Hard time enabling openldap meta backend

openldap

Right now I'm feeling stuck with enabling meta backend using openldap 2,4

this is the result of my slaptest

[root@localhost openldap]# slaptest -f slapd.conf -F slapd.d/

    WARNING: No dynamic config support for database meta.

    WARNING: The converted cn=config directory is incomplete and may not work.

but in my centos 6,3 machine there's no "meta" module to add or include.

My sandbox is a clean centos 6,3 install, I've installed openldap-servers and openldap-clients , is there anything else that need to be installed in order to get meta working?

this is my slap.conf file:

include /etc/openldap/schema/core.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/misc.schema

database meta
suffix "dc=int,dc=test,dc=com"
uri     "ldap://int.test.com/dc=int,dc=test,dc=com"

The uri exist in my sandbox network.

help!

Best Answer

cn=config support for back-meta was added in OpenLDAP 2.4.33. If you run an older version you'll have to use slapd.conf.

The changelog also mentions a variety of other fixes to back-meta in subsequent releases.

If you're not prepared to build the current OpenLDAP release from source, the LTB-Project provides up-to-date RPM packages.

Related Solutions

Mysql – How Do I Configure OpenLDAP to use MySQL (Ubuntu 9.04)

The OpenLDAP Admin Guide seems to walk through the setup in a pretty clear fashion. And man 5 slapd-sql appears to be thorough and complete.

Ldap – Using OpenLDAP to proxy to an Novell eDirectory LDAP Server

Since you are having issues with eDirectory, you are quite lucky, since you can use DSTrace with the LDAP option on to see what is going on, from the eDirectory server view.

Once you know what is being asked, and what the server is responding you can effectively troubleshoot the issue.

Basic eDirectory schema is complaint with LDAP and any standard LDAP schema should work for the most part. To get some specific features you might need some additional support, but that does not sound like your issue.

If you have access to the 10.10.1.27 box, try and look at it via http://10.10.1.27:8008 (or possibly port 8010, or 8028 depending if you are running eDirectory on Netware, Windows or a Unix variant respectively). This should redirect you to an https:// connection one port number higher (8009, 8010, or 8030 (ya 2 not 1)). Look for iMonitor or Dstrace, and then clear all the other flags, and enable the LDAP flag. Then the Dstrace Live icon will refresh on each click with the latest transactions.

Now as to your issue of:

there's almost no hierarchy. (I can set a base DN and view a particular object... but if I set the real base DN... I can only see it... and no children.)

I would suspect this issue is more about not doing the right kind of query. Sounds like you are doing Entry not Subtree queries. This will be very obvious in Dstrace, as you will see a query event that looks something like:

10:19:01 B68BEBA0 LDAP: (10.1.1.42:55133)(0x0002:0x63) Search request:
base: "ou=people,o=acme,dc=com"
scope:2 dereference:3 sizelimit:1 timelimit:0 attrsonly:0
filter: "(&(objectClass=inetorgperson)(acme7DigitName=gxc1234))"
no attributes
10:19:01 B68BEBA0 LDAP: (10.1.1.42:55133)(0x0002:0x63) Empty attribute list implies all user attributes
10:19:01 B68BEBA0 LDAP: (10.1.1.42:55133)(0x0002:0x63) Sending search result entry "cn=gxc1234,ou=UNK,ou=People,o=acme,dc=com" to connection 0xa07e6c0

There the scope: 2 tells you it is an entry search. You want to see it do a subtree (0) level search in order to get what you are looking for.

You can read more about how I used this sort of tooling to debug the nonsense that SAP's GRC web interface does for LDAP data retrieval.

Best Answer

Related Solutions

Mysql – How Do I Configure OpenLDAP to use MySQL (Ubuntu 9.04)

Ldap – Using OpenLDAP to proxy to an Novell eDirectory LDAP Server

Related Topic