Hi list,

I have searched far and wide for a solution to this but cannot find anywhere where it is possible to configure back-sql as such.

I am trying to interface openldap with a MySQL backend using the standard back-sql configuration, with one exception - every 'ldap_*' prefixed table needs to be named 'custom_ldap_*' as we are trying to fit in LDAP support into an existing product which requires the additional tables to make this work to conform with existing schema.

What I've found is, I can get the LDAP requests working perfectly via a test database using standard 'ldap_*' notation, but I cannot for the life of me get the system to handle different table names properly.

My config file, "/etc/openldap/slapd.conf", on CentOS 5.2 shows the following: <snip>

# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema

# Allow LDAPv2 client connections. This is NOT the default. #allow bind_v2

loglevel -1 logfile /var/log/ldap.log

# Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args

# Load dynamic backend modules: modulepath /usr/lib64/openldap

# modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la

# modules available in openldap-servers-sql RPM package: moduleload back_sql.la

# The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem

# Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING!

####################################################################### # sql definitions for mysql access #######################################################################

database sql dbname ldaptest readonly on suffix "dc=rams,dc=com,dc=au" dbuser ldaptest dbpasswd abc123

subtree_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" children_cond "custom_ldap_entries.dn LIKE CONCAT('%',?)" id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM custom_ldap_oc_mappings" at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM custom_ldap_attr_mappings WHERE oc_map_id=?"

has_ldapinfo_dn_ru no lastmod off

####################################################################### # ldbm and/or bdb database definitions #######################################################################

#database bdb #suffix "dc=my-domain,dc=com" #rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg

# The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap

# Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

# Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com@EXAMPLE.COM

</snip>

Now, when I run "/usr/sbin/slapd -d -5" and attempt to do a general query on the ldap server using "ldapsearch -x -b 'dc=rams,dc=com,dc=au'" I get the following feedback from openldap: <snip> # extended LDIF # # LDAPv3 # base <dc=rams,dc=com,dc=au> with scope subtree # filter: (objectclass=*) # requesting: ALL #

# search result search: 2 result: 80 Other (e.g., implementation specific) error

# numResponses: 1

</snip>

And, the debug output displays: <snip> ... ==>backsql_search(): base="dc=rams,dc=com,dc=au", filter="(objectClass=*)", scope=2, deref=0, attrsonly=0, attributes to load: all ==>backsql_get_db_conn() ==>backsql_open_db_conn(3) daemon: epoll: listen=8 active_threads=0 tvp=NULL <==backsql_open_db_conn(3) backsql_open_db_conn(3): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_dn2id("dc=rams,dc=com,dc=au") matched expected backsql_dn2id("dc=rams,dc=com,dc=au"): id_query "SELECT id,keyval,oc_map_id,dn FROM custom_ldap_entries WHERE dn=?" backsql_dn2id("dc=rams,dc=com,dc=au"): id=1 keyval=1 oc_id=1 dn=dc=rams,dc=com,dc=au

...

...

dnPrettyNormal: <dc=rams,dc=com,dc=au>

<<< dnPrettyNormal: <dc=rams,dc=com,dc=au>, <dc=rams,dc=com,dc=au> <==backsql_dn2id("dc=rams,dc=com,dc=au"): err=0 ==>backsql_id2entry() backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="organizationalUnit" attr="objectClass" keyval=1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM ldap_entry_objclasses,ldap_entries,company WHERE company.id=? AND ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entries.keyval=company.id and ldap_entries.oc_map_id=1' Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entry_objclasses' doesn't exist" <==backsql_id2entry() ==>backsql_oc_get_candidates(): oc="inetOrgPerson" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,contact.id,'inetOrgPerson' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,contact WHERE contact.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '2' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" ==>backsql_oc_get_candidates(): oc="organizationalUnit" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 Constructed query: SELECT DISTINCT ldap_entries.id,company.id,'organizationalUnit' AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,company WHERE company.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND 9=9 AND 3=3 id: '1' backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=1146 SQLengineState=S0002 msg="[unixODBC][MySQL][ODBC 3.51 Driver][mysqld-5.0.45]Table 'ldaptest.ldap_entries' doesn't exist" send_ldap_result: conn=3 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=80 ber_flush: 14 bytes to sd 9 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 50 04 00 04 00 0....e...P.... conn=3 op=1 SEARCH RESULT tag=101 err=80 nentries=0 text= ... </snip>

In summary, I feel that there is some kind of missing configuration variable either in documentation or tutorials online that really doesn't allow you to fully specify alternate table names for the default 4 main tables in the back-sql implementation. If this is due to the backend being experimental then so be it - however I really need some kind of quantified 'yes' or 'no' as to whether what I'm trying to achieve is possible at all.

TIA

Matthew Hallsworth