"Our attempts to find your SCHEMA for "attributetypes" have FAILED"

[Bruneel Michaël]

Binary package hint: phpldapadmin slapd

After an upgrade from 9.04 Server to 9.10 Server, after login into phpldapadmin (with a normal user and also with the admin user) we got the error message :

"Our attempts to find your SCHEMA for "attributetypes" have FAILED"

Like it is mentioned on the phpldapadmin's FAQ we have to allow anonymous acess to the schemas.

We can do this by :

1. Add the ACL rule in the frontendDB "olcDatabase={-1}frontend,cn=config" :

We can edit the file "olcDatabase={-1}frontend.ldif" located in "/etc/ldap/slapd.d/cn=config" and add the line "olcAccess: {1}to dn.base="cn=subschema" by * read" just after
"olcAccess: {0}to * by dn.exact=cn=localroot,cn=config manage by * break"

2. Restart openldap : "sudo /etc/init.d/slapd restart"

Note that after the upgrade I got the version 2.4.18-0ubuntu1 of OpenLDAP server.

I think it's a bug because :
1. before the upgrade everthing was working fine and
2. we have to manualy add the rule (it's not so easy)

[Mathias Gug (mathiaz)]

Hi,

Thanks for taking the time to report a bug and help making Ubuntu better.

On Sun, Nov 29, 2009 at 03:13:23AM -0000, Launchpad Bug Tracker wrote:
>
> After an upgrade from 9.04 Server to 9.10 Server, after login into
> phpldapadmin (with a normal user and also with the admin user) we got
> the error message :
>
> "Our attempts to find your SCHEMA for "attributetypes" have FAILED"
>
> Like it is mentioned on the phpldapadmin's FAQ we have to allow
> anonymous acess to the schemas.
>
[...]
> Note that after the upgrade I got the version 2.4.18-0ubuntu1 of
> OpenLDAP server.
>

Could you try to compare the ACL configuration between 9.04 and 9.10 and figure
out what has changed during the upgrade?

  status incomplete
  importance low

--
Mathias Gug
Ubuntu Developer http://www.ubuntu.com

[Anton Kudris (kudris)]

this is really nasty bug. I've spent hours after upgrading my server to Karmic and finding that phpldapadmin is broken.
The solution in description works just well for me. Thanks a lot!

[Akom (akomakom)]

I've spent 4 weeks (on and off) before I found this solution/bug. Thank you!
Even granting write to * system-wide did not fix the issue.

[PiersHarding (piersharding)]

I'd like to add my thanks for this too - it caused me no end of grief.

Cheers,
Piers Harding.

[Quanah Gibson-Mount (mishikal)]

This is *not* a low priority bug. The ability to read the cn=subschema entry is critical to all applications that need to retrieve schema data from the LDAP server. The first two ACL's for an LDAP server should pretty much always be:

olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to dn.base="cn=subschema" by * read

The first so that access to the controls available, etc, is there, and the second so that access to the cn=subschema entry is available.

These access issues both broken with Ubuntu, and very serious.

--Quanah