RE: structural objectclass checking

To: "Markus.Storm@t-systems.com" <Markus.Storm@t-systems.com>

Subject: RE: structural objectclass checking

From: "Vandenburgh, Steve Y" <Steve.Vandenburgh@centurylink.com>

Date: Wed, 8 Jan 2020 18:45:27 +0000

Accept-language: en-US

Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=centurylink.com; dmarc=pass action=none header.from=centurylink.com; dkim=pass header.d=centurylink.com; arc=none

Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tljnTSJoM7yqSJars6WTMlw+Y1jg6gH06206rJLn8W8=; b=M3d8ccRktf7Q4Oyrh2udkq0UPMCCQk0ahGKOYQ8AJ3X8kgG1ZCc/6311RmJY76sI2AYAINFzH/Gsubey9xD5QaGmVuGK19q7vp6EbK4NzaEzwPw5m90207YcxiK3nPWQXZ13VPYYFoFoXKlAaBHZ3xXl5DxkQ2r+gL+qlpcendqSbfKEmU3vNc8L22S/uy+jaqdmR2It3Qtbi1W0KigTGCO3dNkQ8JXP+wLMXagQB4FeORtNJ0du2cCbt9cHqf3jLj8inc8hksPPd8D1clwiq/uPDwNg29bHneZlnafy27A47GrzGqSkB92CaI08ffCMHlELeF2dU0QdEVfXCC2vRw==

Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=l5wkbUoE4ZIN4YjRrs52WppAU9NcMATYoIueGkAAppA+7prWOdiGqZ1Y4nbwiSr3za3l7tq7mZEjDNMwXr/NQn2E95LrZnsu5D2YAEKkr/fYdjxdAMDTXVBTq6yxZ1xbqXD4gTuAxKHIxwJl5pX5bS7xungIYrMvpFD5ylTtZOPwC8uuuxmwOQwklitPHdQIgr2ihlye2HlVBBrx0M/8vqAwFQ66pfZ6QhkRB0VSVmT39JNcOFu5GFXXiOIwU1BtqpdeOLhPcs5UM8aXmkKhiGbm9V3EmCt3JBJ3KXWFERMEQcJ25vIApPNYh6JCOt/Bk1z5+Uqk/PWfGkA2sVfR8A==

Authentication-results: spf=none (sender IP is ) smtp.mailfrom=Steve.Vandenburgh@centurylink.com;

Cc: "openldap-technical@openldap.org" <openldap-technical@openldap.org>

Content-language: en-US

Dkim-filter: OpenDKIM Filter v2.11.0 lxdnp29m.centurylink.com 008IjYps044289

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/simple; d=centurylink.com; s=default; t=1578509135; bh=IbbPnUVUeohXU+UFj1RtxgkZQN1ICOY18+knNuy0nHg=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=aERdtAQ7kPOPJ6tegT1yjWbcKwpWGK6kW+5+lhSqoEvQAkzXatllNMvPKG6llCTtu sCVuStSky2I04q8u/kt+0OCjYHmzcrj9h7+13TxBHF9TGINhGFEeq2fZIw3dj+u52J bSbTEnivbnRNkV6MaH5N8CP8dUG58PHZl8QM3w2E=

In-reply-to: <LEJPR01MB017032248F597DFB218E2B94D03E0@LEJPR01MB0170.DEUPRD01.PROD.OUTLOOK.DE>

References: <LEJPR01MB017032248F597DFB218E2B94D03E0@LEJPR01MB0170.DEUPRD01.PROD.OUTLOOK.DE>

Thread-index: AdXGNU8z0aQAoYK5RtWOCqVNm+W4AwAHW3mA

Thread-topic: structural objectclass checking

Markus,

You might review the objectclass definitions for your data. There is no issue with multiple STRUCTURAL objectclasses on the same object as long as they are part of the same hierarchy e.g.

dn: uid=user,ou=people,dc=example,dc=com

objectClass: top

objectClass: person

objectClass: organizationalPerson

objectClass: inetOrgPerson

objectClass: customizedObjectClassBasedOnInetOrgPerson

There might also be the opportunity to convert some structural classes to auxiliary.

From: openldap-technical <openldap-technical-bounces@openldap.org> On Behalf Of Markus.Storm@t-systems.com
Sent: Wednesday, January 8, 2020 8:25 AM
To: openldap-technical@openldap.org
Subject: structural objectclass checking

Hi,

is there a way to disable OpenLDAP checking entries for existence of STRUCTURAL objectclasses?

I know it’s illegal per standard to have either no or multiple objectclasses of STRUCTURAL type on an entry.

Unfortunately in the enterprise world it is very common that you have to deal with existing data which is even beyond your control. Our LDAP is full of such ‘bad’ records, making imports into OpenLDAP fail for 50% of our entries.

I’m trying to present OpenLDAP as an alternative to the commercial LDAP software my company is currently running but I need to come up with a solution to this in order to convince our managers and engineering.

Competition such as Oracle Unified Dir have an option to selectively disable this type of checking.

Is there a way to do it in OpenLDAP via config? If no, would it be rather easy or hard to add that to the code myself ? I once made a similar patch but it had to be applied in a single location within the source only.

Thanks

Best regards
Markus

This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

References:

structural objectclass checking
- From: <Markus.Storm@t-systems.com>