1

There's almost no information about how Chain overlays are configured in OpenLDAP LDIF backend. What's the minimal configuration required?

1 Answer 1

2

The only way to work this out is by converting an old style configuration file into LDIF style. This show's quite a complex structure which isn't well documented.

The structure creates LDAP database entries in the frontend to intercept referrer responses.

To complicate matters, a schema validation conflicts with OpenLDAP's own configuration requirements (olcDbURI can not be used in the first entry). To work around this, the offline/direct modification must be made but remember that editing the LDIF directly with a text editor is strongly discouraged - See Working with OpenLDAP 2.4 LDIF config backend

If you're on Ubuntu/Debian, ensure you load the back_ldap module - OpenLDAP Chain not found

  1. Create "chainoverlay.ldif":

    dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config
    objectClass: olcOverlayConfig
    objectClass: olcChainConfig
    olcOverlay: chain
    olcChainCacheURI: FALSE
    olcChainMaxReferralDepth: 1
    olcChainReturnError: TRUE
    
  2. As root, import indirectly:

    # ldapadd -Y EXTERNAL -H ldapi:/// -f chainoverlay.ldif
    
  3. Create "defaultldap.ldif":

    dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
    objectClass: olcLDAPConfig
    objectClass: olcChainDatabase
    olcDatabase: ldap
    
  4. Import defaultldap.ldif offline (This is to work around schema validation):

    # service slapd stop
    # slapadd -b cn=config -l defaultldap.ldif
    
  5. Fix a weird entry and perms:

    # rm "/etc/ldap/slapd.d/cn=config/olcDatabase={-1}over.ldif"
    # chown -R openldap:openldap "/etc/ldap/slapd.d/cn=config"
    
  6. Start slapd:

    # service slapd start
    
  7. Create a chain intercept configuration - chainedserver.ldif:

    dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
    objectClass: olcLDAPConfig
    objectClass: olcDatabaseConfig
    objectClass: olcConfig
    objectClass: top
    objectClass: olcChainDatabase
    olcDatabase: ldap
    olcDbURI: ldap://areferredserver.com
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .