[phpldapadmin] [ phpldapadmin-Bugs-2959419 ] Schema error when combining overlays

Bugs item #2959419, was opened at 2010-02-26 15:59
Message generated for change (Comment added) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2959419&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.1.x
>Status: Closed
>Resolution: Out of Date
Priority: 5
Private: No
Submitted By: Gropefruit (gropefruit)
Assigned to: Nobody/Anonymous (nobody)
Summary: Schema error when combining overlays

Initial Comment:
Greetings.  Using phpldapadmin 1.1.0.5 on amd64 Debian/Lenny system. LDAP server is OpenLDAP 2.4.20 on same local box.

phpLDAPadmin works fine except when using the following modules & configuration options in slapd.conf:

###############

moduleload back_ldap
moduleload back_monitor

overlay chain
chain-uri ldaps://1.2.3.4:636/
chain-idassert-bind 
bindmethod=simple 
   binddn="uid=manager,dc=example,dc=com"
   credentials=password
   mode=self
chain-idassert-authzFrom "*"

updateref   ldaps://1.2.3.4:636/

###############

When using the above configuration, upon attempting to login to phpLDAPadmin:

Error
Schema error: attributeType "olmDbURIList" inherits from "managedInfo", but attributeType "managedInfo" does not exist.

Removing back_ldap (along with the chain option) OR back_monitor fixes the problem.  However both of these are critical to the functionality of this server.

Issue is not an OpenLDAP issue. The LDAP-functionality of this server is perfect and does what we want within the guidelines of OpenLDAP's documentation.  This is a phpLDAPadmin problem.  The schema attributes to which this error refers are part of an internally-loaded schema system controlled by back_monitor, and it seems that phpLDAPadmin is picking up on parts of this schema, and freaking out unnecessarily, denying my login.

*** I understand phpLDAPadmin is not compatible with back_monitor.  But WE ARE NOT USING phpLDAPadmin with the back_monitor overlay, it is merely loaded for other, unrelated purposes. ***

If anyone has any input, or knows of a work around OTHER than the unacceptable options I've already listed, please throw it my way.

Thank you,

GropeFruit

----------------------------------------------------------------------

>Comment By: Deon George (wurley)
Date: 2010-02-28 09:55

Message:
FIrstly, PLA 1.1 is no longer being maintained...

That said however, this is probably not a PLA bug, but an openldap bug. I
suggest you report it with the openldap team. RFC 2252 states "Servers MAY
recognize additional names and attributes not listed in this document, and
if they do so, MUST publish the definitions of the types in the
attributeTypes attribute of their subschema entries."

There seems to be a thread on the openldap lists
http://www.openldap.org/lists/openldap-bugs/200806/msg00110.html

What I would consider doing in PLA, is dropping the offending schema
definition However, I cant re-create your condition - it would appear that
my openldap is correctly rejecting schema attributeType definitions when
they reference a non-existent SUP. (This correct action on the ldap server
means that you would never see this message.)

----------------------------------------------------------------------

Comment By: Gropefruit (gropefruit)
Date: 2010-02-26 16:01

Message:
Sorry, additional note:

We are using apache2 (mpm-prefork) 2.2.9-10+lenny6.

Also, php packages required are: 5.2.6.dfsg.1-1+lenny6.

Gropefruit

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2959419&group_id=61828

------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/