Re: Have you seen this FUD - IT pros suffer OpenLDAP configuration headaches ?

[harry.jede@arcor.de]

Howard Chu wrote:
> harry.jede@arcor.de wrote:
> > #!/bin/sed -rf
> > # Author: Harry Jede
> > # produce human readable but still machine parseable
> > # olcAccess lines and removes the ordering numbers in {}
> > # because humans don't need them, really.
> 
> Nice formatting, but just a note - the ordering prefixes are there to
> allow you to insert new ACLs in the precise spot where they belong.
> So in fact, human or machine, they are necessary. We wouldn't throw
> things in there for no reason.
I know this. The reason why you have created the ordering prefixes is 
that without them the ordering is *not* always the same during multiple 
searches.


> 
> Otherwise, to insert one rule in front of existing rules, you would
> need to delete and reinsert all of the rules.
Dacor.
For documenting, comparing, testing or creating access to new databases 
I found that this is my favorite approach.

And during some support sessions by customers I found that one of the 
common failures during access design, is that customers failed to order 
the "to clause" of access rules. In such cases I retrieve the access 
rules, reorder them with an editor, and upload all at once wih 
ldapmodify. And yes, slapd adds the ordering prefixes in line order of 
the ldif file. Magic and cool.

If I need to modify or add single rules, i still use the script to 
retrieve, but without the olcacces line. Now I can create ldifs for 
ldapmodify with ordering prefix. The "by clauses" are one at a line. 
That's better for my eys.

# cat $(which fmt_olcAccess2)
#!/bin/sed -rf
# Author: Harry Jede
# produce human readable but still machine parseable
# olcAccess lines
# the hole script
$!{H;d}
${H;g;s/\n //g;s/[[:space:]]+by /\n  by /g}

the output is now with prefixes.



-- 

Harry Jede