New subject: [EXT] Re: Migration from 2.4 to 2.5: problem with using "olcPPolicyDefault" in ACL duriung slapadd

20 Feb 2025


      Hi!
I'm about to migrate openLDAP 2.4 from SLES12 SP5 to openLDAP 2.5 from SLES15 SP6, following the rather terse https://www.openldap.org/doc/admin25/appendix-upgrading.html.
I've removed the policy schema as advised from the LDIF export of cn=config, but now it seems that slapadd cannot use "olcPPolicyDefault" in an ACL:
# slapadd -v -n0 -F /etc/openldap/slapd.d -S 1 -w -l 0.ldif
added: "cn=config" (00000001)
added: "cn=module{0},cn=config" (00000001)
added: "cn=schema,cn=config" (00000001)
added: "cn={0}core,cn=schema,cn=config" (00000001)
added: "cn={1}cosine,cn=schema,cn=config" (00000001)
added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001)
added: "cn={3}rfc2307bis,cn=schema,cn=config" (00000001)
added: "cn={4}yast,cn=schema,cn=config" (00000001)
added: "cn={5}sudo,cn=schema,cn=config" (00000001)
added: "olcDatabase={-1}frontend,cn=config" (00000001)
olcAccess: value #1: unknown attr "olcPPolicyDefault" in to clause.
<access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+
<what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>]
<attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist>
<attrlist> ::= <attr> [ , <attrlist> ]
<attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children
<who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ]
        [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ]
        [dnattr=<attrname>]
        [realdnattr=<attrname>]
        [group[/<objectclass>[/<attrname>]][.<style>]=<group>]
        [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>]
        [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>]
        [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]
<style> ::= exact | regex | base(Object)
<dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex
<attrstyle> ::= exact | regex | base(Object) | one(level) | sub(tree) | children
<peernamestyle> ::= exact | regex | ip | ipv6 | path
<domainstyle> ::= exact | regex | base(Object) | sub(tree)
<access> ::= [[real]self]{<level>|<priv>}
<level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage
<priv> ::= {=|+|-}{0|d|x|c|s|r|{w|a|z}|m}+
<control> ::= [ stop | continue | break ]
slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=908): ▒5=▒
Closing DB...
(Also note the garbage in the error message that seems to appear for any slapadd error)
As noted Openldap is SUSE's version (openldap2_5-2.5.18+31-150500.11.12.1.x86_64) they re-introduced in SLES15 SP5 (maybe due to failing to provide a working migration tool to 389-DS and a proper administration manual)
So is it a bug that the attribute cannot be used in ACL, or is it a configuration error on my side? (line 908 is "dn: olcDatabase={0}config,cn=config")
The actual line in question is like this:
olcAccess: {1}to attrs=olcPPolicyDefault by dn.exact="uid=PP-Checker,ou=system,dc=domain,dc=org" read by * break
Kind regards,
Ulrich Windl