I'm trying to adda new object class to OpenLDAP and getting the following error, but can't see the issue:
# Add the securityPrincipal class
dn: cn={0}core,cn=schema,cn=config
changetype: modify
add: olcObjectClasses
olcObjectClasses: ( 1.2.840.113556.1.5.6 NAME 'securityPrincipal'
DESC: 'Contains the security information for an object.'
SUP top AUXILIARY
MUST ( $ sAMAccountName )
MAY ( )
)
This is the error:
ldapmodify: invalid format (line 38) entry: "cn={0}core,cn=schema,cn=config"
which refers to this line:
olcObjectClasses: ( 1.2.840.113556.1.5.6 NAME 'securityPrincipal'
I found the issue by putting everything on the same line and then the error was much clearer
Related
I have configured an openLDAP server for testing purposes and am trying to add a few users from the actual LDAP server. The problem is that they have some attributes that are not defined in the default object classes- top, person or organizationalPerson. So I am trying to define my own object class- user with one new attribute for start called instanceType. This is the schema file I created- object_class.schema:
attributetype ( 1.3.6.1.4.1.42.2.27.4.1.6
NAME 'instanceType'
DESC 'instanceType attribute'
EQUALITY caseExactMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE )
objectclass ( 1.3.6.1.4.1.42.2.27.4.2.1
NAME 'user'
DESC 'user object'
SUP top
STRUCTURAL
MUST ( cn $ instanceType ) )
I also created object_class.conf:
include /ldap-data/object_class.schema
After that I am running slaptest -f /ldap-data/object_class.conf -F /ldap-data/schemas/ which produces the following file- /ldap-data/schemas/cn=config/cn=schema/cn={0}object_class.ldif
I am stopping the slapd service but when I run slapadd -l /ldap-data/schemas/cn\=config/cn\=schema/cn\=\{0\}object_class.ldif -n 0
I receive:
slapadd: line 1: database #0 (cn=config) not configured to hold "cn={0}object_class"; no database configured for that naming context
_#################### 100.00% eta none elapsed none fast!
Closing DB...
Is my schema wrong? I tried finding the attributes for the "user" data class which I thought are standard but I couldn't.
I am trying to add a custom attributes object class, because one of my applications only works with sAMAccountName.
I found out, that it needs the following schema to add it to LDAP.
olcAttributeTypes: ( 1.2.840.113556.1.4.221
NAME 'sAMAccountName'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )
I created a ldif file with this content and sAMAccountName appeared in Apache Directory Studio
dn: cn=custom-attributes,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: custom-attributes
olcAttributeTypes: ( 1.2.840.113556.1.4.221
NAME 'sAMAccountName'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )
But if I tried to add this attribute to my user I got an error #65, because it was not allowed by my object classes, so I removed it and tried to add a object class for custom attributes:
dn: cn=custom-attributes,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: custom-attributes
olcAttributeTypes: ( 1.2.840.113556.1.4.221
NAME 'sAMAccountName'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.100.1
NAME 'customAttributes'
SUP top
AUXILIARY
DESC 'Custom attributes class'
MAY (sAMAccountName)
)
Now I am getting this error
ldapadd: invalid format (line 6) entry: "cn=custom-attributes,cn=schema,cn=config"
I am adding the ldif file via terminal
ldapadd -H ldaps://ldap.mydomain.com/ -f samaccountname.ldif -D "cn=admin,cn=config" -w mypassword
Which line is meant by the error message? And whats wrong with the syntax?
I also heard about proxy the sAMAccountName to uid, but I did not find a example ldif file, so this solution seamed more achievable to me.
I think it is due to the last parenthesis. A new line on a LDIF file means a new item description. Try to put the last parenthesis at the end of the MAY line.
I have an existing LDAP ObjectClass of gosaAccount, used by Fusion Directory, and I am looking to add a new attribute to track the badge numbers of members with this object class. Fairly simple. I was able to use ldapmodify to add the attribute but have had no luck adding the attribute to the gosaAccount object through ldapmodify. Right now I am running into the error ldap_modify: Invalid syntax (21) additional info: objectclasses: value #0 invalid per syntax when I attempt to run ldapmodify with an LDIF file with the below contents. What am I missing that would prevent me from modifying this class?
This is the file I used to add the attribute to the schema common name (exposing it to all Schemas/Object Classes)
version: 1
dn: cn=schema,cn=config
changetype: modify
add: olcAttributeTypes
olcAttributeTypes: ( 2.16.840.1.113730.3.1.5
NAME 'badgeNumber'
DESC 'Employee Badge Number'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36
SINGLE-VALUE )
And this LDIF file is the one used to add that attribute to gosaObject.
version: 1
dn: cn=schema,cn=config
changetype: modify
replace: objectclasses
objectclasses: ( 1.3.6.1.4.1.10098.1.2.1.19.6 NAME 'gosaAccount'
DESC 'Class for GOsa Accounts (v2.6.6)'
SUP top
AUXILIARY
MUST uid
MAY ( sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ gosaDefaultLanguage $ academicTitle $ personalTitle $ dateOfBirth $ sambaBadPasswordCount $ sambaBadPasswordTime $ gender $ gosaLoginRestriction $ badgeNumber ) )
I'm currently implementing a pwdCheckModule library for Openldap version 2.4.14 (Version cannot be changed). During that I'd like to read some attributes from the LDAP database. One of these attributes is called pcpMinNumberLowerUpper and holds minimum number of lower and/or upper characters. The attribute should be part of an already existing objectClass called pwdPolicy located under the cn:schema which already has some other attributes like pwdMaxAge etc.
I'd like to use the ldapmodify terminal command in order to add the attribute to the already existing LDAP database. The command I'v just used looks like the following:
ldapmodify -h localhost -p 389 -D "cn=Administrator,dc=<mydc>,dc=<mydc>..." -w "<mysecret>" -x -f pcp_attribute_upgrade.ldif
The corresponding ldif-file has the following content:
dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUED USAGE userApplications )
Now, if I execute the command above it raises the following error message to the terminal output:
ldap_start_tls: Protocol error (2)
additional info: unsupported extended operation
modifying entry "cn=schema"
ldap_modify: Invalid syntax (21)
additional info: attributetypes: value #0 invalid per syntax
I already tried to use olcAttributeTypes instead of attributeTypes but it did not help. Any help would be nice :-)
Thanks in advance,
Flo
With default OpenLdap configuration, for schema modification usually you have to use external authentication from local ldap servers root account:
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f pcp.ldif
and pcp.ldif should be:
dn: cn=schema,cn=config
changetype: modify
add: olcAttributetypes
olcAttributetypes: ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE userApplications )
(changed dn, "attributeTypes" replaced to "olcAttributetypes" and "SINGLE-VALUED" to "SINGLE-VALUE")
The keyword for single valued attribute is SINGLE-VALUE, as reported when trying to add the schema definition to the OpenDJ LDAP directory server :
The provided value "( 1.3.6.1.4.1.42.2.27.8.1.18 NAME
'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUED USAGE
userApplications )"could not be parsed as a valid attribute type
description because it contains an illegal token "SINGLE-VALUED"
Change it as below and it'll work.
dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE userApplications )
I am trying to set up an openLDAP LDAP on Ubuntu 14.04, and I would like to add a custom schema to the dynamic ldap conf. As I understood, I have to add dynamically a ldif entry to my ldap, under the DN: cn=myCustomSchema,cn=schema,cn=config.
What I wanted to do was:
creation of a schema file
creation of a .conf file linking to my schema file
conversion of the schema to a ldif file, thanks to a slaptest or slapcat command and the .conf file
addition of the .ldif to the LDAP
I can't go through point 3., since both slaptest and slapcat command return: line xxx: unknown directive outside backend info and database definitions.
I've read a thousand time my schema file, but I can't find my error. I also couldn't find anything usefull about such an error.
Here is a part of my schema file:
attributeTypes: (1.2.840.113556.1.8000.2554.48931.2232.50796
NAME 'altitudeEntity'
EQUALITY caseIgnoreMatch
ORDERING caseIgnoreOrderingMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE USAGE userApplications )
attributeTypes: ( 1.2.840.113556.1.8000.17728.40464.13370.25661.2712
NAME 'descriptionEntity'
EQUALITY caseIgnoreMatch
ORDERING caseIgnoreOrderingMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
USAGE userApplications )
.
. other attributes
.
ObjectClass: ( 1.2.840.113556.45669.16975.37105.36062
NAME 'principalClass'
SUP top STRUCTURAL
MUST RDNFragment
MAY ( altitudeEntity $ descriptionEntity $ ...) )
.
. other classes extending principalClass (SUP principalClass)
.
Also: when keeping only attributes, the commands succeed and the ldif files are generated. The error is always on the first objectClass.
Thanks for any help :)
Found the error this morning, I guess I was tired yesterday.
The correct syntax is objectclass ( OID ... without " : ". I changed also attributeTypes: ( OID... to attributetype ( OID... and everything worked fine.