Re: access control

On Wednesday 05 December 2007 00:52:11 Nathan Nobbe wrote: > so now i will come to the problem. > there is no way (that ive found in the administration guide) to > access the entry a user authenticated against when writing the access > control rules. But the reverse is possible (using a regex base

Re: ldap queries rewriting

Aaron Richton wrote: If the copier has a Bind DN option, then something along the lines of... access to dn.subtree="ou=Engineering,dc=example,dc=com" by dn.exact="cn=EngineeringCopier,ou=Engineering,dc=example,dc=com" read by [...everythingelse...] access to * by dn.exact="cn=EngineeringC

Re: 2.4.6 prov/con, delta-syncrepl and auditContext

Pierangelo Masarati wrote: > So, the only reason to have slapo-accesslog(5) built and loaded **BUT > NOT INSTANTIATED** on the __consumer__ (doesn't sound such strikingly > resource intensive a requirement) is to have this attribute defined in > the schema. If this sounds so unreasonable, please s

Re: syncrepl - ldap_start_tls failed (-11)

Hello Quanah, sorry, I am actually using: provider=ldap://192.168.0.7:389 Would that be ok to use? Cristian Quanah Gibson-Mount schrieb: --On December 5, 2007 3:17:01 PM +0100 Cristian Laufer <[EMAIL PROTECTED]> wrote: Hello All, syncrepl rid=123 starttls=yes provider=ldap://ldapmaste

Re: 2.4.6 prov/con, delta-syncrepl and auditContext

Michael Ströder wrote: Pierangelo Masarati wrote: So, the only reason to have slapo-accesslog(5) built and loaded **BUT NOT INSTANTIATED** on the __consumer__ (doesn't sound such strikingly resource intensive a requirement) is to have this attribute defined in the schema. If this sounds so unre

slave-to-master replica

Hellow, its about for ldap-2.3 replication with syncrepl I need slave-to-master replica, have making slapd.conf like http://www.openldap.org/faq/data/cache/1434.html... but it's not working. Its even imposable to make changes on the slave directly,.. I hope anybody have a working sample, ..please

Active/Active servers

Hi, I am not sure if this is the right place to ask this or not. If I install 2 nodes of OpenLDAP and they both share the same SAN storage, is it possible that both of them would be working active/active ?, i.e. behind a load balancer (doing reads and writes). -- Taymour A El Erian System

RE: syncrepl - ldap_start_tls failed (-11)

What did you use when you generated your certificate? Important thing is that they match. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Cristian Laufer Sent: Thursday, December 06, 2007 9:50 AM To: Quanah Gibson-Mount; openldap-software@openldap.org S

Re: Active/Active servers

Multimaster support is present in OpenLDAP 2.4. On Thu, 6 Dec 2007, Taymour A. El Erian wrote: Hi, I am not sure if this is the right place to ask this or not. If I install 2 nodes of OpenLDAP and they both share the same SAN storage, is it possible that both of them would be working activ

Re: Active/Active servers

Taymour A. El Erian wrote: Hi, I am not sure if this is the right place to ask this or not. If I install 2 nodes of OpenLDAP and they both share the same SAN storage, is it possible that both of them would be working active/active ?, i.e. behind a load balancer (doing reads and writes).

Re: Active/Active servers

Aaron Richton wrote: Multimaster support is present in OpenLDAP 2.4. That's not quite the complete answer though. He's also talking about two servers sharing the same storage. In general, that is not supported in BerkeleyDB and is certainly not supported by back-bdb or back-hdb. On Thu, 6 D

Re: Active/Active servers

On Thursday 06 December 2007 13:46:28 Taymour A. El Erian wrote: > Hi, > > I am not sure if this is the right place to ask this or not. If I > install 2 nodes of OpenLDAP and they both share the same SAN storage, is > it possible that both of them would be working active/active ?, i.e. > behind

Re: Active/Active servers

Buchan Milne wrote: On Thursday 06 December 2007 13:46:28 Taymour A. El Erian wrote: Hi, I am not sure if this is the right place to ask this or not. If I install 2 nodes of OpenLDAP and they both share the same SAN storage, is it possible that both of them would be working active/active ?,

Re: syncrepl - ldap_start_tls failed (-11)

On Thursday 06 December 2007 16:50:16 Cristian Laufer wrote: > Hello Quanah, > > sorry, I am actually using: > > provider=ldap://192.168.0.7:389 > > Would that be ok to use? > > Cristian > > Quanah Gibson-Mount schrieb: > > --On December 5, 2007 3:17:01 PM +0100 Cristian Laufer > > > > <[EMAIL PROT

Re: slave-to-master replica

A Molchanov wrote: Hellow, its about for ldap-2.3 replication with syncrepl I need slave-to-master replica, have making slapd.conf like http://www.openldap.org/faq/data/cache/1434.html... but it's not working. Hi, Can we see your config? Its even imposable to make changes on the slave direct

Re: Active/Active servers

> Indeed. I wonder why people even think that "load balancing" with shared > storage ever makes sense. The biggest bottleneck in server performance is > disk > throughput. Putting a bunch of fast CPU frontends in front of the same Bunch > Of Disks isn't going to do squat for write rates, and wr

RE: Active/Active servers

> Howard Chu wrote: >> Aaron Richton wrote: >> Multimaster support is present in OpenLDAP 2.4. > >That's not quite the complete answer though. He's also talking about two >servers sharing the same storage. In general, that is not supported in >BerkeleyDB and is certainly not supported by back-bdb

Re: access control

Quanah Gibson-Mount wrote: --On December 5, 2007 1:41:49 PM -0500 Nathan Nobbe <[EMAIL PROTECTED]> wrote: i have not read any material on ideal directory layout. can you refer me to good resource? the design i have created is based only on intuition. that, and the schema reference availa

RE: Active/Active servers

>-Original Message- >From: [EMAIL PROTECTED] [mailto:openldap-software->[EMAIL PROTECTED] rg] On Behalf Of John Madden >Sent: Thursday, December 06, 2007 1:39 PM >To: Howard Chu >Cc: Buchan Milne; openldap-software@openldap.org; Taymour A. El Erian >Subject: Re: Active/Active servers > >> I

RE: Active/Active servers

> Only change to this comment I would make is: rather than an > active/active master cluster, I'd have it active/hot standby (i.e. the > VIP on the load balancer only directs connections to one master, and > fails over to the other master if that one is unavailable rather than > balancing connecti

Re: chain and ppolicy question

Tony Earnshaw wrote: OpenLDAP 2.3.38. My site is implementing ppolicy on a 4-server OpenLDAP/RHEL5 setup. I have a problem with chaining referrals from the 3 slaves to the master. I followed the slapo-chain man page and chaining works: moduleload back_ldap.la overlay chain chain-uri

Re: Password Filter

[EMAIL PROTECTED] wrote: Hi, How to write a password filter for OpenLdap? I want make a specific policy, I think that a password filter is the best way. man slapo-ppolicy -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E

RE: Active/Active servers

--On December 6, 2007 5:03:01 PM -0500 John Madden <[EMAIL PROTECTED]> wrote: Only change to this comment I would make is: rather than an active/active master cluster, I'd have it active/hot standby (i.e. the VIP on the load balancer only directs connections to one master, and fails over to

Re: size limit by ip?

Patrick Radtke wrote: Is it possible to control the size limit based on the ip address? man slapd.conf *limits* <*who*> <*limit*> *[*<*limit*> *[...]] *The argument *who* can be any of anonymous | users | [dn[.

Re: Recursive access control for groups

> That is very urgent and critical for our project, we really need to solve this problem as soon as possible! Please help!!! http://www.openldap.org/support/ for urgent things. Most people on these lists use their spare time.