openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

(no subject)
by Bad Guy 13 Nov '08

13 Nov '08

Dear all, I am running the openldap 2.4.11 with 4 way masters (SID=001 to 004) configured. (my suffix is empty in slapd.conf) The data can be synced initially. I add records in 1 server and all the other 3 servers will have the new record added. However, I found that after running for some time, one server will have corrupted contextCSN in SID=001. dn: contextCSN:: sCttCIio0wAxNTQzMTMuMDQ1Mjk3WiMwMDAwMDAjMDAyIzAwMDAwMA== contextCSN: 20081107061013.853051Z#000000#001#000000 contextCSN: 20081107073602.911356Z#000000#003#000000 contextCSN: 20081107061028.825773Z#000000#004#000000 The contextCSN for SID=002 in server 1 is corrupted. So, whenever there is an update in SID=002 server, the SID=001 server will never get the update, however, when there is update in SID=003 or SID=004 server, the records will get updated in SID=001. We have a background cron job in each server running at 1 minutes interval to retrieve the records and set some user defined attributes if it meet some certain criteria. What's the cause to this corruption ? Is there any way to recover the corrupted contextCSN by command or script without rebuild the data ? Thanks _________________________________________________________________ 用部落格分享照片、影音、趣味小工具和最愛清單，盡情秀出你自己 — Windows Live Spaces http://spaces.live.com/

3 4

Password protection of TLS key
by Akke Bengtsson 12 Nov '08

12 Nov '08

Is it still a requirement that TLS keys must have their password nullified before using them in an openldap context? Some experimentation with slapd startup has revealed that for some combinations of OS and OpenLDAP version, I will be given a prompt for the TLS password and can also input it and the slapd daemon starts correctly. On other systems, I was prompted for the password but before I even could enter it, the slapd startup crashed. The tests were all performed doing a manual startup via "/etc/init.d/ldap start". Automatic startup means that the password, instead of being entered by a person, has to reside on file and thereby be accessible to potential intruders. Is there any way to prevent unprotected keys or passwords to keys in this context? Akke Bengtsson

2 1

Cannot modify directory entry with custom attribute
by James S. White 10 Nov '08

10 Nov '08

I cannot add a custom objectclass to a directory entry. When I remove my custom objectclass and attributes, I can modify the entry normally. When I add them, I get an "Invalid Syntax (21)" error. I've googled extensively, and can find other cases of this happening, but not an effective solution. What am I missing here? Details: #/etc/ldap/schema/venn.schema attributetype ( 1.1.2.1.1 NAME 'vennBase' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributetype ( 1.1.2.1.2 NAME 'vennClass' DESC 'A single set this host belongs to' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClass ( 1.1.2.2.1 NAME 'vennHost' SUP top AUXILIARY MUST ( vennBase $ vennClass ) ) #added to /etc/ldap/slapd.conf include /etc/ldap/schema/venn.schema # command /etc/init.d/slapd restart #freyr.ldif dn: cn=freyr,ou=Hosts,dc=websages,dc=com cn: freyr objectclass: top objectclass: ipHost objectclass: device objectclass: vennHost ipHostNumber: 72.14.177.235 vennBase: debian-etch vennClass: ldap_server vennClass: bind9_server vennClass: cfengine_server vennClass: openldap_server vennClass: irc_server # command ldapmodify -xh freyr.websages.com -D "cn=root,dc=websages,dc=com" -f freyr.ldif -W #error modifying entry "cn=freyr,ou=Hosts,dc=websages,dc=com" ldap_modify: Invalid syntax (21) additional info: objectclass: value #3 invalid per syntax if I remove all the venn* stuff from the .ldif, everything works fine... Any help would be appreciated.

1 1

moving ldap-db via file-copying?
by Silvana 10 Nov '08

10 Nov '08

Hello! I hope you can help me, migrate my old ldap-db, problem is this: Our old server was running with ldap2.2.7? to serve as backend to the sambaserver and as of today its refusing to work or give errors (the ldap-daemon seems to start, but doesn't open the port, is not accessible, gives no errors and has to be killed, because stopping it gives no reaction) now, i've set up a new machine, to use ldap, given it the same suffix, cn, etc. the version of ldap is a newer one, than on the old box, although i'm not sure, how far they are removed. is it in some way possible, to just copy the files in /var/lib/ldap/ from the old server and insert them into the new box in the same folder? if so, which files would be ok to overwrite, which not? or woul i have to tweak some other files for that as well? or is this completely inconceivable (as i dread is the case), and if yes, how am i to get the files from the old server to the new one? any help on this would be greatly appreciated bye silvana

3 3

Re: ldap attributes - performance problem?
by Pavlos Parissis 09 Nov '08

09 Nov '08

On Sun, 09 Nov 2008 08:52:21 -0800 radim.roska(a)gmail.com wrote: > Hi, > > ok..then i guess there is not a problem :)..of course I'll add indexes, but > I was just thinking if its ok to have a lot of same attributes.. If the schema allows multiple values for this attribute then from OL point of view is fine. I assume that apache or any other LDAP client which is going to fetch this attribute will correctly handle the multiple values. Cheers, Pavlos > > thanks, > Radim > > On Nov 9, 2008 11:43am, Pavlos Parissis <p_pavlos(a)freemail.gr> wrote: > > Hi, > > > > > > > > I don't real understand your concerns. > > > > > > > > Are you worry about LDAP search performance? > > > > Adding indexes is your solution on this. > > > > > > > > Cheers, > > > > Pavlos > > > > > > > > > > > > On Sat, 8 Nov 2008 21:15:02 +0100 > > > > "Radim Roska" wrote: > > > > > > > > > Hi, > > > > > > > > > > I'm thinking about solution to following problem: authorization to > > > > > directories on our file server (accessed by webdav). Is it a performance > > > > > issue to build solution on following pattern? > > > > > > > > > > part of user's ldif > > > > > ... > > > > > uid=someone > > > > > allow_dir: directory1 > > > > > allow_dir: directory2 > > > > > allow_dir: directory3 > > > > > allow_dir: directory4 > > > > > > > > > > and then just htaccess directives in apache for every of these > directories > > > > > :) > > > > > > > > > > > > > > > it could happen that someone would have eg 50 of these > attributes...would > > > > > it be a problem? > > > > > > > > > > Thanks for advice and advanced opinion :) > > > > > Radim > > > > > > > >

1 0

ldap attributes - performance problem?
by Radim Roska 09 Nov '08

09 Nov '08

Hi, I'm thinking about solution to following problem: authorization to directories on our file server (accessed by webdav). Is it a performance issue to build solution on following pattern? part of user's ldif ... uid=someone allow_dir: directory1 allow_dir: directory2 allow_dir: directory3 allow_dir: directory4 and then just htaccess directives in apache for every of these directories :) it could happen that someone would have e.g. 50 of these attributes...would it be a problem? Thanks for advice and advanced opinion :) Radim

2 1

Re: any tools for data resync....
by Gavin Henry 07 Nov '08

07 Nov '08

----- "Paul Lee" <paul(a)hk.fujitsu.com> wrote: > Dear all, > > My customers is very concern on the data synchronization on the 4-way > > masters openldap servers. > > If in case there is record unsync (due to whatever reason, e.g. > network > failure, CSN too old, etc), will there be any tools to resync the data > ? > > If there is such tools, we can execute a cron job to do this. They will retry depending on what settings you have if there is a connection problem. Can you try on 2.4.12, not 2.4.9 and also host your config somewhere. You can quickly check all contextCSN are the same via: [ghenry@suretec ~]$ ldapsearch -x -LLL -H ldap://host1 -s base -b 'dc=suretecsystems,dc=com' contextCSN dn: dc=suretecsystems,dc=com contextCSN: 20081025222436.822813Z#000000#000#000000 [ghenry@suretec ~]$ ldapsearch -x -LLL -H ldap://host2 -s base -b 'dc=suretecsystems,dc=com' contextCSN dn: dc=suretecsystems,dc=com contextCSN: 20081025222436.822813Z#000000#000#000000 -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

2 1

Indexing integers
by Sean Burford 07 Nov '08

07 Nov '08

Hi, I have been looking for the index to apply to integer attributes to speed up less than/greater than filters, but have turned up nothing. These searches work, but eq and pres indexes don't seem to affect their speed. Is there an index that help with integer ordering searches? Thanks Sean

2 1

any tools for data resync....
by Paul Lee 06 Nov '08

06 Nov '08

Dear all, My customers is very concern on the data synchronization on the 4-way masters openldap servers. If in case there is record unsync (due to whatever reason, e.g. network failure, CSN too old, etc), will there be any tools to resync the data ? If there is such tools, we can execute a cron job to do this. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

OPENLDAP installation error
by Sujeet Vanage 05 Nov '08

05 Nov '08

Hi I am getting following error when tried to configure open ldap Basically I just need OPEN LDAP client library and not directory server I issued following command $ ./configure --disable-slapd --disable-slurpd and got this error message configure:4505: error: C compiler cannot create executables See `config.log' for more details. I checked that cc and gcc are installed and in PATH any idea how to solve? Pleas help below are some details from config.log >>>>>>>>>>>>>>>>>> ## ----------- ## ## Core tests. ## ## ----------- ## configure:1616: checking build system type configure:1634: result: sparc-sun-solaris2.10 configure:1642: checking host system type configure:1656: result: sparc-sun-solaris2.10 configure:1664: checking target system type configure:1678: result: sparc-sun-solaris2.10 configure:1707: checking for a BSD-compatible install configure:1762: result: build/shtool install -c configure:1773: checking whether build environment is sane configure:1816: result: yes configure:1881: checking for gawk configure:1910: result: no configure:1881: checking for mawk configure:1910: result: no configure:1881: checking for nawk configure:1897: found /usr/bin/nawk configure:1907: result: nawk configure:1917: checking whether make sets $(MAKE) configure:1937: result: yes configure:2146: checking configure arguments configure:3644: WARNING: slapd disabled, ignoring --enable-bdb argument configure:3644: WARNING: slapd disabled, ignoring --enable-hdb argument configure:3644: WARNING: slapd disabled, ignoring --enable-monitor argument configure:3644: WARNING: slapd disabled, ignoring --enable-relay argument configure:3680: WARNING: slapd disabled, ignoring --enable-seqmod argument configure:3680: WARNING: slapd disabled, ignoring --enable-syncprov argument configure:3748: result: done configure:3917: checking for cc configure:3933: found /usr/ucb/cc configure:3943: result: cc configure:3967: checking for ar configure:3983: found /usr/ccs/bin/ar configure:3993: result: ar configure:4052: checking for style of include used by make configure:4080: result: GNU configure:4421: checking for C compiler version configure:4424: cc --version </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4427: $? = 1 configure:4429: cc -v </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4432: $? = 1 configure:4434: cc -V </dev/null >&5 /usr/ucb/cc: language optional software package not installed configure:4437: $? = 1 configure:4460: checking for C compiler default output file name configure:4463: cc conftest.c >&5 /usr/ucb/cc: language optional software package not installed configure:4466: $? = 1 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define OPENLDAP_PACKAGE "OpenLDAP" | #define OPENLDAP_VERSION "2.4.11" | #define LDAP_VENDOR_VERSION 20411 | #define LDAP_VENDOR_VERSION_MAJOR 2 | #define LDAP_VENDOR_VERSION_MINOR 4 | #define LDAP_VENDOR_VERSION_PATCH 11 | #define HAVE_MKVERSION 1 | /* end confdefs.h. */ | | int | main () | { | | ; | return 0; | } configure:4505: error: C compiler cannot create executables See `config.log' for more details. ## ---------------- ## ## Cache variables. ## ## ---------------- ## ac_cv_build=sparc-sun-solaris2.10 ac_cv_build_alias=sparc-sun-solaris2.10 ac_cv_env_CC_set= ac_cv_env_CC_value= ac_cv_env_CFLAGS_set= ac_cv_env_CFLAGS_value= ac_cv_env_CPPFLAGS_set= ac_cv_env_CPPFLAGS_value= ac_cv_env_CPP_set= ac_cv_env_CPP_value= ac_cv_env_LDFLAGS_set= ac_cv_env_LDFLAGS_value= ac_cv_env_build_alias_set= ac_cv_env_build_alias_value= ac_cv_env_host_alias_set= ac_cv_env_host_alias_value= ac_cv_env_target_alias_set= ac_cv_env_target_alias_value= ac_cv_host=sparc-sun-solaris2.10 ac_cv_host_alias=sparc-sun-solaris2.10 ac_cv_prog_AR=ar ac_cv_prog_AWK=nawk ac_cv_prog_CC=cc ac_cv_prog_make_make_set=yes ac_cv_shtool=build/shtool ac_cv_target=sparc-sun-solaris2.10 >>>>>>>>>>> Thanks Sujeet Vanage

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical