I am trying to setup freeIPA to handle Oracle Database name resolution. I have followed this tutorial for OpenLDAP http://www.idevelopment.info/data/Oracle/DBA_tips/LDAP/LDAP_8.shtml The schema definition files have been corrected for freeIPA and are nicely loaded.

ipa-ldap-updater --schema-file /usr/share/ipa/85oidbase.ldif
ipa-ldap-updater --schema-file /usr/share/ipa/86oidnet.ldif
ipa-ldap-updater --schema-file /usr/share/ipa/87oidrdbms.ldif

It all works fine on freeIPA 3.3.5, but I am not able to do any name resolution for freeIPA > 4


C:\>tnsping DB1.EXAMPLE.COM

TNS Ping Utility for 32-bit Windows: Version - Production on 07-JUL-2015 08:27:41

Copyright (c) 1997, 2010, Oracle.  All rights reserved.

Used parameter files:

TNS-03505: Failed to resolve name

freeIPA access log

[03/Jul/2015:15:10:12 +0200] conn=125 fd=86 slot=86 connection from to
[03/Jul/2015:15:10:12 +0200] conn=125 op=0 BIND dn="" method=128 version=3
[03/Jul/2015:15:10:12 +0200] conn=125 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[03/Jul/2015:15:10:12 +0200] conn=125 op=1 SRCH base="cn=DB1,cn=OracleContext,dc=example,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass orclNetDescString orclNetDescName orclVersion"
[03/Jul/2015:15:10:12 +0200] conn=125 op=1 RESULT err=0 tag=101 nentries=0 etime=0
[03/Jul/2015:15:10:12 +0200] conn=125 op=2 UNBIND
[03/Jul/2015:15:10:12 +0200] conn=125 op=2 fd=86 closed - U1
[03/Jul/2015:15:10:31 +0200] conn=9 op=30 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn"
[03/Jul/2015:15:10:31 +0200] conn=9 op=30 RESULT err=32 tag=101 nentries=0 etime=0

Can someone guide me in a direction where to look. What did change in version 4? Do I need to add some permission attributes?

#ipa permission_add oracle --right={read,search,compare} --bindtype=anonymous --subtree='cn=OracleContext,dc=example,dc=com' --filter='(objectclass=*)'

#ipa permission-show oracle
  Permission name: oracle
  Granted rights: read, search, compare
  Bind rule type: anonymous
  Subtree: cn=OracleContext,dc=example,dc=com
  Extra target filter: (objectclass=*)

#ldapsearch -h -x -D "cn=Directory Manager" -b "cn=OracleContext,dc=example,dc=com" "objectclass=*" -w secret
# extended LDIF
# LDAPv3
# base <cn=OracleContext,dc=example,dc=com> with scope subtree
# filter: objectclass=*
# requesting: ALL

# OracleContext, example.com
dn: cn=OracleContext,dc=example,dc=com
objectClass: orclContext
objectClass: top
cn: OracleContext

# db1, OracleContext, example.com
dn: cn=db1,cn=OracleContext,dc=example,dc=com
objectClass: top
objectClass: orclNetService
cn: db1
orclNetDescString: (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=dbnode1.example.com)(PO

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

Still the same output in the access log and no resolution.


It looks like you are doing anonymous bind. In FreeIPA 4.x, there was complete re-write of access controls and defaults were put to not allow anonymous binds to see much of the content.

Given that you are adding new attributes and object classes, it may make sense to configure access to them as well. See ipa permission, ipa privilege, and ipa role to get details on what commands to use.

You can start with a permission that grants anonymous binds an access to cn=OracleContext:

$ ipa permission-add 'read oracle context' --subtree=cn=OracleContext,dc=example,dc=com --bindtype=anonymous --rights={read,search,compare}

Note that I'm using shell brace expansion to allow --rights option to be written concisely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.