samba - Jan 2015 - Slow ldap authentication against samba 4

hi everyone... somebody has experimented any problems with poor
performance about ldap authentication against samba 4? I'm trying
authentication with 300 users and many users can't login. Some conections
are rejected. I doesn't found anything searching on internet. Any help?


--
Grato,
Jefferson Parreira dos Santos Emerick

On Mon, Jan 19, 2015 at 1:22 PM, Jefferson Parreira dos Santos Emerick
<jeparre at gmail.com> wrote:
>  hi everyone... somebody has experimented any problems with poor
> performance about ldap authentication against samba 4? I'm trying
> authentication with 300 users and many users can't login. Some
conections
> are rejected. I doesn't found anything searching on internet. Any help?
>
      Can the same users authenticate against other devices/services
using ldap without issues? What does the log file say?
>
> --
> Grato,
> Jefferson Parreira dos Santos Emerick
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

On Mon, Jan 19, 2015 at 1:22 PM, Jefferson Parreira dos Santos Emerick
<jeparre at gmail.com> wrote:
>  hi everyone... somebody has experimented any problems with poor
> performance about ldap authentication against samba 4? I'm trying
> authentication with 300 users and many users can't login. Some
conections
> are rejected. I doesn't found anything searching on internet. Any help?
>
      Can the same users authenticate against other devices/services
using ldap without issues? What does the log file say?
>
> --
> Grato,
> Jefferson Parreira dos Santos Emerick
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

On 19/01/15 18:22, Jefferson Parreira dos Santos Emerick
wrote:
>   hi everyone... somebody has experimented any problems with poor
> performance about ldap authentication against samba 4? I'm trying
> authentication with 300 users and many users can't login. Some
conections
> are rejected. I doesn't found anything searching on internet. Any help?
>
>
> --
> Grato,
> Jefferson Parreira dos Santos Emerick
Hi, are you using samba in 'classic' mode with openldap, or you 
referring to the builtin samba ldap when used in AD DC mode.

Could you post your smb.conf

Rowland

On 19/01/15 19:50, Jefferson Parreira dos Santos Emerick
wrote:
> Hi.. so.. I did the classicupgrade from samba3 with sucess. Users can 
> login how i expected. The problem happen when i try many users to 
> logon to samba 4. This is very slow and some users can't login and the 
> message that i got is: "Can't contact LDAP server". I
didn't see
> anything more in samba log's.
>
> The *samba's* version i'm using is *4.1.14* with *bind 9.10*
>
> Here is my conf:
>
> # Global parameters
> [global]
> workgroup = XXXXXX
> realm = XXXXXX.XXX.XXX
> netbios name = XXXXXXXXXX
> server role = active directory domain controller
> private dir = /opt/samba/private
> log level = 2
> lock directory = /opt/samba
> state directory = /opt/samba/state
> cache directory = /opt/samba/cache
> server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, 
> winbind, ntp_signd, kcc, dnsupdate
> idmap_ldb:use rfc2307 = yes
>
>   interfaces           = 127.0.0.1 10.1.0.65
> bind interfaces only = yes
> socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 
> SO_SNDBUF=65536
> max mux = 1000
>
> [netlogon]
> path = /opt/samba/state/sysvol/xxxxx.xxx.xx/scripts 
> <http://conab.gov.br/scripts>
> read only = No
>
> [sysvol]
> path = /opt/samba/state/sysvol
> read only = No
>
>
> I thank you for the help.
>
> Sorry by my english.
>
Hi, remove the 'socket options' & 'max mux' lines, you
shouldn't use the
first and you shouldn't need to change the second.

What OS are you using ?

I take it your clients are joined to the domain, are they using roaming 
profiles ??

Did you compile samba yourself ?

Don't worry about your English, it is a lot better than my Brazilian :-D

Rowland

On 20/01/15 11:07, Jefferson Parreira dos Santos Emerick
wrote:
> Good morning, dude.
> I compiled 'cause i already tried use other package version and
didn't
> work properly.
> Yeah yeah.. about the network, is very well. Everything working fine.
>
> I'm just trying simple bind of many users or many times with one user 
> and the ldap response is very slow or sometimes can't login. The same 
> test in OpenLDAP or AD is working fine
>
> That is more strange for me. The same test with AD that is part of the 
> domain works like a charm.
> --
>
Could you be a bit more precise on how you are binding to the ldap in 
AD, what are you trying to achieve ??

Rowland

On 20/01/15 11:14, Jefferson Parreira dos Santos Emerick
wrote:
> ? Yeah.. I wrote a simple script in python to test it. Here is the scrit:
>
> *import ldap*
> *from threading import Thread*
> *import time*
> *import sys*
> *
> *
> *class LDAPTtryThread(Thread):*
> *
> *
> *  def __init__(self, **kwargs):*
> *      Thread.__init__(self)*
> *self.id <http://self.id> = kwargs.get('id')*
> *      self.host = kwargs.get('host')*
> *      self.username = kwargs.get('username')*
> *      self.password = kwargs.get('password')*
> *      self.timeout = kwargs.get('timeout',None)*
> *
> *
> *  def run(self):*
> *      try:*
> *          l = ldap.open(self.host)*
> *          l.protocol_version = ldap.VERSION3*
> *          l.port = 389*
> *          if self.timeout:*
> *              l.set_option(ldap.OPT_TIMEOUT, self.timeout)*
> *          l.simple_bind_s(self.username, self.password)*
> *          print '%s OK' %self.id <http://self.id>*
> *      except ldap.LDAPError, e:*
> *          print '%s FAIL' %self.id <http://self.id>, e*
> *
> *
> *for i in range(int(sys.argv[4])):*
> *  timeout = None*
> *  if len(sys.argv) > 5:*
> *      timeout = int(sys.argv[5])*
> *  LDAPTesteThread(*
> *      id=i, host=sys.argv[1], username=sys.argv[2], 
> password=sys.argv[3],timeout=timeout).start()*
> ?
>
Hmm, no idea if that is part of the problem or not, to me python is a 
snake :-D

Why do you want to use ldap authentication ?

Do you have some specific programs that you want to connect to AD ?

Rowland

Good Morning.

So.. anybody else have this same issue? Slow ldap authentication?

--
Grato,
Jefferson Parreira dos Santos Emerick

2015-01-20 9:52 GMT-02:00 Jefferson Parreira dos Santos Emerick <
jeparre at gmail.com>:
> I have many corporate systems that connect to Samba 4 for authentication
> and a considerable number of users and machines that need this
> authentication working well and smoothly.
> I try a java script too, with the same problem.
>
> I found foruns with the same problem about postfix trying to use samba4
> and having trouble in slow tree search or auth, without solution.
>
> --
> Grato,
> Jefferson Parreira dos Santos Emerick
>
> 2015-01-20 9:42 GMT-02:00 Rowland Penny <rowlandpenny at
googlemail.com>:
>
>> On 20/01/15 11:14, Jefferson Parreira dos Santos Emerick wrote:
>>
>>> ​ Yeah.. I wrote a simple script in python to test it. Here is the
scrit:
>>>
>>> *import ldap*
>>> *from threading import Thread*
>>> *import time*
>>> *import sys*
>>> *
>>> *
>>> *class LDAPTtryThread(Thread):*
>>> *
>>> *
>>> *  def __init__(self, **kwargs):*
>>> *      Thread.__init__(self)*
>>> *self.id <http://self.id> = kwargs.get('id')*
>>> *      self.host = kwargs.get('host')*
>>> *      self.username = kwargs.get('username')*
>>> *      self.password = kwargs.get('password')*
>>> *      self.timeout = kwargs.get('timeout',None)*
>>> *
>>> *
>>> *  def run(self):*
>>> *      try:*
>>> *          l = ldap.open(self.host)*
>>> *          l.protocol_version = ldap.VERSION3*
>>> *          l.port = 389*
>>> *          if self.timeout:*
>>> *              l.set_option(ldap.OPT_TIMEOUT, self.timeout)*
>>> *          l.simple_bind_s(self.username, self.password)*
>>> *          print '%s OK' %self.id <http://self.id>*
>>> *      except ldap.LDAPError, e:*
>>> *          print '%s FAIL' %self.id <http://self.id>,
e*
>>> *
>>> *
>>> *for i in range(int(sys.argv[4])):*
>>> *  timeout = None*
>>> *  if len(sys.argv) > 5:*
>>> *      timeout = int(sys.argv[5])*
>>> *  LDAPTesteThread(*
>>> *      id=i, host=sys.argv[1], username=sys.argv[2],
>>> password=sys.argv[3],timeout=timeout).start()*
>>> ​
>>>
>>>
>> Hmm, no idea if that is part of the problem or not, to me python is a
>> snake :-D
>>
>> Why do you want to use ldap authentication ?
>>
>> Do you have some specific programs that you want to connect to AD ?
>>
>>
>> Rowland
>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
>
>

On 8/13/2015 9:23 AM, Jefferson P. S. Emerick wrote:
> Good Morning.
>
> So.. anybody else have this same issue? Slow ldap authentication?
>
> --
> Grato,
> Jefferson Parreira dos Santos Emerick
>
> 2015-01-20 9:52 GMT-02:00 Jefferson Parreira dos Santos Emerick <
> jeparre at gmail.com>:
>
>> I have many corporate systems that connect to Samba 4 for
authentication
>> and a considerable number of users and machines that need this
>> authentication working well and smoothly.
>> I try a java script too, with the same problem.
>>
>> I found foruns with the same problem about postfix trying to use samba4
>> and having trouble in slow tree search or auth, without solution.
>>
>> --
>> Grato,
>> Jefferson Parreira dos Santos Emerick
>>
>> 2015-01-20 9:42 GMT-02:00 Rowland Penny <rowlandpenny at
googlemail.com>:
>>
>>> On 20/01/15 11:14, Jefferson Parreira dos Santos Emerick wrote:
>>>
>>>> ​ Yeah.. I wrote a simple script in python to test it. Here is
the scrit:
>>>>
>>>> *import ldap*
>>>> *from threading import Thread*
>>>> *import time*
>>>> *import sys*
>>>> *
>>>> *
>>>> *class LDAPTtryThread(Thread):*
>>>> *
>>>> *
>>>> *  def __init__(self, **kwargs):*
>>>> *      Thread.__init__(self)*
>>>> *self.id <http://self.id> = kwargs.get('id')*
>>>> *      self.host = kwargs.get('host')*
>>>> *      self.username = kwargs.get('username')*
>>>> *      self.password = kwargs.get('password')*
>>>> *      self.timeout = kwargs.get('timeout',None)*
>>>> *
>>>> *
>>>> *  def run(self):*
>>>> *      try:*
>>>> *          l = ldap.open(self.host)*
>>>> *          l.protocol_version = ldap.VERSION3*
>>>> *          l.port = 389*
>>>> *          if self.timeout:*
>>>> *              l.set_option(ldap.OPT_TIMEOUT, self.timeout)*
>>>> *          l.simple_bind_s(self.username, self.password)*
>>>> *          print '%s OK' %self.id
<http://self.id>*
>>>> *      except ldap.LDAPError, e:*
>>>> *          print '%s FAIL' %self.id
<http://self.id>, e*
>>>> *
>>>> *
>>>> *for i in range(int(sys.argv[4])):*
>>>> *  timeout = None*
>>>> *  if len(sys.argv) > 5:*
>>>> *      timeout = int(sys.argv[5])*
>>>> *  LDAPTesteThread(*
>>>> *      id=i, host=sys.argv[1], username=sys.argv[2],
>>>> password=sys.argv[3],timeout=timeout).start()*
>>>> ​
>>>>
>>>>
>>> Hmm, no idea if that is part of the problem or not, to me python is
a
>>> snake :-D
>>>
>>> Why do you want to use ldap authentication ?
>>>
>>> Do you have some specific programs that you want to connect to AD ?
>>>
>>>
>>> Rowland
>>>
>>>
>>> --
>>> To unsubscribe from this list go to the following URL and read the
>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>
>>
I configured squid-cache proxy server to use Samba4 AD DC as the ldap 
server, and I don't see any slow authentication.
This is a production setup.

Allen

-- 
Allen Chen
Network Administrator
IT

Harbourfront Centre

235 Queens Quay West, Toronto, ON
M5J 2G8, Canada | harbourfrontcentre.com
<http://www.harbourfrontcentre.com>
Office: +1 416 973 7973
Cell: +1 416 556 2493