2

I'm not able to add posix users/groups to this newly created ldap directory. OpenLDAP version is 2.4.19.

The LDIF I've populated the LDAP directory is probably the problem, but I'm not sure what I need to do next...

dn: dc=company,dc=net,dc=au
objectClass: dcObject
objectClass: organization
o: Company Pty Ltd
dc: company

dn: cn=manager,dc=company,dc=net,dc=au
objectClass: organizationalRole
cn: Manager

dn: ou=People,dc=company,dc=net,dc=au
objectClass: organizationalUnit
objectClass: top
ou: People

dn: ou=Groups,dc=company,dc=net,dc=au
objectClass: organizationalUnit
objectClass: top
ou: Groups

Could someone please educate me :)


Update: I've added nis.schema, which I expected to fix the problem as it has all the posix* classes I was after. However, I now get the following error:

/etc/openldap/schema/nis.schema: line 203 objectclass: AttributeType not found: "manager"
/opt/openldap/etc/openldap/slapd.conf: line 6: <include> handler exited with 1!
slapd destroy: freeing system resources.
slapd stopped.
connections_destroy: nothing to destroy.

The relevant section of nis.schema, ~line 203 is as follows...

objectclass ( 1.3.6.1.1.1.2.6 NAME 'ipHost'
    DESC 'Abstraction of a host, an IP device'
    SUP top AUXILIARY
    MUST ( cn $ ipHostNumber )
    MAY ( l $ description $ manager ) )

I'll continue reading.

2
  • What method are you using to add the users and groups?
    – TRS-80
    Nov 22, 2009 at 11:05
  • Hi TRS-80 - At the moment I'm using phpldapadmin - I should have mentioned that, but didn't want to cloud the problem. Now that I've added the appropriate (I think) schema (nis.schema) - I can't start the LDAP service - /etc/openldap/schema/nis.schema: line 203 objectclass: AttributeType not found: "manager"
    – khosrow
    Nov 22, 2009 at 11:21

4 Answers 4

1

I think I've figured it out - Once I'm done reading, I'll post the root cause, and the detailed solution; but for now - and in short - I hadn't included the appropriate schema files.

The posixAccount is an auxiliary class, so it's a completely optional that can be "attached" onto the required structural one - be it person, organizationalPerson, or interOrgPerson.


No, I thought I was close, still no luck. In order to add nis.schema, I had to add a few prerequisite schemas, so now I have...

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

That resolved slapd not starting up, however, I still can't see any posix* classes anywhere in the ldap mgmt web interface.

1

I cannot help you much with the phpldap, as I've never used it (I'm preferring ApacheDirectoryStudio or the openldap's command line tools), but if you can use a generic LDIF file with it, please try this one:

dn: uid=juser,ou=People,dc=company,dc=net,dc=au
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: top
cn: Joe User
gidNumber: 100
homeDirectory: /home/juser
uid: juser
uidNumber: 1004
gecos: Joe User
givenName: Joe
loginShell: /bin/bash

...and see if it works?

In any case, I strongly recommend using ApacheDirectoryStudio as a generic LDAP/schema browser.

1
  • I did switch over to ApacheDirectoryStudio - very good tool thank you. I eneded up redoing the entire thing from scratch and everything worked - which is good, but also bad as I don't have a nice resolution to close this ticket.
    – khosrow
    Dec 28, 2009 at 4:58
1

You had the right answer; you need to add the schemas as followed in your slapd.conf and restart:

note: the order is important!

include         /etc/openldap/schema/corba.schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/duaconf.schema
include         /etc/openldap/schema/dyngroup.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/java.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/openldap.schema
include         /etc/openldap/schema/ppolicy.schema
include         /etc/openldap/schema/collective.schema

Then you can add POSIX user via ldif file:

# User primary group
dn: cn=ussergroup,ou=groups,dc=me,dc=com
cn: ussergroup
objectClass: top
objectClass: posixGroup
gidNumber: 10001

# User account
dn: uid=user,ou=users,dc=me,dc=com
cn: user
givenName: user
sn: user
uid: user
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/user
mail: [email protected]
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
loginShell: /bin/bash
userPassword: {CRYPT}*
0

You might try using the migration scripts to generate a base ldif. On my RHEL install, they are at /usr/share/openldap/migration/, of course depending on your distro they may land somewhere else.

migrate_passwd.pl will give you your users, and migrate_group.pl you groups (both obvious). If appropriate, you can also use the migrate_all_online.sh to suck in everything from your current system and dump it directly into a currently running LDAP (and then prune or add as needed).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .