On 02/14/2018 05:58 PM, Bret Wortman wrote:
On 02/14/2018 10:22 AM, Florence Blanc-Renaud wrote:
> On 02/14/2018 12:52 PM, Bret Wortman via FreeIPA-users wrote:
>> I did figure out that I can use
>>
>> # ldapsearch -D 'directory manager' -W -E pr=20000 -b
>> idnsname=damascusgrp.com,cn=dns,dc=damascusgrp,dc=com
>>
>> to list out all the entries, but the format isn't what I'm expecting.
>>
>> What I'm actually trying to do is move our whole infrastructure from
>> one set of old & busted servers to some shiny new VMs. We'd like to
>> extract the data and start fresh, as our replication agreements just
>> don't seem to be working as expected. Changes to one don't always
>> make it to the other and vice versa. While I'd love to dig in and
>> solve that, it's easier right now to try to extract the data and
>> reload it into a new server, build new replicas, then unbind &
>> re-bind every client to the new server using ansible since we also
>> lost our internal CA in the process.
>>
>> So while our current configuration is a mess, we can't afford to lose
>> all the host/user/dns/hbac data in our servers. Thus, I've been
>> capturing the output to text using various ipa *-find commands and
>> have parsers to turn those back into new entries on the fresh hosts.
>> DNS is the only thing that's holding me up.
>>
>>
>> Bret
>>
>>
>> On 02/14/2018 06:33 AM, Bret Wortman wrote:
>>>
>>> Also, this doesn't solve the fact that the Web UI always produces an
>>> error dialog whenever accessing our primary zone.
>>>
>>>
>>> On 02/13/2018 02:19 PM, Natxo Asenjo via FreeIPA-users wrote:
>>>>
>>>>
>>>> On Tue, Feb 13, 2018 at 8:13 PM, Natxo Asenjo
>>>> <natxo.asenjo(a)gmail.com <mailto:natxo.asenjo@gmail.com>>
wrote:
>>>>
>>>>
>>>> the canonical way to do this is using ldap paging, with
>>>> ldapsearch you could try using the -E pr=xxxx parameter, where
>>>> xxxx could be 1000 for instance. That way you know you are always
>>>> under the limit imposed by the server.
>>>>
>>>>
>>>> if you use -E pr=1000/noprompt, it will not prompt to continue,
>>>> nicer for scripts obviously.
>>>>
>>>> --
>>>> Groeten,
>>>> natxo
>>>>
>>>>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email
>>>> tofreeipa-users-leave(a)lists.fedorahosted.org
>>>
>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>>
> Hi Bret,
>
> the search limits can be set at multiple levels:
> - for the whole 389-ds server
> nsslapd-sizelimit (in cn=config)
> nsslapd-lookthroughlimit (in cn=config,cn=ldbm
> database,cn=plugins,cn=config)
>
> - for operations performed through ipa * commands (or the webGUI):
> ipaSearchRecordsLimit (in cn=ipaConfig,cn=etc,$BASEDN)
>
> - for each user:
> nssizelimit and nsLookThroughLimit attributes (in
> uid=$USER,cn=users,cn=accounts,$BASEDN)
>
> You are probably hitting one of these limits in your ipa *-find command.
>
> HTH,
> Flo
>
So I found almost all of these:
# ldapsearch -D 'cn=directory manager' -W -b 'cn=config' cn=config |
grep nsslapd-sizelimit
nsslapd-sizelimit: 2000
# ldapsearch -D 'cn=directory manager' -W -b 'cn=config,cn=ldbm
database,cn=plugins,cn=config' | grep lookthroughlimit
nsslapd-lookthroughlimit: 100000
# ldapsearch -D 'cn=directory manager' -W -b
'cn=ipaConfig,cn=etc,dc=damascusgrp,dc=com' | grep ipaSearchRecordsLimit
ipaSearchRecordsLimit: 99999
# ldapsearch -D 'cn=directory manager' -W -b
'uid=admin,cn=users,cn=accounts,dc=damascusgrp,dc=com' | grep -i limit
(returns data but nothing matches)
Hi,
nsSizeLimit and nsLookThroughLimit are operational attributes, meaning
that a standard ldapsearch will not return them. You need either to
specifically request them by providing them in the attributes list:
$ ldapsearch -D 'cn=directory manager' -W -b $BASE nssizelimit
nslookthroughlimit
or you can also specify + instead of the attributes in order to get all
operational attributes:
$ ldapsearch -D 'cn=directory manager' -W -b $BASE +
HTH,
Flo
The first doesn't seem to be something I can change. It's
stuck at 2000,
but since my issue occurs at 5000, I'm not worried about it. I believe
that I'm missing something in the fourth search that might point me
toward the attributes you mentioned but I'm not sure where.