Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Directory Server fails due to *bind-dyndb-ldap* schema errors
The version of the *bind-dyndb-ldap* LDAP schema included in Identity Management contains syntax errors and is missing a description of one attribute. If the user uses this version of the schema, the Directory Server component fails to start. Consequently, error messages are logged in the journal, informing the user about the incorrect syntax.
To work around this problem:
1. Obtain a corrected schema file from the upstream `git.fedorahosted.org` repository:
# wget https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/plain/doc/schema.ldif?id=17711141882aca3847a5daba2292bcbcc471ec63 -O /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif
2. Copy the corrected schema file into the Directory Server's instance configuration folder.
# cp /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif /etc/dirsrv/slapd-[EXAMPLE-COM]/schema/[SCHEMA_FILE_NAME].ldif
3. Restart Directory Server:
# systemctl restart dirsrv.target
Description of problem:
bind-dyndb-ldap default schema is shipped with syntax error.
Version-Release number of selected component (if applicable):
bind-dyndb-ldap-10.0-5.el7.x86_64
How reproducible:
100%
Steps to Reproduce:
1. Configure RHDS server
2. Install bind-dyndb-ldap
3. Use default shipped schema with RHDS
# cp /usr/share/doc/bind-dyndb-ldap-10.0/schema.ldif /etc/dirsrv/slapd-rhds10-1/schema/65idnszone.ldif
4. RHDS restart Fails.
Actual results:
[17/Jan/2017:06:09:44 +051800] attr_syntax_create - Error: the EQUALITY matching rule [caseIgnoreMatchSINGLE-VALUE] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [idnsServerId]
[17/Jan/2017:06:09:44 +051800] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-rhds10-1/schema/65idnszone.ldif (lineno: 1) is invalid, error code 20 (Type or value exists) - object class idnsTemplateObject: Superior object class "topAUXILIARY" does not exist
Additional info:
From the previous schema, Below information was added.
365c365
< EQUALITY caseIgnoreMatch
---
> EQUALITY caseIgnoreMatch
429c429
< SUP top
---
> SUP top
431c431
< MUST ( idnsTemplateAttribute ) )
---
> )
There are two errors logged while parsing the schema.ldif file:
- For attribute 'idnsServerId', the caseIgnoreMatch matching rule is said to be incompatible with 'Directory String' 1.3.6.1.4.1.1466.115.121.1.15. So far, I have not explanation for this because it looks compatible for me.
- The definition of idnsTemplateObject looks broken. It is likely that it is missing a ' ' (space) between 'top' and 'AUXILIARY. Does it exist a ' ' between 'top' and the end of the line ?
This is going to be fixed as a part of the rebase of bind-dyndb-lap to 11+ (bug 1393889).
As a workaround, you can download the correct schema from the upstream git. See DocText for more info.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:2120
Hi,
could you please help me find the problem?
https://bugs.centos.org/view.php?id=14475
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ldapns.ldif
adding new entry "cn=ldapns,cn=schema,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
additional info: olcObjectClasses: ObjectClass not found: "topAUXILIARY"
cat ldapns.ldif
dn: cn=ldapns,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: ldapns
olcAttributeTypes: {0}( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService' DESC
'IANA GSS-API authorized service name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.
1.4.1.1466.115.121.1.15{256} )
olcAttributeTypes: {1}( 1.3.6.1.4.1.5322.17.2.2 NAME 'loginStatus' DESC 'Curre
ntly logged in sessions for a user' EQUALITY caseIgnoreMatch ORDERING caseIgn
oreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString )
olcObjectClasses: {0}( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
DESC 'Auxiliary object class for adding authorizedService attribute' SUP top
AUXILIARY MAY authorizedService )
olcObjectClasses: {1}( 1.3.6.1.4.1.5322.17.1.2 NAME 'hostObject' DESC 'Auxilia
ry object class for adding host attribute' SUP top AUXILIARY MAY host )
olcObjectClasses: {2}( 1.3.6.1.4.1.5322.17.1.3 NAME 'loginStatusObject' DESC '
Auxiliary object class for login status attribute' SUP top AUXILIARY MAY logi
nStatus )
Hi,
It looks it there is a typo in the ldapns.ldif file for the definition of 'authorizedServiceObject'.
It is a missing space between between 'top' and 'AUXILIARY'. you may fix it with
olcObjectClasses: {0}( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
DESC 'Auxiliary object class for adding authorizedService attribute' SUP top
AUXILIARY MAY authorizedService )