Hi!
I'm migrating from OpenLDAP to Fedora Directory.
In the OpenLDAP infrastructure, I had used proxy LDAP servers (the
slapd-ldap backend) to direct requests to slapd-bdb backend OpenLDAP
instances with failover in case of failure.
In addition to that, using the rwm overlay, the slapd-ldap instance
did request rewriting of queries that specify empty base dn.
The configuration for slapd-ldap instance was:
database ldap
suffix ""
uri "ldap://localhost:392/,ldaps://otherserver:636/"
timeout 24
idle-timeout 16
overlay rwm
rwm-rewriteEngine on
rwm-rewriteContext searchBase
rwm-rewriteRule "$" "o=MyDefaultBase" ":"
I've read a thread from 2006-02 on this list
(
https://www.redhat.com/archives/fedora-directory-users/2006-February/msg0...)
that it's possible to get a similar behaviour on FDS by modifying
dse.ldif.
I've stopped the FDS instance, modified
/etc/dirsrv/slapd-instancename/dse.ldif and started FDS again:
dn:
objectClass: top
objectClass: extensibleObject
defaultsearchbase: o=MyDefaultBase
aci: (targetattr != "aci")(version 3.0; aci "rootdse anon read
access"; allow(
read,search,compare) userdn="ldap:///anyone";)
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config
createTimestamp: 20080411165538Z
modifyTimestamp: 20080411165538Z
However, it still doesn't return anything when clients search with
empty base:
# /usr/lib64/mozldap/ldapsearch -b 'o=MyDefaultBase' -s sub uid=olo uid
version: 1
dn: uid=olo,ou=People,o=MyDefaultBase
uid: olo
# /usr/lib64/mozldap/ldapsearch -b '' -s sub uid=olo uid
ldap_search: No such object
Maybe it's relevant that the host in question takes part in
multi-master replication setup of 3 FDS servers.
defaultSearchBase is not a server side thing. It only works if clients
understand how to use it. There is no way to make Fedora DS do a
subtree search from base "" unless you write a C code plugin