Re: ldapdelete: Invalid DN on an Accesslog generated DN

To: Michael Ströder <michael@stroeder.com>

Subject: Re: ldapdelete: Invalid DN on an Accesslog generated DN

From: Giuseppe Civitella <giuseppe.civitella@gmail.com>

Date: Thu, 17 May 2018 11:43:51 +0200

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=IVySILoypNfhjRVVaU28+nqdGl6Q2Y5VxC0e3tG0N5Y=; b=TsqjQ/3zpixpRWJeWqSxuUkECyLKW1srLlg+neMBJNIu3SY7QYo2dpzhLf1y2nLkfA cG6wNx7QYxHudj0YlduvhAU356ZyCj3YuO1/Tc3wyq5H4izE5hl6d/5Zqcu4NBXUy58Y h/MdMLdmeKhsceu9J+P/vz90pcE8QTU0OJsr3ExQZW485pK+L5i8eY41oQGakj2mUjk0 zAyElBUOeu289h/urx2JB0iTESHGTereJUQkRB0Orc6GLqndOaLskUhCxqb68IQRRa/J YoFJr8gQ4PztFbB/vn5pbV04QWhkQgpr7OKhALkHIc0ToVPAt3CPki5A3z0w7rJWu/EY AKug==

In-reply-to: <778dd46d-8237-a9b0-c822-401013d43d09@stroeder.com>

References: <3042772.EVL4XEmfuI@maya> <778dd46d-8237-a9b0-c822-401013d43d09@stroeder.com>

Ciao, Michael,

Yes, it is a slapcat output and it is filtered: BASEDN is just a replacement.

I had to remove slapo-accesslog because I was unable to login to the server anymore. So properly delete these entries was not an option for me.

This is the origin of the problem.

Thanks,

Giuseppe

2018-05-17 10:57 GMT+02:00 Michael Ströder <michael@stroeder.com>:

Giuseppe Civitella wrote:
> while doing some tests to enable accesslog in my directory, I did enable the
> overlay and then disabled it because of login problems.

I doubt that you had login problems caused by slapo-accesslog.

> Once restored the directory, I found a few entries like this:
>
> dn: reqStart=20180509102412.000000Z,BASEDN
> objectClass: auditModify
> structuralObjectClass: auditModify
> REQSTART: 20180509102412.000000Z
> REQEND: 20180509102412.000001Z
> REQTYPE: modify

Is this slapcat output? Did you obfuscate your e-mail with "BASEDN"?

Note that removing slapo-accesslog also removed the object class and
attribute type descriptions from your subschema. Typically slapcat
outputs names of attribute types missing in subschema all with capital
letters.

> deleting entry "reqStart=20180509102412.000000Z,BASEDN"
> ldap_delete: Invalid DN syntax (34)
> additional info: invalid DN

OpenLDAP server checks schema even for DNs. Hence a DN containing
'reqStart' is an invalid DN if you don't have slapo-accesslog loaded.

Ciao, Michael.