openldap-technical

openldap-technical@openldap.org

2 participants
9943 discussions

Regarding LDAP Replication
by ashish mahamuni 15 Sep '08

15 Sep '08

Hello Everybody, I've one query regarding LDAP master/slave configuration. When we set replication,We put same base DN on master as well as on slave. Also If my organization have any unique OID that will also get replicated on slave. But as per my knowledge, ideally we should not use existing OID's and base DN's(not sure about base DN's) because it could cause inconsistency. How this replication works indeed? Regards, Ash Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

Re: pwd* Attributes and replication
by Eyal Marantenboim 15 Sep '08

15 Sep '08

Hi, here are the configs: Thanks! MASTER: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/openldap-2.4.11/etc/openldap/schema/core.schema include /opt/openldap-2.4.11/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.11/etc/openldap/schema/inetorgperson.schema include /opt/openldap-2.4.11/etc/openldap/schema/dnszone.schema include /opt/openldap-2.4.11/etc/openldap/schema/nis.schema include /opt/openldap-2.4.11/etc/openldap/schema/sudo.schema include /opt/openldap-2.4.11/etc/openldap/schema/DUAConfigProfile.schema include /opt/openldap-2.4.11/etc/openldap/schema/solaris.schema include /opt/openldap-2.4.11/etc/openldap/schema/ppolicy.schema include /opt/openldap-2.4.11/etc/openldap/schema/autofs.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/openldap-2.4.11/var/run/slapd.pid argsfile /opt/openldap-2.4.11/var/run/slapd.args allow bind_v2 password-hash {MD5} database monitor # TLS configuration TLSCipherSuite HIGH:MEDIUM:TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/ca-ldap.crt TLSCertificateFile /etc/openldap/ldap1.crt TLSCertificateKeyFile /etc/openldap/ldap1.key ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=empresa,dc=com" rootdn "cn=root,dc=empresa,dc=com" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/openldap-2.4.11/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Database access list access to attrs=userPassword by self write by anonymous auth access to attrs=shadowLastChange by self write by * read access to * by * read # Replication overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Password policies overlay ppolicy ppolicy_default "cn=Password,ou=Policies,dc=empresa,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout # Access Logging overlay accesslog logdb cn=log logops bind logsuccess TRUE # Access DB database bdb suffix "cn=log" directory /opt/openldap-2.4.11/var/openldap-accesslog rootdn "cn=log" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart, eq,pres # Syncrepl overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE SLAVE: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/openldap-2.4.11/etc/openldap/schema/core.schema include /opt/openldap-2.4.11/etc/openldap/schema/cosine.schema include /opt/openldap-2.4.11/etc/openldap/schema/inetorgperson.schema include /opt/openldap-2.4.11/etc/openldap/schema/dnszone.schema include /opt/openldap-2.4.11/etc/openldap/schema/nis.schema include /opt/openldap-2.4.11/etc/openldap/schema/sudo.schema include /opt/openldap-2.4.11/etc/openldap/schema/DUAConfigProfile.schema include /opt/openldap-2.4.11/etc/openldap/schema/solaris.schema include /opt/openldap-2.4.11/etc/openldap/schema/ppolicy.schema include /opt/openldap-2.4.11/etc/openldap/schema/autofs.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/openldap-2.4.11/var/run/slapd.pid argsfile /opt/openldap-2.4.11/var/run/slapd.args allow bind_v2 password-hash {MD5} database monitor # TLS configuration TLSCACertificateFile /etc/openldap/cacerts/ca-ldap.crt TLSCertificateFile /etc/openldap/ldap2.crt TLSCertificateKeyFile /etc/openldap/ldap2.key ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=empresa,dc=com" rootdn "cn=root,dc=empresa,dc=com" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/openldap-2.4.11/var/openldap-data # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Database Access list access to * attrs=userPassword by self write by anonymous auth access to * attrs=shadowLastChange by self write by * read access to * by * read # Replication # Transparently proxy updates to master overlay chain chain-uri "ldap://ldap1.empresa.com" chain-idassert-bind bindmethod="simple" binddn="cn=root,dc=empresa,dc=com" credentials="password" mode="self" chain-tls start chain-return-error TRUE # Replication agent syncrepl rid=123 provider=ldaps://ldap1.empresa.com type=refreshOnly interval=00:00:01:00 searchbase="dc=empresa,dc=com" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=on retry="60 10 300 3" bindmethod=simple binddn="cn=root,dc=empresa,dc=com" credentials=password # Refer updates to master updateref ldap://ldap1.empresa.com/ # Password policies overlay ppolicy ppolicy_default "cn=Password,ou=Policies,dc=empresa,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout # Access Logging overlay accesslog logdb cn=log logops bind logsuccess TRUE # Access DB database bdb suffix "cn=log" directory /opt/openldap-2.4.11/var/openldap-accesslog rootdn "cn=log" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart, eq,pres syncrepl rid=124 provider=ldaps://ldap1.empresa.com bindmethod=simple binddn="cn=root,dc=empresa,dc=com" credentials=password type=refreshOnly interval=00:00:01:00 filter="(objectClass=*)" retry="5 +" searchbase="cn=log" logbase="cn=log" syncdata=accesslog # type=refreshAndPersist # schemachecking=on updateref ldap://ldap1.empresa.com/ ----- Original Message ---- From: Gavin Henry <ghenry(a)OpenLDAP.org> To: Eyal Marantenboim <eyalmdiveo(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Monday, September 15, 2008 12:46:15 PM Subject: Re: pwd* Attributes and replication Eyal Marantenboim wrote: > Hi, > > We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. > When a user tries to bind with incorrect credential, the master server > gets populated with pwdFailureTime attribute. > After 4 times of entering wrong credentials, pwdAccountLockedTime is > added to that user. > > Our problem is that the secondary server (using syncrepl) is not > replicating the pwd* values. > I've noticed that neither entryCSN nor contextCSN are being updated (on > the master) when pwdFailureTime is added to the user (I'm not sure if it > should actually change). > But, when we change any other attribute (userPassword, etc) on the > master, that does change entryCSN, and all pwd* attributes do get > updated in the seconday server. > > appreciate your help. > Thanks! > Config? -- Kind Regards, Gavin Henry. OpenLDAP Engineering Team. E ghenry(a)OpenLDAP.org Community developed LDAP software. http://www.openldap.org/project/

1 0

custom bind attribute
by Stefano Zanmarchi 15 Sep '08

15 Sep '08

Hi all, I'd like to let users bind against an attribute other than "userPassword". Is it possible or is userPassword hardcoded? Moreover I'd like to serve bind requests from one IP against "userPassword" and bind requests from another IP against another (custom) attribute. Is this possible by any chance? Thank you very much for your help, Stefano

2 1

Migrating AD Users/Groups to samba-ldap server
by janskey 15 Sep '08

15 Sep '08

Hi All, I need advice on how i can pull down AD users/groups (password of each users) to samba-ldap server. I already configured my server using the howto: * http://www.howtoforge.com/openldap-samba-domain-controller-ubuntu7.10 * http://ubuntuforums.org/showthread.php?t=640760 I tried also ldifde to create ldif files and tried to populate in smbldap-tools. But it has an error, some sort of compatibility of ldif syntax. Our objective is to phase out or Win2003 AD server and user samba+ldap authentication scheme. cheers, janskey

2 1

Active directory change notification using open ldap library: errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece
by susant sahani 15 Sep '08

15 Sep '08

Hi , I am trying to syncing up with Active directory. When ever there is a change in active directory it should send the information. But It's keep on sending me this error message . errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece LDAP_SERVER_NOTIFICATION_OID_W "1.2.840.113556.1.4.528" char* base="dc=ad,dc=hello123,dc=com"; char* filter="(objectClass=*)"; controls[0] = create_psearch_control (LDAP_SERVER_NOTIFICATION_OID_W, 1, 1); controls[1] = 0; ret = ldap_search_ext (ld, base, LDAP_SCOPE_SUBTREE, filter, 0, /* attrs */ 0, /* attrsonly */ controls, 0, /* clientctrls */ 0, /* timeout */ LDAP_NO_LIMIT, &msgid); while ((ret = ldap_result (ld, msgid, LDAP_MSG_RECEIVED, &timeout, &entries)) >= 0) { LDAPMessage *entry; LDAPControl **ec_controls; if (!ret) { printf ("Timed out\n"); continue; } } Please let me know what I am doing wrong. -- Thanks, Susant

1 0

Syncrepl missing cn,sn and givenName
by Stelios A. 13 Sep '08

13 Sep '08

Hello all, I'm going mad with a problem during syncrepl. I have one master and one slave. When I add one entry to the master the record is replicated to the slave without a problem but without all fields and this is causing me problems as from a shell cannot resolve the user using for example the command 'id username'. That gives me an error, no such a user and cause further problems with existin email setup. Under master ldap everything works/resolves fine. If I manually add the whole tree of the master including the 'username' entry then it works fine. Master entry is like: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Kostas sn: Somelastname cn: Kostas Somelastname uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com and slave when replicated has: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com If you check the fields that missing from slave are: cn, sn and givenName My slave slapd.conf has: syncrepl rid=001 provider=ldap://192.168.1.110 type=refreshOnly interval=00:00:05:00 retry="30 10 600 20" searchbase="dc=mydomain,dc=com" attrs="*" scope=sub binddn="uid=syncrepl,ou=System,dc=mydomain,dc=com" credentials=smypassword updateref ldap://192.168.1.110 Any help is much appreciated. Thanks a lot

2 1

Chage for LDAP
by Gustavo Mendes de Carvalho 13 Sep '08

13 Sep '08

Hi All, Is there any tool for LDAP that works like chage, to inform when I changed my password, when will expire, and so on. I am using Openldap 2.3.39 with ppolicy. Thanks --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

Re: Help: Slow LDAP search with high %iowait
by Victor 12 Sep '08

12 Sep '08

Would you folks mind sharing some thoughts/ideas on this? Thanks a lot! --- On Mon, 9/8/08, Victor <victorfuman(a)yahoo.com> wrote: > From: Victor <victorfuman(a)yahoo.com> > Subject: Help: Slow LDAP search with high %iowait > To: openldap-technical(a)openldap.org > Date: Monday, September 8, 2008, 5:35 PM > Hi , > > I did quite a bit reading and research before I send email > to this list for help. If I have missed some basic concepts > here, please execuse my ignorance. Thanks for your help and > time in advance. > > 1. Summary > The initial search in my prototyping with OpenLDAP (slapd + > BDB) seemed to be slow. What is the reason and How could I > fix it? > > 2. Configuration > 2.1 Environment > Linux CentOS, 1 hard disk (therefore unfortunately the BDB > transaction logs and database files are written to the same > disk), 120GB disk space (80% unused), 1GB RAM, reserved for > this prototyping, OpenLDAP 2.3.39 with default BDB > installation > > 2.2 slapd.conf (modified trivially for discussion > purpose) > # global configuration > loglevel 0 > > # BDB > database bdb > suffix "dc=test,dc=dummy,dc=com" > rootdn > "cn=Manager,dc=test,dc=dummy,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for > details. > # Use of strong authentication encouraged. > rootpw secret > # The database directory MUST exist prior to running slapd > AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > directory /usr/local/var/openldap-data > #Other DB configuration > idlcachesize 60000 > cachesize 20000 > # Indices to maintain > # the indexes are to support search in first name, last > name and email for both exact match and wild cards in the > end > index objectClass eq > index gn pres,eq,sub > index sn pres,eq,sub > index mail pres,eq,sub > > 2.3 DB_CONFIG (for BDB) > set_cachesize 0 52428800 1 > set_lg_bsize 2097512 > set_flags DB_LOG_AUTOREMOVE > set_lg_regionmax 262144 > > 2.4 Data setup > 2 million records (users with gn, sn, email, mobile, street > address, etc. in the BDB; all records are indexed using the > index in the above slapd.conf; grouped by the first > character of lastName. For example, > dn: ou=Z,dc=test,dc=dummy,dc=com > objectclass: organizationalUnit > ou: Z > > Sample LDIF entry: > #Directory Entry > dn: > uid=ABCDEFGHIJKLMNOPQRSTUVWXYZ123459,ou=F,dc=test,dc=dummy,dc=com > objectclass: top > objectclass: person > objectclass: organizationalPerson > objectclass: inetOrgPerson > uid: ABCDEFGHIJKLMNOPQRSTUVWXYZ123459 > ...... (details omitted) > > 3. Symptom/Problem > > It was very slow in the first (fresh) search if I searched > by wildcard firstname only like "Larry*" (which > returned 478 entries/users). The response time was generally > higher than 5 seconds Depending the count of records found, > the response time might exceed 20 or even 50 seconds. During > the search, the "iostat" result showed +95% > %iowait, await was much higher that svctm, the device %util > was over 96%. Here is the "iostat" output: > > Time: 10:51:34 AM > avg-cpu: %user %nice %sys %iowait %idle > 3.10 0.00 1.40 95.50 0.00 > > Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s > rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util > hda 0.00 2.90 64.94 65.33 1322.68 580.22 > 661.34 290.11 14.61 51.99 343.51 7.44 96.92 > dm-0 0.00 0.00 64.94 72.53 1322.68 580.22 > 661.34 290.11 13.84 55.44 330.62 7.06 96.99 > dm-1 0.00 0.00 0.00 0.00 0.00 0.00 > 0.00 0.00 0.00 0.00 0.00 0.00 0.00 > > > However, The subsequent search (using the exact search > criteria) is much faster (within 200ms). I believe it is > because of the cache. > > I did a "db_stat -m" check and saw +90% cache hit > rate (I guess it is normal?). The detailed output is in the > attachment. > > 4. Questions > The "iostat" output showed obvious I/O > bottleneck. Assuming I can't upgrade my hardware (for > example, adding another disk specifically for writing > transaction logs to), assuming I won't set a limit to > the max number of entried returned, is there anything else I > can do (typically BDB/slapd tuning or configuration) to make > the fresh/first search much faster (say within 2 seconds for > the worst case)? Did I do anything wrong? Please advise. > > Thanks a lot! > > Vic

3 5

CREATE LDAP REPLICA
by LITLE TUX 12 Sep '08

12 Sep '08

Hi i install openldap in servers and create replica but is not runin perfectly My entry in ldap server: MASTER SERVER: replogfile /var/log/replica/replica.log replica host=hostname_slave.domain.com:389 binddn="cn=Administrator,dc=domain,dc=com" bindmethod=simple credentials=123456 tls=none ################################################## ###################### SLAVE SERVER: updatedn "cn=Administrator,dc=domain,dc=com" updateref ldap://hostname_master.domain.com In my /etc/hosts configure any hostnames... The file replica.log is empty and not create replica. I execute normaly /etc/init.d/slurpd start only master server. Is necessary running slurod daemon is slave server? Exist other configuration to slapd.conf? My slapd.conf is same in master and slave except lines reference the replica. Thanks for your helps..... Best

1 0

pwd* Attributes and replication
by Eyal Marantenboim 12 Sep '08

12 Sep '08

Hi, We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. When a user tries to bind with incorrect credential, the master server gets populated with pwdFailureTime attribute. After 4 times of entering wrong credentials, pwdAccountLockedTime is added to that user. Our problem is that the secondary server (using syncrepl) is not replicating the pwd* values. I've noticed that neither entryCSN nor contextCSN are being updated (on the master) when pwdFailureTime is added to the user (I'm not sure if it should actually change). But, when we change any other attribute (userPassword, etc) on the master, that does change entryCSN, and all pwd* attributes do get updated in the seconday server. appreciate your help. Thanks!

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical