Re: Re: Can domain admins be filtered out with ACLs?

2015-04-17 Thread Igor Shmukler
Hello Ulrich, I do not doubt that you are right, yet what to understand. Why would be rootdn necessary to fix ACLs when we have the config database without RootDN and therefore that one is cannot be messed up by applying a filter to the RootDN? Not that I doubt wisdom of the design decisions.

olcHidden breaks slapcat? possible bug in slapcat(8)?

2015-04-17 Thread Igor Shmukler
Hello, I use olcHidden and set it to true in some instances. This seems to work, yet it breaks slapcat(8) as below: $ sudo slapcat -n 0 5530b282 olcRootPW: value #0: olcRootPW can only be set when rootdn is under suffix 5530b282 config error processing olcDatabase={2}hdb,cn=config: olcRootPW can

Re: olcHidden breaks slapcat? possible bug in slapcat(8)?

2015-04-17 Thread Igor Shmukler
Hello Ulrich, Not to me, it does not answer the question. How do I connect olcHIdden set to TRUE throwing an error, and FALSE does not? Would you mind making the connection for me, please. Sincerely, Igor Shmukler On Fri, Apr 17, 2015 at 9:38 AM, Ulrich Windl ulrich.wi...@rz.uni-regensburg.de

Re: Fwd: 2.4.40 memory leak?

2015-04-17 Thread Sergey Esin
It's still happening, see http://i.imgur.com/NL8ztmp.png. The only solution for us now is to reboot slapd on a regular basis. What information can I provide to help to find the reason and fix it? -- Sergey On Mon, Mar 30, 2015 at 12:01 PM, Sergey Esin sergey.e...@gmail.com wrote: Hi Ryan,

Re: separate loglevels for different databases?

2015-04-17 Thread Meike Stone
Dear list, I've configured two different databases (one ldap, one bdb) in openLDAP. Is it possible, to configure separate loglevels for each database? maybe at least different logfiles? Thanks Meike

Re: Structural object class rules

2015-04-17 Thread dE
On 04/15/15 19:28, Michael Ströder wrote: dE wrote: An object or alias entry is characterized by precisely one structural object class superclass chain which has a single structural object class as the most subordinate object class. This structural object class is referred

Re: Auxiliary object class practically of no use?

2015-04-17 Thread dE
On 04/15/15 19:31, Howard Chu wrote: dE wrote: According to RFC 4512 An entry can belong to any subset of the set of auxiliary object classes allowed by the DIT content rule associated with the structural object class of the entry. From what I understand, this means auxiliary classes

catch size and performance

2015-04-17 Thread Greg Jetter
Hello: I, running a openldap setup with one provider and 3 consumers , I am seeing intermittent problems of replication not happening Until the consumers are re started . This cures the problem. replication starts up and continues for a while . The servers have very large amount of

how to check user lock status

2015-04-17 Thread rockwang
Hi, all I set policy for user as following # default, policies, abc.com dn: cn=default,ou=policies,dc=abc,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMaxAge: 7776002 pwdExpireWarning: 432000 pwdInHistory: 3

How to disable SSF (integrity) on GSSAPI mech?

2015-04-17 Thread Osipov, Michael
Hi folks, I am binding against Active Directory with GSSAPI mech and would like to disable SASL integrity for debugging purposes with Wireshark. Unfortunately, this call fails: char *secprops = minssf=0,maxssf=0; rc = ldap_set_option(ld, LDAP_OPT_X_SASL_SECPROPS, secprops); with: Diagnostic

Re: Fwd: 2.4.40 memory leak?

2015-04-17 Thread Ryan Tandy
On Fri, Apr 17, 2015 at 05:43:45PM +0300, Sergey Esin wrote: It's still happening, see http://i.imgur.com/NL8ztmp.png. The only solution for us now is to reboot slapd on a regular basis. What information can I provide to help to find the reason and fix it? If you can provide a reproducible

Re: catch size and performance

2015-04-17 Thread Quanah Gibson-Mount
--On Thursday, April 16, 2015 8:59 PM + Greg Jetter gjet...@gci.com wrote: Hello: I, running a openldap setup with one provider and 3 consumers , I am seeing intermittent problems of replication not happening Until the consumers are re started . This cures the problem. replication

Re: How to disable SSF (integrity) on GSSAPI mech?

2015-04-17 Thread Dan White
On 04/15/15 21:10 +, Osipov, Michael wrote: Hi folks, I am binding against Active Directory with GSSAPI mech and would like to disable SASL integrity for debugging purposes with Wireshark. Unfortunately, this call fails: char *secprops = minssf=0,maxssf=0; rc = ldap_set_option(ld,

Re: catch size and performance

2015-04-17 Thread Quanah Gibson-Mount
--On Thursday, April 16, 2015 8:59 PM + Greg Jetter gjet...@gci.com wrote: Hello: I, running a openldap setup with one provider and 3 consumers , I am seeing intermittent problems of replication not happening Until the consumers are re started . This cures the problem. replication

Re: olcHidden breaks slapcat? possible bug in slapcat(8)?

2015-04-17 Thread Howard Chu
Igor Shmukler wrote: Hello, I use olcHidden and set it to true in some instances. This seems to work, yet it breaks slapcat(8) as below: $ sudo slapcat -n 0 5530b282 olcRootPW: value #0: olcRootPW can only be set when rootdn is under suffix 5530b282 config error processing

RE: catch size and performance

2015-04-17 Thread Quanah Gibson-Mount
--On Friday, April 17, 2015 8:11 PM + Greg Jetter gjet...@gci.com wrote: Version: 2.4.28-1.1ubuntu4.4 I strongly advise upgrading, numerous issues in sync replication have been fixed since that release. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc.

Re: Structural object class rules

2015-04-17 Thread Michael Ströder
dE wrote: On 04/15/15 19:28, Michael Ströder wrote: dE wrote: An object or alias entry is characterized by precisely one structural object class superclass chain which has a single structural object class as the most subordinate object class. This structural object class

Re: Help: LDAP using alias to reference value of another attribute

2015-04-17 Thread Quanah Gibson-Mount
--On Wednesday, April 15, 2015 7:14 PM +0400 Poul Etto zepoule...@gmail.com wrote: Hi, Thank you for your replies ! @ Quanah: What I understand of their system is that they built their own SCHEMAs... And thay put all information (attributes) in one single OU Is that it ? They extended

Re: Auxiliary object class practically of no use?

2015-04-17 Thread Michael Ströder
dE wrote: On 04/15/15 19:31, Howard Chu wrote: dE wrote: According to RFC 4512 An entry can belong to any subset of the set of auxiliary object classes allowed by the DIT content rule associated with the structural object class of the entry. From what I understand, this means