ldap_add: Insufficient access for ldap subtree

[iulian roman]

Hello everybody,

I have modified the ipa schema in order to automate Oracle TNS entries. When I try to add entries with ipa-ldap-updater it works, but not when running ldapadd (which is used by Oracle). The error i get is :
 /bin/ldapadd -h ipaprd04.ipa.example.corp -p 389 -D "uid=tnsadmin,cn=users,cn=accounts,dc=ipa,dc=example,dc=corp" -W -x -f  orcl1.ldif
Enter LDAP Password:
adding new entry "cn=SP7DEV,cn=oraclecontext,dc=ipa,dc=example,dc=corp"
ldap_add: Insufficient access (50)
    additional info: Insufficient 'add' privilege to add the entry 'cn=SP7DEV,cn=oraclecontext,dc=ipa,dc=example,dc=corp'.

The permission on the ldap subtree:
ipa permission-show 'write oracle context'
  Permission name: write oracle context
  Granted rights: write, compare, delete, add, read, search, all
  Bind rule type: permission
  Subtree: cn=oraclecontext,dc=ipa,dc=example,dc=corp
  Target DN: cn=*,cn=oraclecontext,dc=ipa,dc=example,dc=corp
  Permission flags: SYSTEM, V2
  Granted to Privilege: tns administrators

Any ideas/hints would be really appreciated.

Regards, 
iulian roman

[Rob Crittenden]

iulian roman via FreeIPA-users wrote:
> Hello everybody,
>
> I have modified the ipa schema in order to automate Oracle TNS entries. When I try to add entries with ipa-ldap-updater it works, but not when running ldapadd (which is used by Oracle). The error i get is :
>  /bin/ldapadd -h ipaprd04.ipa.example.corp -p 389 -D "uid=tnsadmin,cn=users,cn=accounts,dc=ipa,dc=example,dc=corp" -W -x -f  orcl1.ldif
> Enter LDAP Password:
> adding new entry "cn=SP7DEV,cn=oraclecontext,dc=ipa,dc=example,dc=corp"
> ldap_add: Insufficient access (50)
>    additional info: Insufficient 'add' privilege to add the entry 'cn=SP7DEV,cn=oraclecontext,dc=ipa,dc=example,dc=corp'.
>
> The permission on the ldap subtree:
> ipa permission-show 'write oracle context'
>   Permission name: write oracle context
>   Granted rights: write, compare, delete, add, read, search, all
>   Bind rule type: permission
>   Subtree: cn=oraclecontext,dc=ipa,dc=example,dc=corp
>   Target DN: cn=*,cn=oraclecontext,dc=ipa,dc=example,dc=corp
>   Permission flags: SYSTEM, V2
>   Granted to Privilege: tns administrators
>
> Any ideas/hints would be really appreciated.

Can you provide the output of the permission show with the --raw flag?
That will include the actual ACI.

I'd do a user-show --all --raw tnsadmin and verify that this permission
shows memberofindirect for 'write oracle context'.

This permission appears to be pretty straightforward and in line with
one that does similar things, System: Add DNS Entries.

I assume the rights are spammed because you were trying to get it to
work. Don't forget to eventually fine-tune it.

rob

[iulian roman]

Thank You Rob! It was a good hint. I forgot to bind roles with privilege, therefore the "memberofindirect" was not present in the attributes of the user. After I added privilege to the role, it worked, and user-show does display memberofindirect for permission and privilege.

Regards, 
iulian roman