how can I add attributes to the translucent instance to all users in an OU (and sub) ?

is there another way to do what I want to do ? thanks all for responses

Le 06/08/2014 03:12, Howard Chu a écrit : > Nicolas RENAULT wrote: >> how can I add attributes to the translucent instance to all users >> in an OU (and sub) ? > > See slapo-collect. >> >> is there another way to do what I want to do ? >> >> thanks all for responses >> > > thanks I think that this is what I want, but I cannot find any exemple of the use for this overlay on google or other site, And the man slapo-collect, is not clear for me. info : openldap 2.4.39 , as exemple, I want to add attribute 'networkAddress' and 'homeDrive' for all the inetOrgPerson from my Edir : ou=EDIR,OU=TOUT,dc=exemple,dc=fr so questions : * in slapd.conf (I use it because of meta ) : I have to add these lines ? moduleload collect ... overlay collect collectinfo cn=ancestor,ou=EDIR,OU=TOUT,dc=exemple,dc=fr networkAdress,homeDrive (I choose ancestor for cn cause they talk about ancestor in the man command) * don't understand how to create the ancestor ? just as an inetOrgPerson with the 2 attributes ? * as 'homeDrive' or 'networkAddress' are not on inetOrgPerson schema (MAY or MUST) it will be a problem no ? Thanks for reply or link to exemple.

Le 07/08/2014 09:09, Dieter Klünter a écrit : > Am Wed, 06 Aug 2014 18:16:07 +0200 > schrieb Nicolas RENAULT <nicolas_renault(a)yahoo.fr&gt;: > >> Le 06/08/2014 03:12, Howard Chu a écrit : >>> Nicolas RENAULT wrote: >>>> how can I add attributes to the translucent instance to all users >>>> in an OU (and sub) ? >>> See slapo-collect. >>>> is there another way to do what I want to do ? >>>> >>>> thanks all for responses >>>> >>> >> thanks I think that this is what I want, >> >> but I cannot find any exemple of the use for this overlay on >> google or other site, And the man slapo-collect, is not clear for >> me. >> >> info : openldap 2.4.39 , as exemple, I want to add attribute >> 'networkAddress' and 'homeDrive' for all the inetOrgPerson from my >> Edir : ou=EDIR,OU=TOUT,dc=exemple,dc=fr >> >> so questions : >> >> * in slapd.conf (I use it because of meta ) : I have to add these >> lines ? >> >> moduleload collect >> >> ... >> >> overlay collect >> collectinfo cn=ancestor,ou=EDIR,OU=TOUT,dc=exemple,dc=fr >> networkAdress,homeDrive >> >> (I choose ancestor for cn cause they talk about ancestor in the man >> command) >> >> * don't understand how to create the ancestor ? just as an >> inetOrgPerson with the 2 attributes ? >> >> * as 'homeDrive' or 'networkAddress' are not on inetOrgPerson >> schema (MAY or MUST) it will be a problem no ? >> >> Thanks for reply or link to exemple. Thanks for informations ! back to work and to this old question. > according to my private documentation, slapd has to be build with > -DLDAP_COLLECTIVE_ATTRIBUTES, this information might be outdated. how can i know if the openldap 2.4.39 that i use is build with support for the collective attribute ?

> ok, the result of the command : ------------------------------------------- @(#) $OpenLDAP: slapd 2.4.39 $ opensuse-buildservice(a)opensuse.org Included static overlays: ppolicy syncprov Included static backends: config ldif monitor bdb hdb ldap mdb relay -------------------------------------------- so no static overlay collect but I use a lot a overlay in my conf with moduleload directive : (from my slapd.conf) -------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/contrib/exemple.schema defaultsearchbase dc=example,dc=fr pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/openldap/modules/ moduleload back_ldap moduleload back_meta moduleload rwm moduleload valsort #moduleload accesslog moduleload memberof moduleload dynlist moduleload sssvlv #moduleload pcache moduleload collect overlay sssvlv .... overlay collect collectinfo cn=collect_OU_NAME,dc=example,dc=fr co,PostalCode .... -------------------------------------------- someone see something wrong ? if all is good with this declaration of collect, do I have to add an objectclass "collectiveAttributeSubentry" somewhere in the schema or it is provided by the module ?

Am Fri, 17 Oct 2014 17:40:20 +0200 schrieb Nicolas RENAULT <nicolas_renault(a)yahoo.fr&gt;: [...] > @(#) $OpenLDAP: slapd 2.4.40 (Oct 17 2014 15:08:43) $ > root@linux-nn6c.site:/root/openldap-2.4.40/servers/slapd > > Included static overlays: > accesslog > auditlog > collect > constraint > dds > deref > dyngroup > dynlist > memberof > ppolicy > pcache > refint > retcode > rwm > seqmod > sssvlv > syncprov > translucent > unique > valsort > Included static backends: > config > ldif > monitor > bdb > hdb > ldap > mdb > meta > relay > > as you can see i build with a lot of overlay and backend (maybe to > much ) > > I take the slapd.conf from the server I used. [...] > modulepath /usr/lib/openldap/modules/ > moduleload back_ldap > moduleload back_meta > moduleload rwm > moduleload valsort > #moduleload accesslog > moduleload memberof > moduleload dynlist > moduleload sssvlv > #moduleload pcache > moduleload collect > overlay sssvlv > .... > overlay collect > collectinfo cn=office,dc=example,dc=fr l,street These are not valid module names, thus no module will be included. Search /usr/lib/openldap/modules for proper module names. -Dieter

collectiveAttrbibuteSubentry is declared in schema_prep.c. When I tested collective attributes, a few years ago, slapd had to be build with -DLDAP_COLLECTIVE_ATTRIBUTES. I don't know whether this is still the case.

Le 21/10/2014 09:23, Michael Ströder a écrit : > Dieter Klünter wrote: >> collectiveAttrbibuteSubentry is declared in schema_prep.c. When I >> tested collective attributes, a few years ago, slapd had to be >> build with -DLDAP_COLLECTIVE_ATTRIBUTES. I don't know whether this >> is still the case. > I've tested this yesterday and I had to build with > -DLDAP_COLLECTIVE_ATTRIBUTES to make 'collectiveAttrbibuteSubentry' > appear in the subschema subentry. > > Ciao, Michael. > thanks for reply so now the noob question : how do I build with -DLDAP_COLLECTIVE_ATTRIBUTES ? with our clue I try to restart the process with : configure : ./configure --enable-syslog --enable-modules --enable-rewrite --enable-ldap --enable-meta --enable-collect --enable-dyngroup --enable-memberof --enable-proxycache --enable-rwm --enable-sssvlv --enable-valsort -DLDAP_COLLECTIVE_ATTRIBUTES result : configure: error: unrecognized option: `-DLDAP_COLLECTIVE_ATTRIBUTES' so I look on "configure --help" and "less INSTALL" , try to google DLDAP_COLLECTIVE_ATTRIBUTES and at last try a grep on the directory openldap-2.4.40/ but cannot find ref on how to build openldap with DLDAP_COLLECTIVE_ATTRIBUTES .. finally and for archives : ./configure --enable-syslog --enable-modules --enable-rewrite --enable-ldap --enable-meta --enable-collect --enable-dyngroup --enable-memberof --enable-proxycache --enable-rwm --enable-sssvlv --enable-valsort CFLAGS="-DLDAP_COLLECTIVE_ATTRIBUTES" after that , make depend, make , make install Works ! that is the good process ? now i can add the ldif with the example the you give me without errors. but it doesn't appli collectives attributes : I have create this to test overlay collect : ## dcObject is an AUXILIARY objectclass and MUST ## have a STRUCTURAL objectclass (organization in this case) dn: dc=example,dc=fr dc: example o: example proxy LDAP Server description: Root entry for example proxy LDAP server objectClass: top objectclass: dcObject objectclass: organization ## FIRST Level hierarchy dn: ou=TOUT,dc=example,dc=fr ou: TOUT description: OU pour contenir tout les annuaires objectClass: top objectClass: organizationalUnit ## FIRST Level hierarchy - Manager dn: cn=Manager,dc=example,dc=fr cn: Manager description: Rootdn objectclass: organizationalRole after that I add this (from example provide in reply) : dn: cn=office,dc=example,dc=fr objectClass: subentry objectClass: extensibleObject objectClass: collectiveAttributeSubentry cn: office subtreeSpecification: {base "ou=TOUT" minimum 2} c-l: Berlin c-street: Main Street and dn: cn=user_test,ou=TOUT,dc=example,dc=fr sn: test cn: user_test objectClass: user objectClass: organizationalPerson objectClass: person objectClass: top and in slapd.conf just for tests : include /etc/openldap/schema/collective.schema ....... database bdb suffix "dc=example,dc=fr" rootdn "cn=Manager,dc=example,dc=fr" rootpw "xxxxx" directory /usr/local/var/openldap-base limits * size=1000 overlay collect collectinfo cn=office,dc=example,dc=fr l,street

with that , when I do an ldap search : ldapsearch -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -W -b "ou=TOUT,dc=example,dc=fr" "(&(objectClass=user)(cn=user_test))" # extended LDIF # # LDAPv3 # base <ou=TOUT,dc=example,dc=fr> with scope subtree # filter: (&(objectClass=user)(cn=user_test)) # requesting: ALL # # user_test, TOUT, example.fr dn: cn=user_test,ou=TOUT,dc=example,dc=fr sn: test cn: user_test objectClass: user objectClass: organizationalPerson objectClass: person objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 no trace for the l and street attributes. any idea ?

Le 21/10/2014 17:42, Dieter Klünter a écrit : > Am Tue, 21 Oct 2014 14:35:14 +0200 > schrieb Nicolas RENAULT <nicolas_renault(a)yahoo.fr&gt;: > >> Le 21/10/2014 09:23, Michael Ströder a écrit : >>> Dieter Klünter wrote: >>>> collectiveAttrbibuteSubentry is declared in schema_prep.c. When I >>>> tested collective attributes, a few years ago, slapd had to be >>>> build with -DLDAP_COLLECTIVE_ATTRIBUTES. I don't know whether >>>> this is still the case. >>> I've tested this yesterday and I had to build with >>> -DLDAP_COLLECTIVE_ATTRIBUTES to make >>> 'collectiveAttrbibuteSubentry' appear in the subschema subentry. >>> >>> Ciao, Michael. >>> >> thanks for reply >> >> so now the noob question : how do I build with >> -DLDAP_COLLECTIVE_ATTRIBUTES ? >> with our clue I try to restart the process with : >> >> configure : >> >> ./configure --enable-syslog --enable-modules --enable-rewrite >> --enable-ldap --enable-meta --enable-collect --enable-dyngroup >> --enable-memberof --enable-proxycache --enable-rwm --enable-sssvlv >> --enable-valsort -DLDAP_COLLECTIVE_ATTRIBUTES >> >> result : >> configure: error: unrecognized option: >> `-DLDAP_COLLECTIVE_ATTRIBUTES' >> >> so I look on "configure --help" and "less INSTALL" , try to google >> DLDAP_COLLECTIVE_ATTRIBUTES and at last try a grep on the directory >> openldap-2.4.40/ but cannot find ref on how to build openldap with >> DLDAP_COLLECTIVE_ATTRIBUTES .. >> >> finally and for archives : >> >> ./configure --enable-syslog --enable-modules --enable-rewrite >> --enable-ldap --enable-meta --enable-collect --enable-dyngroup >> --enable-memberof --enable-proxycache --enable-rwm --enable-sssvlv >> --enable-valsort CFLAGS="-DLDAP_COLLECTIVE_ATTRIBUTES" >> >> after that , make depend, make , make install >> >> Works ! that is the good process ? >> >> now i can add the ldif with the example the you give me without >> errors. >> >> but it doesn't appli collectives attributes : >> >> I have create this to test overlay collect : >> >> ## dcObject is an AUXILIARY objectclass and MUST >> ## have a STRUCTURAL objectclass (organization in this case) >> >> dn: dc=example,dc=fr >> dc: example >> o: example proxy LDAP Server >> description: Root entry for example proxy LDAP server >> objectClass: top >> objectclass: dcObject >> objectclass: organization >> >> ## FIRST Level hierarchy >> >> dn: ou=TOUT,dc=example,dc=fr >> ou: TOUT >> description: OU pour contenir tout les annuaires >> objectClass: top >> objectClass: organizationalUnit >> >> ## FIRST Level hierarchy - Manager >> >> dn: cn=Manager,dc=example,dc=fr >> cn: Manager >> description: Rootdn >> objectclass: organizationalRole >> >> after that I add this (from example provide in reply) : >> >> dn: cn=office,dc=example,dc=fr >> objectClass: subentry >> objectClass: extensibleObject >> objectClass: collectiveAttributeSubentry >> cn: office >> subtreeSpecification: {base "ou=TOUT" minimum 2} >> c-l: Berlin >> c-street: Main Street >> >> and >> >> dn: cn=user_test,ou=TOUT,dc=example,dc=fr >> sn: test >> cn: user_test >> objectClass: user >> objectClass: organizationalPerson >> objectClass: person >> objectClass: top >> >> and in slapd.conf just for tests : >> >> include /etc/openldap/schema/collective.schema >> ....... >> database bdb >> suffix "dc=example,dc=fr" >> rootdn "cn=Manager,dc=example,dc=fr" >> rootpw "xxxxx" >> directory /usr/local/var/openldap-base >> limits * size=1000 >> overlay collect >> collectinfo cn=office,dc=example,dc=fr l,street > attributes should be c-l,c-street ok so now the line is collectinfo cn=office,dc=example,dc=fr c-l,c-street >> with that , when I do an ldap search : >> >> ldapsearch -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" >> -W -b "ou=TOUT,dc=example,dc=fr" >> "(&(objectClass=user)(cn=user_test))" # extended LDIF >> # >> # LDAPv3 >> # base <ou=TOUT,dc=example,dc=fr> with scope subtree >> # filter: (&(objectClass=user)(cn=user_test)) >> # requesting: ALL >> # >> >> # user_test, TOUT, example.fr >> dn: cn=user_test,ou=TOUT,dc=example,dc=fr >> sn: test >> cn: user_test >> objectClass: user >> objectClass: organizationalPerson >> objectClass: person >> objectClass: top >> >> # search result >> search: 2 >> result: 0 Success >> >> # numResponses: 2 >> # numEntries: 1 >> >> no trace for the l and street attributes. any idea ? > The entries should be in cn=office,dc=example,dc=fr sorry but I don't understand : I create the object cn=office,dc=example,dc=fr dn: cn=office,dc=example,dc=fr objectClass: subentry objectClass: extensibleObject objectClass: collectiveAttributeSubentry cn: office subtreeSpecification: {base "ou=TOUT" minimum 2} c-l: Berlin c-street: Main Street with the subtreeSpecification to apply to "ou=TOUT" on dc=example,dc=fr. no ? I read the man "Collective attributes are added to entries returned by a search operation when the entry is within the scope of the related ancestor" I think that your reply refer to this part, but can you provide an working example or adapt my example to a working state ? Thanks for reply