You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Brian Burch <br...@pingtoo.com> on 2019/11/06 09:36:36 UTC
ApacheDS 2.0.0-M23 non-gui adding a partition
Emmanuel helped me a lot when I added the new section to the wiki more
than 2 years ago. The users mailing list thread carried the subject
"ApacheDS 2.0.0-M23 non-gui adding a partition".
I am slowly working my way through migration of my ubuntu 16.04 LTS i386
apacheds M23 production system to an ubuntu 18.04 LTS amd64 AM25
platform. I won't bore you with my war stories, but I intend to reflect
some of my lessons learnt in the wiki.
I've had a painful and frustrating time trying to follow my own
instructions in the wiki! Eventually, I realised my M23 partition was
working fine /even though/ its ads-contextentry value has always been
completely wrong! I haven't investigated how this might have happened,
but I want to be sure the new partition I create on my AM25 system is
correct.
I have created a series of scripts and crib sheets to document clearly
how the ads-contextentry base64 hash has been generated for the example
partition. However, I now realise I am not 100% clear how to create a
valid base64 for my own partition.
By carefully hashing 4 specific lines of the example root entry I can
generate the correct hash. These lines are:
dn: dc=example,dc=com
dc: example
objectclass: domain
objectclass: top
The dn value corresponds to the ads-partitionsuffix attribute. The dc
value corresponds to the ads-partitionid attribute.
The objectclass value of top is required in all ldapobjects, but I don't
see where the "objectclass: domain" comes from, or even why it is
specified before top, because their respective orders will alter the
value of the base64 hash.
Also, I am puzzled about what ldapattributes I need to hash for my own
partition. It's top-level ldapentry follows the "old school" convention,
and I am very reluctant to change it because there are so many
dependencies within the directory, but also the various applications
which rely on the directory.
The top entry looks like this:
dn: O=PingToo.com
objectclass: top
objectclass: organization
o: PingToo.com
Obviously, the order of these attributes and also the exact use of
letter case (and any white space ) will alter the resultant
ads-contextentry hash.
Can anyone offer me some advice on how and why to do this correctly, please?
Once I have successfully created my new partition I hope to understand
the algorithm properly and will update the wiki page to explain the
process more clearly.
Regards,
Brian
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Emmanuel Lécharny <el...@gmail.com>.
On 14/11/2019 09:35, Brian Burch wrote:
>
> p.s. you never answered me about the blogger - was/is it you?
No.
My blog (which is somehow dormant) is on hrabal.blogspot.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Brian Burch <br...@pingtoo.com>.
On 13/11/19 7:19 pm, Emmanuel Lécharny wrote:
>
> On 13/11/2019 09:26, Brian Burch wrote:
>> On 7/11/19 6:35 pm, Emmanuel Lécharny wrote:
>>> Hi Brian,
>>
>> Hi yet again Emmanuel!
>>
>> I'm really up the creek without a paddle (does that have a French
>> equivalent? I'm sure you will understand!)
>
> https://www.urbandictionary.com/define.php?term=up%20a%20creek%20without%20a%20paddle
>
>
>
> In french : "A poil dans la pampa" (aka "naked in the desert")
>
>
>>
>> I won't give you too much painful history because I hope to make sense
>> of my re-testing once I understand what is going on.
>>
>> Basically, I generated a case-sensitive ads-partition definition,
>> along with the appropriate ads-contextentry. When I tried ldapmodify
>> (add) for the new entry, it was rejected because one of its attributes
>> was required to be all-lower-case. (After all, dn's are
>> case-insensitive and so my legacy choice of case should be just "eye
>> candy")
>
>
> DN aren't case insensitive ! A DN depends on each RDN it contains, and
> each RDN may use a case sensitive AttributeType.
>
>
>>
>> Next, after deciding to KISS, I re-generated an all-lowercase version,
>> but that failed and crashed the AM25 server! It would not restart and
>> still won't at this moment. The error message says there is a missing
>> index entry, but I innocently assumed I would be able to add those
>> later...
>>
>> I am wondering whether it is actually worth fighting any more.
>> However, I now have a dead server BUT a lot of external mods I don't
>> want to recreate (systemd definitions and dependencies not part of the
>> deb's init.d script setup).
>>
>> If I could successfully get back to a vanilla server which is
>> currently stopped (the deb starts it during installation!), I could
>> re-run my setup jobs repeatedly until I have something meaningful to
>> document.
>>
>> I found this interesting blog post (was it you?):-
>>
>> http://frenchhack.blogspot.com/2016/02/remove-partition-on-apacheds.html
>
>
> What you can do is to start a fresh server, and add the partition into it.
>
> OTOH, it's all about getting rid of the directories under the
> partitions/XXX directory (see
> http://directory.apache.org/apacheds/advanced-ug/2.2-instance-layout.html).
> If the configuration is correct, those partitions will be recreated at
> startup.
>
>>
>> I immediately realised this "solution" assumed one was using Studio to
>> delete the partition, but (of course) it would not work for me unless
>> I can start the server!!! (Catch 22)
>>
>> I had some problems building the AM25 from source, so I was lazy in
>> using the deb. Therefore, I have just unpacked the deb offline and
>> looked at its contents. /var/lib/apacheds-2.0.0.AM25/default/ has an
>> unmigrated config.ldif file and an empty partitions directory, which
>> looks like a good starting place to me!
>>
>> Do you think I can just replace the whole of
>> /var/lib/apacheds-2.0.0.AM25/default/ to get back to an initial
>> configuration?
> Yes.
>>
>> If yes, then I can go around my testing loop quickly, changing one
>> thing at a time, and arrive at a partition which works for me.
>>
>> Also, it would be useful to put a "wipe and restart" procedure on the
>> wiki for others in the same catch 22 situation...
>
>
> That's a good suggestion. Could you create a JIRA under
> https://issues.apache.org/jira/projects/DIR for that ?
Just a quick note to let you know the re-deployment of the /var/lib
directory tree, followed by hacking the example entries in config.ldif
worked perfectly.
I will try to find time to create the JIRA and send another more
detailed email tomorrow. Of course. I'll be delighted to add the "trick"
to the wiki soon.
Thanks for your help,
Brian
p.s. you never answered me about the blogger - was/is it you?
> Thanks !
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Emmanuel Lécharny <el...@gmail.com>.
On 13/11/2019 09:26, Brian Burch wrote:
> On 7/11/19 6:35 pm, Emmanuel Lécharny wrote:
>> Hi Brian,
>
> Hi yet again Emmanuel!
>
> I'm really up the creek without a paddle (does that have a French
> equivalent? I'm sure you will understand!)
https://www.urbandictionary.com/define.php?term=up%20a%20creek%20without%20a%20paddle
In french : "A poil dans la pampa" (aka "naked in the desert")
>
> I won't give you too much painful history because I hope to make sense
> of my re-testing once I understand what is going on.
>
> Basically, I generated a case-sensitive ads-partition definition,
> along with the appropriate ads-contextentry. When I tried ldapmodify
> (add) for the new entry, it was rejected because one of its attributes
> was required to be all-lower-case. (After all, dn's are
> case-insensitive and so my legacy choice of case should be just "eye
> candy")
DN aren't case insensitive ! A DN depends on each RDN it contains, and
each RDN may use a case sensitive AttributeType.
>
> Next, after deciding to KISS, I re-generated an all-lowercase version,
> but that failed and crashed the AM25 server! It would not restart and
> still won't at this moment. The error message says there is a missing
> index entry, but I innocently assumed I would be able to add those
> later...
>
> I am wondering whether it is actually worth fighting any more.
> However, I now have a dead server BUT a lot of external mods I don't
> want to recreate (systemd definitions and dependencies not part of the
> deb's init.d script setup).
>
> If I could successfully get back to a vanilla server which is
> currently stopped (the deb starts it during installation!), I could
> re-run my setup jobs repeatedly until I have something meaningful to
> document.
>
> I found this interesting blog post (was it you?):-
>
> http://frenchhack.blogspot.com/2016/02/remove-partition-on-apacheds.html
What you can do is to start a fresh server, and add the partition into it.
OTOH, it's all about getting rid of the directories under the
partitions/XXX directory (see
http://directory.apache.org/apacheds/advanced-ug/2.2-instance-layout.html).
If the configuration is correct, those partitions will be recreated at
startup.
>
> I immediately realised this "solution" assumed one was using Studio to
> delete the partition, but (of course) it would not work for me unless
> I can start the server!!! (Catch 22)
>
> I had some problems building the AM25 from source, so I was lazy in
> using the deb. Therefore, I have just unpacked the deb offline and
> looked at its contents. /var/lib/apacheds-2.0.0.AM25/default/ has an
> unmigrated config.ldif file and an empty partitions directory, which
> looks like a good starting place to me!
>
> Do you think I can just replace the whole of
> /var/lib/apacheds-2.0.0.AM25/default/ to get back to an initial
> configuration?
Yes.
>
> If yes, then I can go around my testing loop quickly, changing one
> thing at a time, and arrive at a partition which works for me.
>
> Also, it would be useful to put a "wipe and restart" procedure on the
> wiki for others in the same catch 22 situation...
That's a good suggestion. Could you create a JIRA under
https://issues.apache.org/jira/projects/DIR for that ?
Thanks !
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Brian Burch <br...@pingtoo.com>.
On 7/11/19 6:35 pm, Emmanuel Lécharny wrote:
> Hi Brian,
Hi yet again Emmanuel!
I'm really up the creek without a paddle (does that have a French
equivalent? I'm sure you will understand!)
I won't give you too much painful history because I hope to make sense
of my re-testing once I understand what is going on.
Basically, I generated a case-sensitive ads-partition definition, along
with the appropriate ads-contextentry. When I tried ldapmodify (add) for
the new entry, it was rejected because one of its attributes was
required to be all-lower-case. (After all, dn's are case-insensitive and
so my legacy choice of case should be just "eye candy")
Next, after deciding to KISS, I re-generated an all-lowercase version,
but that failed and crashed the AM25 server! It would not restart and
still won't at this moment. The error message says there is a missing
index entry, but I innocently assumed I would be able to add those later...
I am wondering whether it is actually worth fighting any more. However,
I now have a dead server BUT a lot of external mods I don't want to
recreate (systemd definitions and dependencies not part of the deb's
init.d script setup).
If I could successfully get back to a vanilla server which is currently
stopped (the deb starts it during installation!), I could re-run my
setup jobs repeatedly until I have something meaningful to document.
I found this interesting blog post (was it you?):-
http://frenchhack.blogspot.com/2016/02/remove-partition-on-apacheds.html
I immediately realised this "solution" assumed one was using Studio to
delete the partition, but (of course) it would not work for me unless I
can start the server!!! (Catch 22)
I had some problems building the AM25 from source, so I was lazy in
using the deb. Therefore, I have just unpacked the deb offline and
looked at its contents. /var/lib/apacheds-2.0.0.AM25/default/ has an
unmigrated config.ldif file and an empty partitions directory, which
looks like a good starting place to me!
Do you think I can just replace the whole of
/var/lib/apacheds-2.0.0.AM25/default/ to get back to an initial
configuration?
If yes, then I can go around my testing loop quickly, changing one thing
at a time, and arrive at a partition which works for me.
Also, it would be useful to put a "wipe and restart" procedure on the
wiki for others in the same catch 22 situation...
TIA,
Brian
> On 07/11/2019 06:01, Brian Burch wrote:
>> On 6/11/19 8:03 pm, Emmanuel Lécharny wrote:
>>> Hi Brian,
>>
>> Hi Emmanuel. I thought you would be too busy for more than a one-line
>> response. It's really nice to know my question interested you
>> sufficiently to be a bit chatty. Please forgive me for taking this
>> opportunity to continue the discussion...
>>
>>> just FTR, the ads-contextentry configuration element contains the
>>> partition context entry (doh !) :
>>
>> Yes, I thought you realised I knew that from the way I framed my
>> question.
> Sure I did. The 'doh' was just me sounding like 'doctor obvious'.
>>
>>> ads-contextentry::
>>> ZG46IGRjPWV4YW1wbGUsZGM9Y29tCmRjOiBleGFtcGxlCm9iamVjdGNsY
>>> XNzOiBkb21haW4Kb2JqZWN0Y2xhc3M6IHRvcAoK
>>>
>>> translates to :
>>>
>>> dn: dc=example,dc=com
>>> dc: example
>>> objectclass: domain
>>> objectclass: top
>>>
>>> when you decode the base64 value.
>>
>> My cribs work the example partition hash backwards, forwards, via
>> strings and files, just to prove I am deeply paranoid!
>
>
> Just to be clear: base64 is not a hash, it's a 6 bits encoding of a 8
> bits byte array. That makes the string acceptable by limiting the used
> characters to [a-zA-Z0-9+/=], which is 26 + 26 + 10 + 2 ascii chars. '='
> is used as a padding.
>
>
> So the deal here is really to *convert* the contextEntry LDIF to a
> single line of base64 encoded String that can be injected in the LDIF
> configuration file. Just wanted to be clear for the users list members.
>
>
>>
>>> Note that regardless of the change, the server will accept both
>>> entries and will work fine.
>>
>> I had not realised that!
>>
>> I was obsessed with matching the auto-generated hash, rather than
>> making any "grand circuit" of possible failure conditions.
>>
>> Without having time to dig into the code, I'm somewhat intrigued by
>> your comment. I guess it de-hashes the four elements and then compares
>> them separately in order of occurrence. (Maybe a StringTokenizer with
>> NL tokens fed into a small hash table?)
>
>
> Actually, we use a LDIF reader to process the decoded base64 value. So
> the process is :
>
> configurationReader : read the ads-contextentry value (ZG46IGRjPWV...)
>
> - decode the value into a string ("ZG46IGRjPWV..." -> "dn:
> dc=example,dc..." )
>
> - parse the decoded value
>
> - add it in the server if it's nor already present.
>
>
> The LDIF parser accepts pretty much anything that is LDIF compliant, and
> there are a few constraints :
>
> - the DN always has to come first
>
> - all the following attributes are considered as a set of
> <attributeType, value>, there is no order requirement. You can have
> something like :
>
> dn: dc=example,dc=com
> objectclass: domain
> dc: example
> objectclass: top
>
> it will be accepted and processed the exact same way as
>
> dn: dc=example,dc=com
> dc: example
> objectclass: domain
> objectclass: top
>
> Internally, we do lookups on the attributes ("fetch the 'objectClass'
> attribute's values" -> 'top', 'domain' ) because those attributes are
> stored in a java Map.
>
>
>>> Now, if you want to generate the proper Base64 encoding from a LDIF
>>> entry, I suggest you use a tool like https://www.base64encode.org/,
>>> where you can copy/paste the entry and encode it (be aware that
>>> spaces or NL at the end of the file will also be translated). You
>>> will then just have to copy/paste the result into the
>>> ads-contextentry attribute.
>>
>> I hit issues with base64 because it is limited to a length of 64 byes
>> and this messed up the output hashes.
>>
>> I switched to openssl with the -A parameter, which happily encodes
>> longer strings. It works fine (and is available to windoze users), so
>> I prefer to stick with it.
>
> That's fine. Whatever works.
>
>
>>
>>> The reason we store the entry base 64 encoded is because it will
>>> contain NL, and that will not fit well with the containing LDIF file.
>>> For instance, using that :
>>>
>>> ads-contextentry: dn: dc=example,dc=com
>>> dc: example
>>> objectclass: top
>>> objectclass: domain
>>>
>>> will simply not work, as the configuration reader will not be able to
>>> understand what these "dc" and "ObjectClass" lines are good for...
>>>
>>> I hope I clarified this part of the configuration...
>>
>> I sort-of understand what you mean, but probably have enough other
>> headaches to let that issue slip slightly hazily past me!
>>
>> HOWEVER...
>>
>> I /still/ don't know which elements of my "old school" directory root
>> need to be hashed to generate an acceptable ads-contextentry value!
>
> The top level entry is the one to encode (not hash).
>
>
>
>>
>>> On 06/11/2019 10:36, Brian Burch wrote:
>>>> Emmanuel helped me a lot when I added the new section to the wiki
>>>> more than 2 years ago. The users mailing list thread carried the
>>>> subject "ApacheDS 2.0.0-M23 non-gui adding a partition".
>>
>> <snip/>
>>
>>>> The top entry looks like this:
>>>>
>>>> dn: O=PingToo.com
>>>> objectclass: top
>>>> objectclass: organization
>>>> o: PingToo.com
>>>>
>>>> Obviously, the order of these attributes and also the exact use of
>>>> letter case (and any white space ) will alter the resultant
>>>> ads-contextentry hash.
>>
>> Q1: I guess I can use the dn and objectclass top lines as-is.
>
> DN first. Otherwise, everything the comes after, at your convenience. We
> usually put the ObjectClass first like we put java declaration first in
> a class: it's candy to the eye, but irrelevant for the computer - unlike
> in Pascal ! -
>
>
>>
>> Q2: Can I use the o value for my ads-partitionid (I think the answer
>> is yes).
>
> Yes, the answer is yes. But be aware that you need to use an ObjectClass
> that has this 'o' attributeType in its MUST or MAY requirements. The
> 'domain' ObjectClass meets this requirement :
>
> objectclass ( 0.9.2342.19200300.100.4.13 NAME 'domain'
> SUP top
> STRUCTURAL
> MUST dc
> MAY ( associatedName $ o $ description $ businessCategory $ seeAlso
> $ searchGuide $ userPassword $ l $ st $ street $
> physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox
> $ facsimileTelephoneNumber $ internationaliSDNNumber $ telephoneNumber $
> teletexTerminalIdentifier $ telexNumber $ preferredDeliveryMethod $
> destinationIndicator $ registeredAddress $ x121Address ) )
>
> Note that you outgh to add a 'dc' as it's mandatory. Last, not least, if
> you decide to go with a DN like "o=acme, dc=com", then you must have the
> "o: acme" in the list of attributes.
>
> dn: o=acme,dc=com
> objectclass: top
> objectclass: domain
> dc: whatever
> o: acme
>
> works but :
>
> dn: o=acme,dc=com
> objectclass: top
> objectclass: domain
> dc: whatever
>
> will not (missing o: acme). Not will :
>
> dn: o=acme,dc=com
> objectclass: top
> objectclass: domain
> o: acme
>
> because the mandatory ('MUST') 'dc' attribute is missing.
>
>
>
>
>
>>
>> Q3: [Your previous advice implied all 4 lines were required to have
>> the example partition created]. What should I do with my objectclass
>> organization line? Should it be changed to "domain", left as-is, or
>> simply eliminated?
>
>
> So that is a different things. Would you decide to use 'organization'
> objectClass instead of 'domain', then your context entry would have to
> look like :
>
> dn: o=acme,dc=com
> objectclass: top
> objectclass: organization
> o: acme
>
> No 'dc', because the 'Organization' objectClass does not require it :
>
> objectclass ( 2.5.6.4 NAME 'organization'
> DESC 'RFC2256: an organization'
> SUP top
> STRUCTURAL
> MUST o
> MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
> x121Address $ registeredAddress $ destinationIndicator $
> preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
> telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $
> street $ postOfficeBox $ postalCode $ postalAddress $
> physicalDeliveryOfficeName $ st $ l $ description ) )
>
>
> As you can see, an attributeType (like 'o') can be used by many
> ObjectClasses (here, 'domain' and 'organization', but many oithers too -
> 'account', 'i,nterOrgPerson', etc...)
>
>
>>
>> Any enlightenment would be very welcome!
>>
>> Merci d'avance (sorry, that sounds less polite to me than the English
>> "Thanks in anticipation"),
>
> 'Merci d'avance' is perfect. It means exactly what it it is : I need
> assistance, and I thank you for providing some, regardless of the delay
> to do so!
>
>
> That's always a pleasure to have such a nice technical conversation with
> you, Brian. You are a gentleman !
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Emmanuel Lécharny <el...@gmail.com>.
Hi Brian,
On 07/11/2019 06:01, Brian Burch wrote:
> On 6/11/19 8:03 pm, Emmanuel Lécharny wrote:
>> Hi Brian,
>
> Hi Emmanuel. I thought you would be too busy for more than a one-line
> response. It's really nice to know my question interested you
> sufficiently to be a bit chatty. Please forgive me for taking this
> opportunity to continue the discussion...
>
>> just FTR, the ads-contextentry configuration element contains the
>> partition context entry (doh !) :
>
> Yes, I thought you realised I knew that from the way I framed my
> question.
Sure I did. The 'doh' was just me sounding like 'doctor obvious'.
>
>> ads-contextentry::
>> ZG46IGRjPWV4YW1wbGUsZGM9Y29tCmRjOiBleGFtcGxlCm9iamVjdGNsY
>> XNzOiBkb21haW4Kb2JqZWN0Y2xhc3M6IHRvcAoK
>>
>> translates to :
>>
>> dn: dc=example,dc=com
>> dc: example
>> objectclass: domain
>> objectclass: top
>>
>> when you decode the base64 value.
>
> My cribs work the example partition hash backwards, forwards, via
> strings and files, just to prove I am deeply paranoid!
Just to be clear: base64 is not a hash, it's a 6 bits encoding of a 8
bits byte array. That makes the string acceptable by limiting the used
characters to [a-zA-Z0-9+/=], which is 26 + 26 + 10 + 2 ascii chars. '='
is used as a padding.
So the deal here is really to *convert* the contextEntry LDIF to a
single line of base64 encoded String that can be injected in the LDIF
configuration file. Just wanted to be clear for the users list members.
>
>> Note that regardless of the change, the server will accept both
>> entries and will work fine.
>
> I had not realised that!
>
> I was obsessed with matching the auto-generated hash, rather than
> making any "grand circuit" of possible failure conditions.
>
> Without having time to dig into the code, I'm somewhat intrigued by
> your comment. I guess it de-hashes the four elements and then compares
> them separately in order of occurrence. (Maybe a StringTokenizer with
> NL tokens fed into a small hash table?)
Actually, we use a LDIF reader to process the decoded base64 value. So
the process is :
configurationReader : read the ads-contextentry value (ZG46IGRjPWV...)
- decode the value into a string ("ZG46IGRjPWV..." -> "dn:
dc=example,dc..." )
- parse the decoded value
- add it in the server if it's nor already present.
The LDIF parser accepts pretty much anything that is LDIF compliant, and
there are a few constraints :
- the DN always has to come first
- all the following attributes are considered as a set of
<attributeType, value>, there is no order requirement. You can have
something like :
dn: dc=example,dc=com
objectclass: domain
dc: example
objectclass: top
it will be accepted and processed the exact same way as
dn: dc=example,dc=com
dc: example
objectclass: domain
objectclass: top
Internally, we do lookups on the attributes ("fetch the 'objectClass'
attribute's values" -> 'top', 'domain' ) because those attributes are
stored in a java Map.
>> Now, if you want to generate the proper Base64 encoding from a LDIF
>> entry, I suggest you use a tool like https://www.base64encode.org/,
>> where you can copy/paste the entry and encode it (be aware that
>> spaces or NL at the end of the file will also be translated). You
>> will then just have to copy/paste the result into the
>> ads-contextentry attribute.
>
> I hit issues with base64 because it is limited to a length of 64 byes
> and this messed up the output hashes.
>
> I switched to openssl with the -A parameter, which happily encodes
> longer strings. It works fine (and is available to windoze users), so
> I prefer to stick with it.
That's fine. Whatever works.
>
>> The reason we store the entry base 64 encoded is because it will
>> contain NL, and that will not fit well with the containing LDIF file.
>> For instance, using that :
>>
>> ads-contextentry: dn: dc=example,dc=com
>> dc: example
>> objectclass: top
>> objectclass: domain
>>
>> will simply not work, as the configuration reader will not be able to
>> understand what these "dc" and "ObjectClass" lines are good for...
>>
>> I hope I clarified this part of the configuration...
>
> I sort-of understand what you mean, but probably have enough other
> headaches to let that issue slip slightly hazily past me!
>
> HOWEVER...
>
> I /still/ don't know which elements of my "old school" directory root
> need to be hashed to generate an acceptable ads-contextentry value!
The top level entry is the one to encode (not hash).
>
>> On 06/11/2019 10:36, Brian Burch wrote:
>>> Emmanuel helped me a lot when I added the new section to the wiki
>>> more than 2 years ago. The users mailing list thread carried the
>>> subject "ApacheDS 2.0.0-M23 non-gui adding a partition".
>
> <snip/>
>
>>> The top entry looks like this:
>>>
>>> dn: O=PingToo.com
>>> objectclass: top
>>> objectclass: organization
>>> o: PingToo.com
>>>
>>> Obviously, the order of these attributes and also the exact use of
>>> letter case (and any white space ) will alter the resultant
>>> ads-contextentry hash.
>
> Q1: I guess I can use the dn and objectclass top lines as-is.
DN first. Otherwise, everything the comes after, at your convenience. We
usually put the ObjectClass first like we put java declaration first in
a class: it's candy to the eye, but irrelevant for the computer - unlike
in Pascal ! -
>
> Q2: Can I use the o value for my ads-partitionid (I think the answer
> is yes).
Yes, the answer is yes. But be aware that you need to use an ObjectClass
that has this 'o' attributeType in its MUST or MAY requirements. The
'domain' ObjectClass meets this requirement :
objectclass ( 0.9.2342.19200300.100.4.13 NAME 'domain'
SUP top
STRUCTURAL
MUST dc
MAY ( associatedName $ o $ description $ businessCategory $ seeAlso
$ searchGuide $ userPassword $ l $ st $ street $
physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOfficeBox
$ facsimileTelephoneNumber $ internationaliSDNNumber $ telephoneNumber $
teletexTerminalIdentifier $ telexNumber $ preferredDeliveryMethod $
destinationIndicator $ registeredAddress $ x121Address ) )
Note that you outgh to add a 'dc' as it's mandatory. Last, not least, if
you decide to go with a DN like "o=acme, dc=com", then you must have the
"o: acme" in the list of attributes.
dn: o=acme,dc=com
objectclass: top
objectclass: domain
dc: whatever
o: acme
works but :
dn: o=acme,dc=com
objectclass: top
objectclass: domain
dc: whatever
will not (missing o: acme). Not will :
dn: o=acme,dc=com
objectclass: top
objectclass: domain
o: acme
because the mandatory ('MUST') 'dc' attribute is missing.
>
> Q3: [Your previous advice implied all 4 lines were required to have
> the example partition created]. What should I do with my objectclass
> organization line? Should it be changed to "domain", left as-is, or
> simply eliminated?
So that is a different things. Would you decide to use 'organization'
objectClass instead of 'domain', then your context entry would have to
look like :
dn: o=acme,dc=com
objectclass: top
objectclass: organization
o: acme
No 'dc', because the 'Organization' objectClass does not require it :
objectclass ( 2.5.6.4 NAME 'organization'
DESC 'RFC2256: an organization'
SUP top
STRUCTURAL
MUST o
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $
street $ postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ st $ l $ description ) )
As you can see, an attributeType (like 'o') can be used by many
ObjectClasses (here, 'domain' and 'organization', but many oithers too -
'account', 'i,nterOrgPerson', etc...)
>
> Any enlightenment would be very welcome!
>
> Merci d'avance (sorry, that sounds less polite to me than the English
> "Thanks in anticipation"),
'Merci d'avance' is perfect. It means exactly what it it is : I need
assistance, and I thank you for providing some, regardless of the delay
to do so!
That's always a pleasure to have such a nice technical conversation with
you, Brian. You are a gentleman !
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Brian Burch <br...@pingtoo.com>.
On 6/11/19 8:03 pm, Emmanuel Lécharny wrote:
> Hi Brian,
Hi Emmanuel. I thought you would be too busy for more than a one-line
response. It's really nice to know my question interested you
sufficiently to be a bit chatty. Please forgive me for taking this
opportunity to continue the discussion...
> just FTR, the ads-contextentry configuration element contains the
> partition context entry (doh !) :
Yes, I thought you realised I knew that from the way I framed my question.
> ads-contextentry::
> ZG46IGRjPWV4YW1wbGUsZGM9Y29tCmRjOiBleGFtcGxlCm9iamVjdGNsY
> XNzOiBkb21haW4Kb2JqZWN0Y2xhc3M6IHRvcAoK
>
> translates to :
>
> dn: dc=example,dc=com
> dc: example
> objectclass: domain
> objectclass: top
>
> when you decode the base64 value.
My cribs work the example partition hash backwards, forwards, via
strings and files, just to prove I am deeply paranoid!
> Obviously, the base64 is order dependent. Typically, encoding teh same
> entry with a reverted attribute like :
>
> dn: dc=example,dc=com
> dc: example
> objectclass: top
> objectclass: domain
>
> gives this result :
>
>
> ads-contextentry::
> ZG46IGRjPWV4YW1wbGUsZGM9Y29tCmRjOiBleGFtcGxlCm9iamVjdGNsY
> XNzOiB0b3AKb2JqZWN0Y2xhc3M6IGRvbWFpbg==
Been there, done that, got the T-shirt! It's (not really) fun to play
with newline, case and embedded white space... not to mention the
end-of-file marker!
> Note that regardless of the change, the server will accept both entries
> and will work fine.
I had not realised that!
I was obsessed with matching the auto-generated hash, rather than making
any "grand circuit" of possible failure conditions.
Without having time to dig into the code, I'm somewhat intrigued by your
comment. I guess it de-hashes the four elements and then compares them
separately in order of occurrence. (Maybe a StringTokenizer with NL
tokens fed into a small hash table?)
> Now, if you want to generate the proper Base64 encoding from a LDIF
> entry, I suggest you use a tool like https://www.base64encode.org/,
> where you can copy/paste the entry and encode it (be aware that spaces
> or NL at the end of the file will also be translated). You will then
> just have to copy/paste the result into the ads-contextentry attribute.
I hit issues with base64 because it is limited to a length of 64 byes
and this messed up the output hashes.
I switched to openssl with the -A parameter, which happily encodes
longer strings. It works fine (and is available to windoze users), so I
prefer to stick with it.
> The reason we store the entry base 64 encoded is because it will contain
> NL, and that will not fit well with the containing LDIF file. For
> instance, using that :
>
> ads-contextentry: dn: dc=example,dc=com
> dc: example
> objectclass: top
> objectclass: domain
>
> will simply not work, as the configuration reader will not be able to
> understand what these "dc" and "ObjectClass" lines are good for...
>
> I hope I clarified this part of the configuration...
I sort-of understand what you mean, but probably have enough other
headaches to let that issue slip slightly hazily past me!
HOWEVER...
I /still/ don't know which elements of my "old school" directory root
need to be hashed to generate an acceptable ads-contextentry value!
> On 06/11/2019 10:36, Brian Burch wrote:
>> Emmanuel helped me a lot when I added the new section to the wiki more
>> than 2 years ago. The users mailing list thread carried the subject
>> "ApacheDS 2.0.0-M23 non-gui adding a partition".
<snip/>
>> The top entry looks like this:
>>
>> dn: O=PingToo.com
>> objectclass: top
>> objectclass: organization
>> o: PingToo.com
>>
>> Obviously, the order of these attributes and also the exact use of
>> letter case (and any white space ) will alter the resultant
>> ads-contextentry hash.
Q1: I guess I can use the dn and objectclass top lines as-is.
Q2: Can I use the o value for my ads-partitionid (I think the answer is
yes).
Q3: [Your previous advice implied all 4 lines were required to have the
example partition created]. What should I do with my objectclass
organization line? Should it be changed to "domain", left as-is, or
simply eliminated?
Any enlightenment would be very welcome!
Merci d'avance (sorry, that sounds less polite to me than the English
"Thanks in anticipation"),
Brian
>> Once I have successfully created my new partition I hope to understand
>> the algorithm properly and will update the wiki page to explain the
>> process more clearly.
>>
>> Regards,
>>
>> Brian
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
>> For additional commands, e-mail: dev-help@directory.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: ApacheDS 2.0.0-M23 non-gui adding a partition
Posted by Emmanuel Lécharny <el...@gmail.com>.
Hi Brian,
just FTR, the ads-contextentry configuration element contains the
partition context entry (doh !) :
ads-contextentry:: ZG46IGRjPWV4YW1wbGUsZGM9Y29tCmRjOiBleGFtcGxlCm9iamVjdGNsY
XNzOiBkb21haW4Kb2JqZWN0Y2xhc3M6IHRvcAoK
translates to :
dn: dc=example,dc=com
dc: example
objectclass: domain
objectclass: top
when you decode the base64 value.
Obviously, the base64 is order dependent. Typically, encoding teh same
entry with a reverted attribute like :
dn: dc=example,dc=com
dc: example
objectclass: top
objectclass: domain
gives this result :
ads-contextentry:: ZG46IGRjPWV4YW1wbGUsZGM9Y29tCmRjOiBleGFtcGxlCm9iamVjdGNsY
XNzOiB0b3AKb2JqZWN0Y2xhc3M6IGRvbWFpbg==
Note that regardless of the change, the server will accept both entries
and will work fine.
Now, if you want to generate the proper Base64 encoding from a LDIF
entry, I suggest you use a tool like https://www.base64encode.org/,
where you can copy/paste the entry and encode it (be aware that spaces
or NL at the end of the file will also be translated). You will then
just have to copy/paste the result into the ads-contextentry attribute.
The reason we store the entry base 64 encoded is because it will contain
NL, and that will not fit well with the containing LDIF file. For
instance, using that :
ads-contextentry: dn: dc=example,dc=com
dc: example
objectclass: top
objectclass: domain
will simply not work, as the configuration reader will not be able to
understand what these "dc" and "ObjectClass" lines are good for...
I hope I clarified this part of the configuration...
On 06/11/2019 10:36, Brian Burch wrote:
> Emmanuel helped me a lot when I added the new section to the wiki more
> than 2 years ago. The users mailing list thread carried the subject
> "ApacheDS 2.0.0-M23 non-gui adding a partition".
>
> I am slowly working my way through migration of my ubuntu 16.04 LTS
> i386 apacheds M23 production system to an ubuntu 18.04 LTS amd64 AM25
> platform. I won't bore you with my war stories, but I intend to
> reflect some of my lessons learnt in the wiki.
>
> I've had a painful and frustrating time trying to follow my own
> instructions in the wiki! Eventually, I realised my M23 partition was
> working fine /even though/ its ads-contextentry value has always been
> completely wrong! I haven't investigated how this might have happened,
> but I want to be sure the new partition I create on my AM25 system is
> correct.
>
> I have created a series of scripts and crib sheets to document clearly
> how the ads-contextentry base64 hash has been generated for the
> example partition. However, I now realise I am not 100% clear how to
> create a valid base64 for my own partition.
>
> By carefully hashing 4 specific lines of the example root entry I can
> generate the correct hash. These lines are:
>
> dn: dc=example,dc=com
> dc: example
> objectclass: domain
> objectclass: top
>
> The dn value corresponds to the ads-partitionsuffix attribute. The dc
> value corresponds to the ads-partitionid attribute.
>
> The objectclass value of top is required in all ldapobjects, but I
> don't see where the "objectclass: domain" comes from, or even why it
> is specified before top, because their respective orders will alter
> the value of the base64 hash.
>
> Also, I am puzzled about what ldapattributes I need to hash for my own
> partition. It's top-level ldapentry follows the "old school"
> convention, and I am very reluctant to change it because there are so
> many dependencies within the directory, but also the various
> applications which rely on the directory.
>
> The top entry looks like this:
>
> dn: O=PingToo.com
> objectclass: top
> objectclass: organization
> o: PingToo.com
>
> Obviously, the order of these attributes and also the exact use of
> letter case (and any white space ) will alter the resultant
> ads-contextentry hash.
>
> Can anyone offer me some advice on how and why to do this correctly,
> please?
>
> Once I have successfully created my new partition I hope to understand
> the algorithm properly and will update the wiki page to explain the
> process more clearly.
>
> Regards,
>
> Brian
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org