I am having some issues with OpenLDAP and Spring security, where the latter does a search with the whole path in dn (filter), and an empty base. OpenLDAP does not like this, and the query fails. The problem is that I have no control over the query, so I am thus wondering if it is possible to configure OpenLDAP to allow such queries.
2 Answers
An empty base is a special case for retrieving information about the OpenLDAP server that can host several databases (or "namingContexts" or "bases"). E.g.:
ldapsearch -x -LLL -b '' -s base 'objectClass=*' +
There really should be some way of specifying the base to use for searches
It's unfortunate that Spring Security won't allow you to set an appropriate search base. Depending on your environment you may be able to get away with setting a default search base to the frontend config.
$ ldapmodify -f <<EOF
dn: olcDatabase={-1}frontend,cn=config
add: olcDefaultSearchBase
olcDefaultSearchBase: dc=example,dc=com
-
I can try, so what should I change to fit my environment here? oldDefaultSearchBase only?– TobbJul 9, 2015 at 6:37
-
Yes. In some environments setting a default search base is not desirable. If this were the case in yours, you would know.– 84104Jul 9, 2015 at 6:55
-
Hehe, I should know perhaps :) But I only have one search tree, and if I understand correctly this should be OK then..– TobbJul 9, 2015 at 7:29