RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1413805 - bind-dyndb-ldap default schema is shipped with syntax error
Summary: bind-dyndb-ldap default schema is shipped with syntax error
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: bind-dyndb-ldap
Version: 7.3
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Pavel Picka
QA Contact: Pavel Picka
Aneta Šteflová Petrová
URL:
Whiteboard:
Depends On: 1393889
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-17 00:43 UTC by Arpit Tolani
Modified: 2020-08-13 08:49 UTC (History)
8 users (show)

Fixed In Version: bind-dyndb-ldap-11.1-1.el7
Doc Type: Known Issue
Doc Text:
Directory Server fails due to *bind-dyndb-ldap* schema errors The version of the *bind-dyndb-ldap* LDAP schema included in Identity Management contains syntax errors and is missing a description of one attribute. If the user uses this version of the schema, the Directory Server component fails to start. Consequently, error messages are logged in the journal, informing the user about the incorrect syntax. To work around this problem: 1. Obtain a corrected schema file from the upstream `git.fedorahosted.org` repository: # wget https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/plain/doc/schema.ldif?id=17711141882aca3847a5daba2292bcbcc471ec63 -O /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif 2. Copy the corrected schema file into the Directory Server's instance configuration folder. # cp /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif /etc/dirsrv/slapd-[EXAMPLE-COM]/schema/[SCHEMA_FILE_NAME].ldif 3. Restart Directory Server: # systemctl restart dirsrv.target
Clone Of:
Environment:
Last Closed: 2017-08-01 19:27:49 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
output (2.78 KB, text/plain)
2017-05-18 12:46 UTC, Pavel Picka 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2120 0 normal SHIPPED_LIVE bind-dyndb-ldap bug fix update 2017-08-01 18:15:06 UTC

Description Arpit Tolani 2017-01-17 00:43:43 UTC 
Description of problem:
bind-dyndb-ldap default schema is shipped with syntax error. 

Version-Release number of selected component (if applicable):
bind-dyndb-ldap-10.0-5.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Configure RHDS server
2. Install bind-dyndb-ldap
3. Use default shipped schema with RHDS
# cp /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif /etc/dirsrv/slapd-rhds10-1/schema/65idnszone.ldif
4. RHDS restart Fails.

Actual results:

[17/Jan/2017:06:09:44 +051800] attr_syntax_create - Error: the EQUALITY matching rule [caseIgnoreMatchSINGLE-VALUE] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [idnsServerId]
[17/Jan/2017:06:09:44 +051800] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-rhds10-1/schema/65idnszone.ldif (lineno: 1) is invalid, error code 20 (Type or value exists) - object class idnsTemplateObject: Superior object class "topAUXILIARY" does not exist

Additional info:

From the previous schema, Below information was added.

365c365
<  EQUALITY caseIgnoreMatch
---
>  EQUALITY caseIgnoreMatch 
429c429
<  SUP top
---
>  SUP top 
431c431
<  MUST ( idnsTemplateAttribute ) )
---
>  )
Comment 1 thierry bordaz 2017-01-17 09:26:13 UTC 
There are two errors logged while parsing the schema.ldif file:
 - For attribute 'idnsServerId', the caseIgnoreMatch matching rule is said to be incompatible with 'Directory String' 1.3.6.1.4.1.1466.115.121.1.15. So far, I have not explanation for this because it looks compatible for me.

 - The definition of idnsTemplateObject looks broken. It is likely that it is missing a ' ' (space) between 'top' and 'AUXILIARY. Does it exist a ' ' between 'top' and the end of the line ?
Comment 2 Tomas Krizek 2017-01-17 09:41:04 UTC 
This has already been fixed upstream: https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/commit/?id=17711141882aca3847a5daba2292bcbcc471ec63
Comment 3 Tomas Krizek 2017-01-18 14:40:51 UTC 
This is going to be fixed as a part of the rebase of bind-dyndb-lap to 11+ (bug 1393889).

As a workaround, you can download the correct schema from the upstream git. See DocText for more info.
Comment 9 Lenka Špačková 2017-01-20 17:25:58 UTC 
The note has been published:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/known_issues_authentication_and_interoperability.html
Comment 11 Tomas Krizek 2017-02-16 12:22:11 UTC 
Upstream ticket:
https://pagure.io/bind-dyndb-ldap/issue/171
Comment 14 Pavel Picka 2017-05-18 12:46:09 UTC 
Created attachment 1280012 [details]
output

verified
with : bind-dyndb-ldap-11.1-3.el7.x86_64 / 389-ds-base-1.3.6.1-9.el7.x86_64
Comment 15 errata-xmlrpc 2017-08-01 19:27:49 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2120
Comment 16 openstep 2018-02-10 20:54:19 UTC 
Hi,

could you please help me find the problem?
https://bugs.centos.org/view.php?id=14475

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ldapns.ldif
adding new entry "cn=ldapns,cn=schema,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
	additional info: olcObjectClasses: ObjectClass not found: "topAUXILIARY"

cat ldapns.ldif
dn: cn=ldapns,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: ldapns
olcAttributeTypes: {0}( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService' DESC
 'IANA GSS-API authorized service name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.
 1.4.1.1466.115.121.1.15{256} )
olcAttributeTypes: {1}( 1.3.6.1.4.1.5322.17.2.2 NAME 'loginStatus' DESC 'Curre
 ntly logged in sessions for a user' EQUALITY caseIgnoreMatch ORDERING caseIgn
 oreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString )
olcObjectClasses: {0}( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
 DESC 'Auxiliary object class for adding authorizedService attribute' SUP top
 AUXILIARY MAY authorizedService )
olcObjectClasses: {1}( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject' DESC 'Auxilia
 ry object class for adding host attribute' SUP top AUXILIARY MAY host )
olcObjectClasses: {2}( 1.3.6.1.4.1.5322.17.1.3 NAME 'loginStatusObject' DESC '
 Auxiliary object class for login status attribute' SUP top AUXILIARY MAY logi
 nStatus )
Comment 17 thierry bordaz 2018-02-12 07:53:20 UTC 
Hi,

It looks it there is a typo in the ldapns.ldif file for the definition of 'authorizedServiceObject'.
It is a missing space between between 'top' and 'AUXILIARY'. you may fix it with

olcObjectClasses: {0}( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
 DESC 'Auxiliary object class for adding authorizedService attribute' SUP top
  AUXILIARY MAY authorizedService )
Note You need to log in before you can comment on or make changes to this bug.