3:34 p.m.
Hi Folks,
At the moment, I'm investigating using pwm to allow user password reset
self service. pwm requires a schema change to add its own attributes.
I'm afraid I've never been clear on what the correct procedure is for
make schema changes and I've been unable to find a blurb on this in the
RH IdM docs.
There seems to be a couple of possible ways of going about this using
ldapmodify or dropping ldif files directly under
/etc/dirsrv/slapd-<foo>/schema. However, that requires templating the
ldif with server specific changes.
Seeing as the files under /usr/share/ipa appear to be templated via
ipa-ldap-updater and the man page states:
Additionally, ipa-ldap-updater can update the schema based
on LDIF files. Any missing object classes and attribute types are
added, and differing ones are updated to match the
LDIF file. To enable this behavior, use the
--schema-file options. Schema files should be in LDIF format, and
may only specify attributeTypes and objectClasses attributes of
cn=schema.
I attempted to template the pwm schema changes as follows:
dn: cn=schema
objectclass: top
objectclass: ldapSubentry
objectclass: subschema
cn: schema
aci: (target="ldap:///cn=schema")(targetattr !="aci")(version
3.0;acl "anonymous, no acis"; allow (read, search, compare) userdn =
"ldap:///anyone";)
aci: (targetattr="*")(version 3.0; acl "Configuration Administrators
Group"; allow (all)
groupdn="ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";)
aci: (targetattr="*")(version 3.0; acl "Configuration
Administrator"; allow (all)
userdn="ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";)
aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all)
groupdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";)
attributetypes: ( 1.3.6.1.4.1.35015.1.2.1 NAME 'pwmEventLog' SYNTAX
1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.2 NAME 'pwmResponseSet'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.3 NAME 'pwmLastPwdUpdate'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN 'user
defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.4 NAME 'pwmGUID' SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.4 NAME 'pwmToken' SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.6 NAME 'pwmOtpSecret'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
attributetypes: ( 1.3.6.1.4.1.35015.1.2.7 NAME 'pwmData' SYNTAX
1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
objectclasses: ( 1.3.6.1.4.1.35015.1.1.1 NAME 'pwmUser' DESC '' SUP
top AUXILIARY MAY ( pwmEventLog $ pwmResponseSet $ pwmLastPwdUpdate
$ pwmGUID $ pwmToken $ pwmOtpSecret $ pwmData ) X-ORIGIN 'user
defined' )
However, trying to use `ipa-ldap-updater` in this manner suggested by
the manpage fails:
# ipa-ldap-updater --schema-file ./99pwm.ldif
Unexpected error - see /var/log/ipaupgrade.log for details:
IOError: [Errno socket error] [Errno -2] Name or service not known
The ipa-ldap-updater command failed. See /var/log/ipaupgrade.log for
more information
The error message is complaining about the socket... which I've
confirmed from the ipaupgrade.log is the correct path to the dirsrv
socket (and dirsrv is otherwise functioning).
Is this an abuse of, or bug in, ipa-ldap-updater? Is it possible to
simply drop templated ldif files under /usr/share/ipa/ and have them be
processed similarly to /usr/share/ipa/updates/?
Any guidance would be greatly appreciated.
-Josh
--