Gervase Markham wrote:
On 07/03/11 21:33, Howard Chu wrote:
> Gervase Markham wrote:
>> On 07/03/11 17:49, Gervase Markham wrote:
>>> oldRootDN: cn=admin,cn=config
>> And that would be the problem :-|
>> Thank you for your help.<shuffles feet in an embarrassed fashion>
> cn=config is an LDAP database, it is not a collection of files for you
> to edit by hand.
Although presumably if you manage to mess up your configuration enough,
that's what you have to do. I've seen "you can edit the files by hand if
it all goes wrong" used as an argument for using the LDIF backend for
cn=config in the archives of this very mailing list, if I'm not mistaken.
As a last resort, not a first measure. You should also have seen in the
archives "cn=config is a slapd database and like any other slapd database, the
format is subject to change without notice." We may well shift it to a purely
binary format down the road.
> You are supposed to use ldapmodify on it, for reasons
> of this very nature. I.e., ldapmodify gets syntax-checked and stupid
> typos of this sort get caught.
But being able to edit the database is precisely the problem I had! It's
rather chicken and egg.
You're apparently working with a slapd that had a pre-canned config. If the
means of accessing the config wasn't obvious to you, then you should be taking
this up with your distro or whoever provided the canned config to you.
> If you had used "ldapmodify -H ldapi:/// -Y EXTERNAL"
to add the desired
> attributes you wouldn't have these silly problems.
Yes, of course - because Real Men use commands with a minimum of 4
command-line flags to do any operation, and if I'm not up to that, I
can't possibly be worthy to use OpenLDAP.
You can always set these as defaults in /etc/openldap/ldap.conf. Again, if
whoever provided your configs to you didn't set this up or document it
clearly, your beef is with them, not the OpenLDAP community. We don't control
what distros do.
> If your LDAP browsers don't support ldapi:/// that's
I don't even know what the "i" in ldapi is, or how it's different from
ldap://. And this search of the OpenLDAP documentation is sadly
Can you tell me which LDAP browsers do support this scheme? After
the other part of my message was asking for advice on which was best.
Anyone built on top of libldap would support it implicitly. I don't keep tabs
of browsers, so I can't recommend one to you.
There are two ways you, the development team, can think about
A) "You have to prove your worthiness to use this software by having a
wide knowledge of Unix history, unwritten conventions, cryptic man-pages
and a perfect recall of command-line options. Searchable documentation
on the web - pah!"
Nonsense. 90% of the OpenLDAP installs in the world are on POSIX-based
systems. If you're using one of these systems and you haven't learned how to
use the most common Unix commands you're doing yourself a disservice. It's not
our job to teach you the basics of getting proficiency with your OS.
You don't have to prove anything to me or anyone else; you simply have to have
the skills that any Unix sysadmin must already possess to have any hope of
doing the job of a sysadmin. The most basic of these is the ability to
actually read documentation and pay attention to the details. You miss the
details and you wind up typing "rm -rf *" in the wrong directory.
B) "We want to lower barriers to entry and make it easier to
We want to make it easier to use, of course, for *system administrators*. This
is not a browser or an email client that Joe Sixpack will use every day. It's
core infrastructure that the majority of the world will never see and never
needs to know about. For that minority of people who need to know, you have
your work cut out for you already. You better already understand IP and TCP
intimately, and you better know how to tune your OS because you're going to
need that kind of knowledge to do your job, whether OpenLDAP is a part of it
System administration is not for children. Don't ask to be coddled like a
child; that's not what we're here for.
If the answer is B), then instead of telling me that I'm an
might wish to reflect on what lessons can be learnt from my experience
to help other people in the future.
I must say that my experience with the OpenLDAP community thusfar
not thrilled me with joy at the prospect of using the software for my
project. I speak as someone whose day job is nurturing, growing and
encouraging open source communities.
Don't blame the community for your own unpreparedness. If your distro didn't
document their chosen configuration well enough to prepare you, then your
complaint is with them, not us. The community is the folks who have stepped in
to bail you out when you were going the wrong direction, we didn't send you in
the wrong direction in the first place.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/