ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett
Hi all,
We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this:
[12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”)
Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”.
Has anyone seen this kind of thing before?
This is 389ds running on CentOS7 as follows:
389-ds-base-1.3.9.1-10.el7.x86_64
Regards,
Graham
—
4 months, 2 weeks
How to analyze large Multi Master Replication (test)-network?
by Eugen Lamers
We are testing scenarios with Multi Master Replication (MMR) with many replicas. We need to gather experience in this area.
The current scenario is a star topology with one central server with replication agreements with all others, and the others only with the central server. It is scaled up to 63 servers replicating with the central server.
To analyze the behaviour in certain situations we would like to have a reliable indicator for the status of the replications.
What we found was the attribute nsds50ruv of the replication agreement. RedHat documentation says:
Information about the replication topology — all of the suppliers which are supplying updates to each other and other replicas within the same replication group — is contained in a set of metadata called the replica update vector (RUV). The RUV contains information about the supplier like its ID and URL, its latest change state number for changes made on the local server, and the CSN of the first change. Both suppliers and consumers store RUV information, and they use it to control replication updates.
1. How is the attribute managed and used, and are there limitations for highly scaled MMR scenarios?
2. Is it necessary that all replicas of all servers in the MMR are listed in this attribute? Are the entries automatically distributed, and who controls this?
3. How do those entries have to look like for the certain server "types": certal servier with replication agreements to all others (1) resp. the "others" (2)?
(1) {replicageneration} <ID> + n * {replica <replica ID> ldap://<FQDN>:389}
(2) {replicageneration} <ID> + {replica <replica ID of central server> ldap://<FQDN of central server>:389}
4. Some entries end with some kind of IDs, possibly replication generation IDs, some don't. Why is that so?
5. What is the meaning of the identifier under the attribute nsruvreplicalastmodified; i.e: replica 1 ldap://<FQDN>:389} 00000000
6. What is a replication group and is that a way to help handling a highly scaled MMR scenario while limiting replication traffic and conflicts, or does "replication group" mean the complete network of the servers in the topology?
7. What must be the order to set up the MMR network? First set up all other MMR server and then setup the central server?
8. We have noticed that the entries are made only after a reboot of the central MMR server. Is this correct or are there other steps that are required to configure the MMR?
Documentation read so far:
[RHC 10, Ch. 3.1.16.12] : https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
[RHA 10, Ch. 15]: https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
https://www.port389.org/docs/389ds/design/csn-pending-lists-and-ruv-updat...
https://directory.fedoraproject.org/docs/389ds/howto/howto-cleanruv.html
Best regards,
Eugen
3 years, 1 month
Unindexed search
by Chase Miller
Why is a one letter wildcard search not hitting the index?...yet if you add
two or more letters to the wildcard, the index is used. Yes cn does have 3
indexes on it.
Example
26/Feb/2021:16:33:51.189998029 -0600] - NOTICE - ldbm_back_search -
Unindexed search: search base="cn=users,o=Xxxxxx,O=Xxxx" scope=1
filter="(cn=a*)" conn=3 op=18
Yet if the filter is ab* it uses the index
3 years, 1 month
Plugin for enforcing minimum attribute length
by Jan Tomasek
Hi,
is there any plugin for enforcing minimum attribute length? I never
needed such thing, but now it would be nice to be able to enforce min 3
characters for dc attribute in one subtree.
Is it possible? Thanks
--
-----------------------
Jan Tomasek aka Semik
http://www.tomasek.cz/
3 years, 2 months
Announcing 389 Directory Server 2.0.3
by Mark Reynolds
389 Directory Server 2.0.3
The 389 Directory Server team is proud to announce 389-ds-base version 2.0.3
Fedora packages are available on Fedora 34
Fedora 34:
https://koji.fedoraproject.org/koji/taskinfo?taskID=61843474
<https://koji.fedoraproject.org/koji/taskinfo?taskID=61843474>
The new packages and versions are:
* 389-ds-base-2.0.3-1
Source tarballs are available for download at Download
389-ds-base Source
<https://github.com/389ds/389-ds-base/archive/389-ds-base-2.0.3.tar.gz>
Highlights in 2.0.3
* Bug & security fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
<https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...>
If you find a bug, or would like to see a new feature, file it in our
GitHub project: https://github.com/389ds/389-ds-base
<https://github.com/389ds/389-ds-base>
* Bump version to 2.0.3
* Issue 4619 - remove pytest requirement from lib389
* Issue 4615 - log message when psearch first exceeds max threads per conn
* Issue 4469 - Backend redesing phase 3a - implement dbimpl API and
use it in back-ldbm (#4618)
* Issue 4324 - Some architectures the cache line size file does not exist
* Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not
found (#4614)
* Issue 4469 - Backend redesign phase 3a - bdb dependency removal
from back-ldbm
* PR 4564 - Update dscontainer
* Issue 4149 - UI - port TreeView and opther components to PF4
* Issue 4577 - Add GitHub actions
* Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
* issue 4612 - Fix pytest fourwaymmr_test for non root user (#4613)
* Issue 4609 - CVE - info disclosure when authenticating
* Issue 4348 - Add tests for dsidm
* Issue 4571 - Stale libdb-utils dependency
* Issue 4600 - performance modify rate: reduce lock contention on the
object extension factory (#4601)
* Issue 4577 - Add GitHub actions
* Issue 4588 - BUG - unable to compile without xcrypt (#4589)
* Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
* Issue 4581 - A failed re-indexing leaves the database in broken
state (#4582)
* Issue 4348 - Add tests for dsidm
* Issue 4577 - Add GitHub actions
* Issue 4563 - Failure on s390x: ‘Fails to split RDN “o=pki-tomcat-CA”
into components’ (#4573)
* Issue 4093 - fix compiler warnings and update doxygen
* Issue 4575 - Update test docstrings metadata
* Issue 4526 - sync_repl: when completing an operation in the pending
list, it can select the wrong operation (#4553)
* Issue 4324 - Performance search rate: change entry cache monitor to
recursive pthread mutex (#4569)
* Issue 4513 - Add DS version check to SSL version test (#4570)
* Issue 5442 - Search results are different between RHDS10 and RHDS11
* Issue 4396 - Minor memory leak in backend (#4558)
* Issue 4513 - Fix replication CI test failures (#4557)
* Issue 4513 - Fix replication CI test failures (#4557)
* Issue 4153 - Added a CI test (#4556)
* Issue 4506 - BUG - fix oob alloc for fds (#4555)
* Issue 4548 - CLI - dsconf needs better root DN access control
plugin validation
* Issue 4506 - Temporary fix for io issues (#4516)
* Issue 4535 - lib389 - Fix log function in backends.py
* Issue 4534 - libasan read buffer overflow in filtercmp (#4541)
* Issue 4544 - Compiler warnings on krb5 functions (#4545)
* Update rpm.mk for RUST tarballs
--
389 Directory Server Development Team
3 years, 2 months