search

amazonlinux / amazon-linux-2023

Amazon Linux 2023
https://aws.amazon.com/linux/amazon-linux-2023/
Other
519 stars 38 forks source link

openldap-servers installation missing cn=module for loading modules #391

Open nelsonwhite opened 1 year ago

nelsonwhite commented 1 year ago

When installing openldap (2.4.57-6), to set up and implement openldap on AL2023, 2023.1.20230705-0, after installing: openldap-clients, openldap-servers, openldap, openldap-devel (all other related dependencies also get installed), it is noted that the cn=module, component is missing under cn=config.

All of the *.la Overlay files are present at /usr/lib64/openldap/, available for installation (I am needing to implement Password Policies (ppolicy.la).) Also, the default Schema does have the required extensions to accommodate cn=module (e.g. - 'olcModuleLoad', 'olcModulePath', etc.). But when doing a basic search after installation: ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config, cn=module is missing. I've tried twice with same results. Just want to make sure I am not missing something.

The openldap.org documentation states (openldap.org/doc/admin26/slapdconf2.html), in describing the basic 'configuration tree' (which shows cn=module{0}, "A set of modules"), "Dynamically loaded modules - These may only be used if the '--enable' modules option was used to configure the software."

Just wondering if the AL2023 openldap-servers, etc. package was built, with including '--enable modules'.

Thanks.

ozbenh commented 1 year ago

I don't know much about openldap, but I did a quick check of our spec file and we do configure it with --enable-modules

nelsonwhite commented 1 year ago

Hello, thanks for confirming, to rule that out.

quanah commented 1 year ago

OpenLDAP 2.4 is historic and should not be used. The comment from @ozbenh is not relevant outside of confirming that module support was built in. The issue you are seeing would generally indicate that the slapd configuration used to bootstrap the openldap config database was incorrectly formed.

I personally build OpenLDAP 2.6 series and run that. Alternatively you may want to build the OpenLDAP 2.5 LTS series. Either way, 2.4.57 should be considered a complete nonstarter.

gjsmith66 commented 1 year ago

Please update to OpenLDAP 2.6. 2.4 is 15 years old....