to be authenticated. But, accounts that are not authenticated will be unable to authenticate. The Directory Administrator account, for example, cannot authenticate at these times. If I restart slapd, all the missing accounts that had persistent connections will no longer be able to authenticate. An LDIF export, however, will show that the accounts are all still there. A regular repair and a catastrophic repair of of the BerkleyDB does not work.[2] The first time this happened, it DID work, but subsequent events have not been so easily fixed. A restore from backup is the only way to fix it. However, I suspect that there is malformed data lurking somewhere in the OpenLDAP system. The backups all have this malformed data. Thus, it doesn't take very much for the system to get corrupted again. A hard shutdown does it every time, and a minor upgrade to the OS did it, too. The standard suggested fix is destroy and rebuild the Open Directory setup. For obvious reasons, I would like to avoid this. I want to know *what* is happening. If it is, in fact, malformed data that is becoming corrupt, *what* data should I be examining, *where* is it located, and *how* do I check it for anomalies? Has anyone else had this kind of persistent corruption of their LDAP system? What was causing it? How did you find it? Any leads or words of wisdom would be greatly appreciated. Gilbert Wilson [1] http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/dsc… [2] http://developer.apple.com/documentation/Darwin/Reference/ManPages/man1/db_…

2 1

Disabling User Account
by piyush joshi 26 Nov '08

26 Nov '08

Dear Team, Is there any Schema or Attribute which can be used to disable user account if that account is not being used from one month or by providing date in advance to disable the account in future automatically. -- Regards Piyush Joshi 9415414376

3 2

Re: Delta-sync symptom in 2.4.11
by William Jojo 26 Nov '08

26 Nov '08

---- Original message ---- >Date: Thu, 20 Nov 2008 11:02:40 -0800 >From: Quanah Gibson-Mount <quanah(a)zimbra.com> >Subject: Re: Delta-sync symptom in 2.4.11 >To: William Jojo <w.jojo(a)hvcc.edu>,openldap-technical(a)openldap.org > >--On Thursday, November 20, 2008 10:38 AM -0500 William Jojo ><w.jojo(a)hvcc.edu> wrote: > > >> Otherwise this is just like test043, except or the missing dn's. :-) >> >> Any ideas? > >Try current RE24 CVS. There have been a number of replication related >fixes made since 2.4.11. > I just tried 2.4.13. The problem still persists. I will check out the CVS version in the morning. Cheers, Bill >--Quanah > >-- > >Quanah Gibson-Mount >Principal Software Engineer >Zimbra, Inc >-------------------- >Zimbra :: the leader in open source messaging and collaboration

2 3

Re: configuring ppolicy overlay using cn=config
by Quanah Gibson-Mount 25 Nov '08

25 Nov '08

--On Tuesday, November 25, 2008 11:19 AM +0100 Vincent Panel <yohonet(a)gmail.com> wrote: > Well, I've more or less solved the problem : > > I've guessed the equivalent for cn=config was the following ldif entry : > > dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcPPolicyConfig > olcOverlay: {1}ppolicy > olcPPolicyDefault: "cn=default,ou=policies,dc=example,dc=com" > > And here's what I've got when I added this entry : > > ldap_add: Invalid syntax (21) > additional info: olcPPolicyDefault: value #0 invalid per syntax > > Now, I've removed the quotes of the last line and I have another > error, but it seems caused by the PPolicyDefault object not > existing... > > But I'm a bit moving forward without any piece of documentation, it's > a bit hard... Please keep replies on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Issues in Performance Tesing of OpenLDAP using SLAMD
by Shilpa Sethi 25 Nov '08

25 Nov '08

Hi all, Currently I am involved in an activity that deals with measuring performance of OpenLDAP on Solaris 10 - x_86 machine. Hardware Specs - 1. Two identical servers (Servers 'NodeA' and 'NodeB') with the following configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2220 (2.8GHz/1MB) processor * 1x 4GB PC2-5300 DDR2-667 memory * 2x 146GB HDD 15K RPM (Hardware RAID-1, so available disk space is 146 GB). 2. One server 'NodeC' is used as a traffic injector and has the following hardware configuration: * Sun Fire X4200 M2 x64 Server * 2x AMD Opteron Model 2218 * 4x 2GB PC2-5300 DDR2-667 memory * 4x 73GB HDD 10K RPM. Software installation common to all servers: 1. JDK 1.6 2. Symas CDS Version 3.9.3 For traffic injection, SLAMD v2.0.0-alpha1 is installed on NodeC. Both Node A and B are Mirror-Mode replicas. The database is having 1 Million subscribers and both the cache sizes are set as follows in slapd.conf : cachesize 250000 idlcachesize 250000 i.e 25% of the subscriber base. Two identical SLAMD SearchRate Jobs, one pointing to Node A and other to Node B are run from Node C. However, there is a wide difference in the number of lookups/sec performed in both the servers. The read rates obtained vary in the ratio of 1:7 or so on both the servers. I am using 1 SLAMD client and 2 threads for targeting on 1 server. If I increase the number of thread, SLAMD starts reporting exceptions. Please suggest a way by which Predictable/ similar read rates could be achieved on both the servers as both being exactly same. Thanks a ton in advance for suggesting a solution. Regards Shilpa Sethi A R I C E N T Plot 6, Electronic City, Sector - 18, Gurgaon 122015 Haryana, India ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 11

Symbol problem with 2.4.13
by William Jojo 25 Nov '08

25 Nov '08

AIX 5.3, OpenLDAP 2.4.13, BDB 4.6.21.3 Previously I emailed the list about symlinking libldap.so to libldap_r.so. For OpenLDAP 2.4.11 this worked perfectly. I have built 2.4.13 with the exact same options and now I get the following error from ldapsearch after symlinking: Could not load program ldapsearch: rtld: 0712-001 Symbol ldap_derefresponse_free was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_parse_derefresponse_control was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. rtld: 0712-001 Symbol ldap_create_deref_control_value was referenced from module ldapsearch(), but a runtime definition of the symbol was not found. Is this a problem with lazy runtime resolution or did something library-wise change in this version? Or, am I just being an idiot and missing something obvious? Cheers, Bill

2 1

Lost Replications
by Burton, Kris - Acision 24 Nov '08

24 Nov '08

All, I am running 2.4.11 with ITS 5709 back ported. What I found digging through CVS was that this impacted syncprov.c 1.147.2.38 ctxcsn.c 1.40.2.6 -> 1.40.2.10 proto-slap.h 1.670.2.31 I can attach my patch file if that would be helpful. What we are seeing now is that on our patched version of 2.4.11 that we lose every 32767 or 32768 entry. This is consistent first we lose the 32767 then the 32768 and this pattern continues rotating back and forth. We pulled the latest RE24 branch and the problem appears to be resolved there. I am not sure if this is a separate ITS, that has been resolved or if there is more to the ITS 5709 that I missed. Hopefully this problem is distinct enough that someone recognizes it and can point me to the proper fix. In the test we produced this we were running mirror mode replication and can produce the problem adding 1 million entries via slapadd. We plan to move forward with 2.4.13 when it's released but for now we need to go forward with 2.4.11. Thanks, Kris Burton This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 2

RE: Data sync tools
by Bad Guy 24 Nov '08

24 Nov '08

The delay seems due to lost of network connections can't be detected (traceroute indicates 7 hops). So, can I use mastercheckint=5 in slapd.conf to periodic check the master server ? 5 means 5 sec ? Also, the parameter "mastercheckint" can be used in N-way master ? Thanks a lot. > Date: Thu, 20 Nov 2008 20:51:02 +0000> From: ghenry(a)OpenLDAP.org> To: badguy9588(a)hotmail.com> CC: openldap-technical(a)openldap.org> Subject: Re: Data sync tools> > > ----- "Bad Guy" <badguy9588(a)hotmail.com> wrote:> > > Dear all,> > > > We are running a multi-master openldap 2.4.11, we always get delay> > sync in some servers.> > > > Is there any way to do a periodic re-sync without restarting the> > openldap slapd daemon ?> > Can you provide more details please.> > -- > Kind Regards,> > Gavin Henry.> OpenLDAP Engineering Team.> > E ghenry(a)OpenLDAP.org> > Community developed LDAP software.> > http://www.openldap.org/project/ _________________________________________________________________ 聰明搜尋和瀏覽網路的免費工具列 — MSN 搜尋工具列 http://toolbar.live.com/

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical