Dear Steve!
Thank you for taking the time to care about this issue.
Am 18.02.2011 02:52, schrieb Steve Langasek:
> And I'm afraid it's not clear to me why this is
> failing. Does /etc/ldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif exist
> and contain the proper schema definition for groupOfNames?
No, it does not exist. This is what I find:
# find slapd.d
slapd.d
slapd.d/cn=config.ldif
slapd.d/cn=config
slapd.d/cn=config/cn=module{0}.ldif
slapd.d/cn=config/olcDatabase={1}hdb.ldif
slapd.d/cn=config/cn=schema.ldif
slapd.d/cn=config/olcDatabase={-1}frontend.ldif
slapd.d/cn=config/olcDatabase={0}config.ldif
groupOfNames is defined only here:
# grep -ir groupofnames schema/
schema/core.ldif:olcObjectClasses: ( 2.5.6.9 NAME 'groupOfNames'
schema/core.schema:objectclass ( 2.5.6.9 NAME 'groupOfNames'
> What does your slapd.conf look like, prior to upgrade?
It consists of several files:
/etc/ldap/slapd.conf:
====%<====
include /etc/ldap/slapd.log.conf
include /etc/ldap/slapd.schemata.conf
pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args
modulepath /usr/lib/ldap
moduleload back_hdb
sizelimit 500
tool-threads 1
backend hdb
include /etc/ldap/slapd.db1.conf
====>%====
/etc/ldap/slapd.log.conf:
====%<====
loglevel 0
====>%====
/etc/ldap/slapd.schemata.conf:
====%<====
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/samba.schema
include /etc/ldap/schema/misc.schema
====>%====
/etc/ldap/slapd.db1.conf:
====%<====
database hdb
suffix "o=base"
dbconfig set_cachesize 0 2097152 0
dbconfig set_lk_max_objects 1500
dbconfig set_lk_max_locks 1500
dbconfig set_lk_max_lockers 1500
checkpoint 512 30
directory "/var/lib/ldap/db1"
index default sub
index uid,mail eq
index cn,sn,givenName,ou pres,eq,sub
index objectClass pres,eq
index uidNumber,gidNumber,memberuid eq
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
password-hash {crypt}
password-crypt-salt-format "$1$%.8s"
rootdn "cn=Manager,o=base"
rootpw XxXxXxXxXxXxXx
lastmod on
include /etc/ldap/slapd.db1.access
====>%====
/etc/ldap/slapd.db1.access:
====%<====
access to dn.base=""
by * read
access to dn=*
by group="cn=FullWriters,ou=Groups,ou=Managers,o=base" write
by * none break
access to dn.subtree="o=base"
attrs=userPassword,sambaNTPassword,sambaLMPassword
by self write
by * auth
access to dn="cn=Manager,o=base"
by * none
access to dn.regex="^cn=(Read|Write)ACL,.*,?o=base$"
by group="cn=ACLManagers,ou=Groups,ou=Managers,o=base" write
access to dn.subtree="ou=Managers,o=base"
by group="cn=WriteACL,ou=Managers,o=base" write
access to dn.subtree="o=base"
attrs=entry,objectClass,uid
by group="cn=UidSearchers,ou=Groups,ou=Managers,o=base" read
by * none break
access to dn.subtree="o=base"
attrs=member
by group="cn=MemberSearchers,ou=Groups,ou=Managers,o=base" read
by * none break
access to dn.subtree="o=base"
by group="cn=UidSearchers,ou=Groups,ou=Managers,o=base" none
by group="cn=MemberSearchers,ou=Groups,ou=Managers,o=base" none
by * none break
access to dn.subtree="ou=Groups,o=base"
by group="cn=WriteACL,ou=groups,o=base" write
by group="cn=ReadACL,ou=groups,o=base" read
access to dn.subtree="ou=GAB,o=base"
by group="cn=WriteACL,ou=GAB,o=base" write
by group="cn=ReadACL,ou=GAB,o=base" read
by * none break
access to dn.regex="^ou=PAB,(uid=[^,]+,ou=intern,o=base)$"
by group="cn=WriteACL,ou=intern,o=base" write
by group="cn=ReadACL,ou=intern,o=base" read
by dn.exact,expand="$1" read
access to dn.regex="^.+,ou=PAB,(uid=[^,]+,ou=intern,o=base)$"
by dn.exact,expand="$1" write
access to dn.subtree="o=base"
by group="cn=WriteACL,ou=intern,o=base" write
by group="cn=ReadACL,ou=intern,o=base" read
by realusers read
====>%====
That'd be it. I shortened the config files to not include comments.
> Staying with the old slapd.conf won't actually be ok for anyone when wheezy
> comes out and the new openldap has no support for even *reading* the old
> slapd.conf style configs... We need to do this migration now if we want to
> have a clean upgrade in another two years.
Wheezy is far away - breaking the update from Lenny to Squeeze without
need because we need a smooth Wheezy update in a few years is not a good
option taken. A smooth squeezy is what'd have been desirable now ime.
Besides, I couldn't get past this installation/conversion error without
fiddling inside the postinst script. Most users would not dare to do so.
I needed to get past this error to complete the squeeze update.
So, letting the user choose wether to now stay with slapd.conf and later
convert to slapd.d format or do it right with the update would have been
the better choice.
I guess a "dpkg-reconfigure slapd" would allow me to convert to slapd.d
format after the upgrade issue has been fixed?
With highest regards,
Robert Kehl
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
