Page 2 - OpenLDAP - much confusion when adding entries

One thing that kinda looks like it may be a problem - is that STRUCTURAL object classes require the same attributes as the parent.

For instance - look at how inetOrgPerson requires and accepts the same type of attributes as organizationalPerson.

The issue seems to be that your emailPerson - though having the SUP of inetOrgPerson - is not detailed out to have the required and accepted attributes that inetOrgPerson has ...

If you add the required and allowed attributes of inetOrgPerson and leave your custom attributes to your emailPerson - and then of course modify your NameViewPerson the same way - I think you will have more success.

This may not be the only issue - but it is definitely one of them ...

Does that make sense?

I think I understand that. So I should be adding all the MUST and MAY fields of inetorgperson to emailPerson, and of emailPerson to NameViewPerson? Even though this is repetition? Goes against what I understand through applying OO Inheritance rules to LDAP schema, but then perhaps I shouldn't apply OO inheritance to everything

I shall have a go at this and let you know the result.

Thanks for your help, once again
Gemma

Hello again.... this didn't seem to do anything. I'm still getting an ldif_record() 89 error.

Aaaargh!

Can I check with you that I've set up logging correctly? I've set the log level to 256 in slapd.conf, and added the following line to /etc/syslog.conf:

local4.* /usr/local/etc/openldap/openldap.log

With the openldap.log file being world-writable.

I then killed syslogd, and slapd, and restarted them in that order.

Thanks for your help

I know the logs are somewhat difficult to configure with OpenLDAP - I'll have to take a look in a bit ...

In the meantime - does your new oc definition look like this - roughly anyway ...

objectclass (1.1.2.1

NAME 'emailPerson'
DESC 'User created'
SUP inetOrgPerson
STRUCTURAL
MUST ( cn $ sn)
MAY audio $ businessCategory $ carLicense $
departmentNumber $ displayName $ employeeType $
employeeNumber $ givenName $ homePhone $
homePostalAddress $ initials $ jpegPhoto $
labeledURI $ manager $ mobile $ pager $
photo $ preferredLanguage $ mail $ o $
roomNumber $ secretary $ uid $ x500uniqueIdentifier $
userCertificate $ userSMimeCertificate $ userPKCS12 $
mailHost $ reportsTo )

)

objectclass (1.1.2.2

NAME 'NameViewPerson'
DESC 'User created'
SUP emailPerson
STRUCTURAL
MUST ( cn $ sn )
MAY ( audio $ businessCategory $ carLicense $
departmentNumber $ displayName $ employeeType $
employeeNumber $ givenName $ homePhone $
homePostalAddress $ initials $ jpegPhoto $
labeledURI $ manager $ mobile $ pager $
photo $ preferredLanguage $ mail $ o $
roomNumber $ secretary $ uid $ x500uniqueIdentifier $
userCertificate $ userSMimeCertificate $ userPKCS12 $
mailHost $ reportsTo $ desktopHost $ extendedAddress $
extensionPhone $ globalLocation $ nickname $ pagerEmail $
altContact $ rfc822Recipient $ countryCode )

)

Ah - the 89 is pretty descriptive.

What that means is that it probably doesn't like one of the values you are supplying at the time you are adding the entry. You could try reducing the number of entries you are adding while you test to try to narrow down the one in particular that is causing the issue.

I will say, however, that it looks like all your attributes are directory string, which means that it should accept just about anything ...

All you should have to do for logging is:

1. Set the loglevel to 256 in slapd.conf
2. Edit the syslog.conf for local4.*
3. ldap restart
4. syslog restart

Looks like you have done that ...

Hello there again

I've double checked my schema file against what you posted - they're identical. Even if I comment out all the entries apart from cn and sn, I still get the 89 error - also if I change the cn to something shorter, with no spaces. However, it's still giving the 89 error if I delete the cn from the dn line (so it's dn: ou=People, o=myOrganization, dc=myDomain, dc=com).

I've done exactly that for logging. All my syslog.conf contains now is:

*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages

*.alert;kern.err;daemon.err operator
*.alert root

*.emerg *

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *
)

local4.* /usr/local/etc/openldap/openldap.log

Which, apart from the final line, was all there before I edited.

Is something else taking OpenLDAPs messages perhaps? I've checked /var/adm/messages and there's nothing related to OpenLDAP there...

Thanks
Gemma

I guess I am out of suggestions for now.

You may want to ask the question on one of the OpenLDAP lists. The description of the lists (along with subscribe links) can be found at:

http://www.openldap.org/lists/#charter

Sorry we didn't get a solution ...

Thanks for all your help thus far Hopefully I'll find an answer otherwise I'll be failing my dissertation!

Thanks again for your knowledge and patience