[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: MDB_BAD_RSLOT while executing slapacl
Howard Chu <hyc@symas.com> wrote on Thu, 12 Dec 2013 15:24:00 +0400:
Igor Zinovik wrote:
2013/12/12 Howard Chu <hyc@symas.com <mailto:hyc@symas.com>>
You should upgrade to get the fix for #7662.
I upgraded my slapd to 2.4.38, but I still see error message when I
execute
slapacl.
I also removed data.mdb and lock.mdb, imported data back to ldap using
backup
copy and I still see error message.
Post your config, sample data, and the exact slapacl command you used.
I started with empty config and empty database with slapd-2.4.38:
# sudo slapadd -F /etc/openldap/slapd.d -n0 -l config.ldif
_#################### 100.00% eta none elapsed none fast!
Closing DB...
I import single object into my catalog:
# cat initial-import.ldif
dn: dc=example,dc=org
dc: example
objectClass: organization
objectClass: dcObject
o: Example
# sudo slapadd -F /etc/openldap/slapd.d -b dc=example,dc=org -l config.ldif
_#################### 100.00% eta none elapsed none fast!
Closing DB...
Trying to check access:
# sudo slapacl -F /etc/openldap/slapd.d -D
uid=zinovik,ou=people,dc=example,dc=org \
-b dc=example,dc=org o/read
authcDN: "uid=zinovik,ou=people,dc=example,dc=org"
52abd7bc mdb_opinfo_get: err MDB_BAD_RSLOT: Invalid reuse of reader
locktable slot(-30783)
read access to o: ALLOWED
Here is my config (with omitted cn=schema,cn=config):
dn: cn=config
objectClass: olcGlobal
cn: config
olcConfigFile: slapd.conf.bak
olcConfigDir: slapd.d
olcArgsFile: /var/run/slapd/slapd.args
olcAttributeOptions: lang-
olcAuthzPolicy: none
olcConcurrency: 0
olcConnMaxPending: 100
olcConnMaxPendingAuth: 1000
olcGentleHUP: FALSE
olcIdleTimeout: 0
olcIndexSubstrIfMaxLen: 4
olcIndexSubstrIfMinLen: 2
olcIndexSubstrAnyLen: 4
olcIndexSubstrAnyStep: 2
olcIndexIntLen: 4
olcLocalSSF: 71
olcPidFile: /var/run/slapd/slapd.pid
olcReadOnly: FALSE
olcSaslSecProps: noplain,noanonymous
olcServerID: 1 ldap://ldap1.example.org
olcServerID: 2 ldap://ldap2.example.org
olcServerID: 3 ldap://ldap3.example.org
olcSockbufMaxIncoming: 262143
olcSockbufMaxIncomingAuth: 16777215
olcThreads: 8
olcTLSCACertificatePath: /etc/ssl/certs
olcTLSCertificateKeyFile: /etc/openldap/ldap.key
olcTLSCRLCheck: none
olcTLSVerifyClient: allow
olcToolThreads: 1
olcWriteTimeout: 0
olcTLSCACertificateFile: /etc/ssl/example-ca-bundle.crt
olcTLSCertificateFile: /etc/openldap/ldap.crt
olcLogLevel: config sync
dn: cn=schema,cn=config
...
[omitted]
...
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/openldap/modules
olcModuleLoad: {0}accesslog
olcModuleLoad: {1}memberof
olcModuleLoad: {2}pcache
olcModuleLoad: {3}refint
olcModuleLoad: {4}syncprov
olcModuleLoad: {5}unique
dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcAccess: {0}to dn.base="" by * read
olcAccess: {1}to dn.base="cn=subschema" by * read
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcMaxDerefDepth: 0
olcReadOnly: FALSE
olcSchemaDN: cn=Subschema
olcSyncUseSubentry: FALSE
olcMonitoring: FALSE
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by group/groupOfNames/member.exact="cn=ldap
admins,ou=grou
ps,dc=example,dc=org" write
olcAddContentAcl: TRUE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=admin,cn=config
olcRootPW:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
olcSyncUseSubentry: FALSE
olcMirrorMode: TRUE
olcMonitoring: FALSE
olcSyncrepl: {0}rid=001 provider=ldap://ldap1.example.org
binddn="cn=admin,cn=co
nfig" bindmethod=simple credentials="XXXXXXXXXXXXXXXXX" searchbase="cn=con
fig" type=refreshAndPersist retry="5 5 30 +" timeout=1 starttls=yes
tls_cert=
"/etc/openldap/ldap.crt" tls_key="/etc/openldap/ldap.key"
tls_cacert="/etc/ss
l/example-ca-bundle.crt" tls_reqcert=demand tls_crlcheck=none
olcSyncrepl: {1}rid=002 provider=ldap://ldap2.example.org
binddn="cn=admin,cn=co
nfig" bindmethod=simple credentials="XXXXXXXXXXXXXXXXX" searchbase="cn=con
fig" type=refreshAndPersist retry="5 5 30 +" timeout=1 starttls=yes
tls_cert=
"/etc/openldap/ldap.crt" tls_key="/etc/openldap/ldap.key"
tls_cacert="/etc/ss
l/example-ca-bundle.crt" tls_reqcert=demand tls_crlcheck=none
olcSyncrepl: {2}rid=003 provider=ldap://ldap3.example.org
binddn="cn=admin,cn=co
nfig" bindmethod=simple credentials="XXXXXXXXXXXXXXXXX" searchbase="cn=con
fig" type=refreshAndPersist retry="5 5 30 +" timeout=1 starttls=yes
tls_cert=
"/etc/openldap/ldap.crt" tls_key="/etc/openldap/ldap.key"
tls_cacert="/etc/ss
l/example-ca-bundle.crt" tls_reqcert=demand tls_crlcheck=none
dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=example,dc=org
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcLimits: {0}group/groupOfNames/member="cn=ldap
admins,ou=groups,dc=example,dc
=ru" size=unlimited
olcLimits: {1}group/groupOfNames/member="cn=ldap
admins,ou=groups,dc=example,dc
=ru" time=unlimited
olcLimits:
{2}group/groupOfNames/member="cn=admins,ou=mail,ou=groups,dc=example
,dc=ru" size=unlimited
olcLimits:
{3}group/groupOfNames/member="cn=replicators,ou=groups,dc=example,dc
=ru" size=unlimited time=unlimited
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=admin,dc=example,dc=org
olcRootPW:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
olcSyncUseSubentry: FALSE
olcSyncrepl: {0}rid=004 provider=ldap://ldap1.example.org
bindmethod=simple bind
dn="uid=mirrormode,ou=services,dc=example,dc=org"
credentials="XXXXXXXXXXXXXXXX
XX" keepalive=0:0:0 starttls=yes tls_cert="/etc/openldap/ldap.crt"
tls_key="/
etc/openldap/ldap.key" tls_cacert="/etc/ssl/example-ca-bunle.crt"
tls_reqcert=
demand tls_crlcheck=none filter="(objectclass=*)"
searchbase="dc=example,dc=org
" schemachecking=on type=refreshAndPersist retry="60 +"
olcSyncrepl: {1}rid=005 provider=ldap://ldap2.example.org
bindmethod=simple bind
dn="uid=mirrormode,ou=services,dc=example,dc=org"
credentials="XXXXXXXXXXXXXXXX
XX" keepalive=0:0:0 starttls=yes tls_cert="/etc/openldap/ldap.crt"
tls_key="/
etc/openldap/ldap.key" tls_cacert="/etc/ssl/example-ca-bundle.crt"
tls_reqcert
=demand tls_crlcheck=none filter="(objectclass=*)"
searchbase="dc=example,dc=r
u" schemachecking=on type=refreshAndPersist retry="60 +"
olcSyncrepl: {2}rid=006 provider=ldap://ldap3.example.org
bindmethod=simple bind
dn="uid=mirrormode,ou=services,dc=example,dc=org"
credentials="XXXXXXXXXXXXXXXX
XX" keepalive=0:0:0 starttls=yes tls_cert="/etc/openldap/ldap.crt"
tls_key="/
etc/openldap/ldap.key" tls_cacert="/etc/ssl/example-ca-bundle.crt"
tls_reqcert
=demand tls_crlcheck=none filter="(objectclass=*)"
searchbase="dc=example,dc=r
u" schemachecking=on type=refreshAndPersist retry="60 +"
olcMirrorMode: TRUE
olcMonitoring: TRUE
olcDbNoSync: FALSE
olcDbIndex: objectClass eq
olcDbIndex: cn pres,eq,approx,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: memberUid eq
olcDbIndex: member eq
olcDbIndex: sudoUser eq,sub
olcDbIndex: uniqueMember eq
olcDbIndex: uidNumber eq
olcDbIndex: rfc822MailMember eq
olcDbIndex: gidNumber eq
olcDbIndex: mail eq,sub
olcDbIndex: zoneName eq
olcDbIndex: relativeDomainName eq
olcDbIndex: dlzHostName,dlzZoneName,dlzRecordID,dlzType eq,pres
olcDbIndex: dhcpHWAddress,dhcpClassData eq
olcDbIndex: sudoHost eq,sub
olcDbIndex: accountStatus eq
olcDbIndex: dc eq
olcDbMaxReaders: 0
olcDbMaxSize: 1073741824
olcDbMode: 0600
olcDbSearchStack: 16
olcAccess: {0}to attrs=userPassword by self write by anonymous auth
olcAccess: {1}to * by * read
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
olcOverlay: {1}refint
olcRefintAttribute: seeAlso
olcRefintAttribute: uniqueMember
olcRefintAttribute: member
olcRefintNothing: cn=EMPTY
dn: olcOverlay={2}unique,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcUniqueConfig
olcOverlay: {2}unique
olcUniqueURI: ldap:///ou=Hosts,dc=example,dc=org?ipHostNumber?sub
olcUniqueURI: ldap:///ou=People,dc=example,dc=org?uid,uidNumber?sub
olcUniqueURI: ldap:///ou=Groups,dc=example,dc=org?cn,gidNumber?sub
olcUniqueURI: ldap:///ou=Mail,dc=example,dc=org?mail,mailLocalAddress?sub
dn: olcOverlay={3}syncprov,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {3}syncprov
olcSpCheckpoint: 100 10
olcSpSessionlog: 100
dn: olcDatabase={2}monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {2}monitor
olcAccess: {0}to * by group/groupOfNames/member.exact="cn=ldap
admins,ou=grou
ps,dc=example,dc=org" read
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcSyncUseSubentry: FALSE
olcMonitoring: FALSE