Hey Im trying to get OpenLDAP database + SAMBA to work as a unit. But when I try to create mashine accaunts I get this error: slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed
tail -200f /var/log/syslog | grep slapd Aug 16 22:43:18 hds-linux slapd[28381]: bdb_idl_insert_key: 15 [80002715] Aug 16 22:43:18 hds-linux slapd[28381]: bdb_idl_insert_key: 15 [80000203] Aug 16 22:43:18 hds-linux slapd[28381]: send_ldap_result: err=0 matched="" text="" Aug 16 22:43:22 hds-linux slapd[28381]: connection_get(17) Aug 16 22:43:22 hds-linux slapd[28381]: conn=14 op=8 do_modify: dn (uid=hds$,ou=Computers,dc=semark,dc=dk) Aug 16 22:43:22 hds-linux slapd[28381]: conn=14 op=8 modifications: Aug 16 22:43:22 hds-linux slapd[28381]: ^Ireplace: objectClass Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Imultiple values Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLogonTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 1 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLogoffTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaKickoffTime Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdCanChange Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 1 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdMustChange Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPwdLastSet Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 10 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaAcctFlags Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 13 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaLMPassword Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 32 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaNTPassword Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 32 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaSID Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 47 Aug 16 22:43:22 hds-linux slapd[28381]: ^Iadd: sambaPrimaryGroupSID Aug 16 22:43:22 hds-linux slapd[28381]: ^I^Ione value, length 45 Aug 16 22:43:22 hds-linux slapd[28381]: hdb_modify: uid=hds$,ou=Computers,dc=semark,dc=dk Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace objectClass Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLogonTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLogoffTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaKickoffTime Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdCanChange Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdMustChange Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPwdLastSet Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaAcctFlags Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaLMPassword Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaNTPassword Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaSID Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: add sambaPrimaryGroupSID Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace entryCSN Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace modifiersName Aug 16 22:43:22 hds-linux slapd[28381]: bdb_modify_internal: replace modifyTimestamp *Aug 16 22:43:22 hds-linux slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed Aug 16 22:43:22 hds-linux slapd[28381]: send_ldap_result: err=69 matched="" text="structural object class modification from 'account' to 'inetOrgPerson' not allowed"* Aug 16 22:43:22 hds-linux slapd[28381]: connection_get(17) Aug 16 22:47:37 hds-linux slapd[28381]: connection_get(25) Aug 16 22:47:37 hds-linux slapd[28381]: SRCH "sambaDomainName=SEMARK.DK,dc=semark,dc=dk" 2 0 Aug 16 22:47:37 hds-linux slapd[28381]: 0 15 0 Aug 16 22:47:37 hds-linux slapd[28381]: filter: (?objectClass=sambaTrustedDomainPassword) Aug 16 22:47:37 hds-linux slapd[28381]: attrs: Aug 16 22:47:37 hds-linux slapd[28381]: sambaDomainName Aug 16 22:47:37 hds-linux slapd[28381]: sambaSID Aug 16 22:47:37 hds-linux slapd[28381]: Aug 16 22:47:37 hds-linux slapd[28381]: bdb_idl_fetch_key: [b49d1940] Aug 16 22:47:37 hds-linux slapd[28381]: send_ldap_result: err=0 matched="" text=""
What do I have to do to allow structural object changes ?
Im running: Debian Lenny (5.0.2) Kernel - 2.6.26-2-xen-686
OpenLDAP: slapd 2.4.17 (Jul 29 2009 00:52:57) Samba Version 3.2.5 Winbind Version 3.2.5
Thanx for the help :)
Henrik Dige Semark wrote:
slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed [..] What do I have to do to allow structural object changes ?
It's forbidden by LDAPv3 specs. An LDAP client which is implemented to modify the structural object class is seriously broken.
Ciao, Michael.
Henrik Dige Semark wrote:
slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed [..] What do I have to do to allow structural object changes ?
It's forbidden by LDAPv3 specs. An LDAP client which is implemented to modify the structural object class is seriously broken.
Michael is correctly stating that you can't change the structural objectClass of an object using an LDAP operation as per the protocol specification. The "normal" procedure would be to delete an object and recreate it with the required structural modifications.
OpenLDAP allows you to do something equivalent atomically using the "relax" control (<draft-zeilenga-ldap-relax>, a work in progress) on top of a modify operation that modifies the entry by deleting the now inappropriate attrs and adding the now appropriate ones within a single modification that leaves the object in a consistent state. The user needs to have "manage" access privileges on all the data that's modified.
As it is a work in progress, its functionality may change a little bit across versions. For example, in earlier versions, the modify operation had to explicitly deal with changing the (operational) attribute structuralObjectClass. Recent versions do not allow this, but rather recompute it according to the final values of the objectClass attribute, provided they result in a consistent inheritance relationship.
p.
masarati@aero.polimi.it wrote:
Henrik Dige Semark wrote:
slapd[28381]: entry failed schema check: structural object class modification from 'account' to 'inetOrgPerson' not allowed [..] What do I have to do to allow structural object changes ?
It's forbidden by LDAPv3 specs. An LDAP client which is implemented to modify the structural object class is seriously broken.
The "normal" procedure would be to delete an object and recreate it with the required structural modifications.
Strictly speaking it's not the same entry anymore even though it has the same DN. But the entryUUID attribute has changed then. Since this might be used for robust syncing of user entries with other user databases in case of name changes you might loose the link.
OpenLDAP allows you to do something equivalent atomically using the "relax" control (<draft-zeilenga-ldap-relax>, a work in progress) on top of a modify operation that modifies the entry by deleting the now inappropriate attrs and adding the now appropriate ones within a single modification that leaves the object in a consistent state. The user needs to have "manage" access privileges on all the data that's modified.
web2ldap 1.1.x now has even better support for that.
As it is a work in progress, its functionality may change a little bit across versions. For example, in earlier versions, the modify operation had to explicitly deal with changing the (operational) attribute structuralObjectClass. Recent versions do not allow this, but rather recompute it according to the final values of the objectClass attribute, provided they result in a consistent inheritance relationship.
Hmm, so the input field for structuralObjectClass should not be enabled which is another special case for the UI if this control is in effect...
You can play with the demo: http://demo.web2ldap.de:1760/web2ldap/ldapparams?ldap:///dc=uninett,dc=no
Ciao, Michael.
masarati@aero.polimi.it wrote:
OpenLDAP allows you to do something equivalent atomically using the "relax" control (<draft-zeilenga-ldap-relax>, a work in progress) on top of a modify operation that modifies the entry by deleting the now inappropriate attrs and adding the now appropriate ones within a single modification that leaves the object in a consistent state. The user needs to have "manage" access privileges on all the data that's modified.
web2ldap 1.1.x now has even better support for that.
How can it be better than using the "relax" control? If you do a delete/add, you still need the "relax" control to enforce the original entryUUID. Can you elaborate on that?
As it is a work in progress, its functionality may change a little bit across versions. For example, in earlier versions, the modify operation had to explicitly deal with changing the (operational) attribute structuralObjectClass. Recent versions do not allow this, but rather recompute it according to the final values of the objectClass attribute, provided they result in a consistent inheritance relationship.
Hmm, so the input field for structuralObjectClass should not be enabled which is another special case for the UI if this control is in effect...
Yes. This took place with ITS#5792, released with 2.4.14.
You can play with the demo: http://demo.web2ldap.de:1760/web2ldap/ldapparams?ldap:///dc=uninett,dc=no
I will, thanks. p.
openldap-technical@openldap.org
-
Henrik Dige Semark -
masarati＠aero.polimi.it -
Michael Ströder