[Fedora-directory-users] LDAP Accounts for large website
by Jared B. Griffith
I was wondering if anyone here has ever used LDAP for a website, that will potentially have millions of LDAP accounts.
If so, are you experiencing slow query responses or other issues?
If you were experiencing slow query responses, and were able to rectify the issue, how did you do this?
We are currently using FDS for our main website for customer accounts. We currently have over 52,000 accounts in LDAP and have only been using this for 3 months. We are now experiencing extreme slow down in query response when getting customer data into and out of the LDAP servers.
Any help would be greatly appreciated.
--
- Thank you,
- Jared B. Griffith
- Farheap Solutions, Inc.
- Lead Systems Administrator
- California IT Department
- Email - jared.griffith(a)farheap.com
- Phone - 949.417.1500 ext. 266
- Cell Phone - 949.910.6542
16 years, 4 months
[Fedora-directory-users] master-master replication issues after restore
by James Deuchar
hello,
I've got a pair of masters replicating happily.
I restore a db backup to master01 and reinitialise the master01->master02 replication agreement. On master02 I see:
[13/Dec/2007:17:55:34 +0100] NSMMReplicationPlugin - replica_reload_ruv: Warning: new data for replica ou=x,dc=y,dc=com does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized
So I do reinitialize the amster02-master02 agreement on master02. On master01 I see:
[13/Dec/2007:17:57:03 +0100] NSMMReplicationPlugin - replica_reload_ruv: Warning: new data for replica ou=x,dc=y,dc=com does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized.
I do this for a while, adding/deleting entries occasionally to see if replication is back - there seems to be no repeatable procedure...
What is the best correct way to restore a pair of replicating masters?
thanks!
_________________________________________________________________
Fancy some celeb spotting?
https://www.celebmashup.com
16 years, 4 months
[Fedora-directory-users] Integrating LDAP tools with Fedora Directory Server
by Jimmy Stewpot
Hello,
I am currently researching the implementation of an LDAP server and I
have some questions regarding compatibility.
- Is it possible to integrate software which is compatible with openldap
with Fedora Directory Server. For example tacplus has the ability to
use openldap. Can I compile it with openldap support but have the FDS
backend?
- If its not possible to use other ldap client libraries does any one
know of a list of software which out of the box supports FDS for things
like RADIUS, TACACS etc.
Any additional feedback would be most welcome.
Regards,
Jimmy.
16 years, 4 months
[Fedora-directory-users] err=65 for ldap entry modify question
by Scott Ding
Hi all,
Can anyone tell me what err=65 means for op=3 in the following log?
[12/Dec/2007:11:47:43 -0800] conn=0 op=3 MOD dn="dn=Scott133133Y,dc=vdb,dc=sprintam,dc=autodesk,dc=com"
[12/Dec/2007:11:47:43 -0800] conn=0 op=3 RESULT err=65 tag=103 nentries=0 etime=0
Thanks in advance,
Scott
[12/Dec/2007:11:47:43 -0800] conn=0 fd=64 slot=64 connection from 144.111.12.135 to 144.111.12.135
[12/Dec/2007:11:47:43 -0800] conn=0 op=0 BIND dn="cn=Directory Manager" method=128 version=2
[12/Dec/2007:11:47:43 -0800] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"
[12/Dec/2007:11:47:43 -0800] conn=0 op=1 SRCH base="dn=Scott133133Y,dc=vdb,dc=sprintam,dc=autodesk,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[12/Dec/2007:11:47:43 -0800] conn=0 op=1 RESULT err=0 tag=101 nentries=1 etime=0
[12/Dec/2007:11:47:43 -0800] conn=0 op=2 ADD dn="dn=Scott133133N20071212194431Z,dc=vdb,dc=sprintam,dc=autodesk,dc=com"
[12/Dec/2007:11:47:43 -0800] conn=0 op=2 RESULT err=0 tag=105 nentries=0 etime=0
[12/Dec/2007:11:47:43 -0800] conn=0 op=3 MOD dn="dn=Scott133133Y,dc=vdb,dc=sprintam,dc=autodesk,dc=com"
[12/Dec/2007:11:47:43 -0800] conn=0 op=3 RESULT err=65 tag=103 nentries=0 etime=0
[12/Dec/2007:11:47:43 -0800] conn=0 op=4 UNBIND
[12/Dec/2007:11:47:43 -0800] conn=0 op=4 fd=64 closed - U1
16 years, 4 months
[Fedora-directory-users] New problem - Mandriva Linux - Administration Server Not Working
by Chris G. Sellers
I switched form Solarisx86 to MDK on x86 to do my testing.
I've compiled the source (after having to link some directories to
match the kernel path) and it appears all is working but the
Administration Server will not work in the GUI.
I noticed the jar files were not installed for the admin server, so I
copied those over manually, but now the Admin Console hang when I
click open the Server group.
At on the console I get
[admin@localhost fd]$ ./startconsole
Uncaught error fetching image:
java.lang.NullPointerException
at java.io.FileInputStream.<init>(FileInputStream.java:103)
at java.io.FileInputStream.<init>(FileInputStream.java:66)
at
sun.awt.image.FileImageSource.getDecoder(FileImageSource.java:35)
at
sun
.awt.image.InputStreamImageSource.doFetch(InputStreamImageSource.java:
240)
at sun.awt.image.ImageFetcher.fetchloop(ImageFetcher.java:172)
at sun.awt.image.ImageFetcher.run(ImageFetcher.java:136)
Nothing in the error logs. I'm guessing that something didn't get
installed.
In order to get the build to work, there were a few times that I had
to symlink :
n -s /var/tmp/dsbuild-fds104/ds/adminserver/work/fedora-
adminserver-1.0.3/built/package/Linux2.6.22_x86_glibc_PTH_OPT.OBJ/ /
var/tmp/dsbuild-fds104/ds/adminserver/work/fedora-adminserver-1.0.3/
built/package/Linux2.6_x86_glibc_PTH_OPT.OBJ
because it got the linux kernel version off by a subrevision. But
once I did that all was okay.
Any ideas anyone? I don't want to spend too much time on this because
my final deployment will probably be on a RHEL or CENTOS server so I'm
not expecting to have to compile.
Thanks
Sellers
______________________________________________
Chris G. Sellers | NITLE Technology
734.661.2318 | chris.sellers(a)nitle.org
AIM: imthewherd | GTalk: cgseller(a)gmail.com
16 years, 4 months
[Fedora-directory-users] Questions about setting up replication by modifying ldap directly.
by Ryan Braun
I'm working on a perl script that will allow you to setup replication agreements from the commandline using Net::LDAP. I've pretty much taken most of the ideas out of the existing mmr.pl and added some more functionality ( and made the code look alot worse lol :)
I have a couple questions about a few attributes involved in the various object classes used in replication, and a couple logic questions to boot.
First off, I've been using the sun docs from 6.1 here
http://docs.sun.com/app/docs/doc/820-0384
for some of the attribute and object class info. I hope it still applies :P
1. When using the console, and you right click the replication agreement, you have the option to "Send Updates Now". Which attribute does that set? I'm assuming its not nsds5BeginReplicaRefresh, but that looks like the closest item from either nsDS5Replica or nsDS5ReplicationAgreement object classes.
Now for some logic questions. When creating a Supplier -> dedicated consumer replication. Here's a rough outline of what I'm doing
1. Supplier -> create replication user
2. Consumer -> create replication user
3. Supplier -> add changelog object ("cn=changelog5,cn=config")
4. Consumer -> add changelog object ("cn=changelog5,cn=config")
5. Supplier -> add replica object ("cn=replica,cn=\"$config{BASE_DN}\",cn=mapping tree,cn=config")
6. Consumer -> add replica object ("cn=replica,cn=\"$config{BASE_DN}\",cn=mapping tree,cn=config") (consumer and supplier rep objects do have their own specific settings in these objects)
7. Supplier -> create rep agreement object ("cn=\"Replication to $to\",cn=replica,cn=\"$base\",cn=mapping tree,cn=config")
8. Consumer -> update referral information in
dn: cn=$config{BASE_DN},cn=mapping tree,cn=config (nsslapd-referral attribute)
and
dn: cn=replica,cn="$config{BASE_DN}",cn=mapping tree,cn=config (nsDS5ReplicaReferral attribute)
9. Consumer -> modify dn: cn=$config{BASE_DN},cn=mapping tree,cn=config attribute nsslapd-state to "referral on update"
I *think* thats it. From what I can when dumping cn=config the 3 objects on the consumer end up something like this. Also there's an empty value for
nsslapd-referralmode: is that normal?
# dc\3Dxxx\2Cdc\3Dec\2Cdc\3Dgc\2Cdc\3Dca, mapping tree, config
dn: cn="dc=xxx,dc=ec,dc=gc,dc=ca",cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
cn: "dc=xxx,dc=ec,dc=gc,dc=ca"
nsslapd-state: referral on update
nsslapd-backend: userRoot
nsslapd-referral: ldap://SRVR1:389/dc=xxx,dc=ec,dc=gc,dc=ca
nsslapd-referral: ldap://SRVR2:389/dc=xxx,dc=ec,dc=gc,dc=ca
# replica, dc\3Dxxx\2Cdc\3Dec\2Cdc\3Dgc\2Cdc\3Dca, mapping tree, config
dn: cn=replica,cn="dc=xxx,dc=ec,dc=gc,dc=ca",cn=mapping tree,cn=config
objectClass: nsDS5Replica
objectClass: top
nsDS5ReplicaRoot: dc=xxx,dc=ec,dc=gc,dc=ca
nsDS5ReplicaType: 2
nsDS5Flags: 0
nsds5ReplicaPurgeDelay: 604800
nsDS5ReplicaBindDN: uid=RManager,cn=config
cn: replica
nsDS5ReplicaId: 65535
nsState:: //8AABRQWEcAAAAAAgAAAAEAAAA=
nsDS5ReplicaName: 60c64002-1dd211b2-8039bd5e-680e0000
nsDS5ReplicaReferral: ldap://SRVR1:389/dc=xxx,dc=ec,dc=gc,dc=ca
nsDS5ReplicaReferral: ldap://SRVR2:389/dc=xxx,dc=ec,dc=gc,dc=ca
nsds5ReplicaChangeCount: 2
nsds5replicareapactive: 0
# changelog5, config
dn: cn=changelog5,cn=config
objectClass: top
objectClass: extensibleObject
cn: changelog5
nsslapd-changelogdir: /opt/fedora-ds/slapd-srvr3/changelogdb
Now for setting up an MMR agreement between 2 suppliers
1. Source -> create rep user
2. Target -> create rep user
3. Source -> create changelog object
4. Target -> create changelog object
5. Source -> create replica object
6. Target -> create replica object
7. Source -> create rep agreement
8. Target -> create rep agreement
9. Source -> set nsDS5BeginReplicaRefresh in the rep agreement on the source to init the target.
10. Source -> update dn: cn="$config{BASE_DN}",cn=mapping tree,cn=config attribute nsslapd-referral with the ldap://target:PORT/$config{BASE_DN}
11. Target -> update dn: cn="$config{BASE_DN}",cn=mapping tree,cn=config attribute nsslapd-referral with the ldap://source:PORT/$config{BASE_DN}
How does that look?
Should the multi-valued attribute nsslapd-referral contain entries for each server for which it has a MMR agreement with?
One other question, it seems that sometimes the value has the escape codes for the comma while sometimes it has the actual comma.
ryan@infinity:~/fds-tools$ grep -i Referral *
xxxoff-config:nsslapd-referral: ldap://xxxoff0.xxx.ec.gc.ca:389/dc%3Dxxx%2Cdc%3Dec%2Cdc%3Dgc
xxxsrvr4-config:nsslapd-referral: ldap://srvr1:389/dc=xxx,dc=ec,dc=gc,dc=ca
I assume either way will work and not break anything? (which seems to be the case as it's running :)
Ryan Braun
Informatics Operations
Aviation and Defence Services Division
Chief Information Officer Branch, Environment Canada
CIV: (204) 833-2500x2824 CSN: 257-2824 FAX: (204) 833-2524
E-Mail: Ryan.Braun(a)ec.gc.ca
16 years, 4 months
[Fedora-directory-users] ACIs Don't Work?
by Glenn
I'm trying to establish an ACI for directory administrators in Fedora
Directory 1.0.3. In the directory console, I right-click the OU and
select "Set Access Permissions". I visit each tab in the visual editor and
enter the correct users, rights, targets, hosts and times. After saving, the
OU shows one ACI. Then I log in to the web-based Directory Server Gateway as
one of the users specified in the ACI, but I am unable to edit another user's
directory attributes. The error message is:
"An error occurred while contacting the LDAP server.
(Insufficient access - Insufficient 'write' privilege to the 'roomNumber'
attribute of entry 'uid=tsmith,ou=main,ou=people,dc=txwes,dc=edu'. )
You do not have sufficient privileges to perform the operation."
I checked all the inherited ACIs on the OU, and no rights are denied. What
else should I look at? Thanks. -Glenn.
16 years, 4 months
[Fedora-directory-users] (no subject)
by audunroe@tihlde.org
Hi,
I've been trying to install Fedora DS 1.0.4-1. Tried using both
fedora-ds-1.0.4-1.RHEL3.i386.opt.rpm and
fedora-ds-1.0.4-1.RHEL4.i386.opt.rpm.
Installation seems to be successful. After completing
/opt/fedora-ds/setup/setup, I get this output:
[slapd-testldap]: starting up server ...
[slapd-testldap]: Fedora-Directory/1.0.4 B2006.312.435
[slapd-testldap]: testldap.test.somehost.com:3389
(/opt/fedora-ds/slapd-testldap)
[slapd-testldap]:
[slapd-testldap]: [11/Dec/2007:14:35:42 +0100] - Fedora-Directory/1.0.4
B2006.312.435 starting up
[slapd-testldap]: [11/Dec/2007:14:35:43 +0100] - slapd started. Listening
on All Interfaces port 3389 for LDAP requests
Your new directory server has been started.
Created new Directory Server
Start Slapd Starting Slapd server configuration.
Success Slapd Added Directory Server information to Configuration Server.
Configuring Administration Server...
Setting up Administration Server Instance...
Configuring Administration Tasks in Directory Server...
Configuring Global Parameters in Directory Server...
Can't start Admin server [/opt/fedora-ds/start-admin > /tmp/fileihS5jQ
2>&1] (error: No such file or directory)
You can now use the console. Here is the command to use to start the
console:
cd /opt/fedora-ds
./startconsole -u admin -a http://testldap.test.somehost.com:2002/
INFO Finished with setup, logfile is setup/setup.log
I can now connect to the ldap-server with an ldap-browser, but as you can
see, the admin server doesn't launch properly. If I then try to re-run the
start-admin script, I get the following errs:
ERROR: ld.so: object '/opt/fedora-ds/bin/admin/lib/libssl3.so' from
LD_PRELOAD cannot be preloaded: ignored.
ERROR: ld.so: object '/opt/fedora-ds/bin/admin/lib/libldap60.so' from
LD_PRELOAD cannot be preloaded: ignored.
httpd.worker: Syntax error on line 151 of
/opt/fedora-ds/admin-serv/config/httpd.conf: Cannot load
/opt/fedora-ds/bin/admin/lib/libmodrestartd.so into server:
/opt/fedora-ds/bin/admin/lib/libmodrestartd.so: wrong ELF class:
ELFCLASS32
Any suggestions?
--
Regards,
Audun
16 years, 4 months
[Fedora-directory-users] Newb question about Solaris X86
by Chris G. Sellers
I've searched some of the lists and was unable to find much of
anything on this topic.
I have a Solaris X86 (openSolaris) environment that I would like to
use FDS on. I've tried to compile the environment (using GCC as well
as SunC) and got all the way to the 'adminutil' section where it can
not find prio.h
Has anyone been able to get FDS going on Solaris x86 and if so what
was the recipe for success.
mkdir -p /var/tmp/dsbuild-fds104/ds/adminutil/work/fedora-
adminutil-1.0.4/built/SunOS5.11_i86pc_OPT.OBJ/lib/libadminutil
cc -DSOLARIS -c -DSVR4 -D__svr4 -D__svr4__ -D_SVID_GETTOD -
DOSVERSION=5011 -DNO_NODELOCK -DXP_UNIX -DSOLARISx86 -xO2 -DNET_SSL -
DSPAPI20 -DBUILD_NUM=\"2007.345.1339\" -DNET_SSL -DSPAPI20 -DBUILD_NUM=
\"2007.345.1339\" -I/var/tmp/dsbuild-fds104/ds/adminutil/work/fedora-
adminutil-1.0.4/include -I/var/tmp/dsbuild-fds104/ds/mozilla/work/
mozilla/dist/OPT.OBJ/include -I/var/tmp/dsbuild-fds104/ds/mozilla/work/
mozilla/dist/public/nss -I/var/tmp/dsbuild-fds104/ds/mozilla/work/
mozilla/dist/public/ldap -I/var/tmp/dsbuild-fds104/ds/icu/work/icu-3.4/
built/include psetc.c -o /var/tmp/dsbuild-fds104/ds/adminutil/work/
fedora-adminutil-1.0.4/built/SunOS5.11_i86pc_OPT.OBJ/lib/libadminutil/
psetc.o
"psetc.c", line 30: cannot find include file: <prio.h>
Thank you (and congratulations) to anyone who can assist.
---
Chris G. Sellers Lead Internet Engineer
National Institute for Technology & Liberal Ed.
535 West William Street, Ann Arbor, MI 48103
chris.sellers(a)nitle.org 734.661.2318
16 years, 4 months
[Fedora-directory-users] Question about ACI
by Chun Tat David Chu
Hi guys,
I am trying to create an organizational unit and an user with ACI, but it
looks like my ACI is not defined correctly.
Below is my ldif.
dn: ou=serviceaccounts,dc=test,dc=example,dc=com
changetype: add
objectclass: top
objectclass: organizationalunit
aci:
(targetattr = "*")
(version 3.0;
acl "default aci for service accounts";
allow (all)
(userdn="ldap:///anyone")
;)
dn: cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com
changetype: add
objectclass: top
objectclass: person
sn: tscei.obs
userPassword: testing123
description: This is a test
aci:
(targetattr = "*")
(version 3.0;
acl "user1";
deny (all)
(userdn="ldap:///self")
;)
I create an organizational unit that allows all users to modify it, then I
create user1 that denies everything.
I then use the below LDIF to perform a LDAP add operation.
dn: cn=testing123,cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com
changetype: add
objectclass: top
objectclass: room
I use this ldapmodify command to perform the add operation
ldapmodify -h hostname -p 1389 -D
"cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com" -w testing123 -f
my_test.ldif -x
The add operation succeeded unexpectedly. The result that I'm looking for
should be not enough privilege to perform add operation.
Anyone knows what's wrong with my ACI setup?
Thanks!
David
16 years, 4 months