主页 / user-1073653

VladC's questions

Martin Hope
VladC
Asked: 2024-02-02 18:05:50 +0800 CST
  • 7

我试图在 OpenLDAP 服务器启动开始时执行自定义 .ldif 文件，并使用以下命令成功：

ldapadd -x -D cn=admin,dc=vlad,dc=lan -w admin -H ldap:// -f ldap/ldap-test.ldif

遗憾的是，我希望能够使用以下命令将自定义属性和对象类添加到架构中：

dn: cn=schema,cn=config
changetype: modify
add: olcObjectClasses
olcObjectClasses: ( 1.2.3.4.5.6.7.8.9.0 NAME 'myCustomObjectClass'
  DESC 'My Custom Object Class'
  AUXILIARY
  MAY ( customAttribute1 $ customAttribute2 $ customAttribute3 $
        customAttribute4 $ customAttribute5 $ customAttribute6 $
        customAttribute7 $ customAttribute8 $ customAttribute9 $
        customAttribute10 $ customAttribute11 $ customAttribute12 $
        customAttribute13 $ customAttribute14 $ customAttribute15 ) )

遗憾的是，它抛出了访问不足 50 错误。这是 slapcat -n0 的输出

dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth manage by * break
olcRootDN: cn=admin,cn=config
structuralObjectClass: olcDatabaseConfig
entryUUID: 3e49b716-55fd-103e-8582-a14a85261557
creatorsName: cn=config
createTimestamp: 20240202095739Z
olcRootPW:: e1NTSEF9d3J4NGVYaUFvaGRmc2dDOXlqT0V0cEFmSWhZYklxWXo=
entryCSN: 20240202095739.321947Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20240202095739Z

dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=vlad,dc=lan
olcLastMod: TRUE
olcRootDN: cn=admin,dc=vlad,dc=lan
olcRootPW:: -----
olcDbCheckpoint: 512 30
olcDbMaxSize: 1073741824
structuralObjectClass: olcMdbConfig
entryUUID: 3e49fae6-55fd-103e-8589-a14a85261557
creatorsName: cn=admin,cn=config
createTimestamp: 20240202095739Z
olcDbIndex: uid eq
olcDbIndex: mail eq
olcDbIndex: memberOf eq
olcDbIndex: entryCSN eq
olcDbIndex: entryUUID eq
olcDbIndex: objectClass eq
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth manage by * break
olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by dn="cn
 =admin,dc=vlad,dc=lan" write by anonymous auth by * none
olcAccess: {2}to * by self read by dn="cn=admin,dc=vlad,dc=lan" wri
 te by dn="cn=user-ro,dc=vlad,dc=lan" read by * none
entryCSN: 20240202095739.438344Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20240202095739Z

如何才能使用 ldapadd 或 ldapmodify 运行上述命令？需要什么用户进行身份验证。

更新： dn: cn=schema,cn=config changetype: modify add: olcObjectClasses olcObjectClasses: ( 1.2.3.4.5.6.7.8.9.0 NAME 'myCustomObjectClass' DESC 'My Custom Object Class' AUXILIARY MAY ( name ) )

将上面的代码与命令一起使用： ldapmodify -Y EXTERNAL -H ldapi:// -f ldap/ldap-modify.ldif

一切似乎都很好，应该添加。

尝试使用该类：

dn: OU=CustomOU,DC=vlad,DC=lan
ou: CustomOU
objectClass: top
objectClass: organizationalUnit
objectClass: myCustomObjectClass

通过命令，它说：

ldapadd -x -D cn=admin,dc=vlad,dc=lan -w admin -H ldap:// -f ldap/ldap-test.ldif 

additional info: objectClass: value #2 invalid per syntax

并且在检查 slapcat -n0 时，似乎没有添加自定义对象。

ldap