RE: Adding attributes to cn=config

[Jon C Kidder <jckidder@aep.com>]

Quanah's point is that changetype: add is for adding new objects.  I'm assuming cn=config already exists.  You need to be using changetype: modify to modify or add attributes to an existing object.  You need to use the add: operation before each new attribute you're adding.  You also need to include a dash on a line by itself between operations on the same record. The object class error is being generated because DN and changetype must be the first 2 elements of a change record.  Objectclass must come after changetype.  If you are modifying the existing cn=config record then you don't even need to include objectclass.

Here is a partially  modified sample of your original ldif that should work using ldapmodify

dn: cn=config
changetype: modify
add: olcTLSCipherSuite
olcTLSCipherSuite: HIGH:MEDIUM+TLSv1+SSLv3
-
add: olcTLSCertificateFile 
olcTLSCertificateFile: /usr/local/openldap/etc/openldap/CA/cacert.pem

-Jon C. Kidder
American Electric Power
Middleware Services
Email: jckidder@aep.com
Phone: 614-716-4970

-----Original Message-----
From: openldap-technical-bounces@OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, John - 0442 - MITLL
Sent: Tuesday, January 21, 2014 1:39 PM
To: openldap-technical@openldap.org
Subject: RE: Adding attributes to cn=config

 This is an EXTERNAL email. STOP. THINK before you CLICK links or OPEN attachments.

**********************************************************************
I tried both ldapmodify and ldapadd (with a couple of different ldifs).  I was trying to "add" an attribute(s) (olcTLSCertificateFile; olcCipherSuite & olcCertificateKeyFile) to the cn=config.  No matter what I tried to do, it either returned the error indicated on the original email or it killed the slapd daemon.

In the past, yes I know it is not the correct way, I had to stop slapd change into the cn=config directory and manually enter what I wanted.  Then restart.  


-----Original Message-----
From: openldap-technical-bounces@OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Quanah Gibson-Mount
Sent: Tuesday, January 21, 2014 12:14 PM
To: Borresen, John - 0442 - MITLL; openldap-technical@openldap.org
Subject: Re: Adding attributes to cn=config

--On Tuesday, January 21, 2014 11:38 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen@ll.mit.edu> wrote:

>
>
> Ok,
>
>
>
> Trying to add the following:
>
>
>
> objectClass: olcGlobal à this is the objectClass on another server 
> that has SSL already set up.
>
> dn: cn=config
>
> changetype: add


Why are you doing an "add" operation on an entry that already exists?

--Quanah




--

Quanah Gibson-Mount
Architect - Server
Zimbra, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration