7:07 a.m.
Hello list,
I have some problems with alias Objects. I have setup an internal and an
external tree. Some group accounts have to point from the external
suffix to the internal one.
Example:
dn: cn=alias,ou=Groups,dc=intern,dc=de
objectClass: top
objectClass: groupOfUniqueNames
cn: alias
...
dn: cn=alias,ou=Groups,dc=extern,dc=de
aliasedObjectName: cn=alias,ou=Groups,dc=intern,dc=de
objectClass: top
objectClass: extensibleObject
objectClass: alias
cn: alias
ldapsearch -h ldap -x -a find -b "ou=Groups,dc=extern,dc=de"
search: 2
result: 33 Alias problem
matchedDN: alias,ou=Groups,dc=gfz-extern,dc=de
text: aliasedObject not found
System:
OpenLDAP: 2.4.16, configured with --enable-overlays=yes
solaris 10, SPARC
The aliasedObjectName is set to "cn=alias,ou=Groups,dc=intern,dc=de" but
the search result give back: "alias,ou=Groups,dc=gfz-extern,dc=de" for
the matchedDN. Both trees are indexed with "olcDbIndex: cn
pres,eq,approx,sub".
I'm looking forward to your advice, hints and help.
Thanks a lot!
Andreas
4:55 a.m.
Andreas Schoe <andi(a)gfz-potsdam.de> writes:
Hello list,
I have some problems with alias Objects. I have setup an internal and an
external tree. Some group accounts have to point from the external
suffix to the internal one.
[...]
ldapsearch -h ldap -x -a find -b "ou=Groups,dc=extern,dc=de"
search: 2
result: 33 Alias problem
matchedDN: alias,ou=Groups,dc=gfz-extern,dc=de
text: aliasedObject not found
[...]
Please check your access rules for ou=groups,dc=intern,dc=de
you may run slapd in debugging mode acl (32) to analyse parsing of the
rules set.
-Dieter
--
Dieter Klünter | Systemberatung
http://dkluenter.de
GPG Key ID:8EF7B6C6
53°08'09,95"N
10°08'02,42"E
5:40 a.m.
Hello,
I post the operation with debug level "-1". I can read out an error with
the indexed DB dn2id, the suffix is called "cn=intern,dc=de" and in the
logs there is an entry "c=intern,dc=de". For testing the server is
contacted by the manager account.
[..]
[ID 198467 local4.debug] >>> dnPrettyNormal:
<cn=alias,ou=Groups,dc=extern,dc=de>
[ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=NULL
[ID 147344 local4.debug] <<< dnPrettyNormal:
<cn=alias,ou=Groups,dc=extern,dc=de>, <cn=alias,ou=groups,dc=extern,dc=de>
[ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=NULL
[ID 829381 local4.debug] SRCH "cn=alias,ou=Groups,dc=extern,dc=de" 2 3
[ID 998714 local4.debug] 0 0 0
[ID 119476 local4.debug] begin get_filter
[ID 873669 local4.debug] PRESENT
[ID 274773 local4.debug] end get_filter 0
[ID 141783 local4.debug] filter: (cn=*)
[ID 503656 local4.debug] attrs:
[ID 100000 local4.debug]
[ID 469902 local4.debug] conn=1389 op=1 SRCH
base="cn=alias,ou=Groups,dc=extern,dc=de" scope=2 deref=3
filter="(cn=*)"
[ID 325447 local4.debug] => bdb_search
[ID 449132 local4.debug] bdb_dn2entry("cn=alias,ou=groups,dc=extern,dc=de")
[ID 449132 local4.debug] bdb_dn2entry("cn=alias,ou=groups,dc=intern,dc=de")
[ID 603319 local4.debug] => bdb_dn2id("c=intern,dc=de")
[ID 433641 local4.debug] <= bdb_dn2id: get failed: DB_NOTFOUND: No
matching key/data pair found (-30988)
[ID 923158 local4.debug] => access_allowed: disclose access to
"cn=alias,ou=Groups,dc=extern,dc=de" "entry" requested
[ID 592946 local4.debug] <= root access granted
[ID 384072 local4.debug] => access_allowed: disclose access granted by
manage(=mwrscxd)
[ID 131099 local4.debug] send_ldap_result: conn=1389 op=1 p=3
[ID 291653 local4.debug] send_ldap_result: err=33
matched="cn=alias,ou=Groups,dc=extern,dc=de" text="aliasedObject not
found"
[ID 324658 local4.debug] send_ldap_response: msgid=2 tag=101 err=33
[ID 832699 local4.debug] conn=1389 op=1 SEARCH RESULT tag=101 err=33
nentries=0 text=aliasedObject not found
[ID 601841 local4.debug] daemon: activity on 1 descriptor
[ID 802679 local4.debug] daemon: activity on:
[ID 522297 local4.debug] 31r
[..]
This will pick up the group account:
ldapsearch -x -h ldap.intern.de -b "cn=alias,ou=Groups,dc=intern,dc=de"
'(cn=*)'
thanks,
Andreas
Dieter Kluenter schrieb:
Andreas Schoe <andi(a)gfz-potsdam.de> writes:
> Hello list,
>
> I have some problems with alias Objects. I have setup an internal and an
> external tree. Some group accounts have to point from the external
> suffix to the internal one.
>
[...]
> ldapsearch -h ldap -x -a find -b "ou=Groups,dc=extern,dc=de"
>
> search: 2
> result: 33 Alias problem
> matchedDN: alias,ou=Groups,dc=gfz-extern,dc=de
> text: aliasedObject not found
>
[...]
Please check your access rules for ou=groups,dc=intern,dc=de
you may run slapd in debugging mode acl (32) to analyse parsing of the
rules set.
-Dieter
--
Andreas Schoe
Abteilung: Daten- und Rechenzentrum (DRZ)
Tel.: +49 (0)331/288-1719
Fax: +49 (0)331/288-1703
Email: andreas.schoe(a)gfz-potsdam.de
___________________________________
Helmholtz-Zentrum Potsdam
Deutsches GeoForschungsZentrum - GFZ
Stiftung des öff. Rechts Land Brandenburg
Telegrafenberg, D-14473 Potsdam
8:02 a.m.
Andreas Schoe <andi(a)gfz-potsdam.de> writes:
Hello,
I post the operation with debug level "-1". I can read out an error with
the indexed DB dn2id, the suffix is called "cn=intern,dc=de" and in the
logs there is an entry "c=intern,dc=de". For testing the server is
contacted by the manager account.
A search with rootdn disables all access rules, and slapd -d acl would
have shown acl parsing. But anyhow...
base="cn=alias,ou=Groups,dc=extern,dc=de" scope=2 deref=3
filter="(cn=*)"
[ID 325447 local4.debug] => bdb_search
[ID 449132 local4.debug] bdb_dn2entry("cn=alias,ou=groups,dc=extern,dc=de")
[ID 449132 local4.debug] bdb_dn2entry("cn=alias,ou=groups,dc=intern,dc=de")
[ID 603319 local4.debug] => bdb_dn2id("c=intern,dc=de")
[ID 433641 local4.debug] <= bdb_dn2id: get failed: DB_NOTFOUND: No
matching key/data pair found (-30988)
[ID 923158 local4.debug] => access_allowed: disclose access to
"cn=alias,ou=Groups,dc=extern,dc=de" "entry" requested
[ID 592946 local4.debug] <= root access granted
[ID 384072 local4.debug] => access_allowed: disclose access granted by
manage(=mwrscxd)
[ID 131099 local4.debug] send_ldap_result: conn=1389 op=1 p=3
[ID 291653 local4.debug] send_ldap_result: err=33
matched="cn=alias,ou=Groups,dc=extern,dc=de" text="aliasedObject not
found"
[ID 324658 local4.debug] send_ldap_response: msgid=2 tag=101 err=33
[ID 832699 local4.debug] conn=1389 op=1 SEARCH RESULT tag=101 err=33
nentries=0 text=aliasedObject not found
The result is quite clear, the object ou=groups,dc=intern,dc=de does
not exist within the servers naming context.
[...]
This will pick up the group account:
ldapsearch -x -h ldap.intern.de -b "cn=alias,ou=Groups,dc=intern,dc=de"
'(cn=*)'
It seems that you either connect to a different host or to a different
search base. In both cases you cannot dereference an alias, you should
probably create referrals.
-Dieter
--
Dieter Klünter | Systemberatung
http://dkluenter.de
GPG Key ID:8EF7B6C6
53°08'09,95"N
10°08'02,42"E
11:22 p.m.
thanks,
i will create referrals. I thought within the same server but two
different kind of suffixes I could use aliases.
Andreas
Dieter Kluenter schrieb:
Andreas Schoe <andi(a)gfz-potsdam.de> writes:
> Hello,
>
> I post the operation with debug level "-1". I can read out an error with
> the indexed DB dn2id, the suffix is called "cn=intern,dc=de" and in the
> logs there is an entry "c=intern,dc=de". For testing the server is
> contacted by the manager account.
>
A search with rootdn disables all access rules, and slapd -d acl would
have shown acl parsing. But anyhow...
> base="cn=alias,ou=Groups,dc=extern,dc=de" scope=2 deref=3
filter="(cn=*)"
> [ID 325447 local4.debug] => bdb_search
> [ID 449132 local4.debug]
bdb_dn2entry("cn=alias,ou=groups,dc=extern,dc=de")
> [ID 449132 local4.debug]
bdb_dn2entry("cn=alias,ou=groups,dc=intern,dc=de")
> [ID 603319 local4.debug] => bdb_dn2id("c=intern,dc=de")
> [ID 433641 local4.debug] <= bdb_dn2id: get failed: DB_NOTFOUND: No
> matching key/data pair found (-30988)
> [ID 923158 local4.debug] => access_allowed: disclose access to
> "cn=alias,ou=Groups,dc=extern,dc=de" "entry" requested
> [ID 592946 local4.debug] <= root access granted
> [ID 384072 local4.debug] => access_allowed: disclose access granted by
> manage(=mwrscxd)
> [ID 131099 local4.debug] send_ldap_result: conn=1389 op=1 p=3
> [ID 291653 local4.debug] send_ldap_result: err=33
> matched="cn=alias,ou=Groups,dc=extern,dc=de" text="aliasedObject not
found"
> [ID 324658 local4.debug] send_ldap_response: msgid=2 tag=101 err=33
> [ID 832699 local4.debug] conn=1389 op=1 SEARCH RESULT tag=101 err=33
> nentries=0 text=aliasedObject not found
>
The result is quite clear, the object ou=groups,dc=intern,dc=de does
not exist within the servers naming context.
[...]
> This will pick up the group account:
> ldapsearch -x -h ldap.intern.de -b "cn=alias,ou=Groups,dc=intern,dc=de"
> '(cn=*)'
>
It seems that you either connect to a different host or to a different
search base. In both cases you cannot dereference an alias, you should
probably create referrals.
-Dieter
--
Andreas Schoe
Abteilung: Daten- und Rechenzentrum (DRZ)
Tel.: +49 (0)331/288-1719
Fax: +49 (0)331/288-1703
Email: andreas.schoe(a)gfz-potsdam.de
___________________________________
Helmholtz-Zentrum Potsdam
Deutsches GeoForschungsZentrum - GFZ
Stiftung des öff. Rechts Land Brandenburg
Telegrafenberg, D-14473 Potsdam
5179
days inactive
5187
days old
openldap-software@openldap.org
4 comments
2 participants
participants (2)
-
Andreas Schoe -
Dieter Kluenter