Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Christian Kratzer
Hi Howard, On Wed, 25 Dec 2013, Howard Chu wrote: See https://tools.ietf.org/html/draft-masarati-ldap-deref Was going to reply but Michael beat me to it. Reiterating all the points Michael made. There is no good reason to use memberUid or uniqueMember in LDAP, both of these schema elements

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Arthur de Jong
On Wed, 2013-12-25 at 15:27 +0100, Michael Ströder wrote: Arthur de Jong wrote: Additionally, if you plan to use the contents of the tree as Unix users and want to have reasonable performance for large trees, you should either: - use memberUid attributes - user member or uniqueMember

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Michael Ströder
Christian Kratzer wrote: I was always intending to ask what the original use case for groupOfUniqueNames actually was as I totally fail to see the point in the uniqueMember attributes. I see lots of people using it just because oh yeas of course we want to have unique members. Most

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Arthur de Jong
On Wed, 2013-12-25 at 16:44 +0100, Michael Ströder wrote: Furthermore there's slapo-deref which seems to work. The client control can be used to retrieve all the 'uid' values in member entries. The NSS provider has to extract the 'uid' values from the response control value. See

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Hallvard Breien Furuseth
Christian Kratzer writes: On Wed, 25 Dec 2013, Howard Chu wrote: Was going to reply but Michael beat me to it. Reiterating all the points Michael made. There is no good reason to use memberUid or uniqueMember in LDAP, both of these schema elements are deeply flawed. thanks to both of you

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Michael Ströder
Arthur de Jong wrote: On Wed, 2013-12-25 at 16:44 +0100, Michael Ströder wrote: Furthermore there's slapo-deref which seems to work. The client control can be used to retrieve all the 'uid' values in member entries. The NSS provider has to extract the 'uid' values from the response control

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Michael Ströder
Arthur de Jong wrote: You can cache things, put them in a local database and use something other than LDAP search queries to search the data but that comes at a price. Cache lookups have to take into account the lifetime of cached entries and handle changes in LDAP gracefully (e.g. change uid

Re: How to sync UID/GID?

2013-12-26 Thread Hallvard Breien Furuseth
Peng Yu writes: (...) http://serverfault.com/questions/19323/is-it-feasible-to-have-home-folder-hosted-with-nfs I see on the above URL that OpenLDAP can be used to sync UID/GID. But it is not clear to how to do it. Could anybody point me some directions? Thanks. ... as you have to keep

Re: Oracle OpenLDAP PPolicy ppolicy and the hierarchy

2013-12-26 Thread Howard Chu
Arthur de Jong wrote: On Wed, 2013-12-25 at 16:44 +0100, Michael Ströder wrote: Furthermore there's slapo-deref which seems to work. The client control can be used to retrieve all the 'uid' values in member entries. The NSS provider has to extract the 'uid' values from the response control

MMR config question - serverID without URL and CSN too old, ignoring in the log

2013-12-26 Thread Daniel Jung
Set up 4 way MMR setup with 2.4.37, centos 6. Reading the doc[0] indicates that adding the URL is an optional and is used to avoid future serverID collision and using the number alone does work without any issue. Based on that information, i created 3 MMR setup with each provider with unique

Re: MMR config question - serverID without URL and CSN too old, ignoring in the log

2013-12-26 Thread Daniel Jung
ntp are set up on all the masters and offset is quite small. so we can rule out ntp as possbile cause. On Dec 26, 2013 6:15 PM, Daniel Jung mimianddan...@gmail.com wrote: Set up 4 way MMR setup with 2.4.37, centos 6. Reading the doc[0] indicates that adding the URL is an optional and is used