OpenLDAP 2.4 Chain Overlay Minimal LDIF Configuration

configurationopenldap

There's almost no information about how Chain overlays are configured in OpenLDAP LDIF backend. What's the minimal configuration required?

Best Answer

The only way to work this out is by converting an old style configuration file into LDIF style. This show's quite a complex structure which isn't well documented.

The structure creates LDAP database entries in the frontend to intercept referrer responses.

To complicate matters, a schema validation conflicts with OpenLDAP's own configuration requirements (olcDbURI can not be used in the first entry). To work around this, the offline/direct modification must be made but remember that editing the LDIF directly with a text editor is strongly discouraged - See Working with OpenLDAP 2.4 LDIF config backend

If you're on Ubuntu/Debian, ensure you load the back_ldap module - OpenLDAP Chain not found

  1. Create "chainoverlay.ldif":

    dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config
objectClass: olcOverlayConfig
objectClass: olcChainConfig
olcOverlay: chain
olcChainCacheURI: FALSE
olcChainMaxReferralDepth: 1
olcChainReturnError: TRUE

  2. As root, import indirectly:

    # ldapadd -Y EXTERNAL -H ldapi:/// -f chainoverlay.ldif

  3. Create "defaultldap.ldif":

    dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
objectClass: olcLDAPConfig
objectClass: olcChainDatabase
olcDatabase: ldap

  4. Import defaultldap.ldif offline (This is to work around schema validation):

    # service slapd stop
# slapadd -b cn=config -l defaultldap.ldif

  5. Fix a weird entry and perms:

    # rm "/etc/ldap/slapd.d/cn=config/olcDatabase={-1}over.ldif"
# chown -R openldap:openldap "/etc/ldap/slapd.d/cn=config"

  6. Start slapd:

    # service slapd start

  7. Create a chain intercept configuration - chainedserver.ldif:

    dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
objectClass: olcLDAPConfig
objectClass: olcDatabaseConfig
objectClass: olcConfig
objectClass: top
objectClass: olcChainDatabase
olcDatabase: ldap
olcDbURI: ldap://areferredserver.com
Related Topic