Hi all,
I tried for some days to make refint overlay work with refint_nothing filled.
The slapo-refint man page says :
refint_nothing <string> Specify an arbitrary value to be used as a placeholder when the last value would otherwise be deleted from an attribute. This can be useful in cases where the schema requires the existence of an attribute for which referential integrity is enforced. The attempted deletion of a required attribute will otherwise result in an Object Class Violation, causing the request to fail. The string must be a valid DN.
but each time I try to delete the last member from a groupOfNames group, the deletion is refused because of schema violation. That's ok without refint_nothing but with the string set it should replace last member, right ?
I tried to increase loglevel to 16383 but can't see any debug for refint overlay. So I'm not sure if refint is working or not. Is there another way to have some debug information from refint ?
I have included my configuration, ldap tree and log content below. For the logs, I have snipped the content to the error directly but can provide full log if required.
The tests are running on debian jessie 8.2 and slapd version 2.4.40+dfsg-1.
And I know I can place the placeholder manually but doing it by hand each time is not what I want and, more important, I want to understand why the module is not worrking like it should.
I hope I have posted to the right list and if there is something missing please ask.
Thanks for help.
######### START CONF LDIF ########
dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: a00e3106-20ce-1035-8943-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z olcLogLevel: 16383 entryCSN: 20151116173108.585343Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116173108Z
dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}refint olcModuleLoad: {2}memberof.la structuralObjectClass: olcModuleList entryUUID: a00edd9a-20ce-1035-894b-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116172537.271031Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116172537Z
dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: a00e5a96-20ce-1035-8946-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.131180Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116165546Z
... schema listing skipped as they are not modified ...
dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb structuralObjectClass: olcBackendConfig entryUUID: a00ef6cc-20ce-1035-894c-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.135178Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116165546Z
dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: a00e4ec0-20ce-1035-8944-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.130875Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151116165546Z
dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcRootDN: cn=admin,cn=config structuralObjectClass: olcDatabaseConfig entryUUID: a00e5654-20ce-1035-8945-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z olcRootPW:: e1NTSEF9NkdpY3VMWFhTUGpBa1IzM3UzcnkxVm1qY2N2ZVZXNHY= entryCSN: 20151116170655.978168Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116170655Z
dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=nodomain olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=nodomain olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: a00efa64-20ce-1035-894d-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z olcRootPW:: e1NTSEF9SlExdmxnN1E0a0hNTTZtanZzdEtIcHBSYjBmNHJyaGI= entryCSN: 20151116170852.768823Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116170852Z
dn: olcOverlay={0}refint,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {0}refint structuralObjectClass: olcRefintConfig entryUUID: cd95de54-20d2-1035-86bf-517b01ed1806 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151116172540Z olcRefintNothing: uid=myuser2,ou=users,dc=nodomain olcRefintAttribute: member entryCSN: 20151116174304.336010Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116174304Z
######### END CONF LDIF ########
######### START DB LDIF ########
dn: dc=nodomain objectClass: top objectClass: dcObject objectClass: organization o: nodomain dc: nodomain structuralObjectClass: organization entryUUID: a01fd816-20ce-1035-8deb-e11fbfc8d840 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116165546Z entryCSN: 20151116165546.245753Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116165546Z
dn: cn=admin,dc=nodomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9Z2doUHZPQVo2dnV5NzVSY1dFLzhhUFNGQjVZY1FXRHY= structuralObjectClass: organizationalRole entryUUID: a02629b4-20ce-1035-8dec-e11fbfc8d840 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116165546Z entryCSN: 20151116165546.287209Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116165546Z
dn: ou=groups,dc=nodomain objectClass: organizationalUnit objectClass: top ou: groups structuralObjectClass: organizationalUnit entryUUID: 25ff55cc-20d1-1035-86b9-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171349Z entryCSN: 20151116171349.840889Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171349Z
dn: ou=users,dc=nodomain objectClass: organizationalUnit objectClass: top ou: users structuralObjectClass: organizationalUnit entryUUID: 351d4e6a-20d1-1035-86ba-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171415Z entryCSN: 20151116171415.203147Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171415Z
dn: uid=myuser1,ou=users,dc=nodomain cn: myuser1 objectClass: inetOrgPerson objectClass: top sn: myuser1 uid: myuser1 structuralObjectClass: inetOrgPerson entryUUID: bba534d4-20d1-1035-86bb-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171800Z entryCSN: 20151116171800.908475Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171800Z
dn: uid=myuser2,ou=users,dc=nodomain cn: myuser2 objectClass: inetOrgPerson objectClass: top sn: myuser2 uid: myuser2 structuralObjectClass: inetOrgPerson entryUUID: d175bac2-20d1-1035-86bc-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171837Z entryCSN: 20151116171837.507205Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171837Z
dn: cn=mygroup1,ou=groups,dc=nodomain cn: mygroup1 member: uid=myuser1,ou=users,dc=nodomain objectClass: groupOfNames objectClass: top structuralObjectClass: groupOfNames entryUUID: f9657978-20d1-1035-86bd-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171944Z entryCSN: 20151116171944.509541Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171944Z
######### END DB LDIF ########
######### START LOG ########
... Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: read active on 13 Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=9 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=10 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=11 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_get(13) Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_get(13): got connid=1154 Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_read(13): checking for input on id=1154 Nov 16 18:43:31 vm-rt1 slapd[15110]: op tag 0x66, time 1447695811 Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 do_modify Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 do_modify: dn (cn=mygroup1,ou=groups,dc=nodomain) Nov 16 18:43:31 vm-rt1 slapd[15110]: >>> dnPrettyNormal: <cn=mygroup1,ou=groups,dc=nodomain> Nov 16 18:43:31 vm-rt1 slapd[15110]: <<< dnPrettyNormal: <cn=mygroup1,ou=groups,dc=nodomain>, <cn=mygroup1,ou=groups,dc=nodomain> Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 modifications: Nov 16 18:43:31 vm-rt1 slapd[15110]: #011replace: member Nov 16 18:43:31 vm-rt1 slapd[15110]: #011#011no values Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 MOD dn="cn=mygroup1,ou=groups,dc=nodomain" Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 MOD attr=member Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify: cn=mygroup1,ou=groups,dc=nodomain Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_dn2entry("cn=mygroup1,ou=groups,dc=nodomain") Nov 16 18:43:31 vm-rt1 slapd[15110]: => mdb_dn2id("cn=mygroup1,ou=groups,dc=nodomain") Nov 16 18:43:31 vm-rt1 slapd[15110]: <= mdb_dn2id: got id=0x7 Nov 16 18:43:31 vm-rt1 slapd[15110]: => mdb_entry_decode: Nov 16 18:43:31 vm-rt1 slapd[15110]: <= mdb_entry_decode Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: 0x00000007: cn=mygroup1,ou=groups,dc=nodomain Nov 16 18:43:31 vm-rt1 slapd[15110]: <= acl_access_allowed: granted to database root Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace member Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace entryCSN Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace modifiersName Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace modifyTimestamp Nov 16 18:43:31 vm-rt1 slapd[15110]: oc_check_required entry (cn=mygroup1,ou=groups,dc=nodomain), objectClass "groupOfNames" Nov 16 18:43:31 vm-rt1 slapd[15110]: Entry (cn=mygroup1,ou=groups,dc=nodomain): object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: entry failed schema check: object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify: modify failed (65) Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_result: conn=1154 op=4 p=3 Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_result: err=65 matched="" text="object class 'groupOfNames' requires attribute 'member'" Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_response: msgid=5 tag=103 err=65 Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 RESULT tag=103 err=65 text=object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on 1 descriptor Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on: Nov 16 18:43:31 vm-rt1 slapd[15110]: Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=9 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=10 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=11 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on 1 descriptor Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on:
######### END LOG ########
katgb wrote:
Hi all,
I tried for some days to make refint overlay work with refint_nothing filled.
The slapo-refint man page says :
refint_nothing <string> Specify an arbitrary value to be used as a placeholder when thelast value would otherwise be deleted from an attribute. This can be useful in cases where the schema requires the existence of an attribute for which referential integrity is enforced. The attempted deletion of a required attribute will otherwise result in an Object Class Violation, causing the request to fail. The string must be a valid DN.
but each time I try to delete the last member from a groupOfNames group, the deletion is refused because of schema violation. That's ok without refint_nothing but with the string set it should replace last member, right ?
No. The refint_nothing value only affects modifications that the refint overlay itself would make when trying to maintain integrity. It doesn't interfere with user modification requests at all.
Le 2015-11-17 17:08, Howard Chu a écrit :
katgb wrote:
Hi all,
I tried for some days to make refint overlay work with refint_nothing filled.
The slapo-refint man page says :
refint_nothing <string> Specify an arbitrary value to be used as a placeholderwhen the last value would otherwise be deleted from an attribute. This can be useful in cases where the schema requires the existence of an attribute for which referential integrity is enforced. The attempted deletion of a required attribute will otherwise result in an Object Class Violation, causing the request to fail. The string must be a valid DN.
but each time I try to delete the last member from a groupOfNames group, the deletion is refused because of schema violation. That's ok without refint_nothing but with the string set it should replace last member, right ?
No. The refint_nothing value only affects modifications that the refint overlay itself would make when trying to maintain integrity. It doesn't interfere with user modification requests at all.
I'm not sure I understand "user modification requests" well. By user, do you mean the person who manipulate the directory or an object of "type" user ? If I have memberof overlay activated and it changes the uid's memberof attribute, isn't it a user modification request (by memberof overlay) ?
I've tested refint another way. I removed the user (identified by uid) from the directory. When the user is deleted, refint_nothing works and replaces the last member with the placeholder (I also have some debug information in logs). I thought that refint_nothing would also work when a modification is done on one of refint attributes. Maybe you can confirm I'm wrong about that.
Is there a way to accomplish what I want ?
M. P. wrote:
I'm not sure I understand "user modification requests" well. By user, do you mean the person who manipulate the directory or an object of "type" user ?
This term is used for normal LDAP modify requests coming from a LDAP client external to slapd.
If I have memberof overlay activated and it changes the uid's memberof attribute, isn't it a user modification request (by memberof overlay) ?
Every modification done by an overlay is internal.
I've tested refint another way. I removed the user (identified by uid) from the directory. When the user is deleted, refint_nothing works and replaces the last member with the placeholder (I also have some debug information in logs). I thought that refint_nothing would also work when a modification is done on one of refint attributes.
In this case slapo-refint's own modification is internal and therefore refint_nothing applys. But it does apply when the modification comes from an external LDAP client.
Thinking about the empty-groupOfNames-problem some more I consider to define a cn=dummy value to be always present in groupOfNames entries and apply val-based ACLs to make it invisible and unremovable for normal clients (even the ones maintaining the groups).
Ciao, Michael.
Le 2015-11-20 08:26, Michael Ströder a écrit :
M. P. wrote:
I'm not sure I understand "user modification requests" well. By user, do you mean the person who manipulate the directory or an object of "type" user ?
This term is used for normal LDAP modify requests coming from a LDAP client external to slapd.
It's clear now
If I have memberof overlay activated and it changes the uid's memberof attribute, isn't it a user modification request (by memberof overlay) ?
Every modification done by an overlay is internal.
It's clear too
I've tested refint another way. I removed the user (identified by uid) from the directory. When the user is deleted, refint_nothing works and replaces the last member with the placeholder (I also have some debug information in logs). I thought that refint_nothing would also work when a modification is done on one of refint attributes.
In this case slapo-refint's own modification is internal and therefore refint_nothing applys. But it does apply when the modification comes from an external LDAP client.
Isn't there a "not" missing in the last sentence ?
Thinking about the empty-groupOfNames-problem some more I consider to define a cn=dummy value to be always present in groupOfNames entries and apply val-based ACLs to make it invisible and unremovable for normal clients (even the ones maintaining the groups).
Yep, I thought about some trick like this. I thought also about the modification of the groupOfNames objectClass but this one does not have the preference of my manager :)
I have to find now how to add automaticcally a user to a group. ;)
Ciao, Michael.
Thanks for the clarifications.
M. P. wrote:
In this case slapo-refint's own modification is internal and therefore refint_nothing applys. But it does apply when the modification comes from an external LDAP client.
Isn't there a "not" missing in the last sentence ?
Yes, should read "But it does not apply".
Thinking about the empty-groupOfNames-problem some more I consider to define a cn=dummy value to be always present in groupOfNames entries and apply val-based ACLs to make it invisible and unremovable for normal clients (even the ones maintaining the groups).
Yep, I thought about some trick like this. I thought also about the modification of the groupOfNames objectClass but this one does not have the preference of my manager :)
Yes, mucking around with standard schema descriptions is not the right way.
You could use groupOfEntries which was exactly defined for that purpose:
https://tools.ietf.org/html/draft-findlay-ldap-groupofentries
I have to find now how to add automaticcally a user to a group. ;)
Whatever "automatically" means in your context...
Ciao, Michael.
Le 2015-11-21 17:27, Michael Ströder a écrit :
M. P. wrote:
In this case slapo-refint's own modification is internal and therefore refint_nothing applys. But it does apply when the modification comes from an external LDAP client.
Isn't there a "not" missing in the last sentence ?
Yes, should read "But it does not apply".
Thinking about the empty-groupOfNames-problem some more I consider to define a cn=dummy value to be always present in groupOfNames entries and apply val-based ACLs to make it invisible and unremovable for normal clients (even the ones maintaining the groups).
Yep, I thought about some trick like this. I thought also about the modification of the groupOfNames objectClass but this one does not have the preference of my manager :)
Yes, mucking around with standard schema descriptions is not the right way.
You could use groupOfEntries which was exactly defined for that purpose:
https://tools.ietf.org/html/draft-findlay-ldap-groupofentries
I was not aware of this one, yet I searched for alternatives. Thanks.
I have to find now how to add automaticcally a user to a group. ;)
Whatever "automatically" means in your context...
I meant that at the creation of a groupOfNames, the placeholder would be added without user interevention. With groupOfEntries, there is no need anymore for that but for my knowledge, it will be interesting.
Ciao, Michael.
openldap-technical@openldap.org
-
Howard Chu -
katgb -
M. P.
-
Michael Ströder