Issue 7786 - Impossible to modify cn=config if olcDbDirectory doesn't exist
Summary: Impossible to modify cn=config if olcDbDirectory doesn't exist
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: 2.4.38
Hardware: All All
: --- normal
Target Milestone: 2.5.4
Assignee: Ondřej Kuzník
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-15 08:59 UTC by Raphael Ouazana
Modified: 2021-04-12 20:00 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description Raphael Ouazana 2014-01-15 08:59:54 UTC
Full_Name: Raphael Ouazana
Version: 2.4.38
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (88.173.78.196)


Hi,

I have an old configuration that I would like to export/reimport. The
olcDbDirectory item of this configuration contains a directory that does not
longer exist.
It it then impossible to modify the parameter:
- I was told not to edit directly LDIF config files
- if i try a slapcat -n0 I get:
52d64c91 olcDbDirectory: value #0: invalid path: No such file or directory
52d64c91 config error processing olcDatabase={2}hdb,cn=config: olcDbDirectory:
value #0: invalid path: No such file or directory
slapcat: bad configuration directory!

I think slapcat should always allow to export a configuration.

Regards,
Rapha�l Ouazana.
Comment 1 ando@openldap.org 2014-01-15 09:29:14 UTC
On 01/15/2014 09:59 AM, raphael.ouazana@linagora.com wrote:
> Full_Name: Raphael Ouazana
> Version: 2.4.38
> OS: Linux
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (88.173.78.196)
>
>
> Hi,
>
> I have an old configuration that I would like to export/reimport. The
> olcDbDirectory item of this configuration contains a directory that does not
> longer exist.
> It it then impossible to modify the parameter:
> - I was told not to edit directly LDIF config files
> - if i try a slapcat -n0 I get:
> 52d64c91 olcDbDirectory: value #0: invalid path: No such file or directory
> 52d64c91 config error processing olcDatabase={2}hdb,cn=config: olcDbDirectory:
> value #0: invalid path: No such file or directory
> slapcat: bad configuration directory!
>
> I think slapcat should always allow to export a configuration.

I see the point; slapcat is failing because to export the configuration 
(c->op == SLAP_CONFIG_EMIT) it needs to read the configuration first, 
and it reads the whole config tree.

Perhaps when slapcat of only the config database is requested, config 
parsing should skip other databases, or at least ignore errors, if possible.

p.


-- 
Pierangelo Masarati
Associate Professor
Dipartimento di Scienze e Tecnologie Aerospaziali
Politecnico di Milano

Comment 2 Howard Chu 2014-01-15 22:04:03 UTC
pierangelo.masarati@polimi.it wrote:
> On 01/15/2014 09:59 AM, raphael.ouazana@linagora.com wrote:
>> Full_Name: Raphael Ouazana
>> Version: 2.4.38
>> OS: Linux
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (88.173.78.196)
>>
>>
>> Hi,
>>
>> I have an old configuration that I would like to export/reimport. The
>> olcDbDirectory item of this configuration contains a directory that does not
>> longer exist.
>> It it then impossible to modify the parameter:
>> - I was told not to edit directly LDIF config files
>> - if i try a slapcat -n0 I get:
>> 52d64c91 olcDbDirectory: value #0: invalid path: No such file or directory
>> 52d64c91 config error processing olcDatabase={2}hdb,cn=config: olcDbDirectory:
>> value #0: invalid path: No such file or directory
>> slapcat: bad configuration directory!
>>
>> I think slapcat should always allow to export a configuration.
>
> I see the point; slapcat is failing because to export the configuration
> (c->op == SLAP_CONFIG_EMIT) it needs to read the configuration first,
> and it reads the whole config tree.
>
> Perhaps when slapcat of only the config database is requested, config
> parsing should skip other databases, or at least ignore errors, if possible.

Agreed, we definitely need this.
>
> p.
>
>


-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 3 Howard Chu 2014-02-06 22:25:17 UTC
Howard Chu wrote:
> pierangelo.masarati@polimi.it wrote:
>> On 01/15/2014 09:59 AM, raphael.ouazana@linagora.com wrote:
>>> Full_Name: Raphael Ouazana
>>> Version: 2.4.38
>>> OS: Linux
>>> URL: ftp://ftp.openldap.org/incoming/
>>> Submission from: (NULL) (88.173.78.196)
>>>
>>>
>>> Hi,
>>>
>>> I have an old configuration that I would like to export/reimport. The
>>> olcDbDirectory item of this configuration contains a directory that does not
>>> longer exist.
>>> It it then impossible to modify the parameter:
>>> - I was told not to edit directly LDIF config files
>>> - if i try a slapcat -n0 I get:
>>> 52d64c91 olcDbDirectory: value #0: invalid path: No such file or directory
>>> 52d64c91 config error processing olcDatabase={2}hdb,cn=config: olcDbDirectory:
>>> value #0: invalid path: No such file or directory
>>> slapcat: bad configuration directory!
>>>
>>> I think slapcat should always allow to export a configuration.
>>
>> I see the point; slapcat is failing because to export the configuration
>> (c->op == SLAP_CONFIG_EMIT) it needs to read the configuration first,
>> and it reads the whole config tree.
>>
>> Perhaps when slapcat of only the config database is requested, config
>> parsing should skip other databases, or at least ignore errors, if possible.
>
> Agreed, we definitely need this.

But it's not clear that it's entirely feasible without major structural 
changes to back-config. In particular, later config items may depend on 
earlier ones succeeding (e.g., loading a module or reading a schema 
definition). So we can't simply no-op everything while running slapcat, nor 
can we safely ignore all errors, because we must still be able to parse all of 
the underlying config LDIF and some of it will be unparseable without 
appropriate schema being loaded.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 4 ando@openldap.org 2014-02-06 22:34:24 UTC
On 02/06/2014 11:25 PM, Howard Chu wrote:
> Howard Chu wrote:
>> pierangelo.masarati@polimi.it wrote:
>>> On 01/15/2014 09:59 AM, raphael.ouazana@linagora.com wrote:
>>>> Full_Name: Raphael Ouazana
>>>> Version: 2.4.38
>>>> OS: Linux
>>>> URL: ftp://ftp.openldap.org/incoming/
>>>> Submission from: (NULL) (88.173.78.196)
>>>>
>>>>
>>>> Hi,
>>>>
>>>> I have an old configuration that I would like to export/reimport. The
>>>> olcDbDirectory item of this configuration contains a directory that 
>>>> does not
>>>> longer exist.
>>>> It it then impossible to modify the parameter:
>>>> - I was told not to edit directly LDIF config files
>>>> - if i try a slapcat -n0 I get:
>>>> 52d64c91 olcDbDirectory: value #0: invalid path: No such file or 
>>>> directory
>>>> 52d64c91 config error processing olcDatabase={2}hdb,cn=config: 
>>>> olcDbDirectory:
>>>> value #0: invalid path: No such file or directory
>>>> slapcat: bad configuration directory!
>>>>
>>>> I think slapcat should always allow to export a configuration.
>>>
>>> I see the point; slapcat is failing because to export the configuration
>>> (c->op == SLAP_CONFIG_EMIT) it needs to read the configuration first,
>>> and it reads the whole config tree.
>>>
>>> Perhaps when slapcat of only the config database is requested, config
>>> parsing should skip other databases, or at least ignore errors, if 
>>> possible.
>>
>> Agreed, we definitely need this.
>
> But it's not clear that it's entirely feasible without major 
> structural changes to back-config. In particular, later config items 
> may depend on earlier ones succeeding (e.g., loading a module or 
> reading a schema definition). So we can't simply no-op everything 
> while running slapcat, nor can we safely ignore all errors, because we 
> must still be able to parse all of the underlying config LDIF and some 
> of it will be unparseable without appropriate schema being loaded.
In the specific case, the fix is trivial: the user must create the 
folder.  In principle, when a "ignore non-blocking errors" flag is set, 
parsing of olcDbDirectory should not cause a failure.  Such flag would 
only be set for, say, database entries that are not strictly required 
for that slapcat (for any tool operation that does not need such 
database, for example).  However, in this specific case, the user could 
simply find the directory name by manually inspecting the offending LDIF 
file...

p.

-- 
Pierangelo Masarati
Associate Professor
Dipartimento di Scienze e Tecnologie Aerospaziali
Politecnico di Milano

Comment 5 Quanah Gibson-Mount 2021-01-25 17:39:36 UTC
Ondrej to document solution treating as back-ldif.
Comment 7 Quanah Gibson-Mount 2021-03-31 17:04:49 UTC
Commits: 
  • e8c03ba5 
by Ondřej Kuzník at 2021-03-31T16:14:25+00:00 
ITS#7786 Document cn=config recovery options


  • 80cfd811 
by Ondřej Kuzník at 2021-03-31T16:14:25+00:00 
ITS#7786 Try to synthesize missing attribute types
Comment 8 Quanah Gibson-Mount 2021-04-12 20:00:07 UTC
Commits: 
  • c29f0315 
by Ondřej Kuzník at 2021-04-12T16:28:49+00:00 
ITS#7786 Allow parsing of invalid entries when schema checking off