[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: backend relay with empty suffix

Hallvard B Furuseth wrote:
> Pierangelo Masarati writes:
>> 3) any other request is served by the relay database,
> Hopefully except requests to read entries local to the server:
> - the root DSE: Search with DN "", scope=base
>   (other scopes should go to the relay database),
> - cn=Subschema.

In this case, yes: the local rootDSE and cn=subschema are accessed as
usual; it's the scope == base that allows the frontend to intercept them.

> Is there a way to get the other ldap server's version of these?
> Or this LDAP server's, if the above are not exceptions from (3:-)?

You should configure a proxy like this

database	ldap
suffix		"cn=remote"
uri		"ldap://remote";
overlay		rwm
rwm-suffixmassage	""

so that anything rooted at "cn=remote" is rewritten stripping the
trailing "cn=remote"; requests for

	"cn=remote", scope == base

will return the remote server's rootDSE; requests for

	"cn=subschema,cn=remote", scope == base

will return the remote server's subschema.

Note that in principle custom code could intercept requests for the
local rootDSE and subschema by means of a global overlay, so that such
requests are handled by the overlay before the frontend gets a chance to
handle them.  This is yet another side-effect of global overlays that
should be documented.  For example, slapo-rwm(5), if configured as
global so that it always adds a trailing DN to each request, something like

overlay		rwm
rwm-suffixmassage	"" "dc=extra"

would prevent rootDSE and subschema from being accessed... maybe this
should be documented.


Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it