There's almost no information about how Chain overlays are configured in OpenLDAP LDIF backend. What's the minimal configuration required?
1 Answer
The only way to work this out is by converting an old style configuration file into LDIF style. This show's quite a complex structure which isn't well documented.
The structure creates LDAP database entries in the frontend to intercept referrer responses.
To complicate matters, a schema validation conflicts with OpenLDAP's own configuration requirements (olcDbURI can not be used in the first entry). To work around this, the offline/direct modification must be made but remember that editing the LDIF directly with a text editor is strongly discouraged - See Working with OpenLDAP 2.4 LDIF config backend
If you're on Ubuntu/Debian, ensure you load the back_ldap
module - OpenLDAP Chain not found
Create "chainoverlay.ldif":
dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE
As root, import indirectly:
# ldapadd -Y EXTERNAL -H ldapi:/// -f chainoverlay.ldif
Create "defaultldap.ldif":
dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap
Import defaultldap.ldif offline (This is to work around schema validation):
# service slapd stop # slapadd -b cn=config -l defaultldap.ldif
Fix a weird entry and perms:
# rm "/etc/ldap/slapd.d/cn=config/olcDatabase={-1}over.ldif" # chown -R openldap:openldap "/etc/ldap/slapd.d/cn=config"
Start slapd:
# service slapd start
Create a chain intercept configuration - chainedserver.ldif:
dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: ldap://areferredserver.com