Fedora directory users - Apr 2008 - defaultsearchbase and empty base dn subtree searches

Hi!

I''m migrating from OpenLDAP to Fedora Directory.

In the OpenLDAP infrastructure, I had used proxy LDAP servers (the 
slapd-ldap backend) to direct requests to slapd-bdb backend OpenLDAP 
instances with failover in case of failure.
In addition to that, using the rwm overlay, the slapd-ldap instance did 
request rewriting of queries that specify empty base dn.

The configuration for slapd-ldap instance was:

database        ldap
suffix          ""
uri           "ldap://localhost:392/,ldaps://otherserver:636/"
timeout 24
idle-timeout 16
overlay rwm
rwm-rewriteEngine on
rwm-rewriteContext searchBase
rwm-rewriteRule   "$" "o=MyDefaultBase" ":"

I''ve read a thread from 2006-02 on this list 
(https://www.redhat.com/archives/fedora-directory-users/2006-February/msg00108.html)
that it''s possible to get a similar behaviour on FDS by modifying
dse.ldif.

I''ve stopped the FDS instance, modified 
/etc/dirsrv/slapd-instancename/dse.ldif and started FDS again:

dn:
objectClass: top
objectClass: extensibleObject
defaultsearchbase: o=MyDefaultBase
aci: (targetattr != "aci")(version 3.0; aci "rootdse anon read
access";
allow(
 read,search,compare) userdn="ldap:///anyone";)
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config
createTimestamp: 20080411165538Z
modifyTimestamp: 20080411165538Z

However, it still doesn''t return anything when clients search with
empty
base:

# /usr/lib64/mozldap/ldapsearch -b ''o=MyDefaultBase'' -s sub
uid=olo uid
version: 1
dn: uid=olo,ou=People,o=MyDefaultBase
uid: olo

# /usr/lib64/mozldap/ldapsearch -b '''' -s sub uid=olo uid
ldap_search: No such object

Maybe it''s relevant that the host in question takes part in
multi-master
replication setup of 3 FDS servers.

-- 
Best Regards,
    Aleksander Adamowski
        GG#: 274614
        ICQ UIN: 19780575 
	http://olo.org.pl

--
Aleksander Adamowski
    Administrator systemów korporacyjnych; Instruktor
    Altkom Akademia S.A. http://www.altkom.pl
    Warszawa, ul. Chłodna 51
    tel. brak
    kom. +48 601-318-080

Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego
Rejestru Sądowego,
KRS: 0000120139, NIP 118-00-08-391, Kapitał zakładowy: 1000 000 PLN.  Adres
rejestrowy Firmy - ul. Stawki 2, 00-193 Warszawa.
Niniejsza wiadomość zawiera informacje zastrzeżone i stanowiące tajemnicę
przedsiębiorstwa firmy Altkom Akademia S.A.
Ujawnianie tych informacji osobom trzecim lub nieuprawnione wykorzystanie ich do
własnych celów jest zabronione.
Jeżeli otrzymaliście Państwo niniejszą wiadomość omyłkowo, prosimy o niezwłoczne
skontaktowanie się z nadawcą oraz usunięcie wszelkich kopii niniejszej
wiadomości.
This message contains proprietary information and trade secrets of Altkom
Akademia S.A. company.
Unauthorized use or disclosure of this information to any third party is
prohibited.
If you received this message by mistake, please contact the sender immediately
and delete all copies of this message.

Aleksander Adamowski wrote:
> Hi!
>
> I''m migrating from OpenLDAP to Fedora Directory.
>
> In the OpenLDAP infrastructure, I had used proxy LDAP servers (the 
> slapd-ldap backend) to direct requests to slapd-bdb backend OpenLDAP 
> instances with failover in case of failure.
> In addition to that, using the rwm overlay, the slapd-ldap instance 
> did request rewriting of queries that specify empty base dn.
>
> The configuration for slapd-ldap instance was:
>
> database        ldap
> suffix          ""
> uri           "ldap://localhost:392/,ldaps://otherserver:636/"
> timeout 24
> idle-timeout 16
> overlay rwm
> rwm-rewriteEngine on
> rwm-rewriteContext searchBase
> rwm-rewriteRule   "$" "o=MyDefaultBase" ":"
>
> I''ve read a thread from 2006-02 on this list 
>
(https://www.redhat.com/archives/fedora-directory-users/2006-February/msg00108.html)
> that it''s possible to get a similar behaviour on FDS by modifying 
> dse.ldif.
>
> I''ve stopped the FDS instance, modified 
> /etc/dirsrv/slapd-instancename/dse.ldif and started FDS again:
>
> dn:
> objectClass: top
> objectClass: extensibleObject
> defaultsearchbase: o=MyDefaultBase
> aci: (targetattr != "aci")(version 3.0; aci "rootdse anon
read
> access"; allow(
> read,search,compare) userdn="ldap:///anyone";)
> creatorsName: cn=server,cn=plugins,cn=config
> modifiersName: cn=server,cn=plugins,cn=config
> createTimestamp: 20080411165538Z
> modifyTimestamp: 20080411165538Z
>
> However, it still doesn''t return anything when clients search with
> empty base:
>
> # /usr/lib64/mozldap/ldapsearch -b ''o=MyDefaultBase'' -s
sub uid=olo uid
> version: 1
> dn: uid=olo,ou=People,o=MyDefaultBase
> uid: olo
>
> # /usr/lib64/mozldap/ldapsearch -b '''' -s sub uid=olo uid
> ldap_search: No such object
>
> Maybe it''s relevant that the host in question takes part in 
> multi-master replication setup of 3 FDS servers.
>
defaultSearchBase is not a server side thing.  It only works if clients 
understand how to use it.  There is no way to make Fedora DS do a 
subtree search from base "" unless you write a C code plugin