☰

Openldap Acl 업데이트 오류

tag-icon • tag-icon openldap
Openldap Acl 업데이트 오류

현재 규칙을 제거하고 아래 명령을 사용하여 새 acl.ldif 파일을 통해 새 규칙으로 업데이트하여 openldap에서 현재 ACL 규칙을 수정하려고 했습니다.

ldapmodify -xWD cn=admin,cn=config -f acl.ldif

하지만 실행하는 동안 오류가 발생합니다.

modifying entry "olcDatabase={1}hdb,cn=config"
ldap_modify: Object class violation (65)
        additional info: attribute 'olcOverlay' not allowed

이것은 나의 현재 olcdatabase 파일입니다.

dn: olcDatabase={1}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=test,dc=test1,dc=com
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
 s auth by dn="ou=admin,dc=test,dc=test1,dc=com" write by * read
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=test,dc=test1,dc=com" w
 rite by * read
olcLastMod: TRUE
olcRootDN: cn=admin,dc=test,dc=test1,dc=com
olcRootPW:: e1Nb01QN3Mrckk=
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcDbIndex: entryCSN,entryUUID eq
structuralObjectClass: olcHdbConfig
entryUUID: 372c8246-a1b5-1031-9131-6b135443c1be
creatorsName: cn=admin,cn=config
createTimestamp: 20121003144902Z
entryCSN: 20121003144902.063840Z#000000#000#000000
modifiersName: cn=admin,cn=config
modifyTimestamp: 20121003144902Z
olcOverlay: syncprov
olcSpCheckPoint: 50 10
olcSpSessionlog: 100

아래에는 acl.ldif 파일이 제공됩니다.

dn: olcDatabase={1}hdb,cn=config
changetype: modify
delete: olcAccess
olcAccess: {0}
-
# Then add a new ACL at position {0}.
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="ou=Users,dc=test,dc=test1,dc=com" write by * read

답변1

현재 데이터베이스 구성이 유효하지 않을 수 있습니다. 스키마에 특이한 작업을 수행하지 않는 한 olcOverlay구성 항목의 objectClasses에서는 속성 사용이 제공되지 않습니다. 오류 메시지는 수행하려는 작업에 대한 것이 아니라 이미 수행한 작업에 대한 것입니다.

이는 보다 일반적인 종류의 구조입니다.

$ ldapsearch -b olcDatabase={1}hdb,cn=config objectClass @olcSyncProvConfig
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig

dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
olcSpCheckpoint: 100 10
olcSpSessionlog: 100

dn: olcOverlay={1}memberof,olcDatabase={1}hdb,cn=config
objectClass: olcMemberOf
objectClass: olcOverlayConfig
olcOverlay: {1}memberof

# find /etc/openldap/slapd.d/
/etc/openldap/slapd.d/
/etc/openldap/slapd.d/cn=config
/etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={0}config
/etc/openldap/slapd.d/cn=config/olcDatabase={0}config/olcOverlay={0}syncprov.ldif
/etc/openldap/slapd.d/cn=config/cn=schema.ldif
/etc/openldap/slapd.d/cn=config/cn=module{0}.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb
/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb/olcOverlay={0}syncprov.ldif
/etc/openldap/slapd.d/cn=config/cn=schema
/etc/openldap/slapd.d/cn=config/cn=schema/cn={7}openssh-lpk.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={3}rfc2307bis.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={8}sudo.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={2}inetorgperson.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={4}misc.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={6}kerberos.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={5}dhcp.ldif
/etc/openldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb
/etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb/olcOverlay={1}memberof.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb/olcOverlay={0}syncprov.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif
/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
/etc/openldap/slapd.d/cn=config.ldif

관련 정보