3

I'm having trouble getting the allop overlay to work. I suspect I'm missing some vital configuration option or that I've done something incorrectly. Any help is greatly appreciated.

I need to use allop to get a cisco device working with ldap using the memberOf attribute. I've already got the memberOf overlay working correctly and memberOf attribute is returned when I query with '+'.

I've installed openldap 2.4.28 on my Ubuntu 12.04.5 LTS server using apt-get install. I compiled the allop overlay from source and copied the allop.so library to the /var/lib/ldap/ directory.

This version of openldap uses the olc config method.

I added the module using the following ldif:

## module.ldif
dn: cn=module,cn=config
cn: module
objectclass: olcModuleList
objectclass: top
olcmoduleload: allop.so
olcmodulepath: /usr/lib/ldap
# sudo ldapadd -Y EXTERNAL -H ldapi:/// -f module.ldif -v

I added the overlay configuration using the following ldif:

## allop.ldif
dn: olcOverlay={2}allop,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {2}allop
# sudo ldapadd -Y EXTERNAL -H ldapi:/// -f allop.ldif -v

I then restarted slapd and tested, but the operational attributes are still not returned.

Here is some of the output from running slapd with debug Trace:

54198057 ldif_read_file: read entry file: "/etc/ldap/slapd.d/cn=config/cn=module{3}.ldif"
54198057 => str2entry: "# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 18d7a995
dn: cn=module{3}
objectClass: olcModuleList
objectClass: top
cn: module{3}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}allop.so
structuralObjectClass: olcModuleList
entryUUID: 1e7b5ebe-d252-1033-97f7-618a755f5e4b
creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
createTimestamp: 20140917010302Z
entryCSN: 20140917010302.779622Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20140917010302Z
"
54198057 >>> dnPrettyNormal: <cn=module{3}>
54198057 <<< dnPrettyNormal: <cn=module{3}>, <cn=module{3}>
54198057 >>> dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 <<< dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 >>> dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 <<< dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 <= str2entry(cn=module{3}) -> 0x7f04f45450c8

...

54198057 ldif_read_file: read entry file: "/etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb/olcOverlay={2}allop.ldif"
54198057 => str2entry: "# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 1b6fab9c
dn: olcOverlay={2}allop
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {2}allop
structuralObjectClass: olcOverlayConfig
entryUUID: 5c207c24-d25a-1033-8da6-db55e5b2e477
creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
createTimestamp: 20140917020202Z
entryCSN: 20140917020202.176575Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20140917020202Z
"
54198057 >>> dnPrettyNormal: <olcOverlay={2}allop>
54198057 <<< dnPrettyNormal: <olcOverlay={2}allop>, <olcOverlay={2}allop>
54198057 >>> dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 <<< dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 >>> dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 <<< dnNormalize: <gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth>
54198057 <= str2entry(olcOverlay={2}allop) -> 0x7f04f45450c8

There's nothing interesting in the debug output when I run the query, certainly no error messages or anything related to allop.

1

You don't mention it in your configuration, but have you got the 'allop-URI' option configured? If left blank it will only return operational attributes for ldap:///??base - that is, a base of "" and a scope "base". You will need to specify a pattern for which it should return the operational attributes, such as ldap:///??sub

Note that allop-URI doesn't do particular operational attributes - it's all or nothing for the scope and base provided.

0

I resolved this issue by moving from OLC to slapd.conf configuration. It seems there is no OLC support for allop.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.