openldap-technical

openldap-technical@openldap.org

5 participants
9991 discussions

custom bind attribute
by Stefano Zanmarchi 15 Sep '08

15 Sep '08

Hi all, I'd like to let users bind against an attribute other than "userPassword". Is it possible or is userPassword hardcoded? Moreover I'd like to serve bind requests from one IP against "userPassword" and bind requests from another IP against another (custom) attribute. Is this possible by any chance? Thank you very much for your help, Stefano

2 1

Migrating AD Users/Groups to samba-ldap server
by janskey 15 Sep '08

15 Sep '08

Hi All, I need advice on how i can pull down AD users/groups (password of each users) to samba-ldap server. I already configured my server using the howto: * http://www.howtoforge.com/openldap-samba-domain-controller-ubuntu7.10 * http://ubuntuforums.org/showthread.php?t=640760 I tried also ldifde to create ldif files and tried to populate in smbldap-tools. But it has an error, some sort of compatibility of ldif syntax. Our objective is to phase out or Win2003 AD server and user samba+ldap authentication scheme. cheers, janskey

2 1

Active directory change notification using open ldap library: errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece
by susant sahani 15 Sep '08

15 Sep '08

Hi , I am trying to syncing up with Active directory. When ever there is a change in active directory it should send the information. But It's keep on sending me this error message . errorMessage: 00000057: LdapErr: DSID-0C09068F, comment: Error processing control, data 0, vece LDAP_SERVER_NOTIFICATION_OID_W "1.2.840.113556.1.4.528" char* base="dc=ad,dc=hello123,dc=com"; char* filter="(objectClass=*)"; controls[0] = create_psearch_control (LDAP_SERVER_NOTIFICATION_OID_W, 1, 1); controls[1] = 0; ret = ldap_search_ext (ld, base, LDAP_SCOPE_SUBTREE, filter, 0, /* attrs */ 0, /* attrsonly */ controls, 0, /* clientctrls */ 0, /* timeout */ LDAP_NO_LIMIT, &msgid); while ((ret = ldap_result (ld, msgid, LDAP_MSG_RECEIVED, &timeout, &entries)) >= 0) { LDAPMessage *entry; LDAPControl **ec_controls; if (!ret) { printf ("Timed out\n"); continue; } } Please let me know what I am doing wrong. -- Thanks, Susant

1 0

Syncrepl missing cn,sn and givenName
by Stelios A. 13 Sep '08

13 Sep '08

Hello all, I'm going mad with a problem during syncrepl. I have one master and one slave. When I add one entry to the master the record is replicated to the slave without a problem but without all fields and this is causing me problems as from a shell cannot resolve the user using for example the command 'id username'. That gives me an error, no such a user and cause further problems with existin email setup. Under master ldap everything works/resolves fine. If I manually add the whole tree of the master including the 'username' entry then it works fine. Master entry is like: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top givenName: Kostas sn: Somelastname cn: Kostas Somelastname uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com and slave when replicated has: dn: cn=Kostas Somelastname,ou=Users,dc=mydomain,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: person objectClass: organizationalPerson objectClass: top uid: kSomelastname userPassword: {MD5}gnzLDuqKcGxMNKFokfhOew== uidNumber: 1802 gidNumber: 100 homeDirectory: /home/kSomelastname loginShell: /bin/false mail: kSomelastname(a)mydomain.com If you check the fields that missing from slave are: cn, sn and givenName My slave slapd.conf has: syncrepl rid=001 provider=ldap://192.168.1.110 type=refreshOnly interval=00:00:05:00 retry="30 10 600 20" searchbase="dc=mydomain,dc=com" attrs="*" scope=sub binddn="uid=syncrepl,ou=System,dc=mydomain,dc=com" credentials=smypassword updateref ldap://192.168.1.110 Any help is much appreciated. Thanks a lot

2 1

Chage for LDAP
by Gustavo Mendes de Carvalho 13 Sep '08

13 Sep '08

Hi All, Is there any tool for LDAP that works like chage, to inform when I changed my password, when will expire, and so on. I am using Openldap 2.3.39 with ppolicy. Thanks --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

Re: Help: Slow LDAP search with high %iowait
by Victor 12 Sep '08

12 Sep '08

Would you folks mind sharing some thoughts/ideas on this? Thanks a lot! --- On Mon, 9/8/08, Victor <victorfuman(a)yahoo.com> wrote: > From: Victor <victorfuman(a)yahoo.com> > Subject: Help: Slow LDAP search with high %iowait > To: openldap-technical(a)openldap.org > Date: Monday, September 8, 2008, 5:35 PM > Hi , > > I did quite a bit reading and research before I send email > to this list for help. If I have missed some basic concepts > here, please execuse my ignorance. Thanks for your help and > time in advance. > > 1. Summary > The initial search in my prototyping with OpenLDAP (slapd + > BDB) seemed to be slow. What is the reason and How could I > fix it? > > 2. Configuration > 2.1 Environment > Linux CentOS, 1 hard disk (therefore unfortunately the BDB > transaction logs and database files are written to the same > disk), 120GB disk space (80% unused), 1GB RAM, reserved for > this prototyping, OpenLDAP 2.3.39 with default BDB > installation > > 2.2 slapd.conf (modified trivially for discussion > purpose) > # global configuration > loglevel 0 > > # BDB > database bdb > suffix "dc=test,dc=dummy,dc=com" > rootdn > "cn=Manager,dc=test,dc=dummy,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for > details. > # Use of strong authentication encouraged. > rootpw secret > # The database directory MUST exist prior to running slapd > AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > directory /usr/local/var/openldap-data > #Other DB configuration > idlcachesize 60000 > cachesize 20000 > # Indices to maintain > # the indexes are to support search in first name, last > name and email for both exact match and wild cards in the > end > index objectClass eq > index gn pres,eq,sub > index sn pres,eq,sub > index mail pres,eq,sub > > 2.3 DB_CONFIG (for BDB) > set_cachesize 0 52428800 1 > set_lg_bsize 2097512 > set_flags DB_LOG_AUTOREMOVE > set_lg_regionmax 262144 > > 2.4 Data setup > 2 million records (users with gn, sn, email, mobile, street > address, etc. in the BDB; all records are indexed using the > index in the above slapd.conf; grouped by the first > character of lastName. For example, > dn: ou=Z,dc=test,dc=dummy,dc=com > objectclass: organizationalUnit > ou: Z > > Sample LDIF entry: > #Directory Entry > dn: > uid=ABCDEFGHIJKLMNOPQRSTUVWXYZ123459,ou=F,dc=test,dc=dummy,dc=com > objectclass: top > objectclass: person > objectclass: organizationalPerson > objectclass: inetOrgPerson > uid: ABCDEFGHIJKLMNOPQRSTUVWXYZ123459 > ...... (details omitted) > > 3. Symptom/Problem > > It was very slow in the first (fresh) search if I searched > by wildcard firstname only like "Larry*" (which > returned 478 entries/users). The response time was generally > higher than 5 seconds Depending the count of records found, > the response time might exceed 20 or even 50 seconds. During > the search, the "iostat" result showed +95% > %iowait, await was much higher that svctm, the device %util > was over 96%. Here is the "iostat" output: > > Time: 10:51:34 AM > avg-cpu: %user %nice %sys %iowait %idle > 3.10 0.00 1.40 95.50 0.00 > > Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s > rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util > hda 0.00 2.90 64.94 65.33 1322.68 580.22 > 661.34 290.11 14.61 51.99 343.51 7.44 96.92 > dm-0 0.00 0.00 64.94 72.53 1322.68 580.22 > 661.34 290.11 13.84 55.44 330.62 7.06 96.99 > dm-1 0.00 0.00 0.00 0.00 0.00 0.00 > 0.00 0.00 0.00 0.00 0.00 0.00 0.00 > > > However, The subsequent search (using the exact search > criteria) is much faster (within 200ms). I believe it is > because of the cache. > > I did a "db_stat -m" check and saw +90% cache hit > rate (I guess it is normal?). The detailed output is in the > attachment. > > 4. Questions > The "iostat" output showed obvious I/O > bottleneck. Assuming I can't upgrade my hardware (for > example, adding another disk specifically for writing > transaction logs to), assuming I won't set a limit to > the max number of entried returned, is there anything else I > can do (typically BDB/slapd tuning or configuration) to make > the fresh/first search much faster (say within 2 seconds for > the worst case)? Did I do anything wrong? Please advise. > > Thanks a lot! > > Vic

3 5

CREATE LDAP REPLICA
by LITLE TUX 12 Sep '08

12 Sep '08

Hi i install openldap in servers and create replica but is not runin perfectly My entry in ldap server: MASTER SERVER: replogfile /var/log/replica/replica.log replica host=hostname_slave.domain.com:389 binddn="cn=Administrator,dc=domain,dc=com" bindmethod=simple credentials=123456 tls=none ################################################## ###################### SLAVE SERVER: updatedn "cn=Administrator,dc=domain,dc=com" updateref ldap://hostname_master.domain.com In my /etc/hosts configure any hostnames... The file replica.log is empty and not create replica. I execute normaly /etc/init.d/slurpd start only master server. Is necessary running slurod daemon is slave server? Exist other configuration to slapd.conf? My slapd.conf is same in master and slave except lines reference the replica. Thanks for your helps..... Best

1 0

pwd* Attributes and replication
by Eyal Marantenboim 12 Sep '08

12 Sep '08

Hi, We have 1 master and 1 secondary servers (version 2.4.11) using ppolicy. When a user tries to bind with incorrect credential, the master server gets populated with pwdFailureTime attribute. After 4 times of entering wrong credentials, pwdAccountLockedTime is added to that user. Our problem is that the secondary server (using syncrepl) is not replicating the pwd* values. I've noticed that neither entryCSN nor contextCSN are being updated (on the master) when pwdFailureTime is added to the user (I'm not sure if it should actually change). But, when we change any other attribute (userPassword, etc) on the master, that does change entryCSN, and all pwd* attributes do get updated in the seconday server. appreciate your help. Thanks!

1 0

Re: Reentrant library question.
by William Jojo 12 Sep '08

12 Sep '08

---- Original message ---- >Date: Thu, 11 Sep 2008 14:55:14 +0100 >From: Duncan Gibb <Duncan.Gibb(a)SiriusIT.co.uk> >Subject: Re: Reentrant library question. >To: William Jojo <w.jojo(a)hvcc.edu> >Cc: openldap-technical(a)openldap.org > >William Jojo wrote: > >WJ> I manage a set of packages [..] for AIX 5.3 and 6.1. > >WJ> Is it safe to [..] > >WJ> libldap.so -> libldap_r.so > >Disclaimer: I do not speak AIX. > That's ok, I do. :-) :-) >The Debian Linux OpenLDAP packages have been doing this since 2.4.7. >We've deployed these and not come across any serious problems (said he, >about to roll out a 2.4.11 backport...). > Sounds wonderful! Thanks a bunch! Cheers, Bill > >Cheers > > >Duncan > >-- >Duncan Gibb, Technical Architect >Sirius Corporation - The Open Source Experts >http://www.siriusit.co.uk/ >Tel: +44 870 608 0063 || +44 7977 441 515

1 0

Reentrant library question.
by William Jojo 11 Sep '08

11 Sep '08

I manage a set of packages under the name pWare for AIX 5.3 and 6.1. I am upgrading the core OpenLDAP from 2.3.38 to 2.4.11 and wanted to do something IBM does with libc. They link libc.a -> libc_r.a Is it safe to do the same in OpenLDAP such that: libldap.so -> libldap_r.so ? Then I rebuild any packages that depended on 2.3 for 2.4. Cheers, Bill

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical