I am still stuck at the same place where a chained consumer allows a client to
auth with a bad password. Remove chaining and bad passwords are no longer
accepted.
To troubleshoot from scratch, I am curious about how chaining should be
configured in the new ldif-based configuration scheme?
Initially, I created a slapd.conf with the appropriate chaining statements and
converted that file to "slapd.d". The conversion places all the chaining config
under the "frontend" database.
: [0115] r...@ldaps01:olcDatabase={-1}frontend # ; ls -lR
.:
total 8
drwxr-x--- 2 ldap ldap 4096 Jun 24 00:30 olcOverlay={0}chain
-rw------- 1 ldap ldap 433 Jun 22 23:00 olcOverlay={0}chain.ldif
./olcOverlay={0}chain:
total 8
-rw------- 1 ldap ldap 591 Jun 23 23:53 olcDatabase={0}ldap.ldif
-rw------- 1 ldap ldap 893 Jun 24 00:30 olcDatabase={1}ldap.ldif
Interestingly, it creates two "ldap" databases for a single "chain" overlay.
Can someone please explain why/how is this so? Why does chaining go to
"frontend" db instead of being under the database that is chained? I tried to
create the "ldap" databases under a "bdb" database but OpenLDAP won't allow
that.
Thanks,
Siddhartha
