Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm importing an openldap database from another server and while importing, I got some errors with some users, the problem is that the mozillaAbPersonAlpha is not a valid objectClass.

#!ERROR [LDAP Error Code 21 - objectClass: value #3 invalid per syntax]
...
dn: uid=somedude,cn=Whatever,dc=test,dc=com
sn: Some Dude
givenName: Dude
mail: dude@test.com
mozillaCustom1: Engineering
l: Somewhere
objectClass: inetOrgPerson
objectClass: top
objectClass: person
objectClass: mozillaAbPersonAlpha
uid: somedude
cn: Some Dude

AFAICT It seems that my installation of OpenLDAP is lacking a schema for mozillaABPersonAlpha.

But how do I install this schema?


EDIT: The server is using the new configuration backend, so there isn't any slapd.conf file. There is, instead, a /etc/slapd.d/ directory with the weird directory naming (e.g. /etc/slapd.d/cn=config/).

How do I add the new schema in this situation?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

I'm answering my own question because I wanted to know how to solve the problem while using the new slapd.d/dynamic/cn=config backend and I didn't wanted going back to the slapd.conf method. (Almost nobody is doing this, AFAICT)

When I try to add the new schema using ldapadd, I was always getting the following error:

ldapadd -H ldap://whatever.test.com -D "cn=admin,dc=whatever,dc=test,dc=com" -x -W -f mozillaabpersonalpha.ldif
ldap_add: Insufficient access (50)

So the BindDN I was using does not have that privileges. I would need to setup an ACL or to use the rootDN for that operation.

I don't know why, but when configuring the slapd debian package, it allowed me to create an admin account for my on DIT, but it mentioned nothing about the rootDN. After some browsing, I found this Blog that explains how to set the password of the rootDN while using the cn=config schema.

So, edited the file /etc/ldap/slapd.d/cn=config/olcDatabase\=\{0\}config.ldif and added the following:

olcRootDN: cn=admin,cn=config
olcRootPW: mypassword

I had to restart the slapd for the changes to take effect (It shouldn't be necessary, but ...). In order to test it, I ran the following command:

ldapwhoami -H ldap://whatever.test.com -D "cn=admin,cn=config" -x -w mypassword

And it worked! The next step was to load the mozillaAbPersonAlpha schema in ldif format using ldapadd:

ldapadd -H ldap://whatever.test.com -D "cn=admin,cn=config" -x -w mypassword -f mozillaabpersonalpha.ldif

The response was successful

adding new entry "cn=mozillaabpersonalpha,cn=schema,cn=config"

Finally, adding one user that depends on the mozillaABPersonAlpha schema is now possible. For example, the file newuser.ldif has this:

dn: uid=somedude,cn=Whatever,dc=test,dc=com
sn: Some Dude
givenName: Dude
mail: dude@test.com
mozillaCustom1: Engineering
l: Somewhere
objectClass: inetOrgPerson
objectClass: top
objectClass: person
objectClass: mozillaAbPersonAlpha
uid: somedude
cn: Some Dude

And adding it to the new directory (not using the rootDN account) works now:

ldapadd -H ldap://whatever.test.com -D "cn=admin,dc=whatever,dc=test,dc=com" -x -W -f usertest.ldif 
Enter LDAP Password: 
adding new entry "uid=somedude,cn=SomeGroup,cn=whatever,dc=test,dc=com
share|improve this answer
    
Thanks for your solution this has worked like charm –  Santhosh Pai Mar 14 at 11:49

Copy 'n paste that schema into a file on your server, and add:

include /path/to/that/file.schema

in your slapd.conf and restart slapd.

share|improve this answer
    
Thanks for your answer, but I wasn't very clear about the setup. I edited the question with the details. –  Noe Nieto May 21 '11 at 18:13

In your slapd.conf(5) file there there will be a (few?) "include" statements:

include         /etc/openldap/schema/core.schema

You need to download the schema file and put it in the schema/ directory with the rest of the ones already there (everything in one location is simpler), and change the configuration to include it. Then restart OpenLDAP.

http://www.zytrax.com/books/ldap/ch6/#include

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.