openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Mailing list query
by Stelios A. 18 Nov '08

18 Nov '08

Hello all, My user.ldif is like: dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Somename sn: Somelastname cn: Somename Somelastname uid: ssomelastname uidNumber: 1002 gidNumber: 100 homeDirectory: /home/ssomelastname loginShell: /bin/bash mail: ssomelastname(a)mydomain.edu.com userPassword: some password encrypted Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com Example ldif: dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr cn: IT objectClass: groupOfUniqueNames uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com What I want is somehow to get all uid of the users belonging to each of my groups in order to build a mailing list with postfix. I've created a file called ldap-aliases.cf with the following inside: server_host = ldaps://myhostname search_base = dc=mydomain,dc=edu,dc=com scope = sub version = 3 query_filter = (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) result_attribute = uid bind = yes bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com bind_pw = mypasswordwithoutencryption The above works ok without errors but it just displays all users in my ldap. I tried several different ways but can't find out how to add to the query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com and also a second more complicated query, that is to show me all users uid where not belonging to any Group (ou=Groups,dc=mydomain,dc=edu,dc=com) Any help is much appreciated. Thanks

4 10

CSN Too Old potential Bug
by Burton, Kris - Acision 17 Nov '08

17 Nov '08

All, I want to ask the list about this before I try to open an ITS to make sure that I am understanding everything correctly. We are running OpenLDAP 2.4.11. I selectively tried to back post ITS 5709 to our source, because we were losing replications. Applying this seemed to help and reduced the number of lost replications. We are running in mirror mode using refreshAndPersist, and doing a high volume of adds to the master, on the order of 100/s. We have run numerous iterations of the same test with very aggressive NTP updates that are keeping both the master and consumer within 50 microseconds of one another. Which I saw recommended as a possible solution in a previous message thread. This seemed to make little to no difference in the replication loss. >From looking at the code I was thinking that the lost replications might be due to entries being queued on the master side in non-ascending order which I was seeing preceding the replication that would be rejected on the consumer side. What I thought was happening is that the logic that traverses the queue to mark committed CSNs and updates the contextCSN was getting out of sync because of this, and orphaning replications that were still pending, because they are too old, but in reality they have never been added to the consumer. I just pulled the latest code from RE24 and reran the test, the latest code is better than before with just the back post of 5709 on 2.4.11, but we are still losing a small percentage of the replications with the "CSN too old" message. With the latest code I am still seeing a correlation between the out of sync queuing on the master and the replications that are rejected on the consumer. During this run NTP was keeping the 2 systems within 10 microseconds of each other, with the most aggressive synch interval that is configurable at 16 seconds. Below I have log snippets and some of the relevant configuration information. If more is desired then please let me know and I will provide it. #### MASTER ##### Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c9568b0 20081114194304.892065Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x42803100 20081114194305.078713Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=14 op=17167 ADD dn="uniqueIdentifier=Evad_Added_tele_5450408582,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4680b100 20081114194305.078878Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43004100 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:05 ng04be03 slapd[7582]: conn=12 op=13844 RESULT tag=105 err=0 text= Nov 14 14:43:05 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b4c87e670 20081114194305.068251Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 ADD dn="uniqueIdentifier=Evad_Added_tele_5450009858,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x4780d100 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=12 op=17496 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5a7f8340 20081114194502.917316Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=13 op=19983 ADD dn="uniqueIdentifier=Evad_Added_tele_5450509990,ou=subscribers,ou=SINGP,o=ricuc…" Nov 14 14:45:02 ng04be03 slapd[7582]: conn=10 op=19719 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ae77160 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=14 op=19598 ADD dn="umbillingnumber=5450409797,uniqueIdentifier=Evad_Added_tele_5450409797,ou=s…" Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x41000100 20081114194502.936884Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: conn=11 op=16763 RESULT tag=105 err=0 text= Nov 14 14:45:02 ng04be03 slapd[7582]: slap_queue_csn: queing 0x43805100 20081114194502.947725Z#000000#001#000000 Nov 14 14:45:02 ng04be03 slapd[7582]: slap_graduate_commit_csn: removing 0x2b5ad51170 20081114194502.917288Z#000000#001#000000 ### CONSUMER ### Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_add (0) Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194305.078653Z#000000#001#000000 Nov 14 14:43:36 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002 Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Nov 14 14:43:36 ng04be04 slapd[24622]: syncrepl_entry: rid=002 be_search (0) Nov 14 14:45:39 ng04be04 slapd[24622]: slap_queue_csn: queing 0x2b4737c990 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: slap_graduate_commit_csn: removing 0x2b473ca890 20081114194502.917523Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: rid=002 CSN too old, ignoring 20081114194502.917288Z#000000#001#000000 Nov 14 14:45:39 ng04be04 slapd[24622]: do_syncrep2: cookie=rid=002,sid=002,csn=20081114194502.936884Z#000000#001#000000 ### Replication Config ### dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig ... olcSyncrepl: {0}rid=2 provider=ldap://ldap.server.com bindmethod=si mple timeout=0 network-timeout=0 binddn="cn=Directory Manager,o=ricuc.com" cr edentials="secret" starttls=no filter="(objectclass=*)" searchbase="o=ricuc.com" scope=sub schemachecking=off type=refreshandpersist retry="60 +" olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 ### Hardware ### Dual Quad Core Xeon 2.83GHz 32GB RAM 8x15000rpm RAID10 Separate LUNS for db and txn logs Kris Burton Software Engineer ________________________________________ Acision. Innovation. Assured. www.acision.com 4870 Sadler Road Suite 200 Glen Allen, VA 23060 USA This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 4

openldap client over ssl
by Beijing Normal Univ 17 Nov '08

17 Nov '08

Hi I am new to openldap and ssl. I would like to use only the openldap client sdk. What I want to do is use the openldap client sdk to develop some tools which could comunicate with ldap server over ssl channel. Do I still need openssl? Maybe I should ask my question this way: Openssl will need to be used to generate the certificate etc. Does my application itself requre openssl libraries if it needs to support ssl? I think the answer probably is yes. Thanks

1 0

OpenLDAP interop with AD questions
by Christopher Barry 17 Nov '08

17 Nov '08

Hi All, I'm still researching methods, and trying to find the best way to integrate our Unix hosts with AD in a way that makes sense for us. The goal is to have a single user/password db in AD, and have all of the old NIS map data in OpenLDAP. SSO would be a nice to have feature too. I've read more stuff than I can count, but I'm still more than a little confused. The translucent overlay looks cool (if it'll even work with AD), but I'm not sure it's the right answer for us with respect to keeping the maps local to OpenLDAP. Any suggestions or doc links you can post? Thanks, -C

4 3

Re: Mailing list query
by Stelios A. 15 Nov '08

15 Nov '08

That query does not return any result. root@myserver:/etc/postfix# postmap -q mail_Group ldap:/etc/postfix/ldap-aliases.cf postmap: warning: dict_ldap_open: /etc/postfix/ldap-aliases.cf: Fixed query_filter cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr is probably useless root@myserver:/etc/postfix# Regarding my second query, I have 5 groups where only staff is assigned to each one depending the department. Then the rest of the users (students) does not belong to any group so in order to get all uid's of students I need to query the whole ldap excluding the groups. 2008/11/15 Chris <cjl(a)viptalk.net>: > > On Nov 15, 2008, at 12:22 AM, Stelios A. wrote: > >> Hello all, >> >> My user.ldif is like: >> >> dn: cn=Somename Somelastname, ou=Users,dc=mydomain,dc=edu,dc=com >> objectClass: inetOrgPerson >> objectClass: posixAccount >> objectClass: person >> objectClass: organizationalPerson >> objectClass: top >> givenName: Somename >> sn: Somelastname >> cn: Somename Somelastname >> uid: ssomelastname >> uidNumber: 1002 >> gidNumber: 100 >> homeDirectory: /home/ssomelastname >> loginShell: /bin/bash >> mail: ssomelastname(a)mydomain.edu.com >> userPassword: some password encrypted >> >> Same user for example is under cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com >> Example ldif: >> >> dn: cn=IT,ou=Groups,dc=bca,dc=edu,dc=gr >> cn: IT >> objectClass: groupOfUniqueNames >> uniqueMember: cn=Somename Somelastname,ou=Users,dc=mydomain,dc=edu,dc=com >> >> What I want is somehow to get all uid of the users belonging to each >> of my groups in order to build a mailing list with postfix. >> >> I've created a file called ldap-aliases.cf with the following inside: >> >> server_host = ldaps://myhostname >> search_base = dc=mydomain,dc=edu,dc=com >> scope = sub >> version = 3 >> query_filter = >> (&(|(objectclass=person)(objectclass=groupofuniquenames)(mail=%s)(ou=Groups))) >> result_attribute = uid >> bind = yes >> bind_dn = cn=admin,dc=mydomain,dc=edu,dc=com >> bind_pw = mypasswordwithoutencryption >> >> The above works ok without errors but it just displays all users in my >> ldap. >> I tried several different ways but can't find out how to add to the >> query to show me only the cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > > Try setting this as your search base: > cn=IT,ou=Groups,dc=mydomain,dc=edu,dc=com > >> and also a second more complicated query, that is to show me all users >> uid where not belonging to any Group >> (ou=Groups,dc=mydomain,dc=edu,dc=com) > > Not quite sure I understand what you're looking for there. > > -- Stelios A

1 0

Active Directory caching
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, I'm looking for some references/answers as to how OpenLDAP and Active Directory work with regards to caching. The scenario I'm seeing is this: I have Apache on a RHEL5 machine authenticating users via LDAP. Its set to cache for 600s, so I dont overload the server unnecessarily. What I'm seeing though, is that something somewhere is caching old passwords. I can change the users password several times, and LDAP will authenticate using any of the passwords previously used. I've tried some timing tests of my own, and it seems that it takes up to 50mins for me first password change to take effect (an odd time to me). So I'm trying to figure out whos caching the other passwords, is it LDAP, or is it AD ? And if so where are the settings to look at? And what timers are involved? I actually don't mind the idea of caching older passwords, but only so long as I know how long it will be for, and what mechanism is doing it, then I can change it if need be. I'm setting these directives (taken straight from the Apache examples). LDAPSharedCacheSize 200000 LDAPCacheEntries 1024 LDAPCacheTTL 600 LDAPOpCacheEntries 1024 LDAPOpCacheTTL 600 My setups quite simple. Ive one Domain Controller. No proxies involved. I've read what I can online, and am getting stuck. Thanks, Adrian

2 1

Debugging a user authentication
by Adrian Marsh 14 Nov '08

14 Nov '08

Hi All, Using Apache 2.2, how do I debug the LDAP lookups being made to a 2003 Domain Controller. Ive one user whos failing to authenticate, but all my other users do and Im trying to see who. He authenticates ok, same password via other mechanisms to the DC, but just not via the Apache LDAP lookup. I'm an LDAP novice so am looking for names of debug tools/methods etc. Thanks, Adrian

2 2

LDAP logs
by Tom Cooper 14 Nov '08

14 Nov '08

Hi all, I am running openldap 2.3.27 and in the database directory log files are created called log.00000xxxx where xxxx is an incrementing number. Each log file is 10MB in size. Searching for it it looks like Berkely DB logs. How do I get rid of it as it chews up my disk space quite quickly? I have noticed that if they are deleted, my database becomes corrupted. Thanks. Tom To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

3 2

startup ldap problem
by GanGan 13 Nov '08

13 Nov '08

hello all, My problem, when I start my server ldap in my log Nov 13 12:34:10 srvtest3 slapd[3738]: daemon: shutdown requested and initiated. Nov 13 12:34:10 srvtest3 slapd[3738]: slapd shutdown: waiting for 0 threads to terminate Nov 13 12:34:10 srvtest3 slapd[3738]: slapd stopped. Nov 13 12:34:12 srvtest3 slapd[3800]: @(#) $OpenLDAP: slapd 2.3.27 (Jul 2 2008 04:29:17) $ brewbuilder@hs20-bc2-2.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: nss_ldap: could not search LDAP server - Server is unavailable Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 55: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 60: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3800]: /etc/openldap/slapd.conf: line 65: rootdn is always granted unlimited privileges. Nov 13 12:34:12 srvtest3 slapd[3801]: slapd starting I do not understand where is the problem, in my /etc/ldap.conf ? this command : getent passwd no user displays ldap someone would have an idea? thanks -- - GanGan -

4 4

(no subject)
by Bad Guy 13 Nov '08

13 Nov '08

Dear all, I am running the openldap 2.4.11 with 4 way masters (SID=001 to 004) configured. (my suffix is empty in slapd.conf) The data can be synced initially. I add records in 1 server and all the other 3 servers will have the new record added. However, I found that after running for some time, one server will have corrupted contextCSN in SID=001. dn: contextCSN:: sCttCIio0wAxNTQzMTMuMDQ1Mjk3WiMwMDAwMDAjMDAyIzAwMDAwMA== contextCSN: 20081107061013.853051Z#000000#001#000000 contextCSN: 20081107073602.911356Z#000000#003#000000 contextCSN: 20081107061028.825773Z#000000#004#000000 The contextCSN for SID=002 in server 1 is corrupted. So, whenever there is an update in SID=002 server, the SID=001 server will never get the update, however, when there is update in SID=003 or SID=004 server, the records will get updated in SID=001. We have a background cron job in each server running at 1 minutes interval to retrieve the records and set some user defined attributes if it meet some certain criteria. What's the cause to this corruption ? Is there any way to recover the corrupted contextCSN by command or script without rebuild the data ? Thanks _________________________________________________________________ 用部落格分享照片、影音、趣味小工具和最愛清單，盡情秀出你自己 — Windows Live Spaces http://spaces.live.com/

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical