Did you actually add an authz-regexp to your config that maps this DN to the cn=config rootdn? Otherwise I'd expect it to fail. Not sure this is really an AEDir thing.
Yep, double checked. globally, I'm impersonating root:
``` # Map root user to rootdn when SASL/EXTERNAL is used with LDAPI authz-regexp "gidnumber=0\+uidnumber=0,cn=peercred,cn=external,cn=auth" "cn=root,ou=ae-dir" ```
and config is really put readonly
``` database config
require strong
# yes, really read-only! readonly on restrict write
access to dn.subtree="cn=config" attrs=entry,objectClass,olcServerID,olcSaslHost by dn.onelevel="cn=ae,ou=ae-dir" read by group/aeGroup/member="cn=ae-login-proxies,cn=ae,ou=ae-dir" read by * none break
access to dn.subtree="cn=config" by dn.exact="cn=root,ou=ae-dir" read by group/aeGroup/member="cn=ae-admins,cn=ae,ou=ae-dir" read by group/aeGroup/member="cn=ae-auditors,cn=ae,ou=ae-dir" read by * none ```
Since I'm probably going to write a controller which joins syncrepls one the fly anyways, I need to deviate from this.
However, for realoding rolled certs this is a bit unfortunante. Alternatively, would it be possible rather than using a SIGNAL to gracefully fall back to reload the TLS context once if the current certs appear expired?
I predict I'm not gonna be the last person with this issue...
Best Regards, David A.
On Fri, Aug 21, 2020 at 15:36, Quanah Gibson-Mount quanah@symas.com wrote:
--On Friday, August 21, 2020 5:53 PM -0500 David Arnold <dar@xoe.solutions mailto:dar@xoe.solutions> wrote:
Cool, I'm getting there! Unfortunately and for good reasons the creator of ae-dir.com has restricted modifying access for config (in order to tightly control runtime config state).
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
Did you actually add an authz-regexp to your config that maps this DN to the cn=config rootdn? Otherwise I'd expect it to fail. Not sure this is really an AEDir thing.
Furthermore, would this dummy change also reload the certificates that are configured for the syncrepls?
No, you'd need to do a replace op on the olcSyncrepl attribute for that database as well.
Regards, Quanah
--
Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com http://www.symas.com/>