On 8/28/20 3:51 AM, Jan Tomasek wrote:
Hi,

I've this directory structure:

dc=example,dc=cz
  + o=apps,dc=example,dc=cz
     + o=TCS2,o=aps,dc=example,dc=cz

I would like store o=TCS2,o=aps,dc=example,dc=cz in it's own database,
to be able create custom indexes only for entries under
o=TCS2,o=aps,dc=example,dc=cz.

When I create it this way:

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "example_cz" --suffix="dc=example,dc=cz"

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "TCS2_apps_example_cz" \
   --suffix="o=TCS2,o=apps,dc=example,dc=cz" \
   --parent-suffix="o=apps,dc=example,dc=cz"

Then I'm unable find o=TCS2 under o=apps,dc=example,dc=cz:

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -b o=apps,dc=example,dc=cz '(o=TCS2)'
Enter LDAP Password:
semik@doma:~$

But it is there:

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -b o=TCS2,o=apps,dc=example,dc=cz '(o=TCS2)'
Enter LDAP Password:
dn: o=TCS2,o=apps,dc=example,dc=cz
objectClass: top
objectClass: organization
o: TCS2

It is very likely because 389DS doesn't understand what I want to do.

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -s base -b '' '(objectClass=*)'
namingContexts nsBackendSuffix
Enter LDAP Password:
dn:
namingContexts: o=TCS2,o=apps,dc=example,dc=cz
namingContexts: dc=example,dc=cz
nsBackendSuffix: example_cz:dc=example,dc=cz
nsBackendSuffix: TCS2_apps_example_cz:o=TCS2,o=apps,dc=example,dc=cz

When I create another database for o=apps,dc=example,dc=cz this way:

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "example_cz" --suffix="dc=example,dc=cz"

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "apps_example_cz" \
   --suffix="o=apps,dc=example,dc=cz" \
   --parent-suffix="dc=example,dc=cz"

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "TCS2_apps_example_cz" \
   --suffix="o=TCS2,o=apps,dc=example,dc=cz" \
   --parent-suffix="o=apps,dc=example,dc=cz"

It works:

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -b o=apps,dc=example,dc=cz '(o=TCS2)'
Enter LDAP Password:
dn: o=TCS2,o=apps,dc=example,dc=cz
objectClass: top
objectClass: organization
o: TCS2

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -s base -b '' '(objectClass=*)'
namingContexts nsBackendSuffix
Enter LDAP Password:
dn:
namingContexts: dc=example,dc=cz
nsBackendSuffix: example_cz:dc=example,dc=cz
nsBackendSuffix: apps_example_cz:o=apps,dc=example,dc=cz
nsBackendSuffix: TCS2_apps_example_cz:o=TCS2,o=apps,dc=example,dc=cz

In first scenario, there are two separate namingContexts
o=TCS2,o=apps,dc=example,dc=cz and dc=example,dc=cz.


I want to get rid of extra apps_example_cz backend database if possible.
Is there a way how to NOT create database for o=apps,dc=example,dc=cz

I think subsuffixes need to be directly under the parent suffix.  Otherwise the server will not find it when searching.  So in your first example, you would need to set your search base to "o=TCS2,o=apps,dc=example,dc=cz", as it won't find it if the search base is "dc=example,dc=cz".

You might want to look into chaining(database links) if you don't want to create that "filler" subsufix (o=apps):

https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/configuring_directory_databases-creating_and_maintaining_database_links

HTH,
Mark


    

Thanks

_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
-- 

389 Directory Server Development Team