[Fedora-directory-users] defaultsearchbase and empty base dn subtree searches

[Aleksander Adamowski]

Hi!

I'm migrating from OpenLDAP to Fedora Directory.

In the OpenLDAP infrastructure, I had used proxy LDAP servers (the 
slapd-ldap backend) to direct requests to slapd-bdb backend OpenLDAP 
instances with failover in case of failure.
In addition to that, using the rwm overlay, the slapd-ldap instance did 
request rewriting of queries that specify empty base dn.

The configuration for slapd-ldap instance was:

database        ldap
suffix          ""
uri           "ldap://localhost:392/,ldaps://otherserver:636/"
timeout 24
idle-timeout 16
overlay rwm
rwm-rewriteEngine on
rwm-rewriteContext searchBase
rwm-rewriteRule   "$" "o=MyDefaultBase" ":"

I've read a thread from 2006-02 on this list 
(https://www.redhat.com/archives/fedora-directory-users/2006-February/msg0010...) 
that it's possible to get a similar behaviour on FDS by modifying dse.ldif.

I've stopped the FDS instance, modified 
/etc/dirsrv/slapd-instancename/dse.ldif and started FDS again:

dn:
objectClass: top
objectClass: extensibleObject
defaultsearchbase: o=MyDefaultBase
aci: (targetattr != "aci")(version 3.0; aci "rootdse anon read access"; 
allow(
 read,search,compare) userdn="ldap:///anyone";)
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config
createTimestamp: 20080411165538Z
modifyTimestamp: 20080411165538Z

However, it still doesn't return anything when clients search with empty 
base:

# /usr/lib64/mozldap/ldapsearch -b 'o=MyDefaultBase' -s sub uid=olo uid
version: 1
dn: uid=olo,ou=People,o=MyDefaultBase
uid: olo

# /usr/lib64/mozldap/ldapsearch -b '' -s sub uid=olo uid
ldap_search: No such object

Maybe it's relevant that the host in question takes part in multi-master 
replication setup of 3 FDS servers.

[Rich Megginson]

Aleksander Adamowski wrote:
> Hi!
>
> I'm migrating from OpenLDAP to Fedora Directory.
>
> In the OpenLDAP infrastructure, I had used proxy LDAP servers (the 
> slapd-ldap backend) to direct requests to slapd-bdb backend OpenLDAP 
> instances with failover in case of failure.
> In addition to that, using the rwm overlay, the slapd-ldap instance 
> did request rewriting of queries that specify empty base dn.
>
> The configuration for slapd-ldap instance was:
>
> database        ldap
> suffix          ""
> uri           "ldap://localhost:392/,ldaps://otherserver:636/"
> timeout 24
> idle-timeout 16
> overlay rwm
> rwm-rewriteEngine on
> rwm-rewriteContext searchBase
> rwm-rewriteRule   "$" "o=MyDefaultBase" ":"
>
> I've read a thread from 2006-02 on this list 
> (https://www.redhat.com/archives/fedora-directory-users/2006-February/msg0010...) 
> that it's possible to get a similar behaviour on FDS by modifying 
> dse.ldif.
>
> I've stopped the FDS instance, modified 
> /etc/dirsrv/slapd-instancename/dse.ldif and started FDS again:
>
> dn:
> objectClass: top
> objectClass: extensibleObject
> defaultsearchbase: o=MyDefaultBase
> aci: (targetattr != "aci")(version 3.0; aci "rootdse anon read 
> access"; allow(
> read,search,compare) userdn="ldap:///anyone";)
> creatorsName: cn=server,cn=plugins,cn=config
> modifiersName: cn=server,cn=plugins,cn=config
> createTimestamp: 20080411165538Z
> modifyTimestamp: 20080411165538Z
>
> However, it still doesn't return anything when clients search with 
> empty base:
>
> # /usr/lib64/mozldap/ldapsearch -b 'o=MyDefaultBase' -s sub uid=olo uid
> version: 1
> dn: uid=olo,ou=People,o=MyDefaultBase
> uid: olo
>
> # /usr/lib64/mozldap/ldapsearch -b '' -s sub uid=olo uid
> ldap_search: No such object
>
> Maybe it's relevant that the host in question takes part in 
> multi-master replication setup of 3 FDS servers.

defaultSearchBase is not a server side thing.  It only works if clients 
understand how to use it.  There is no way to make Fedora DS do a 
subtree search from base "" unless you write a C code plugin