Slapd hang

2013-06-12 Thread Carsten Czerner
Hi, nearly every 2 weeks the slapd stops answering on search requests. The process is still running(socket is open as well) but every questions runs into a timeout. When that happen, I need to kill the process with -9 manually. After that I can start the process again. We have configured a

How can OpenLDAP client process on FreeBSD authenticate a web user with active directory

2013-06-12 Thread Ganesh Borse
Dear Friends I am new to OpenLDAP. We are migrating our application (integrated with webserver) from Windows to FreeBSD. However, this is adding a bit of a problem. Previously, I used Microsoft SSPI authentication loop mechanism to authenticate the users connecting from GUI client (launched from

Re: How can OpenLDAP client process on FreeBSD authenticate a web user with active directory

2013-06-12 Thread Dieter Klünter
Am Wed, 12 Jun 2013 16:23:00 +0800 schrieb Ganesh Borse bganes...@gmail.com: Dear Friends I am new to OpenLDAP. We are migrating our application (integrated with webserver) from Windows to FreeBSD. However, this is adding a bit of a problem. Previously, I used Microsoft SSPI

Re: How can OpenLDAP client process on FreeBSD authenticate a web user with active directory

2013-06-12 Thread Ganesh Borse
Hi Dieter Thanks for this quick guidance. Yes, I will try to use ldap proxy, I think which will be nothing but slapd-ldap. Is there any way to integrate this proxy in my application process (a C++ process)? This is because depending on success or failure of this authentication process our

OpenLDAP Proxy for Active Directory Authentication

2013-06-12 Thread Jason Brandt
We run in a mixed environment, with both Active Directory and LDAP directory servers. Some users exist in both LDAP and AD, while some are just in AD. As such, we always have obstacles with password sync between directories. Is it possible, to set up an OpenLDAP proxy (if that's the correct

Re: Slapd hang

2013-06-12 Thread Quanah Gibson-Mount
--On Wednesday, June 12, 2013 8:31 AM +0200 Carsten Czerner carsten.czer...@leuphana.de wrote: Happend on Debian 6 as well as on Debian7(now) root@ldap085:/var/openldapdb07# slapd -V @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $

Re: OpenLDAP Proxy for Active Directory Authentication

2013-06-12 Thread Clément OUDOT
2013/6/12 Jason Brandt jbra...@fsmail.bradley.edu: We run in a mixed environment, with both Active Directory and LDAP directory servers. Some users exist in both LDAP and AD, while some are just in AD. As such, we always have obstacles with password sync between directories. Is it possible,

Re: OpenLDAP Proxy for Active Directory Authentication

2013-06-12 Thread Jason Brandt
That appears to be exactly what I was looking for. So, if I used something like: {SASL}user@domain in the userPassword attribute, it would use external auth, whereas if we populated the attribute with the SSHA password, it would still authenticate via LDAP, correct? Appreciate the help. On

Re: OpenLDAP Proxy for Active Directory Authentication

2013-06-12 Thread Clément OUDOT
2013/6/12 Jason Brandt jbra...@fsmail.bradley.edu: That appears to be exactly what I was looking for. So, if I used something like: {SASL}user@domain in the userPassword attribute, it would use external auth, whereas if we populated the attribute with the SSHA password, it would still

Re: Slapd hang

2013-06-12 Thread Quanah Gibson-Mount
--On Wednesday, June 12, 2013 4:59 PM +0200 Michael Ströder mich...@stroeder.com wrote: I would note there are issues with the way in which Debian builds BDB as well. Is this still true today? Which issues are this in detail? Yes, it is still true today. They do not set the

Re: Slapd hang

2013-06-12 Thread Michael Ströder
On Wed, 12 Jun 2013 08:35:37 -0700 Quanah Gibson-Mount qua...@zimbra.com wrote --On Wednesday, June 12, 2013 4:59 PM +0200 Michael Ströder mich...@stroeder.com wrote: I would note there are issues with the way in which Debian builds BDB as well. Is this still true today? Which issues

Re: Slapd hang

2013-06-12 Thread Quanah Gibson-Mount
--On Wednesday, June 12, 2013 5:57 PM +0200 Michael Ströder mich...@stroeder.com wrote: On Wed, 12 Jun 2013 08:35:37 -0700 Quanah Gibson-Mount qua...@zimbra.com wrote --On Wednesday, June 12, 2013 4:59 PM +0200 Michael Ströder mich...@stroeder.com wrote: I would note there are issues with

Re: LMDB: MDB_MAP_FULL doesn't allow deletions

2013-06-12 Thread Jeremy Bernstein
Hi, I may have spoken too soon. I'm now using a 32MB toy database, typical for my users. I'm pruning at 90% which seems to be about the right number, but… the number of pages in my mdb_stat() isn't reducing. So I'll do a round of pruning, maybe 5% of the records. But the next time I come

Re: LMDB: MDB_MAP_FULL doesn't allow deletions

2013-06-12 Thread Howard Chu
Jeremy Bernstein wrote: Hi, I may have spoken too soon. I'm now using a 32MB toy database, typical for my users. I'm pruning at 90% which seems to be about the right number, but… the number of pages in my mdb_stat() isn't reducing. So I'll do a round of pruning, maybe 5% of the records. But

Getting Openldap to Trigger Events On Add

2013-06-12 Thread Bram Cymet
Hi, I am wondering if it is possible to have OpenLDAP trigger a script anytime something is added to the ldap tree. For example after a user entry is added to the tree I would like to run some commands to create a kerberos principle for that user. A user will always be Kerberized so it would be

Re: How can OpenLDAP client process on FreeBSD authenticate a web user with active directory

2013-06-12 Thread Michael Ströder
Ganesh Borse wrote: I am new to OpenLDAP. We are migrating our application (integrated with webserver) from Windows to FreeBSD. However, this is adding a bit of a problem. Previously, I used Microsoft SSPI authentication loop mechanism to authenticate the users connecting from GUI client

Re: Getting Openldap to Trigger Events On Add

2013-06-12 Thread Michael Ströder
Bram Cymet wrote: I am wondering if it is possible to have OpenLDAP trigger a script anytime something is added to the ldap tree. You probably want to read about slapo-sock(5) Ciao, Michael. smime.p7s Description: S/MIME Cryptographic Signature

Re: LMDB: MDB_MAP_FULL doesn't allow deletions

2013-06-12 Thread Jeremy Bernstein
That makes sense, but I'm also seeing a similar problem with the freelist entries. Once I start pruning (btw I'm not deleting in a single commit -- my granularity is also 50 deletes per transaction, then I commit and reset the cursor before continuing), the freepages freezes at a certain value

Re: How can OpenLDAP client process on FreeBSD authenticate a web user with active directory

2013-06-12 Thread Ganesh Borse
What I am looking for is somewhat similar to openldap proxy for AD. What I did not understand is how a separate process running on the same computer request the slapd daemon to perform the authentication of various users? Will the client process be connected to AD using ldap_bind_s and also