Grouper Users - Open Discussion List

[Tom Barton <>]

The slapd message "bdb_equality_candidates: (eduPersonPrincipalName) 
index_param failed" might indicate that there is no equality index on 
eduPersonPrincipalName. Part of good ldap operational practice is to 
have an equality index for each attribute that frequently figures as 
part of an equality clause in a search filter.

You have a JNDISourceAdapter configured in sources.xml that you don't 
appear to need. The only activity in the ldap logs below relate to (1) 
the initialization of that source adapter, and (2) the initialization of 
the grouper API session that is operating in connection with ldappc. 
You'd best remove that from sources.xml.

There is *no* provisioning activity logged at all - no searching for 
current state of groups and memberships to compute the incremental 
changes needed, and consequently no attempts to update the directory. 
Ldappc itself did not even attempt to bind to this directory, if this is 
the full log.

Last time there was a search for  
,ou=people,dc=ncl,dc=ac,dc=uk. Are you certain that the logs below 
capture the *entire* ldappc session?

Sanjay Vivek wrote:
> Hi Tom,
>
> I've set the openldap loglevel to 256 and the logs obtained are given at
> the end of this email. I believe it's an ACL issue as well but it
> doesn't help that the "bdb_search: 135 does not match filter" is a very
> common error and it could mean anything from openldap not accepting v_2
> binds to incompatible versions. However, after trawling through openldap
> mailing lists, ACL seem to be the most common reason for the error.
> Unfortunately, I don't have much experience with openLDAP so most of
> this is a trial and error process. I'd be reading up a bit more on ACL
> issues and hopefully that will sort this out. Thanks again for all your
> help. Cheers.
>
> Regards
> Sanjay
>
> Oct 17 09:35:19 pen slapd[11218]: conn=7 fd=13 ACCEPT from
> IP=128.240.2.3:58359 (IP=0.0.0.0:389) 
> Oct 17 09:35:19 pen slapd[11218]: conn=7 op=0 BIND
> dn="cn=Manager,dc=ncl,dc=ac,dc=uk" method=128 
> Oct 17 09:35:19 pen slapd[11218]: conn=7 op=0 BIND
> dn="cn=Manager,dc=ncl,dc=ac,dc=uk" mech=SIMPLE ssf=0 
> Oct 17 09:35:19 pen slapd[11218]: conn=7 op=0 RESULT tag=97 err=0 text= 
> Oct 17 09:35:19 pen slapd[11218]: conn=8 fd=14 ACCEPT from
> IP=128.240.2.3:36969 (IP=0.0.0.0:389) 
> Oct 17 09:35:19 pen slapd[11218]: conn=8 op=0 BIND
> dn="cn=Manager,dc=ncl,dc=ac,dc=uk" method=128 
> Oct 17 09:35:19 pen slapd[11218]: conn=8 op=0 BIND
> dn="cn=Manager,dc=ncl,dc=ac,dc=uk" mech=SIMPLE ssf=0 
> Oct 17 09:35:19 pen slapd[11218]: conn=8 op=0 RESULT tag=97 err=0 text= 
> Oct 17 09:35:19 pen slapd[11218]: conn=8 op=1 UNBIND 
> Oct 17 09:35:19 pen slapd[11218]: conn=8 fd=14 closed 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 fd=14 ACCEPT from
> IP=128.240.2.3:45996 (IP=0.0.0.0:389) 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=0 BIND
> dn="cn=Manager,dc=ncl,dc=ac,dc=uk" method=128 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=0 BIND
> dn="cn=Manager,dc=ncl,dc=ac,dc=uk" mech=SIMPLE ssf=0 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=0 RESULT tag=97 err=0 text= 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=1 SRCH
> base="ou=people,dc=ncl,dc=ac,dc=uk" scope=2 deref=3
> filter="(&(eduPersonPrincipalName=groupersystem)(objectClass=eduPerson))
> " 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=1 SRCH attr=cn cn
> eduPersonPrincipalName 
> Oct 17 09:35:20 pen slapd[11218]: <= bdb_equality_candidates:
> (eduPersonPrincipalName) index_param failed (18) 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=1 SEARCH RESULT tag=101
> err=0 nentries=0 text= 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 op=2 UNBIND 
> Oct 17 09:35:20 pen slapd[11218]: conn=9 fd=14 closed 
> Oct 17 09:35:20 pen slapd[11218]: conn=7 op=1 UNBIND 
> Oct 17 09:35:20 pen slapd[11218]: conn=7 fd=13 closed