Am 20.02.25 um 12:05 schrieb Windl, Ulrich:
Hi!I’m about to migrate openLDAP 2.4 from SLES12 SP5 to openLDAP 2.5 from SLES15 SP6, following the rather terse https://www.openldap.org/doc/ admin25/appendix-upgrading.html <https://www.openldap.org/doc/admin25/ appendix-upgrading.html>.I’ve removed the policy schema as advised from the LDIF export of cn=config, but now it seems that slapadd cannot use "olcPPolicyDefault" in an ACL:# slapadd -v -n0 -F /etc/openldap/slapd.d -S 1 -w -l 0.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}rfc2307bis,cn=schema,cn=config" (00000001) added: "cn={4}yast,cn=schema,cn=config" (00000001) added: "cn={5}sudo,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) olcAccess: value #1: unknown attr "olcPPolicyDefault" in to clause.<access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+<what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>]<attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist><attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex | base(Object)<dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex<attrstyle> ::= exact | regex | base(Object) | one(level) | sub(tree) | children<peernamestyle> ::= exact | regex | ip | ipv6 | path <domainstyle> ::= exact | regex | base(Object) | sub(tree) <access> ::= [[real]self]{<level>|<priv>} <level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage <priv> ::= {=|+|-}{0|d|x|c|s|r|{w|a|z}|m}+ <control> ::= [ stop | continue | break ]slapadd: could not add entry dn="olcDatabase={0} config,cn=config" (line=908): ▒5=▒Closing DB...(Also note the garbage in the error message that seems to appear for any slapadd error)As noted Openldap is SUSE’s version (openldap2_5-2.5.18+31-150500.11.12.1.x86_64) they re-introduced in SLES15 SP5 (maybe due to failing to provide a working migration tool to 389-DS and a proper administration manual)So is it a bug that the attribute cannot be used in ACL, or is it a configuration error on my side? (line 908 is “dn: olcDatabase={0} config,cn=config”)The actual line in question is like this:olcAccess: {1}to attrs=olcPPolicyDefault by dn.exact="uid=PP- Checker,ou=system,dc=domain,dc=org" read by * breakKind regards, Ulrich Windl
-- Stefan Kania Landweg 13 25693 St. Michaelisdonn --------------------- Es gibt keine WOLKE, nur die Computer fremder Leute
OpenPGP_0x52F6D4DD1BB68AB5.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
