Hide Forgot
Description of problem: bind-dyndb-ldap default schema is shipped with syntax error. Version-Release number of selected component (if applicable): bind-dyndb-ldap-10.0-5.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1. Configure RHDS server 2. Install bind-dyndb-ldap 3. Use default shipped schema with RHDS # cp /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif /etc/dirsrv/slapd-rhds10-1/schema/65idnszone.ldif 4. RHDS restart Fails. Actual results: [17/Jan/2017:06:09:44 +051800] attr_syntax_create - Error: the EQUALITY matching rule [caseIgnoreMatchSINGLE-VALUE] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [idnsServerId] [17/Jan/2017:06:09:44 +051800] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-rhds10-1/schema/65idnszone.ldif (lineno: 1) is invalid, error code 20 (Type or value exists) - object class idnsTemplateObject: Superior object class "topAUXILIARY" does not exist Additional info: From the previous schema, Below information was added. 365c365 < EQUALITY caseIgnoreMatch --- > EQUALITY caseIgnoreMatch 429c429 < SUP top --- > SUP top 431c431 < MUST ( idnsTemplateAttribute ) ) --- > )
There are two errors logged while parsing the schema.ldif file: - For attribute 'idnsServerId', the caseIgnoreMatch matching rule is said to be incompatible with 'Directory String' 1.3.6.1.4.1.1466.115.121.1.15. So far, I have not explanation for this because it looks compatible for me. - The definition of idnsTemplateObject looks broken. It is likely that it is missing a ' ' (space) between 'top' and 'AUXILIARY. Does it exist a ' ' between 'top' and the end of the line ?
This has already been fixed upstream: https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/commit/?id=17711141882aca3847a5daba2292bcbcc471ec63
This is going to be fixed as a part of the rebase of bind-dyndb-lap to 11+ (bug 1393889). As a workaround, you can download the correct schema from the upstream git. See DocText for more info.
The note has been published: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/known_issues_authentication_and_interoperability.html
Upstream ticket: https://pagure.io/bind-dyndb-ldap/issue/171
Created attachment 1280012 [details] output verified with : bind-dyndb-ldap-11.1-3.el7.x86_64 / 389-ds-base-1.3.6.1-9.el7.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2120
Hi, could you please help me find the problem? https://bugs.centos.org/view.php?id=14475 ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ldapns.ldif adding new entry "cn=ldapns,cn=schema,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: olcObjectClasses: ObjectClass not found: "topAUXILIARY" cat ldapns.ldif dn: cn=ldapns,cn=schema,cn=config objectClass: olcSchemaConfig cn: ldapns olcAttributeTypes: {0}( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService' DESC 'IANA GSS-API authorized service name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 1.3.6.1.4.1.5322.17.2.2 NAME 'loginStatus' DESC 'Curre ntly logged in sessions for a user' EQUALITY caseIgnoreMatch ORDERING caseIgn oreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString ) olcObjectClasses: {0}( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject' DESC 'Auxiliary object class for adding authorizedService attribute' SUP top AUXILIARY MAY authorizedService ) olcObjectClasses: {1}( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject' DESC 'Auxilia ry object class for adding host attribute' SUP top AUXILIARY MAY host ) olcObjectClasses: {2}( 1.3.6.1.4.1.5322.17.1.3 NAME 'loginStatusObject' DESC ' Auxiliary object class for login status attribute' SUP top AUXILIARY MAY logi nStatus )
Hi, It looks it there is a typo in the ldapns.ldif file for the definition of 'authorizedServiceObject'. It is a missing space between between 'top' and 'AUXILIARY'. you may fix it with olcObjectClasses: {0}( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject' DESC 'Auxiliary object class for adding authorizedService attribute' SUP top AUXILIARY MAY authorizedService )