Bug 750082

Summary: SASL EXTERNAL mechanism not usable on cn=config database with default ACLs
Product: [Fedora] Fedora Reporter: Olivier BONHOMME <obonhomme>
Component: openldapAssignee: Jan Vcelak <jvcelak>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 15CC: jvcelak, rmeggins, tsmetana
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-11-01 09:03:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Olivier BONHOMME 2011-10-30 18:48:23 UTC
Description of problem:

It is not possible to use the SASL EXTERNAL mechanism in order to update the cn=config database due to restricted ACLs stored in the LDAP directory.

Indeed, the default ACLs deployed in the cn=config database are : 
{0}to * by * none.

Version-Release number of selected component (if applicable): openldap-2.4.24-3.fc15.i686

How reproducible:

Try to insert a schema in the cn=config database with the SASL EXTERNAL mechanism with the following command : 
ldapadd -Y EXTERNAL -H ldapi:/// -f <schema_file>
 
Actual results:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=goto,cn=schema,cn=config"
ldap_add: Insufficient access (50)

Expected results:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=goto,cn=schema,cn=config"

Additional info: Having the following ACL by default would resolve this issue : 

olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externalcn=auth manage by * break

Comment 1 Jan Vcelak 2011-11-01 09:03:37 UTC
Enabling ldapi and setting appropriate ACLs was done in F16 some time ago. There is no plan to fix this in F15.

*** This bug has been marked as a duplicate of bug 712495 ***