openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Performance - keep connection open between operations?
by k bah 04 Jul '08

04 Jul '08

I have some code that connects do LDAP, and between LDAP operations for a connection made, I have to contact other server (not LDAP), I wanna know if closing the connection to LDAP and then making it again (and of course a new bind) will take more time (I guess so) than wait for the "other" server to respond, and keep the connection to LDAP open. On some tests, the whole code (connect to the other server, closing that connection, and after that connecting to LDAP), with similar operations (operations performed on the "other" server and on the LDAP server) take no more than 1 second. The test was made with a *test* LDAP server, serves just me, but the "other" server, is a production one, that "almost 1 second group of operations" was made on a test LDAP server, and a real "other" server(busy), our company has a huge network and that server is clustered, thousands of connections/minute. I think it's best to connect to LDAP, bind, make operations on LDAP server, keep the connection open, query the "other" server, then get back with the LDAP operations, and just then close the connection to the LDAP server, what do you think? thanks = Home Business Miracle Discover How I Made $72,144.13. Last Month Giving Away Free Training. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=650f274a600e14d771ac3ee… -- Powered by Outblaze

2 1

Integrate openldap with postfix
by Aravind Arjunan 04 Jul '08

04 Jul '08

hi, I had configured postfix for my mail server which is working fine. I had configured openldap on the same server and added many entries in that. It is also working fine.when i use ldapsearch i can able to view the entries etc. The users which i had created in ldap is already there in OS for postfix. I had integrated openldap with postfix, to fetch the mail infromation from openldap. like mailid,mailQuota,mailbox location etc. But when i send mail to user it is fetching from openldap at all. It is strainght away delivering to mailbox.plz help me with this issue This is my main.cf file parameters. [root@master ~]# postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, *ldap:aliases *command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix debug_peer_level = 2 html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain mydomain = panafnet.com myhostname = master.panafnet.com mynetworks = 192.168.117.0/24, 127.0.0.0/8 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES relay_domains = $mydestination relayhost = $mydomain sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550 *aliases_server_host = localhost aliases_server_port = 389 aliases_search_base = dc=panafnet,dc=com aliases_scope = sub aliases_bind = no aliases_query_filter = (&(objectClass=qmailUser)(mail=%s)) aliases_result_attribute = mailMessageStore aliases_timeout = 10 aliases_version = 3*

2 4

[ldap with tls] installation problem
by GanGan 03 Jul '08

03 Jul '08

Hello all, I try to install tls for ldap but without success :( I make a CA (compiled openssl) when i start ldap with : service ldap start i have this logs : May 27 20:39:29 srvtest3 slapd[19546]: @(#) $OpenLDAP: slapd 2.3.27 (Jun 27 2007 08:48:26) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 39: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 44: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: main: TLS init def ctx failed: -1 May 27 20:39:29 srvtest3 slapd[19546]: slapd stopped. May 27 20:39:29 srvtest3 slapd[19546]: connections_destroy: nothing to destroy. my /etc/openldap/slapd.conf is : include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # logs loglevel 4 # needed for login_ldap allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=midian,dc=org" rootdn "cn=god,dc=midian,dc=org" rootpw {SSHA}EkM4ViGxzWnZQ2n5hKBBcfffFMTcCO-0E4 directory /var/lib/ldap index objectClass eq # ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=god,dc=midian,dc=org" write by * none access to * by self write by dn="cn=god,dc=midian,dc=org" write by * read # CA signed certificate and server cert entries: # TLS & SSL TLSCertificateFile /etc/openldap/cacerts/srvtest3.test.org.pem TLSCertificateKeyFile /etc/openldap/cacerts/srvtest3.test.org.key TLSCACertificateFile /etc/ssl/cacert.pem TLSVerifyClient never my /etc/openldap/ldap.conf base dc=midian,dc=org uri ldap//srvtest3.test.org/ ldap_version 3 TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT demand my /etc/ldap.conf # SSL & TLS ssl start_tls #ssl on #tls_checkpeer yes # Afin que le client puisse valider l'identitéu serveur, on doit le fournir la cléublique # du CA avec laquelle il pourra éblir que le certificat du serveur a bien é signéar # la clérivéde cette mê CA. TLS_CACERT /etc/openldap/cacerts/ldap.crt # On demande élement au client de toujours valider l'identitéu serveur. TLS_REQCERT demand # IP du serveur ldap #host 127.0.0.1 uri ldap://srvtest3.test.org/ # Le DN de base pour effectuer les recherches base dc=midian,dc=org # Optimisation de recherche dans la base scope=one # Pour que le poste demarre meme si le server ldap ne repond pas bind_policy soft # Version du protocole utilise ldap_version 3 # Port ecoute serveur port 389 # Filtres de validation dun utilisateur pam_filter objectclass=account pam_filter host=srvtest3.test.org # Attribut compare avec lindentifiant de connexion de lutilisateur pam_login_attribute uid # Verification attribut host pam_check_host_attr yes # DN groupe auquel il faut appartenir pour acces machine locale pam_groupdn ou=group,dc=midian,dc=org # Definit lattribut dappartenance au groupe pam_member_attribute member # password envoi serveur pam_password crypt # Parametres nss-ldap de recherche nss_base_passwd ou=user,dc=midian,dc=org?sub nss_base_shadow ou=user,dc=midian,dc=org?sub nss_base_group ou=group,dc=midian,dc=org?sub nss_base_hosts ou=machines,dc=midian,dc=org?sub if someone could help me it would be nice sorry for my bad english - GanGan -

1 0

Quota and groupOfUniqueNames
by AlexanDER Franca 03 Jul '08

03 Jul '08

Hi all. I have a Linux + ext3 system and I'm stuck in a situtation that I can't configure any quota of groups because all my groups are groupOfUniqueNames. I'm using Plone/Zope, so, now it's essential to use groupOfUniqueNames (and not posixGroup). Is there any way to fix this mess? Maybe I'm telling stupid things (like it's not possible use groupOfUniqueNames and group quota), I really don't know. Must I change schemas or something like that? []'s Alexander Brazil - Rio de Janeiro

1 0

Performance and TLS on bind/search operations.
by k bah 03 Jul '08

03 Jul '08

Hi, I noticed binds to the LDAP server with TLS off (plain connection) generate around 14 packets, while with TLS on, generate around twice the number of packets. It's not always twice, but near that. The smtp server only does anonymous binds do LDAP, while the IMAP server always use TLS, because it makes bind with DN/passwords. I don't think about changing this setup (smtp = plain connections, imap = tls connections). My question is about other software, code me and others write, that makes queries to the same LDAP server. We want to define a standard to always use TLS on code any of us write, so we don't need to recheck the code, to find if authenticated binds are being made without TLS, or sensitive data is being passed on a LDAP query with plain text connections. We can't always be sure if sensitive data will be passed, it's not just passwords. My question is, any of you can share your experience on LDAP perfomance regarding this, whether or not to *always use TLS*? I think it's best to be sure we always use TLS, but don't know the impact on performance. For the code we write I guess it will be no more than 100 connections/hour (bind operations). That's really not much, so I think TLS on everything won't be a problem. The real load is the smtp server use of LDAP, thousands/hour, but that's all plain connections, anon bind, search operations. thanks = Manage Clusters Easier Easy to use Graphical Interface. Get 90-99% HW Utilization - Try Moab. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=c8db0bf13ca5dbd1a987ac0… -- Powered by Outblaze

1 0

different shells on different hosts?
by Joy Khoriaty 02 Jul '08

02 Jul '08

Hi! I'd like my LDAP users to have different shells on 2 different client machines. Is that possible? how can I set it up? e.g, on host1, user1 has for shell /bin/bash, on host2, user1 has for shell /bin/rsh Someone suggested having the defined shell for the user in their LDAP entry be called e.g. /bin/ldap_shell, and symbolic linking accordingly on each machine, but it doesn't give me the granularity I want on a per user basis Any suggestions, pointers, ideas are more than welcomed! Thanks! -- Joy Khoriaty elventails(a)elventails.com http://elventails.com

2 2

How does Openldap work with Cyrus SASL and MIT Kerberos V
by Le Trung Kien 02 Jul '08

02 Jul '08

Hi everyone, I have built up one server with Openldap, Cyrus SASL, MIT Kerberos V. Now, my server can authenticate users. In "Authentication Configuration", I set option information for LDAP server and Kerberos server. And I could login with accounts (Kerberos principals) which are created through Kerberos. And user information can be obtained from LDAP server. But it's seem to be only Openldap and Kerberos work with together. I can't figure out what the SASL role is in this strategy. And how it effects on my system. When I attempt setup phpldapadmin, I must configure SASL option, but I don't know how SASL works with LDAP in this strategy ? -- Le Trung Kien.

5 8

ldap_bind: Invalid credentials (49)
by Wael Mashal 02 Jul '08

02 Jul '08

I install the openldap on windows I add the .ldif file on ldap put the problem appear when I use c:\OpenLDAP>ldapwhoami -x -D "cn=admin,o=world" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) Please help Wael Mashal Java Team Leader ASAL Technologies Ramallah, Palestine Tel: +970-2-2409 101 Fax: +970-2-2409 103 Mob: +970-52-487-11-70 Web: http://www.asaltech.com

2 1

openldap Master/slave
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi i had configured openldap in rhel5 as master/slave openldap version is 2.3 Slave is not getting replicating from master. These are the logs generated in master and slave server. plz help me with this issue. At the time restarting slapd.conf in master server. [B][root@master~]# tail -f /var/log/slapd.log[/B]Jul 1 21:07:21 master slapd[2960]: daemon: shutdown requested and initiated. Jul 1 21:07:21 master slapd[2960]: slapd shutdown: waiting for 0 threads to terminate Jul 1 21:07:21 master slapd[2960]: slapd stopped. Jul 1 21:07:22 master slapd[3254]: @(#) $OpenLDAP: slapd 2.3.27 (Jan 3 2007 13:13:17) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jul 1 21:07:23 master slapd[3255]: slapd starting ============================================================================================================================ ###At the time of restarting the slave slapd.conf##### [root@master~]# tail -f /var/log/slapd.log Jul 1 21:08:34 master slapd[3255]: conn=0 fd=13 ACCEPT from IP= 192.168.117.5:35205 (IP=0.0.0.0:389) Jul 1 21:08:34 master slapd[3255]: conn=0 op=0 BIND dn="cn=syncuser,dc=panafnet,dc=com" method=128 *Jul 1 21:08:34 master slapd[3255]: conn=0 op=0 RESULT tag=97 err=49 text=* *Jul 1 21:08:35 master slapd[3255]: conn=0 op=1 UNBIND *Jul 1 21:08:35 master slapd[3255]: conn=0 fd=13 closed Jul 1 21:08:35 master slapd[3255]: connection_read(13): no connection! [B][root@slave ~]# tail -f /var/log/slapd.log[/B]Jun 30 10:40:36 slave slapd[6481]: daemon: shutdown requested and initiated. Jun 30 10:40:36 slave slapd[6481]: slapd shutdown: waiting for 0 threads to terminate Jun 30 10:40:36 slave slapd[6481]: slapd stopped. Jun 30 10:40:37 slave slapd[6758]: @(#) $OpenLDAP: slapd 2.3.27 (Jan 3 2007 13:13:17) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jun 30 10:40:38 slave slapd[6759]: slapd starting *Jun 30 10:40:38 slave slapd[6759]: do_syncrep1: ldap_sasl_bind_s failed (49)* * *

2 1

me
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi, i had configured openldap and postfix in rhel 5. I had not installed any source code for the above two. With the help of rpm only i had configured ldap and postfix. Now i need to integrate openldap with postfix. I had followed the redhat documents for integrating. I want to know wheather it is necessary to complie ldap with postfix source code instead of rpm's? and kindly tell what mistake i had made here? plz look the error which am getting while sending mail to user who is located in ldap database. This is my configuration paramaters: ===================================== alias_maps = hash:/etc/postfix/aliases, ldap:ldapaliases alias_database = hash:/etc/postfix/aliases, ldap:ldapaliases ldapaliases_server_host = localhost ldapaliases_server_port = 389 ldapaliases_search_base = dc=panafnet,dc=com ldapaliases_scope = sub ldapaliases_query_filter = (|(mailid=%s)) ldapaliases_result_attribute = maildrop Error in maillog ================= Jul 1 17:18:05 experts postfix/cleanup[7422]: 900CFFDFE1: message-id=< 20080701114805.900CFFDFE1(a)experts.panafnet.com> Jul 1 17:18:05 experts postfix/qmgr[7416]: 900CFFDFE1: from=< root(a)panafnet.com>, size=310, nrcpt=1 (queue active) Jul 1 17:18:05 experts postfix/local[7424]: warning: dict_ldap_lookup: ldapaliases: Search base '' not found: 32: No such object Jul 1 17:18:05 experts postfix/local[7424]: 900CFFDFE1: to=< aravind(a)panafnet.com>, orig_to=<aravind>, relay=local, delay=0, status=deferred (alias database unavailable)

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical