I cannot add uniqueMembers to a static group (objectClass: groupOfUniqueNames)
According to this documentation:
Modifying group entries: In order to add a member to a static group, add the user's distinguished name as an additional value for the member or uniqueMember attribute. Following is an example:
ldapmodify -h 127.0.0.1 -D "cn=admin" -w xxxx -f modStaticGrp.ldif
Where modStaticGrp.ldif contains:
dn: cn=group1, o=Your Company
changetype: modify
add: member
member: cn=jeff, cn=tim, o=Your Company
dn: cn=group2, o=Your Company
changetype: modify
add: uniqueMember
uniqueMember: cn=joe,o=Your Company
When I try to add a uniqueMember with ldapmodify with the following ldif file:
dn: cn=Private,o=My Company
changetype: modify
add: uniqueMember
uniqueMember: uid=1234567890,ou=My Company
I get the error:
ldapmodify: wrong attributeType at line 4, entry "cn=Private,o=My Company”
What am I missing? Any ideas?
uid=1234567890,ou=My Company
A uniqueMember value is a complete DN. Judging by the rest of your DNs this should be something like
uid=1234567890,o=My Company
although I woudl have expected to see something more like this:
uid=1234567890,ou=Users,o=My Company
actually, depending on exactly how you've designed your DIT. You shouldn't be adding user entries at its top level.
Related
I created an OpenLDAP server on Ubuntu 22.04, and created users but forgot to add them to a organizational unit (ou). How can I associate them all to an ou now ?
The actual server looks like this:
dn=company
ou=Users
uid=user1
uid=user2
uid=user3
...
What I would like is:
dn=company
ou=Users
uid=user1
uid=user2
uid=user3
...
Concretely, I would like to go from this:
uid=user1,dc=example,dc=fr
to this:
uid=user1,ou=Users,dc=example,dc=fr
Adding an ou attribute to the entry is one thing, moving the entry in the DIT is another thing. For the latter, you need to use the newsuperior directive.
Using ldapmodify -f with changetype: (modrdn|moddn) :
dn: uid=user1,dc=example,dc=fr
changetype: modrdn
# rdn unchanged
newrdn: uid=user1
# deletes old entry
deleteoldrdn: 1
# adds to Users hierarchy
newsuperior: ou=Users,dc=example,dc=com
Using ldapmodrdn -r -s <newsuperior> <dn> <newrdn> :
ldapmodrdn -r -s "ou=Users,dc=example,dc=com" "uid=user1,dc=example,dc=fr" "uid=user1"
Actually I just found an answer on my own.
I simply did a LDIF file modify.ldif:
dn: uid=user1,dc=example,dc=fr
changetype: modify
add: ou
ou: Users
And then ldapmodify -x -D cn=admin,dc=example,dc=fr -W -f ./modify.ldif
I have the following entry in LDAP directory:
dn: ou=Users,dc=itau,dc=co
objectClass: organizationalUnit
ou: Users
Unfortunately, I forgot to add the gid attribute. Because of this, I had created the following LDIF file called "modify.ldif":
dn: ou=Users,dc=itau,dc=co
changetype: modify
add: gid
gid: 20000
But when I run the command
ldapmodify -x -D "cn=admin,dc=itau,dc=co" -w <PASSWORD> -H ldap:// -f modify.ldif
I get the error:
ldap_modify: Undefined attribute type (17)
additional info: gid: attribute type undefined
It's important to say that I had checked for blank spaces at the end of each line, but this error didn't desappear.
Why I'm getting this error?.
Thank you.
I'm trying to add a user to the "wheel" group and I keep getting this error message (removed dc entries to mask my company:
[root#~]# ldapmodify -x -W -D "cn=Manager,dc=XXX,dc=XXX" -f usergroupadd.ldif
Enter LDAP Password:
modifying entry "cn=wheel,ou=groups,dc=XXX,dc=XXX"
ldap_modify: No such object (32)
matched DN: dc=XXX,dc=XXX
Now I'm sure many will wonder if the 'wheel' group even exists, and that answer is yes. Adjusted user names for security purposes.
[root#~]# getent group| grep wheel
wheel:x:10:USER1,USER2,USER3,USER4,USER5,USER6
[root#~]#
And lastly my ldif file with the usergroup add appears to be correct:
[root#~]# cat usergroupadd.ldif
dn: cn=wheel,ou=groups,dc=XXX,dc=XXX
changetype: modify
add: memberuid
memberuid: USER7
So my question is, what is causing the No such object (32) error?
Thanks,
I'm trying to add 'mail' attribute to users on my openldap server but somehow it fails.
I tried using ldapmodify but I get this:
ldap_modify: Object class violation (65)
additional info: attribute 'mail' not allowed
Here's how my schema looks like:
# LDIF Export for ou=users,dc=mydomain,dc=com
# Server: (ldap.mydomain.com)
# Search Scope: sub
# Search Filter: (objectClass=*)
# Total Entries: 63
version: 1
# Entry 1: ou=users,dc=mydomain,dc=com
dn: ou=users,dc=mydomain,dc=com
objectclass: organizationalUnit
objectclass: top
ou: users
# Entry 2: uid=tom.hanks,ou=users,dc=mydomain,dc=com
dn: uid=tom.hanks,ou=users,dc=mydomain,dc=com
cn: tom.hanks
description: User account
gecos: tom.hanks
gidnumber: 100
homedirectory: /home/tom.hanks
loginshell: /bin/bash
objectclass: account
objectclass: posixAccount
uid: tom.hanks
uidnumber: 1005
userpassword: blahblah
Include objectclass: iNetOrgPerson to add the mail attribute.
In order to give the user the Attribute mail you first have to add the mail attribute to the user's olcObjectClasses.
This can be done by a modification via an ldif like this:
dn: cn={12345}someName,cn=schema,cn=config
changetype: modify
delete: olcObjectClasses
olcObjectClasses: {1}
-
add: olcObjectClasses
olcObjectClasses: {1}( 1.3.6.1.4.1.12344556.1.1.1 NAME 'yourObjectClassEGAccount' DESC 'some description' SUP inetOrgPerson STRUCTURAL MUST ( requiredparam1 $ requiredParam2 $ reqParam3 ) MAY ( optionalParam1 $ optionalParam2 ) ) )
-
See the documentation for ldapmodify for details: Oracle ldapmodify Doc
The modification is then given to ldap via the following command (command line):
sudo ldapmodify -f filename.ldif
make sure to read the documentation on whether you need further parameters like eg. -h for hostname or -Y for a proxyDN: lmodify Doc
I'm trying to setup an LDIF file which shall add a new attribute value to an existing node. The attribute is a mandatory attribute of custom objectclass.
Here is the contents of the LDIF file 'add.ldif':
dn: cn=hna,cn=Users,DC=lan,DC=test,DC=de
changetype: modify
add: objectclass
objectclass: MyCustomObjectClass
-
add: myCustomAttribute
myCustomAttribute: someValue
-
Problem: when I try add that to the LDAP server using
ldapmodify -h ... -D ... -w ... -x -f add.ldif
I get the error message
ldap_modify: Objectclass violation (65)
additional info: 00002014: objectclass_attrs: attribute 'myCustomAttribute'
on entry 'cn=hna,cn=Users,DC=lan,DC=test,DC=de' does not exist in the
specified objectclasses
When I leave out the 'add' of 'myCustomAtribute' then of course then I get:
ldap_modify: Objectclass violation (65)
additional info: 00002014: objectclass_attrs: at least one mandatory attribute
('myCustomAttribute') on entry 'cn=hna,cn=Users,DC=lan,DC=test,DC=de'
wasn't specified!
Any idea what is wrong with my approach?
ldapmodify is the one from OpenLDAP; the server is a Samba V4 LDAP.
This should work:
dn: cn=hna,cn=Users,DC=lan,DC=test,DC=de
changetype: modify
add: objectclass
objectclass: MyCustomObjectClass
add: myCustomAttribute
myCustomAttribute: someValue
There MUST be an empty line after the last line.
The "-" is only needed if you want to perform separate modify operations and have them be atomic. (ie all work or all fail).
As adding the objectclass requires MUST attributes must happen in the same modification.
By the way I have noticed that some ldapmodify programs do not handle these properly.
-jim