openldap-technical

openldap-technical@openldap.org

7 participants
9864 discussions

OpenLDAP 2.5.3 Beta binary builds for testing
by Quanah Gibson-Mount 02 Apr '21

02 Apr '21

Symas is pleased to provide binary builds of the OpenLDAP 2.5.3 beta for testing purposes only on the following select platforms. Builds install into /opt/openldap25/ with state files stored in /var/opt/openldap25/ so as to be entirely self contained. No init scripts are provided and it is expected that end testers are familiar with OpenLDAP configuration. Please file any software (not packaging) related issues found at https://bugs.openldap.org/ These builds include a number of contrib modules in addition to the stock OpenLDAP offerings. Platforms: Ubuntu 20.04 LTS RHEL8 and binary compatible distributions (note: requires EPEL) Fedora 34 -------------------------------------------------- Ubuntu 20.04 LTS installation instructions: sudo add-apt-repository ppa:symas/openldap25 sudo apt-get update sudo apt install openldap-clients openldap-server -------------------------------------------------- -------------------------------------------------- RHEL8 installation instructions: dnf install 'dnf-command(copr)' dnf install epel-release dnf copr enable symas/openldap25 yum install openldap25-libs openldap25-clients openldap25-server -------------------------------------------------- -------------------------------------------------- Fedora 34 installation instructions: dnf install 'dnf-command(copr)' dnf copr enable symas/openldap25 yum install openldap25-libs openldap25-clients openldap25-server -------------------------------------------------- Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 02 Apr '21

02 Apr '21

--On Friday, April 2, 2021 6:29 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > HI Quanah, > > Any help would be appreciated, I am making sure to collecting additional > logs. In case if you get a time to look the issue and help us. Don't spam the list, you already sent this email. I've nothing further to add at this time. I would note that loglevel is not debug (terminology is important). If you had a ulimit issue where you were running out of file descriptors in the slapd process, then that would be clearly logged. I don't suggest making gratuitous changes that are not backed up by documented evidence. --Quanah > We are scheduling the change ticket for this weekend. I just want to make > sure below action items I am going to try. > > 1) enable the debug logs >>> loglevel stats in ldap.conf > 2) would like to increase the ulimit to 16K from 4k to just rule out > limit issue. > > After enabling the debug logs will capture the logs from master and > clients(2-3) to review later. I guess I will see the same issue after the > cutover from old servers to new servers and I will roll back to old > servers . > > Let me know if you have other suggestion to capture more data. > > -Narayanan > > -----Original Message----- > From: Ballem, Narayanan > Sent: Wednesday, March 31, 2021 11:41 AM > To: Quanah Gibson-Mount <quanah(a)symas.com>; > openldap-technical(a)openldap.org Subject: RE: [EXT]:Re: Openldap client is > not populating GID name instead of it just getting GID with empty Group > name > > HI Quanah, > > Hope you are doing good !!! > We are scheduling the change ticket for this weekend. I just want to make > sure below action items I am going to try. > > 1) enable the debug logs >>> loglevel stats > 2) would like to increase the ulimit to 16K from 4k to just rule out > limit issue. > > After enabling the debug logs will capture the logs from master and > clients(2-3) to review later. I guess I will see the same issue after the > cutover from old servers to new servers and I will roll back to old > servers . > > Let me know if you have other suggestion to capture more data. > > Thanks for your valuable time. > > -Narayanan > -----Original Message----- > From: Ballem, Narayanan > Sent: Tuesday, March 23, 2021 2:21 PM > To: 'Quanah Gibson-Mount' <quanah(a)symas.com>; > openldap-technical(a)openldap.org Subject: RE: [EXT]:Re: Openldap client is > not populating GID name instead of it just getting GID with empty Group > name > > Unfortunately I cannot demonstrate right now as my old prod servers live > and I cannot bring new systems into traffic during business hours. I can > schedule the activity on coming on April 3rd/4th where I can collect > additional logging as you mentioned and replicate the issue. > > -Narayanan > > -----Original Message----- > From: Quanah Gibson-Mount <quanah(a)symas.com> > Sent: Tuesday, March 23, 2021 2:13 PM > To: Ballem, Narayanan <Narayanan.Ballem(a)Staples.com>; > openldap-technical(a)openldap.org Subject: RE: [EXT]:Re: Openldap client is > not populating GID name instead of it just getting GID with empty Group > name > > > > --On Tuesday, March 23, 2021 7:05 PM +0000 "Ballem, Narayanan" > <Narayanan.Ballem(a)Staples.com> wrote: > >> Ok I will test this one. >> Unfortunately I cannot test this as I see only during the cutover from >> old to new servers.. >> >> Apart from additional logging do you suggest any tuning to take more >> 5k ldap clients connections ? > > No, you've yet to even demonstrate that OpenLDAP is having any issue. > All you've noted is that you're having some issue somewhere in your stack. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sym > as.com%2F&data=04%7C01%7CNarayanan.Ballem%40Staples.com%7C59043688533 > a4266ee4108d8ee274ca1%7Cb101f7ab56ac485fb3975279698fdf7d%7C1%7C0%7C637521 > 199838305231%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIi > LCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FPOxOEnVAaVQGNXLaZUsHSu > asC9LoROX1EQd2biE8FE%3D&reserved=0> -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

openSUSE and SLE packages of OpenLDAP 2.5.3beta available
by Michael Ströder 01 Apr '21

01 Apr '21

On 4/1/21 6:17 AM, project(a)openldap.org wrote: > OpenLDAP 2.5.3beta is now available for experimentation and testing. You can find openSUSE and SLE packages of release 2.5.3beta in this OBS project: https://build.opensuse.org/project/show/home:stroeder:openldap25 Notes: - The packages are experimental and not tested in production. - This is my private work not related to the OpenLDAP project => blame me if something looks wrong with the packaging. - If unsure install openldap-ms, not openldap2, for testing (see below). Safe option: openldap-ms home:stroeder:openldap25/openldap-ms contains packages installed into a separate prefix /opt/openldap-ms. You can safely install these without breaking system-wide libraries and config files. There shouldn't be any conflict with other OS-provided packages. Danger area: openldap2 (You have been warned!) home:stroeder:openldap25/openldap2 is a *replacement* for the OS-provided packages which replaces system-wide client libraries. *This will likely break your system*! If you know what you're doing you can install this into e.g. test VMs, container or similar throw-away deployments. Download repos for various versions: https://download.opensuse.org/repositories/home:/stroeder:/openldap25/ Choose a directory and add the repo like this (example for openSUSE Tumbleweed): zypper addrepo -f https://download.opensuse.org/repositories/home:/stroeder:/openldap25/openS… Refresh your repos: zypper refresh -f Install packages zypper install openldap-ms openldap-ms-contrib Ciao, Michael.

4 4

MDB_MAP_FULL with plenty of free pages
by Jean-Charles ROGEZ 25 Mar '21

25 Mar '21

Hello, We use OpenLDAP 2.4.57 under RHEL8 with a configuration with 2 directories in MM and 2 replicas. We only write on one of the masters. The size of the LMDB database grows following writes of members of large groups (2000 members) by a batch which runs every 10 minutes. The base grows regularly and sometimes undergoes significant jumps until it reaches its maximum size. The lmdb_stat -ef command indicates that very few pages are used and everything else is free pages. The used pages are stable. [cid:image001.jpg@01D720BD.58844450] And yet, it is no longer possible to write in the directory. Sometimes it's on the master directory, sometimes on replicas where syncrepl fails. 2021-03-24T11: 52: 59.978157 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - mdb_id2entry_put: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached (-30792) "uid = us-00000301, ou = users, dc = bst, dc = ocn, dc = infra, dc = ftgroup " 2021-03-24T11: 52: 59.978184 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_null_callback: error code 0x50 2021-03-24T11: 52: 59.978202 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_entry: rid = 001 be_modify failed (80) 2021-03-24T11: 52: 59.978780 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - do_syncrepl: rid = 001 rc 80 retrying There is no transaction in progress: mdb_stat -r /var/lib/ldap/data/ Reader Table Status pid thread txnid 25076 7fa0e42c5480 - 25076 7fa0977fe700 - 25076 7fa097fff700 - 25076 7fa094cfa700 - 25076 7fa086ffe700 - 25076 7fa0857fb700 - 25076 7fa0867fd700 - 25076 7fa085ffc700 - 25076 7fa074ffc700 - The batch executes a lot of transactions < 2s. Restarting slapd does not resolve the problem. If we compact the database with mdb_copy -c, it only makes a few MB and it works again. The problem no longer appears without large groups. Why are free pages not used? Wouldn't there be a problem with writing many multi-valued attributes? Thank you for your help ! Jean-Charles Rogez [https://marketing.csnovidys.com/Logos/banniere_mail.png] [twitter icon]<https://twitter.com/csnovidys> [linkedin icon]<https://www.linkedin.com/company/novidy's> Jean-Charles ROGEZ Architecte Système | INTEGRATION SYSTEMES | PLESSIS Standard : +33180848010<tel:+33180848010> Ligne directe : <tel:r> Mobile : <tel:> Email : jean-charles.rogez(a)csnovidys.com<mailto:jean-charles.rogez@csnovidys.com>

7 15

OpenLDAP LTB packages for 2.4.58 are available
by Clément OUDOT 25 Mar '21

25 Mar '21

Hello, LTB packages for OpenLDAP 2.4.58 are available: https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-58-packages-rele… Download: https://ltb-project.org/download#openldap Thanks to OpenLDAP team and LTB team! Clément.

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 7:05 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Ok I will test this one. > Unfortunately I cannot test this as I see only during the cutover from > old to new servers.. > > Apart from additional logging do you suggest any tuning to take more 5k > ldap clients connections ? No, you've yet to even demonstrate that OpenLDAP is having any issue. All you've noted is that you're having some issue somewhere in your stack. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 6:45 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Yes presently logs enabled below in slapd.conf. > and during troubleshoot I have enabled loglevel -1 as well in the past. > ># enable a lot of logging - we might need it ># but generates huge logs ># loglevel -1 > loglevel 17384 I would strongly advise using the logging keywords (see slapd.conf(5)), it makes it a lot simpler to understand what is being done. And initially, just start with: loglevel stats It should generally provide information necessary to see if there are any issues occurring between the server and the backend. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 6:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > No, F5 is not closing the connections as I see connection on LDAP > servers which are coming via F5 on both the sites and also secondary site > server under F5 as well which are working fine when client connections > are coming via F5. What logging level do you have set on the OpenLDAP server side? I assume you're doing something like using back-ldap to proxy the connection from OpenLDAP to AD? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Friday, March 19, 2021 1:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > > HI , > > Thanks for your time and response. > Looks like I missed this email. > > I don't see issue with AD here, Let me explain bit more > > We have 2 (1 master , 1 slave) servers in each site and those are under > F5 LB with TCP enabled. > > Under F5 setup > Primary site servers takes load around 3K Ldap clients > Secondary site servers take around 50K Ldap clients > > The problem which I am seeing with primary site server directly by > passing F5 layer when we test with 5-10 clients it's working as expected > no issue with GID name fetching however when we enabled servers under F5 > with all the clients we are seeing GID fetching issue. And we are not > offloaded any cert in F5 it just TCP so no issue with F5 here. > Similarly secondary site servers are working fine with F5 or directly > without any issue and Backend AD syncing is working fine in both the > sites. > > Both the sites configuration are intact except systems are in different > locations. > > The only difference I see is no of clients are high in primary site and > no errors in ldap server logs , I am not sure my ldap servers not able to > take more than 100 clients. I am guessing some tuning might required. Are you sure the F5 isn't silently closing connections? This is a common problem with F5's. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

SHA-256 Password Support and OpenLDAP2-2.4.46 SLES15SP2
by Dario García Díaz-Miguel 23 Mar '21

23 Mar '21

Hello, We have a question related with the pw-sha2 module. We have deployed OpenLDAP2.4.46-9.31.1 on SLES15 SP2 from the official Suse Repository and we are able to use {CRYPT} {MD5} {SMD5} {SSHA} and {SHA}. We are awared that in order to support SHA-256 we have to load the contrib module named pw-sha2 which it was included on SLES12SP5 but is totally missing on SLES15SP2 package. This means that we would need to compile it, but due to limitations of the project we are working on we are not allowed to compile anything external. So I checked the changelog and I found that support was added on 2.4.32 release. Is it possible that the openldap2 package could have been compiled with the module features itself and I just need to add some kind of attribute or entry to my LDAP directory in order to enable it? We have tried to use Apache Directory Studio instead of slappasswd and we have set up a password to SHA256 but the bind won't work. Instead, CRYPT-SHA256 works so I can't figure out why. I suppose I'm totally misunderstanding this and the compilation of the module is required, but a little light ray of hope is there. Thank you so much. Regards. P Please consider the environment before printing this e-mail.

6 13

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical