Hi All,

Centos6

I am facing issue on my test ldap server server is working fine but i am trying to configure ACL in openldap server so that ldap users can change their password but it show me the below error

ldap_modify: Object class violation (65)
additional info: attribute 'olcTLSCertificateFile' not allowed


[root@master cn=config]# ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config olcSuffix="dc=unxldap,dc=com" dn olcsuffix
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={2}bdb,cn=config
olcSuffix: dc=unxldap,dc=com



[root@master cn=config]# ldapmodify -Y EXTERNAL -H ldapi:/// -f access-list.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}bdb,cn=config"
ldap_modify: Object class violation (65)
additional info: attribute 'olcTLSCertificateFile' not allowed

[root@master cn=config]#


[root@master cn=config]# ll
total 76
-rw-r--r--. 1 root root 287 May 15 03:18 access-list.ldif
drwx------. 2 ldap ldap 4096 May 11 12:01 cn=schema
-rw-------. 1 ldap ldap 51896 May 11 12:01 cn=schema.ldif
-rw-------. 1 ldap ldap 592 May 11 12:01 olcDatabase={0}config.ldif
-rw-------. 1 ldap ldap 525 May 11 12:01 olcDatabase={-1}frontend.ldif
-rw-------. 1 ldap ldap 620 May 11 12:05 olcDatabase={1}monitor.ldif
-rw-------. 1 ldap ldap 1363 May 12 09:38 olcDatabase={2}bdb.ldif
[root@master cn=config]# cat access-list.ldif
dn: olcDatabase={2}bdb,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword
by self write
by anonymous auth
by dn.exact="cn=Manager,ou=Groups,dc=unxldap,dc=com" write
by * none
olcAccess: to *
by dn.base="cn=Manager,dc=unxldap,dc=com" write
by * read
[root@master cn=config]#



[root@master cn=config]# cat olcDatabase\=\{2\}bdb.ldif
dn: olcDatabase={2}bdb
objectClass: olcDatabaseConfig
objectClass: olcBdbConfig
olcDatabase: {2}bdb
olcSuffix: dc=unxldap,dc=com
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=Manager,dc=unxldap,dc=com
olcSyncUseSubentry: FALSE
olcMonitoring: TRUE
olcDbDirectory: /var/lib/ldap
olcDbCacheSize: 1000
olcDbCheckpoint: 1024 15
olcDbNoSync: FALSE
olcDbDirtyRead: FALSE
olcDbIDLcacheSize: 0
olcDbIndex: objectClass pres,eq
olcDbIndex: cn pres,eq,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: uidNumber pres,eq
olcDbIndex: gidNumber pres,eq
olcDbIndex: mail pres,eq,sub
olcDbIndex: ou pres,eq,sub
olcDbIndex: loginShell pres,eq
olcDbIndex: sn pres,eq,sub
olcDbIndex: givenName pres,eq,sub
olcDbIndex: memberUid pres,eq,sub
olcDbIndex: nisMapName pres,eq,sub
olcDbIndex: nisMapEntry pres,eq,sub
olcDbLinearIndex: FALSE
olcDbMode: 0600
olcDbSearchStack: 16
olcDbShmKey: 0
olcDbCacheFree: 1
olcDbDNcacheSize: 0
structuralObjectClass: olcBdbConfig
entryUUID: 24ad5dfe-8bf3-1034-853c-734d1b37f2f0
creatorsName: cn=config
createTimestamp: 20150511063147Z
entryCSN: 20150511063147.158564Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20150511063147Z
olcRootPW: {SSHA}H4qHRdoNYk7gW8QN7DYiLJtYRwpcadwf
olcTLSCertificateFile: /etc/pki/tls/certs/example.pem
olcTLSCertificateKeyFile: /etc/pki/tls/certs/examplekey.pem

[root@master cn=config]#

does i need to change anything to change ??



[root@master cn=config]# ldapsearch -LLLY EXTERNAL -H ldapi:/// -b cn=config -s base |grep -i tls
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: "OpenLDAP Server"
olcTLSCertificateKeyFile: /etc/openldap/certs/password
olcTLSVerifyClient: never
[root@master cn=config]#

[root@master cn=config]# ldapmodify -Y EXTERNAL -H ldapi:/// -f access-list.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}bdb,cn=config"
ldap_modify: Object class violation (65)
additional info: attribute 'olcTLSCertificateFile' not allowed


[root@master cn=config]# cat olcDatabase\=\{2\}bdb.ldif |grep -i tls
olcTLSCertificateFile: /etc/pki/tls/certs/example.pem
olcTLSCertificateKeyFile: /etc/pki/tls/certs/examplekey.pem
[root@master cn=config]#

The below changes has been made on the database of LDAP which make it fixed

add these below line at the bottom of the file
# cat olcDatabase\=\{2\}bdb.ldif

olcAccess: to attrs=userPassword by self write by anonymous auth by dn.exact="cn=Manager,ou=Groups,dc=unxldap,dc=com" write by * none
olcAccess: to * by dn.exact="cn=Manager,dc=unxldap,dc=com" write by * read


now login into the client machine & change the password

#passwd

I am sorry for bumping into this old thread but I landed here in search for something and I think anybody could land here.

This is not the right way for adding attributes to the db. You need to use "ldapmodify" and pass the ldif files with changes (called mods). I was stuck on this very error for the past few hours and the following fixed it for me:

The error you are getting ("additional info: attribute 'olcTLSCertificateFile' not allowed") is because the TLS certificates does not belong to individual databases, they belong to dn: cn=config which is global.

1. Create /tmp/addtls.ldif
Now run the ldapmodify as:
# ldapmodify -H ldapi:// -Y EXTERNAL -f /tmp/addtls.ldif

This should update the location of certificates. Next remove the certificates from individual database (olcDatabase\=\{2\}bdb) in this case:

2. Create /tmp/rmtls.ldif
Next, run ldapmodify:
# ldapmodify -H ldapi:// -Y EXTERNAL -f /tmp/rmtls.ldif

All that is left is add (in my case) the olcAccess attribute using another ldif file (/tmp/passaccess.ldif)

3. Create /tmp/passaccess.ldif
Run it as:
# ldapmodify -H ldapi:// -Y EXTERNAL -f /tmp/passaccess.ldif

As we've changed the TLS certs location, a restart for slapd is needed (not everything is automated, yet!)

Hope this helps somebody who is trying to figure out a way out.

PS: Many thanks to @tarpman and @JoBbZ at #openldap for pointing me in the right direction from time to time.
Cheers