Quite often when one tries to migrate data from a directory server to another, small differences are discovered that prevent a direct and smooth migration. One of the most common issues when migrating from OpenLDAP or other Linux centric directory server to OpenDJ is around the schema for NIS, or the RFC 2307.
Before we dive into the core of the problem, let’s describe the symptoms:
Part of migrating from one directory to another consist of exporting the data to a common textual format, most likely LDIF, and import it in the new server. If you try to import some data in OpenDJ and it rejects entries as invalid with messages like the one just below, then you’ve just hit a schema issue with RFC 2307.
LDAP: error code 65 – Entry cn=MyGroup,ou=groups,dc=example,dc=com violates the Directory Server schema configuration because it does not include a structural objectclass. All entries must contain a structural objectclass
Why a schema issue ?
Well, RFC 2307, “An Approach for Using LDAP as a Network Information Service” was published as an experimental RFC in 1998. As Unix vendors started to use it, they found a few issues which were addressed in an internet draft nicknamed rfc2307bis (the latest version can be found here). Solaris and HP-UX started to use this later schema, while Linux sticked to the official RFC.
One of the main difference between the RFC and the internet draft, is the PosixGroup object class definition that was changed from Structural to Auxiliary, hence the failure to import an entry defined with the RFC 2307 schema into a server supporting the rfc2307bis schema.
So what to do if I want to successfully import my data ?
There are 2 options : Fix the data to be compliant with rfc230bis schema or configure OpenDJ schema to be strictly RFC2307 compliant.
Fixing the data is quite simple, but requires basic knowledge of LDIF.
Since in rfc2307bis the posixGroup is Auxiliary, the entries are missing a Structural object class to be valid. The simplest way to fix that is to add the namedObject Structural object class.
dn: cn=MyGroup,ou=Groups,dc=example,dc=com cn: MyGroup objectClass: top objectClass: posixGroup objectClass: namedObject gidNumber: 1001 description: My Group memberUid: 1 memberUid: 10
Make sure you change all group definition and you can now import the data to OpenDJ.
Linux pam_ldap has full support for RFC2307bis. You just need to update the /etc/pam_ldap.conf file with the following line :
Now, if you prefer to remain strictly compliant with RFC 2307, you need to change the schema of the OpenDJ server. Basically, you just need to stop the server, remove the 04-rfc2307bis.ldif file from the config/schema/ directory (save it in case you need it later) and add in the config/schema/ directory, the 04-rfc2307.ldif file. You can now import the data in OpenDJ.
This 04-rfc2307.ldif file is not part of the current distribution of OpenDJ, but we will add it pretty soon, however not as the default schema.
thanks a lot for this post, it was necessary understanding for modify the smbldap-migrate-unix-groups script in intention to move linux groups.
thanks for this excellent post.
May I ask if you see reason why rfc2307bis was not adopted by IETF as standard, and if you think that this may change in the future ?
rfc2307bis was not published by IETF as an RFC (which is far from being a “Standard”), because the author didn’t have time to pursue it, and the adopters (Sun, HP) didn’t invest in the effort either.
I don’t see anyone willing to move the ideas to the IETF in the future. There is no more LDAP working group at IETF. It could be pushed to RFC by an individual, but it will not attract the masses anyway.
Thanks Ludo, and sorry for the french travel: I thought that my message would have been moderated and kept “off the record”.
To let you know : I also tested on OpenDJ 2.5.0-Xpress1
I will try again next week and will come back here to report.
It seems that this may answer a previously unsolved problem listed in this thread by Peter Major at ForgeRock:
[OpenAM] Structural Objectclass LDAP Error when running Default Configuration
Thanks for putting it out there, time after time.
Is there an updated location to get the 04-rfc2307.ldif file? The link on dropbox seems to be broken.
Is it? It could be due to changes from Dropbox. As far as I can see, the folder and files are still publicly available on Dropbox : https://www.dropbox.com/sh/2yrsfkwo73l6d4j/AAB9eFPmkus0kTIbTgpj_wFKa?dl=0
Thank you I was able to get it from that link.