[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: LDAP Crafted Search Request Access Allowed
On Thu, Oct 30, 2014 at 09:54:57AM -0300, Net Warrior wrote:
> >I suspect that you do not want that. It would force every client to
> >have a client-side X.509 certificate. Good for secure authentication,
> >but more effort to manage than most people are prepared to handle.
>
> Is it because of the certificte expiration or something like that tha's hard to
> mantain?
Yes. It is worth considering though, provided you have a well-organised
system for distributing and installing new client-side certificates.
You will also need to make sure that the admin tools you use can work with
client-side certs.
> >That is because you tried to add it to a database but it is a global option.
> I added to the global section cn=config and do not see it.
Odd. If you use ldapadd to do this then it should either work or return an error code.
> >Are you really using the BDB database? It has been deprecated for some time
> now.
> >I would suggest using MDB
>
> Yes my bad, after I went to production, I was told that backend was
> deprecated, is there any doc related to migrate from one backend to another or
> should I reconfigure the whole database from scratch ?
The safest approach is to slapcat each of your databases into LDIF files
then configure new MDB databases and slapadd the data. You will find
that loading MDB with slapadd -q is extremely fast.
Andrew
--
-----------------------------------------------------------------------
| From Andrew Findlay, Skills 1st Ltd |
| Consultant in large-scale systems, networks, and directory services |
| http://www.skills-1st.co.uk/ +44 1628 782565 |
-----------------------------------------------------------------------