error: Automatically removed objectClass from template as it is not defined in the schema

Question

I'm installing openldap with phpldapadmin in 2 diffrent CENTOS 7 servers with configuration as follows:

openldap server:

firewall-cmd --permanent --add-service=ldap
firewall-cmd --permanent --add-port=389/tcp
firewall-cmd --reload
yum install -y openldap openldap-clients openldap-servers
slappasswd

set the pass and take note the hash

in: /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif

Change:

olcSuffix: dc=mydomain,dc=com

olcRootDN: cn=user,dc=mydomain,dc=com

olcRootPW: {SSHA}therandomhashfromslappswd

in /usr/share/openldap-servers/slapd.ldif

Change:

Line 134: n=auth" read by

dn.base="cn=user,dc=mydomain,dc=com" read by * none Line 144:

olcSuffix: dc=mydomain,dc=com Line 145: olcRootDN:

cn=user,dc=mydomain,dc=com

add:

olcRootPW: {SSHA}therandomhashfromslappswd

in /etc/openldap/ldap.conf

change:

BASE dc=mydomain,dc=com

URI ldap://hostname.domain.local

Run:

slaptest -u

config file testing succeeded

I receive checksum error as follow, but i ignore it.

54a39508 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"

54a39508 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif"

Run:

systemctl enable slapd
systemctl start slapd
systemctl restart slapd
cd /etc/openldap/
vi base.ldif

create

base.ldif

as follow:

dn: dc=mydomain,dc=com
objectClass: dcObject
objectClass: organization
o: mydomain.com
dc: mydomain

dn: ou=users,dc=mydomain,dc=com
objectClass: organizationalUnit
objectClass: top
ou: users

dn: ou=groups,dc=mydomain,dc=com
objectClass: organizationalUnit
objectClass: top
ou: group

finally run:

ldapadd -x -W -D "cn=root,dc=mydomain,dc=com" -f base.ldif
systemctl restart slapd

phpldapadmin Server:

Run:

yum -y install httpd
firewall-cmd --add-service=http
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload
systemctl restart httpd.service
systemctl start httpd.service
systemctl enable httpd.service
yum -y install php php-mbstring php-pear php-ldap
systemctl restart httpd.service
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
sudo rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm
yum --enablerepo=epel -y install phpldapadmin
setsebool -P httpd_can_connect_ldap on

result:

connection is working fine, i can access phpldapadmin site and login through open ldap server.

Problem:

I receive a lot of errors: Automatically removed ObjectClass from template - while i actually need it to create acct, etc.

Anyone knows what's wrong here?

I've been spent quite number of hours figuring out :(

Please let me know if someone can help me :)

Thanks,

AnD

Answer 1

Those errors have no impact on the functionality. You can hide those template error messages uncommenting this line in /etc/phpldapadmin/config.php:

$config->custom->appearance['hide_template_warning'] = true;

Answer 2

The error message seems rather clear. inetOrgPerson isn't defined in your server's schema. It won't be there by default, and it doesn't look like you added it.

inetOrgPerson schema depends on cosine schema, which in turn depends on core schema. Core schema may be present by default.

ldapadd <auth for cn=config> -f /etc/openldap/schema/core.ldif
ldapadd <auth for cn=config> -f /etc/openldap/schema/cosine.ldif
ldapadd <auth for cn=config> -f /etc/openldap/schema/inetorgperson.ldif

You may have to hack a little in /etc/openldap/slapd.d/cn=config.ldif to be able to get write priviledges on cn=config. A number of distributions do not have reasonable defaults for OpenLDAP.