主页 / server / 问题 / 1080937
Accepted
azmeuk
Asked: 2021-10-19 10:33:39 +0800 CST

OpenLDAP memberof 覆盖错误：memberof_value_modify err=32

  • 772

我使用 OpenLDAP 2.4.57 启用了 refint 和 memberof 覆盖，但是当我创建 groupOfNames 时出现memberof_value_modify .. failed err=32错误。我还启用了带备件的syncprov。我究竟做错了什么？

组加法

$ ldapadd -W -x -D cn=admin,dc=mydomain,dc=tld << EOF
dn: cn=mygroup,ou=groups,dc=mydomain,dc=tld
objectClass: top
objectClass: groupOfNames
cn: mygroup
member: cn=myüser,ou=members,dc=mydomain,dc=tld
EOF

错误日志

slapd: conn=132979 op=1: memberof_value_modify DN="cn=myüser,ou=members,dc=mydomain,dc=tld" add memberOf="cn=mygroup,ou=groups,dc=mydomain,dc=tld" failed err=32
slapd: <= bdb_equality_candidates: (memberOf) not indexed

配置

$ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=module{0},cn=config
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}back_hdb
olcModuleLoad: {1}syncprov
olcModuleLoad: {2}memberof
olcModuleLoad: {3}refint

$ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD:: bWVtYmVyT2Yg

$ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b olcOverlay={2}refint,olcDatabase={1}hdb,cn=config
dn: olcOverlay={2}refint,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {2}refint
olcRefintAttribute: memberof member manager owner
ldap openldap

1 个回答

  1. Best Answer

    错误 32 表示no such object

    我的节点的 dn 是 base64 编码的，因为它包含重音。对于另一个具有明确 DN 的对象，一切正常。

    $ ldapsearch -W -x -D cn=admin,dc=mydomain,dc=tld -b ou=members,dc=mydomain,dc=tld sn=Doe
dn:: Y249bXn8c2VyLG91PW1lbWJlcnMsZGM9bXlkb21haW4sZGM9dGxk
objectClass: top
objectClass: person
objectClass: inetOrgPerso
sn: Doe
givenName: John
uid: john.doe

    这是RFC2849中定义的行为说：

      4)  Any dn or rdn that contains characters other than those
      defined as "SAFE-UTF8-CHAR", or begins with a character other
      than those defined as "SAFE-INIT-UTF8-CHAR", above, MUST be
      base-64 encoded.  Other values MAY be base-64 encoded.  Any
      value that contains characters other than those defined as
      "SAFE-CHAR", or begins with a character other than those
      defined as "SAFE-INIT-CHAR", above, MUST be base-64 encoded.
      Other values MAY be base-64 encoded.

    使用 dn 的编码版本一切正常：

    $ ldapadd -W -x -D cn=admin,dc=mydomain,dc=tld << EOF
dn: cn=mygroup,ou=groups,dc=mydomain,dc=tld
objectClass: top
objectClass: groupOfNames
cn: mygroup
member:: Y249bXn8c2VyLG91PW1lbWJlcnMsZGM9bXlkb21haW4sZGM9dGxk
EOF
    • 0

相关问题