Hello Zak,

In fact 'dc' is IAString (e.g. ascii) (1.3.6.1.4.1.1466.115.121.1.26) and so can be match with caseIgnoreIA5Match and caseIgnoreIA5SubstringsMatch matching rules.
Directory string (e.g. UTF-8) (1.3.6.1.4.1.1466.115.121.1.15) can not. It should however work if the 'dc' only contains ascii character set.

Would you check in your DS schema (/etc/dirsrv/slapd-<instance>/schema/00core.ldif and 99user.ldif) what is the syntax for 'dc' ? it should be IAString.

regards
thierry

On 05/23/2017 08:05 PM, Zak Wolfinger via FreeIPA-users wrote:

Running FreeIPA Version 4.2.0

Seeing a lot of these in the slapd error log:

the EQUALITY matching rule [caseIgnoreIA5Match] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc]
the SUBSTR matching rule [caseIgnoreIA5SubstringsMatch] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc]

Any clue as to what this means and specifically how to fix it?

Cheers,
Zak Wolfinger

Infrastructure Engineer | Emma®
zak.wolfinger@myemma.com
800.595.4401 or 615.292.5888 x197
615.292.0777 (fax)

Emma helps organizations everywhere communicate & market in style.
Visit us online at www.myemma.com
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org