[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
ITS#7434
--_2dfc1396-6cab-4ee1-b5cd-ec8dfb5286a7_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Quanah=2C Trying to post a reply using my hotmail account. Sorry for the =
unreadable output previously posted. I'm almost embarassed to say I've bee=
n involved in IT for over 15 years and never used a mailing list before. An=
yhow=2C I did download the source packages and compiled them. However=2C t=
he semester was winding down and I was under a lot of pressure to have some=
thing completed before the end of finals week so my professor could assgn m=
e a grade for the work I had done. I revered back to my previous version t=
o to get some stuff written. Not to mention=2C my algorithms professor was=
kicking my butt too. Wil I ever "really" need an FFT in the real world? l=
ol The more I looked at what I was trying to accomplish=2C I realized I was=
attaking the problem all wrong. What I was being asked to do was somethin=
g more like configuring my two slapd servers to act more like Active Direct=
ory global catalog servers. GC's utilitze MM instead of single master repl=
ication so I scrapped the SM replication design in favor of MM. Once this =
was done=2C I no longer needed the chaining overlay or proxy auth. I now h=
ave MM replication of both cn=3Dconfig and my directory data (with delta) w=
orking and my Kerberos KDC's are happy. One thing I did find was that confi=
guring MM replication made me learn a little more about how to "properly" n=
ame/configure an overlay with the syncprov and accesslog modules by digging=
into the test scripts. I had some issues with sync state on the consumer=
s =2C but I found a post you made to someone else a few years back that sol=
ved my delta replication issue by configuring an syncprov overlay on the ac=
cesslog db. Not sure I remember seeing that in the Admin Guide. Looking ba=
ck at the orignal post I noticed the chain overlay I had configured was dn:=
olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2C=
cn=3Dconfig. knowing what I know now=2C I'm not 100% sure that was correc=
t. Shouldn't that overlay have been in either config database of my direct=
ory or ldap backend database for the chain rather than a "frontend"? Just=
a thought I've been kicking around in my head. Either way=2C I have my lda=
p config working. We can either close this issue if you'd like or leave it=
open and I'll attempt to confirm my theory on the overlay not being proper=
ly located when I get a chance. Completely your choice.
But I do have a couple questions on my MM replication of cn=3Dconfig if you=
want to take them. First=2C does it make sense or is it possible to do de=
lta replication on cn=3Dconfig? The data "on the wire" seems like it would=
be much smaller and less frequent than directory data so perhaps it's not =
as beneficial? Secondly=2C I am using a simple bind with this replication=
agreement (versus sasl/gssapi and tls for my directoiry data). When confi=
guring limits and acl's for replication of my dit=2C I created a groupofnam=
es (cn=3Dreplicators=2C ou=3Dgroups=2C dc=3Dexample=2Cdc=3Dnet) that has ea=
ch ldap server as a member. My thought process was that this made the solu=
tion a bit more scalable. As ldap servers were added to the topology=2C th=
ey could be added to the group of names and automtically be given the corre=
ct permissions an limits. Likewise=2C as server are decomisioned=2C they c=
ould easily be removed by deleteing them from the group and directory. Ca=
n I use this same group of names in cn=3Dconfig replication by creating a s=
imilar limit and acl using this group of names? Since I am handling the fo=
rmatting of the gssapi uid in cn=3Dconfig (maybe a mistake if I ever wanted=
to be able to handle multiple directories/domains)=2C can I use the gssapi=
authtication of hosts in dc=3Dexample=2Cdc=3Dnet? Seems I sould be able t=
o since it appears that when the authorization occurs in the database=2C th=
e bind id is assumed to be already authenticated and accepted as presented =
with no further authentication taking place. I'm thinking that so long as =
that uid is formatted into a dn listed in an acl=2C the matching access is =
applied? Am I way off base in my thinking? Now that I have a rough workab=
le solution I'm just trying to pretty it up a bit and make the design more =
efficient and scalable. Thanks Barry =
--_2dfc1396-6cab-4ee1-b5cd-ec8dfb5286a7_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 12pt=3B
font-family:Calibri
}
--></style></head>
<body class=3D'hmmessage'><div dir=3D'ltr'>Quanah=2C <BR> =3B<BR>Trying=
to post a reply using my hotmail account. =3B Sorry for the unreadable=
output previously posted. =3B I'm almost embarassed to say I've been i=
nvolved in IT for over 15 years and never used a mailing list before.<BR>&n=
bsp=3B<BR>Anyhow=2C I did download the source packages and compiled them.&n=
bsp=3B However=2C the semester was winding down and I was under a lot of pr=
essure to have something completed before the end of finals week so my prof=
essor could assgn me a grade for the work I had done. =3B I revered bac=
k to my previous version to to get some stuff written. =3B Not to menti=
on=2C my algorithms professor was kicking my butt too. Wil I ever "really" =
need an FFT in the real world? =3B lol<BR> =3B<BR>The more I looked=
at what I was trying to accomplish=2C I realized I was attaking the proble=
m all wrong. =3B What I was being asked to do was something more like c=
onfiguring my two slapd servers to act more like Active Directory global ca=
talog servers. GC's utilitze MM instead of =3B single master replicatio=
n so I scrapped the SM replication design in favor of MM. =3B Once this=
was done=2C I no longer needed the chaining overlay or proxy auth. =3B=
I now have MM replication of both cn=3Dconfig and my directory data (with =
delta) working and my Kerberos KDC's are happy.<BR> =3B<BR>One thing I =
did find was that configuring MM replication made me learn a little more ab=
out how to "properly" name/configure an overlay with the syncprov and acces=
slog modules by digging into the test scripts. =3B =3B =3BI had=
some issues with sync state on the consumers =3B=2C but I found a post=
you made to someone else a few years back that solved my delta replication=
issue by configuring an syncprov overlay on the accesslog db. =3B Not =
sure I remember seeing that in the Admin Guide.<BR> =3B<BR>Looking back=
at the orignal post I noticed the chain overlay I had configured was dn: o=
lcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2C c=
n=3Dconfig. =3B knowing what I know now=2C I'm not 100% sure that was c=
orrect. =3B Shouldn't that overlay have been in =3Beither config da=
tabase =3Bof my directory =3B or ldap backend database for the chai=
n rather than a "frontend"? =3B Just a thought I've been kicking around=
in my head.<BR> =3B<BR>Either way=2C I have my ldap config working.&nb=
sp=3B We can either close this issue if you'd like or leave it open and I'l=
l attempt to confirm my theory on the overlay not being properly located wh=
en I get a chance. =3B =3B =3BCompletely your choice.<br><BR>Bu=
t I do have a couple questions on my MM replication of cn=3Dconfig if you w=
ant to take them. =3B First=2C does it make sense or is it possible to =
do delta replication on cn=3Dconfig? =3B The data "on the wire" seems l=
ike it would be much smaller and less frequent than directory data so perha=
ps it's =3Bnot as beneficial? =3B =3B Secondly=2C I am using a =
simple bind with this replication agreement (versus sasl/gssapi and tls for=
my directoiry data). =3B When configuring limits and acl's for replica=
tion of my dit=2C I created a groupofnames (cn=3Dreplicators=2C ou=3Dgroups=
=2C dc=3Dexample=2Cdc=3Dnet) that has each ldap server as a member. =3B=
My thought process was that this made the solution a bit more scalable.&nb=
sp=3B As ldap servers were added to the topology=2C they could be added to =
the group of names and automtically be given the correct permissions an lim=
its. =3B Likewise=2C as server are decomisioned=2C they could easily be=
removed =3Bby deleteing them from the group and directory. =3B&nbs=
p=3B Can I use this same group of names in cn=3Dconfig replication by creat=
ing a similar limit and acl using this group of names? =3B Since I am h=
andling the formatting of the gssapi uid in cn=3Dconfig (maybe =3Ba mis=
take if I ever wanted to be able to handle multiple directories/domains)=2C=
can I use the gssapi authtication of hosts in dc=3Dexample=2Cdc=3Dnet?&nbs=
p=3B Seems I sould be able to since it appears that when the authorization =
occurs in the database=2C the bind id is assumed to be already authenticate=
d and accepted as presented with no further authentication taking place.&nb=
sp=3B I'm thinking that so long as that uid is formatted into a dn listed i=
n an acl=2C the matching access is applied? =3B Am I way off base in my=
thinking? =3B Now that I have a rough workable solution I'm just tryin=
g to pretty it up a bit and make the design more efficient and scalable.<BR=
> =3B<BR>Thanks<BR> =3B<BR>Barry<BR> =3B<BR> </div><=
/body>
</html>=
--_2dfc1396-6cab-4ee1-b5cd-ec8dfb5286a7_--