OpenLDAP : How to enable the memberOf overlay when the attribuType (memberof) already exists

openldap

I would like to set up the memberof overlay. It cannot be loaded because the attributeType memberof already exists in a configured schema.

How to set it up by using the existing attributeType ?

5b4f0a2e register_at: AttributeType "( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that the entry belongs to' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' EQUALITY distinguishedNameMatch USAGE dSAOperation X-ORIGIN 'iPlanet Delegated Administrator' )": Duplicate attributeType, 1.2.840.113556.1.2.102
5b4f0a2e memberof_initialize: register_at #0 failed
5b4f0a2e conn=1002 op=18 RESULT tag=103 err=80 text= handler exited with 1

Best Answer

As you already noted some OpenLDAP overlays bring their own LDAP schema descriptions hard-coded in the overlay's C code and that might conflict with schema descriptions in the config file (aka slapd.conf) or config database (aka cn=config).

In this particular case it's not a big problem because the OID and the NAME matches excactly what slapo-memberof will install. So you can safely just remove the attribute type description for memberOf you currently have in the schema. (I guess you've imported that during a LDAP server migration from another vendor.)

Do not add memberOf to your object classes. If slapo-memberof is correctly configured (on all replicas!) it will maintain the attribute values.

When changing your schema and doing migrations I'd also recommand to use command-line tool slapschema to check whether the current database content still matches the schema descriptions.