☰

OpenLAP olc (cn=config) 和链接 - 需要帮助

tag-icon • tag-icon linux openldap
OpenLAP olc (cn=config) 和链接 - 需要帮助

因此，经过大量令人沮丧的谷歌搜索后，似乎我的谷歌能力还不够好——我对链接的细节还不太了解。

我已经使用答案得到了部分答案这里，但当我尝试添加实际的链接时这没有帮助：

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f chain_conf.ldif

chain_conf.ldif 包含：

#dn: olcOverlay={0}chain
#objectClass: olcOverlayConfig
#objectClass: olcChainConfig
#olcOverlay: {0}chain
#olcChainCacheURI: FALSE
#olcChainMaxReferralDepth: 1
#olcChainReturnError: TRUE
#structuralObjectClass: olcChainConfig

dn: olcDatabase={0}config
objectClass: olcLDAPConfig
objectClass: olcChainDatabase
olcDatabase: {0}ldap
olcDbStartTLS: none  starttls=no
olcDbRebindAsUser: FALSE
olcDbChaseReferrals: TRUE
olcDbTFSupport: no
olcDbProxyWhoAmI: FALSE
olcDbProtocolVersion: 3
olcDbSingleConn: FALSE
olcDbCancel: abandon
olcDbUseTemporaryConn: FALSE
olcDbConnectionPoolMax: 16
olcDbSessionTrackingRequest: FALSE
olcDbNoRefs: FALSE
olcDbNoUndefFilter: FALSE
structuralObjectClass: olcLDAPConfig

dn: olcDatabase={1}mdb
objectClass: olcLDAPConfig
objectClass: olcChainDatabase
olcDatabase: {1}ldap
olcDbURI: "ldap://provider.example.com"
olcDbStartTLS: none  starttls=no
olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm
 ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=example,c=com”
 credentials="VerySecret" keepalive=0:0:0
olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no
olcDbProxyWhoAmI: FALSE
olcDbProtocolVersion: 3
olcDbSingleConn: FALSE
olcDbCancel: abandon
olcDbUseTemporaryConn: FALSE
olcDbConnectionPoolMax: 16
olcDbSessionTrackingRequest: FALSE
olcDbNoRefs: FALSE
olcDbNoUndefFilter: FALSE
structuralObjectClass: olcLDAPConfig

尝试添加此项会得到以下响应：

root@consumer:~# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f chain_conf.ldif
adding new entry "olcDatabase={0}config"
ldap_add: Server is unwilling to perform (53)
        additional info: no global superior knowledge

...现在我陷入困境。

一般的想法是拥有一个单独的主 ldap 服务器，该服务器与几个只读服务器同步，这些服务器依次提供链接回主服务器以进行更新，否则提供查找。

我已经设法使 syncrepl 运行并且它运行良好。

OpenLDAP 信息：

Package: slapd
Version: 2.4.45+dfsg-1ubuntu1

操作系统：

Ubuntu 17.10

有人可以帮忙吗？

答案1

根据您发布的 LDIF，专有名称是错误的。它应该看起来像这样：

dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
objectClass: olcOverlayConfig
objectClass: olcChainConfig
olcOverlay: {0}chain
olcChainCacheURI: FALSE
olcChainMaxReferralDepth: 1
olcChainReturnError: TRUE

dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
objectClass: olcLDAPConfig
objectClass: olcChainDatabase
olcDatabase: {0}ldap
olcDbStartTLS: none  starttls=no
olcDbRebindAsUser: FALSE
olcDbChaseReferrals: TRUE
olcDbTFSupport: no
olcDbProxyWhoAmI: FALSE
olcDbProtocolVersion: 3
olcDbSingleConn: FALSE
olcDbCancel: abandon
olcDbUseTemporaryConn: FALSE
olcDbConnectionPoolMax: 16
olcDbSessionTrackingRequest: FALSE
olcDbNoRefs: FALSE
olcDbNoUndefFilter: FALSE

dn: olcDatabase={1}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config
objectClass: olcLDAPConfig
objectClass: olcChainDatabase
olcDatabase: {1}ldap
olcDbURI: "ldap://provider.example.com"
olcDbStartTLS: none  starttls=no
olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=example,c=com” credentials="VerySecret" keepalive=0:0:0
olcDbRebindAsUser: FALSE
olcDbChaseReferrals: TRUE
olcDbTFSupport: no
olcDbProxyWhoAmI: FALSE
olcDbProtocolVersion: 3
olcDbSingleConn: FALSE
olcDbCancel: abandon
olcDbUseTemporaryConn: FALSE
olcDbConnectionPoolMax: 16
olcDbSessionTrackingRequest: FALSE
olcDbNoRefs: FALSE
olcDbNoUndefFilter: FALSE

注意dn:线条已经改变。

这假设你也加载了back_ldap模块

答案2

啊！——终于！——顿悟了 :)

因此，首先我想到各个 dn: olcDatabase={N}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config节应该与中的实际olcDatabase={N}mdb,cn=config属性(?)相匹配cn=config，其次，从使用unicode左引号和右引号而不是好的ascii双引号的可怕网页上剪切和粘贴往往会导致日后出现麻烦。

相关内容