Re: Creating extra backend database for sub-sub-suffix

Mark Reynolds <mreynolds@xxxxxxxxxx> · Fri, 28 Aug 2020 08:48:30 -0400

    On 8/28/20 3:51 AM, Jan Tomasek wrote:

      Hi,

I've this directory structure:

dc=example,dc=cz
  + o=apps,dc=example,dc=cz
     + o=TCS2,o=aps,dc=example,dc=cz

I would like store o=TCS2,o=aps,dc=example,dc=cz in it's own database,
to be able create custom indexes only for entries under
o=TCS2,o=aps,dc=example,dc=cz.

When I create it this way:

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "example_cz" --suffix="dc=example,dc=cz"

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "TCS2_apps_example_cz" \
   --suffix="o=TCS2,o=apps,dc=example,dc=cz" \
   --parent-suffix="o=apps,dc=example,dc=cz"

Then I'm unable find o=TCS2 under o=apps,dc=example,dc=cz:

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -b o=apps,dc=example,dc=cz '(o=TCS2)'
Enter LDAP Password:
semik@doma:~$

But it is there:

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -b o=TCS2,o=apps,dc=example,dc=cz '(o=TCS2)'
Enter LDAP Password:
dn: o=TCS2,o=apps,dc=example,dc=cz
objectClass: top
objectClass: organization
o: TCS2

It is very likely because 389DS doesn't understand what I want to do.

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -s base -b '' '(objectClass=*)'
namingContexts nsBackendSuffix
Enter LDAP Password:
dn:
namingContexts: o=TCS2,o=apps,dc=example,dc=cz
namingContexts: dc=example,dc=cz
nsBackendSuffix: example_cz:dc=example,dc=cz
nsBackendSuffix: TCS2_apps_example_cz:o=TCS2,o=apps,dc=example,dc=cz

When I create another database for o=apps,dc=example,dc=cz this way:

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "example_cz" --suffix="dc=example,dc=cz"

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "apps_example_cz" \
   --suffix="o=apps,dc=example,dc=cz" \
   --parent-suffix="dc=example,dc=cz"

dsconf -D "cn=Directory Manager" -w "$pswd" \
   ldap://localhost backend create \
   --be-name "TCS2_apps_example_cz" \
   --suffix="o=TCS2,o=apps,dc=example,dc=cz" \
   --parent-suffix="o=apps,dc=example,dc=cz"

It works:

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -b o=apps,dc=example,dc=cz '(o=TCS2)'
Enter LDAP Password:
dn: o=TCS2,o=apps,dc=example,dc=cz
objectClass: top
objectClass: organization
o: TCS2

semik@doma:~$ ldapsearch -LLL -H ldaps://ldap.example.cz -D
"cn=directory manager" -W -x -s base -b '' '(objectClass=*)'
namingContexts nsBackendSuffix
Enter LDAP Password:
dn:
namingContexts: dc=example,dc=cz
nsBackendSuffix: example_cz:dc=example,dc=cz
nsBackendSuffix: apps_example_cz:o=apps,dc=example,dc=cz
nsBackendSuffix: TCS2_apps_example_cz:o=TCS2,o=apps,dc=example,dc=cz

In first scenario, there are two separate namingContexts
o=TCS2,o=apps,dc=example,dc=cz and dc=example,dc=cz.

I want to get rid of extra apps_example_cz backend database if possible.
Is there a way how to NOT create database for o=apps,dc=example,dc=cz

    I think subsuffixes need to be directly under the parent suffix. 
      Otherwise the server will not find it when searching.  So in your
      first example, you would need to set your search base to
      "o=TCS2,o=apps,dc=example,dc=cz", as it won't find it if the
      search base is "dc=example,dc=cz". 

    You might want to look into chaining(database links) if you don't
      want to create that "filler" subsufix (o=apps):
    https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/configuring_directory_databases-creating_and_maintaining_database_links
    HTH,

      Mark

Thanks

      _______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx

    -- 

389 Directory Server Development Team

_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx