I have an existing LDAP ObjectClass of gosaAccount, used by Fusion Directory, and I am looking to add a new attribute to track the badge numbers of members with this object class. Fairly simple. I was able to use ldapmodify to add the attribute but have had no luck adding the attribute to the gosaAccount object through ldapmodify. Right now I am running into the error ldap_modify: Invalid syntax (21) additional info: objectclasses: value #0 invalid per syntax when I attempt to run ldapmodify with an LDIF file with the below contents. What am I missing that would prevent me from modifying this class?
This is the file I used to add the attribute to the schema common name (exposing it to all Schemas/Object Classes)
version: 1
dn: cn=schema,cn=config
changetype: modify
add: olcAttributeTypes
olcAttributeTypes: ( 2.16.840.1.113730.3.1.5
NAME 'badgeNumber'
DESC 'Employee Badge Number'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36
SINGLE-VALUE )
And this LDIF file is the one used to add that attribute to gosaObject.
version: 1
dn: cn=schema,cn=config
changetype: modify
replace: objectclasses
objectclasses: ( 1.3.6.1.4.1.10098.1.2.1.19.6 NAME 'gosaAccount'
DESC 'Class for GOsa Accounts (v2.6.6)'
SUP top
AUXILIARY
MUST uid
MAY ( sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ gosaDefaultLanguage $ academicTitle $ personalTitle $ dateOfBirth $ sambaBadPasswordCount $ sambaBadPasswordTime $ gender $ gosaLoginRestriction $ badgeNumber ) )
Related
I am trying to add a custom attributes object class, because one of my applications only works with sAMAccountName.
I found out, that it needs the following schema to add it to LDAP.
olcAttributeTypes: ( 1.2.840.113556.1.4.221
NAME 'sAMAccountName'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )
I created a ldif file with this content and sAMAccountName appeared in Apache Directory Studio
dn: cn=custom-attributes,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: custom-attributes
olcAttributeTypes: ( 1.2.840.113556.1.4.221
NAME 'sAMAccountName'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )
But if I tried to add this attribute to my user I got an error #65, because it was not allowed by my object classes, so I removed it and tried to add a object class for custom attributes:
dn: cn=custom-attributes,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: custom-attributes
olcAttributeTypes: ( 1.2.840.113556.1.4.221
NAME 'sAMAccountName'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )
olcObjectClasses: ( 1.3.6.1.4.1.4203.666.100.1
NAME 'customAttributes'
SUP top
AUXILIARY
DESC 'Custom attributes class'
MAY (sAMAccountName)
)
Now I am getting this error
ldapadd: invalid format (line 6) entry: "cn=custom-attributes,cn=schema,cn=config"
I am adding the ldif file via terminal
ldapadd -H ldaps://ldap.mydomain.com/ -f samaccountname.ldif -D "cn=admin,cn=config" -w mypassword
Which line is meant by the error message? And whats wrong with the syntax?
I also heard about proxy the sAMAccountName to uid, but I did not find a example ldif file, so this solution seamed more achievable to me.
I think it is due to the last parenthesis. A new line on a LDIF file means a new item description. Try to put the last parenthesis at the end of the MAY line.
I would like to modify my openldap schema to make memberUid case insensitive.
Looking in /etc/ldap/slapd.d/cn=config/cn=schema/cn={2}nis.ldif:
dn: cn={2}nis
objectClass: olcSchemaConfig
cn: {2}nis
olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExac
tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12
1.1.26 )
I tried the following:
$ ldapmodify -h localhost -x
dn: cn={2}nis
changetype: modify
replace: olcAttributeTypes
olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
But I got the following error:
modifying entry "cn={2}nis"
ldap_modify: Server is unwilling to perform (53)
additional info: no global superior knowledge
I also tried using objectClass instead of olcAttributeTypes, but received the following:
modifying entry "cn={2}nis"
ldap_modify: Invalid syntax (21)
additional info: objectClass: value #0 invalid per syntax
Can someone point me in the right direction? I have found a lot of documentation on adding new attributes and objectclasses, but not much on modifying the existing schema.
I'm talking here about common ldap operations, it could be different when tweaking the configuration.
I never tried to modify only one value in a set of a multivalued attribute, what I do in this case is delete the value I want to modify and add the new one :
Something like :
dn: cn={2}nis,cn=schema,cn=config
changetype: modify
delete: olcAttributeTypes
olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
add: olcAttributeTypes
olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
I'm starting out studying LDAP protocol and this is an example of a possible entry that I found while reading:
dn: o=TUDelft, c=NL
o: TUDelft
objectclass: organization
Now I looked for the organization classobject in the core.schema and I found that the only one mandatory attribute is o and in the attribute definition there isn't the c attribute:
objectclass ( 2.5.6.4 NAME 'organization'
DESC 'RFC2256: an organization'
SUP top STRUCTURAL
MUST o
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $
postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) )
So my question is: if an entry is defined as beloging to a sort of objectclass (in this case organization) can it use other attribute too?
An LDAP entry can have any attributes that are defined for any of its objectclasses. In your example, the entry has only the one objectclass organization. Thus, that entry must have an o attribute (which it does) and may have any of the other attributes listed in the MUST section of organization's schema definition. If you want the entry to have attributes not in organization's definition, you must add another objectclass that does contain that attribute.
For example, if you add the objectclass organizationalPerson you can then add organizationalPerson's attributes which include street and postalAddress. (Let's ignore the fact that it does not make much sense that an entry be both an organization and a person.)
You said "the attribute definition there isn't the c attribute". The c=NL in the dn o=TUDelft, c=NL is not an attribute, but rather, part of the entry's distinguished name.
I'm currently implementing a pwdCheckModule library for Openldap version 2.4.14 (Version cannot be changed). During that I'd like to read some attributes from the LDAP database. One of these attributes is called pcpMinNumberLowerUpper and holds minimum number of lower and/or upper characters. The attribute should be part of an already existing objectClass called pwdPolicy located under the cn:schema which already has some other attributes like pwdMaxAge etc.
I'd like to use the ldapmodify terminal command in order to add the attribute to the already existing LDAP database. The command I'v just used looks like the following:
ldapmodify -h localhost -p 389 -D "cn=Administrator,dc=<mydc>,dc=<mydc>..." -w "<mysecret>" -x -f pcp_attribute_upgrade.ldif
The corresponding ldif-file has the following content:
dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUED USAGE userApplications )
Now, if I execute the command above it raises the following error message to the terminal output:
ldap_start_tls: Protocol error (2)
additional info: unsupported extended operation
modifying entry "cn=schema"
ldap_modify: Invalid syntax (21)
additional info: attributetypes: value #0 invalid per syntax
I already tried to use olcAttributeTypes instead of attributeTypes but it did not help. Any help would be nice :-)
Thanks in advance,
Flo
With default OpenLdap configuration, for schema modification usually you have to use external authentication from local ldap servers root account:
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f pcp.ldif
and pcp.ldif should be:
dn: cn=schema,cn=config
changetype: modify
add: olcAttributetypes
olcAttributetypes: ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE userApplications )
(changed dn, "attributeTypes" replaced to "olcAttributetypes" and "SINGLE-VALUED" to "SINGLE-VALUE")
The keyword for single valued attribute is SINGLE-VALUE, as reported when trying to add the schema definition to the OpenDJ LDAP directory server :
The provided value "( 1.3.6.1.4.1.42.2.27.8.1.18 NAME
'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUED USAGE
userApplications )"could not be parsed as a valid attribute type
description because it contains an illegal token "SINGLE-VALUED"
Change it as below and it'll work.
dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pcpMinNumberLowerUpper' DESC 'Minimum of upper or lower characters' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE USAGE userApplications )
I try to move some posixGroup-Definitions from one ldap-server to a new one using
ldapadd -x -v -W -D cn=ldapAdmin,dc=ibk,dc=local -f groups_ldap_20151028.ldif
This produces the following error:
ldap_initialize( <DEFAULT> )
Enter LDAP Password:
add objectClass:
posixGroup
sambaGroupMapping
add cn:
users
add displayName:
users
add sambaGroupType:
2
add sambaSID:
S-1-5-21-4027309494-1722177077-478768286-513
add gidNumber:
100
adding new entry "cn=users,ou=groups,dc=ibk,dc=local"
ldap_add: Object class violation (65)
additional info: no structural object class provided
I do not understand what happens here, so please give me a hint. As i found posixGroup' is a structural object, sambaGroupMapping not. Adding 'top' as objectClass did not help. All necessary attributes are set and the old setting worked. Importing users the same way worked also well. Both ldap-version are the same.
EDIT: The primary Problem was the wrong schema which had posixGroup an as structural class. The modern uses the configuration in the description below. The rest was a mess of duplicate names and whitespace in the ldif-file. Thank you!
Try adding group or groupOfName or groupofUniqueName (depends on LDAP implementation) as an added objectClass. posixGroup is typically an Auxiliary Group
'posixGroup' SUP top AUXILIARY DESC 'Abstraction of a group of accounts' MUST gidNumber MAY ( authPassword $ userPassword $ memberUid $ description ) X-ORIGIN 'draft-howard-rfc2307bis' )