openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

syncrel seems ignore some of the LDAP update request
by Paul Lee 28 Apr '08

28 Apr '08

Dear all, I have setup 2 LDAP servers, the slapd.conf as show below : - server 1 (rid = 002) =============== syncprov-checkpoint 100 10 syncprov-sessionlog 100 # syncrepl directives syncrepl rid=002 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 syncrepl rid=003 provider=ldap://10.0.1.34:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 mirrormode on serverID 002 - server 2 (rid = 003) =============== syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=002 provider=ldap://10.166.23.218:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 syncrepl rid=003 provider=ldap://10.0.1.34:389/ bindmethod=simple binddn="cn=Manager" credentials=secret searchbase="o=HKSARG" schemachecking=off type=refreshAndPersist attrs="*,+" retry="1 +" interval=00:00:01:00 mirrormode on serverID 003 Testing procedure ============= - I have created 1 DN called with dn as "cn=user3,ou=SCIG,ou=Govt-Dept,o=HKSARG", then, I use a program to update the attribute(user defined) LastLoginTime in server 1, after that, I list the content of the content of LastLoginTime in both server 1 and server 2 and find that the content is different. server 1's data is correct but server 2's data is not correct. In checking the ldap log in server 2, I find the following : It seems that the update request is ignored, what's wrong ? I have checked the time in both server 1 and server 2, they are the same. syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) syncrepl_entry: rid=002 be_search (0) syncrepl_entry: rid=002 cn=user3,ou=SCIG,ou=Govt-Dept,o=HKSARG slap_queue_csn: queing 0x9b869f0 20080429020045.698548Z#000000#002#000000 slap_graduate_commit_csn: removing 0x9b86388 20080429020045.698548Z#000000#002#000000 syncrepl_entry: rid=002 be_modify (0) slap_queue_csn: queing 0x9b869f0 20080429020045.698548Z#000000#002#000000 null_callback : error code 0x10 slap_graduate_commit_csn: removing 0x9b89218 20080429020045.698548Z#000000#002#000000 syncrepl_updateCookie: rid=002 be_modify failed (16) do_syncrepl: rid=002 retrying syncprov_sendresp: cookie=rid=003,sid=003,csn=20080429020045.698548Z#000000#002#000000 do_syncrep2: cookie=rid=003,sid=003,csn=20080429020045.499891Z#000000#002#000000 do_syncrep2: rid=003 CSN too old, ignoring 20080429020045.499891Z#000000#002#000000 do_syncrep2: rid=002 LDAP_RES_INTERMEDIATE - REFRESH_DELETE do_syncrep2: cookie=rid=003,sid=003,csn=20080429020045.504107Z#000000#002#000000 do_syncrep2: rid=003 CSN too old, ignoring 20080429020045.504107Z#000000#002#000000 do_syncrep2: cookie=rid=003,sid=003,csn=20080429020045.508906Z#000000#002#000000 do_syncrep2: rid=003 CSN too old, ignoring 20080429020045.508906Z#000000#002#000000 do_syncrep2: cookie=rid=003,sid=003,csn=20080429020045.521010Z#000000#002#000000 do_syncrep2: rid=003 CSN too old, ignoring 20080429020045.521010Z#000000#002#000000 do_syncrep2: cookie=rid=003,sid=003,csn=20080429020045.526839Z#000000#002#000000 do_syncrep2: rid=003 CSN too old, ignoring 20080429020045.526839Z#000000#002#000000 do_syncrep2: cookie=rid=003,sid=003,csn=20080429020045.530847Z#000000#002#000000 Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

Serious performance problems
by Mikel.Santos＠idom.com 28 Apr '08

28 Apr '08

Hi guys, First of all, I would like to thank the community for such a great piece of software and encourage the developers to keep up the good work. Until now, the setup of the ldap and the file configuration has been pretty straightforward. The ldap was performing great with few entries, but things got worse as the number of entries in the ldap increased. Currently we are experiencing serious performance problems when the searches performed exceed certain amount of entries. The "ldap_search" calls usually return after a few seconds but as the number of results matching the filter entered increases, the waiting time varies from one minute to many minutes. The scenario is the following: * We are accessing openldap via PHP function calls * The number of entries in the ldap is close to 100.000 * The hardware is the following: Intel(R) Xeon(TM) CPU 3.33GHz 1Gb RAM * The slapd.conf file is the following: /************************************************************************************************************/ modulepath /usr/lib/ldap moduleload back_bdb sizelimit -1 tool-threads 1 backend bdb checkpoint 512 30 database bdb directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 cachesize 100000 /************************************************************************************************************/ We have tried to increase both set_cachesize and cachesize (multiplying both by 100) and have not noticed a performance increase. I hope any of you can point us in the right direction since we are beginning to get desperated... Thanks in advance, Mikel

3 4

ldap_sasl_interactive_bind_s: Local error (-2)
by Rodrigo Castro 28 Apr '08

28 Apr '08

Hi, can anyone help me find what's causing this error? ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code krb5 7) -- __________________________________ Rodrigo de Castro Cosme Ciência da Computação - Universidade Federal do Espírito Santo Suporte mailing list - suporte(a)inf.ufes.br MSN - rdccosmo(a)gmail.com

1 0

RE: Compiling openldap-2.4.8 on cygwin
by Gavin Henry 28 Apr '08

28 Apr '08

> Thanks for the reply. > Anyone know of a decent dummies guide to compiling mingw exes? > I've never done this before. > Thanks, > > Chris > > IIRC, it's the same as normal on *unix, that's the point: /configure --blah make depend make make test

2 1

OpenLDAP Updating Schema Definition
by Jimmy Liang 24 Apr '08

24 Apr '08

I've read that OpenLDAP supports runtime schema modifications but I can't figure out the extensiveness of this feature. On Sun's page ( http://java.sun.com/products/jndi/tutorial/ldap/schema/object.html under the header "Adding a New Object Class") it's telling me that OpenLDAP does not support this kind of modification. When I try the code on that page, I run into Exception in thread "main" javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - objectClasses: value #0 invalid per syntax]; remaining name '' And in the syslog I noticed this Apr 24 15:38:14 localhost slapd[6532]: daemon: read activity on 12 Apr 24 15:38:14 localhost slapd[6532]: connection_get(12) Apr 24 15:38:14 localhost slapd[6532]: connection_get(12): got connid=14 Apr 24 15:38:14 localhost slapd[6532]: connection_read(12): checking for input on id=14 Apr 24 15:38:14 localhost slapd[6540]: do_modify Apr 24 15:38:14 localhost slapd[6540]: do_modify: dn (cn=Subschema) Apr 24 15:38:14 localhost slapd[6540]: => get_ctrls Apr 24 15:38:14 localhost slapd[6540]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) Apr 24 15:38:14 localhost slapd[6532]: ber_get_next on fd 12 failed errno=11 (Resource temporarily unavailable) Apr 24 15:38:14 localhost slapd[6540]: <= get_ctrls: n=1 rc=0 err="" Apr 24 15:38:14 localhost slapd[6540]: >>> dnPrettyNormal: <cn=Subschema> Apr 24 15:38:14 localhost slapd[6540]: <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> Apr 24 15:38:14 localhost slapd[6540]: send_ldap_result: conn=14 op=3 p=3 Apr 24 15:38:14 localhost slapd[6540]: send_ldap_result: err=21 matched="" text="objectClasses: value #0 invalid per syntax" Apr 24 15:38:14 localhost slapd[6540]: send_ldap_response: msgid=4 tag=103 err=21 Apr 24 15:38:14 localhost slapd[6540]: conn=14 op=3 RESULT tag=103 err=21 text=objectClasses: value #0 invalid per syntax Apr 24 15:38:14 localhost slapd[6532]: daemon: select: listen=6 active_threads=0 tvp=NULL Apr 24 15:38:14 localhost slapd[6532]: daemon: activity on 1 descriptor Apr 24 15:38:14 localhost slapd[6532]: daemon: activity on: Apr 24 15:38:14 localhost slapd[6532]: 13r Does OpenLDAP allow programmic (hopefully but necessarily Java) schema changes at runtime?

2 1

bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989)
by Srinidhi Sharma 24 Apr '08

24 Apr '08

Hi, I am using open ldap 2.4.8 with berkeley db 4.6.21 The installation of the open ldap went through successfully. But I have the following problem. 1. When tried accessing the dc=example,dc=com through ldapsearch it fails with no such object. ldapsearch -h my-openldap-host -p 9011 -D"cn=Manager,dc=example,dc=com" -w secret -b 'dc=example,dc=com' -s sub 'objectclass=*' ldap_search: No such object Following the error msgs from slapd ========================== => bdb_search bdb_dn2entry("dc=example,dc=com") => bdb_dn2id("dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) send_ldap_result: conn=2 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=32 ber_flush2: 14 bytes to sd 11 0000: 30 0c 02 01 02 65 07 0a 01 20 04 00 04 00 0....e... .... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 20 04 00 04 00 0....e... .... connection_get(11): got connid=2 connection_read(11): checking for input on id=2 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=2 op=2 do_unbind connection_closing: readying conn=2 sd=11 for close connection_resched: attempting closing conn=2 sd=11 contents of slapd.conf are =================== database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory <myhost-dir>/openldap/install/openldap-2.4.8/var/openldap-data # Indices to maintain index objectClass eq However, when I try ldapbind to the open ldap it works fine.. ldapbind -h my-openldap-host -p 9011 -D"cn=Manager,dc=example,dc=com" -w secret And also , base search goes through fine. ldapsearch -h my-openldap-host -p 9011 -D"cn=Manager,dc=example,dc=com" -w secret -b '' -s base 'objectclass=*' How do I get around this error !!!, is there any configuration mismatch ??? The slapd is running as a normal unix user and not as a "ldap "user. Command used to run the slapd is: ./slapd -h ldap://my-openldap-host:9011 -f ../etc/openldap/slapd.conf -d3 Please help -- Thanks, Srinidhi

1 0

OpenLDAP: slave is not being updated by master and replog is empty
by brad davison 24 Apr '08

24 Apr '08

I am working in a test environment to construct a SAMBA / LDAP domain for windows clients. There is a PDC with OpenLDAP server 2.3.35 and SAMBA 3.026 running on ubuntu server 7.10. The PDC is functioning; I am able to create users and login with them, as well as join workstations to the domain. The slave slapd was populated with an output from an ldif file that was exported from the master via: slapcat -l >> master.ldif I had entered the 'replica' line in the master-slapd, and the updatedn and updateref lines in the slave-slapd as stated in 14.4 in the OpenLDAP 2.3 admin's guide. The 'openldap' user has rights to the replog file. Problem 1) The master (dc01-ubuntu.example.local) is not updating the replog file with either a success or failure. Problem 2) The slave (bdc01-ubuntu.example.local) is not getting updates from the master when changes occur. I am relatively new to LDAP and I might be missing something core. I have the OpenLDAP admin guide printed out and I am referring to it, but I believe I had entered the lines as the book instructed. Attached are my master-slapd.conf and slave-slapd.conf files. Again, this is a test environment for now. I understand the current setup is not secure. What I would like to achieve is a working PDC -> BDC replication. When I start slapd on the master i get:Starting OpenLDAP: slapd slurpd. with no errors. When I start slapd on the slave I get : Starting OpenLDAP: slapd with no errors. master-slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 0 modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb suffix "dc=example,dc=local" rootdn "cn=admin,dc=example,dc=local" rootpw 12345 replica uri=ldap://bdc01-ubuntu.example.local:389 binddn="cn=admin,dc=example,dc=local" credentials=12345 bindmethod=simple tls=no replogfile /var/log/replog.bdc01-ubuntu.example.local directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=example,dc=local" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=local" write by * read ------------------------- slave slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 0 modulepath /usr/lib/ldap moduleload back_bdb operation sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb ### slurpd updatedn "cn=admin,dc=example,dc=local" updateref ldap://dc01-ubuntu.example.local suffix dc=example,dc=local rootdn cn=admin,dc=example,dc=local rootpw 12345 directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=example,dc=local" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=local" write by * read ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 7

noob ldap question
by Nizameddin Ordulu 23 Apr '08

23 Apr '08

Hi All, My apologies in advance if this is not the right place to ask this noob question. I am trying to create an ldap database with base dn: dc=tr,dc=tc. Once created it will be used to store the email accounts like username(a)tr.tc. When I execute the command to modify the dn entry, I get the following error root@nizam-desktop:/home/nizam/Desktop# ldapadd -f user2.ldiff -xv -D "cn=admin,dc=tr,dc=tc" -h 127.0.0.1 -w 1234 ldap_initialize( ldap://127.0.0.1 ) add objectClass: top dcObject organization add dc: tr tc add description: top level of the tr.tc hierarchy adding new entry "dc=tr,dc=tc" modify complete ldap_add: Constraint violation (19) additional info: dc: multiple values provided The user2.ldiff file looks like this: dn: dc=tr,dc=tc objectClass: top objectClass: dcObject objectClass: organization dc: tr dc: tc description: top level of the tr.tc hierarchy dn: cn=admin,dc=tr,dc=tc objectClass: organizationalRole cn: admin description: LDAP Directory Administrator dn: cn=user1,dc=tr,dc=tc objectClass: inetOrgPerson objectClass: inetLocalMailRecipient cn: user1 sn: user1lastname mail: user1(a)tr.tc userPassword: 1234 mailHost: 127.0.0.1 The configuration for the database dc=tr,dc=tc is as follows (part of /etc/ldap/slapd.conf) database bdb suffix "dc=tr,dc=tc" rootdn "cn=admin,dc=tr,dc=tc" rootpw 1234 directory /var/lib/ldap/trtc defaultaccess read schemacheck on lastmod on index cn,sn,st,o eq,pres,sub my OS is Ubuntu 7.10 and i am running slapd installed by the synaptic manager. root@nizam-desktop:/home/nizam/Desktop# uname -a Linux nizam-desktop 2.6.22-14-generic #1 SMP Sun Oct 14 23:05:12 GMT 2007 i686 GNU/Linux Can anyone please tell me why I can not add dc=tr,dc=tc? Kind regards, nizam -- Nizameddin Ordulu

3 3

Re: AW: Invalid syntax (21)
by Luke Lee 23 Apr '08

23 Apr '08

I referenced both the section 4.3 and 6.27 of the rfc2252 and tried the following: (,l\5Fluke,mydomain.com) (,l\_luke,mydomain.com) (,l'\_'luke,mydomain.com (,l"_"luke,mydomain.com) (,(l'_'luke,mydomain.com) (,l"\5F"luke,mydomain.com) (,l"\_"luke,mydomain.com) (,"l_luke",mydomain.com) (,'l_luke',mydomain.com) However, none of the above worked. What is the correct way of doing the escape? Your help will be much appreciated! Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Wednesday, April 23, 2008 6:37:33 AM Subject: Re: AW: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi Claus, > > Thank you for your valuable opinion. > > I tried to "fix" the syntax problem by removing the _ from the username. It > worked! However, I want to use the _ because this is my company's user naming > convention. I have to point out that when I ran the early version of OpenLDAP > (version 2.2-13), there were no syntax problems when I used the ldif with the > nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP > (version 2.3-39). Then, I immediately encountered the invalid syntax problem > when I triled to load the same ldif. RFC-2307 defines the attribute elements of syntax 'keystring, keystring, as defined in rfc2252, does not allow underscores, if you do require underscores you may escape this character. -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: AW: Invalid syntax (21)
by Luke Lee 23 Apr '08

23 Apr '08

I referenced both the section 4.3 and 6.27 of the rfc2252 and tried the following: (,l\5Fluke,mydomain.com) (,l\_luke,mydomain.com) (,l'\_'luke,mydomain.com (,l"_"luke,mydomain.com) (,(l'_'luke,mydomain.com) (,l"\5F"luke,mydomain.com) (,l"\_"luke,mydomain.com) (,"l_luke",mydomain.com) (,'l_luke',mydomain.com) However, none of the above worked. What is the correct way of doing the escape? Your help will be much appreciated! Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Wednesday, April 23, 2008 6:37:33 AM Subject: Re: AW: Invalid syntax (21) Luke Lee <leeluke77(a)yahoo.com> writes: > Hi Claus, > > Thank you for your valuable opinion. > > I tried to "fix" the syntax problem by removing the _ from the username. It > worked! However, I want to use the _ because this is my company's user naming > convention. I have to point out that when I ran the early version of OpenLDAP > (version 2.2-13), there were no syntax problems when I used the ldif with the > nisNetgroupTriple that was defined. I just did a custom build of OpenLDAP > (version 2.3-39). Then, I immediately encountered the invalid syntax problem > when I triled to load the same ldif. RFC-2307 defines the attribute elements of syntax 'keystring, keystring, as defined in rfc2252, does not allow underscores, if you do require underscores you may escape this character. -Dieter -- Dieter Klünter | Systemberatung http://www..dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical