Is there a way to automatically check if that an overlay, for instance memberof, is enabled with openldap?
A lot of tutorial out there explain how to enable memberof, but how can I know if this had already been enabled?
A console-based solution would be appreciated.
Add a comment
|
2 Answers
If you use OpenLDAP directory based configuration, and not file base configuration, you can check the loaded modules with:
slapcat -n 0 | grep olcModuleLoad
When memberof is enabled, it should appear in the output:
# slapcat -n 0 | grep olcModuleLoad
olcModuleLoad: {0}back_mdb
olcModuleLoad: {1}memberof
olcModuleLoad: {2}refint
And you can check that the overlay is enabled with:
# slapcat -n 0 | grep olcOverlay
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
olcOverlay: memberof
dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
olcOverlay: {1}refint
Rather than dumping your entire directory and piping it through grep you can simply search for the entries you want.
To get a list of all configured overlays:
ldapsearch -LLL -b 'cn=config' 'objectClass=olcModuleList' 'olcModuleLoad'
Sample output:
dn: cn=module{0},cn=config
olcModuleLoad: {0}memberof.la
dn: cn=module{1},cn=config
olcModuleLoad: {0}ppolicy.la
dn: cn=module{2},cn=config
olcModuleLoad: {0}smbk5pwd.la
To see the configuration entries for each of the overlays:
ldapsearch -LLL -b 'cn=config' 'objectClass=olcOverlayConfig' '*'
Sample output:
dn: olcOverlay={0}memberof,olcDatabase={2}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf
dn: olcOverlay={1}ppolicy,olcDatabase={2}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: {1}ppolicy
olcPPolicyDefault: cn=passwordDefaults,ou=policies,dc=example,dc=com
olcPPolicyHashCleartext: FALSE
olcPPolicyUseLockout: FALSE
olcPPolicyForwardUpdates: FALSE
dn: olcOverlay={2}smbk5pwd,olcDatabase={2}mdb,cn=config
objectClass: olcConfig
objectClass: olcSmbK5PwdConfig
objectClass: olcOverlayConfig
olcOverlay: {2}smbk5pwd
olcSmbK5PwdEnable: samba
olcSmbK5PwdMustChange: 0
To see the configuration entries for just one of the overlays:
ldapsearch -LLL -b 'cn=config' '(&(olcOverlay=smbk5pwd)(objectClass=olcOverlayConfig))' '*'
Sample output:
dn: olcOverlay={2}smbk5pwd,olcDatabase={2}mdb,cn=config
objectClass: olcConfig
objectClass: olcSmbK5PwdConfig
objectClass: olcOverlayConfig
olcOverlay: {2}smbk5pwd
olcSmbK5PwdEnable: samba
olcSmbK5PwdMustChange: 0
The -LLL flag gives more concise output. Obviously, add on whatever authentication info you need to your command.
