Merge lp:~ahasenack/serverguide/default-backend-is-mdb-1689649 into lp:serverguide/trunk

[Andreas Hasenack]

Change references to HDB with references to MDB, since MDB is the default backend in openldap-server in xenial.

I tried to keep drive-by changes to a minimum here, and open new bugs where bigger changes were needed (like #1689809 for ACLs), but some changes were small enough to make here, mostly in command outputs:
- updated shown content of /etc/ldap/slapd.d
- removed note about bug #1689809 since it's fixed already
- in the example that adds an index, changed the index from "uid" to "mail", since an index for the uid attribute is already created by default when the package is installed
- changed the output of the ldpasearch command that shows the existing indexes, because the slapd package now installs some indexes by default
- when adding the corba schema, changed the output of the commands because we now get a different index number for it

The replication section had a few more changes because of the switch to MDB:
- the apparmor changes and restarts are no longer needed (I tested it)
- the MDB database/backend doesn't require a DB_CONFIG file, so the instructions to copy it over to the accesslog directory were removed

Finally, I changed the indentation of the olcSyncRepl attribute contents to start with two spaces instead of one. It's easier to show why than to explain:

This:
foobar: this is a line
 continuation

If there is no whitespace after the word "line" above, this becomes:
foobar: this is a linecontinuation

It's a very easy and confusing mistake to make when one copies and pastes blocks of text from documentation, because the ending whitespace in the line above doesn't show. The error looks like (missing whitespace just before credentials):
 additional info: Error: parse_syncrepl_line: unable to parse "binddn="cn=admin,dc=example,dc=com"credentials=secret searchbase=dc=example,dc=com"

[Doug Smythies (dsmythies)]

O.K. thanks again.

review: Approve

=== modified file 'serverguide/C/network-auth.xml'
--- serverguide/C/network-auth.xml	2017-05-09 23:10:32 +0000
+++ serverguide/C/network-auth.xml	2017-05-10 14:07:57 +0000
@@ -225,19 +225,19 @@
 <screen>
 <computeroutput>
     /etc/ldap/slapd.d/
+    /etc/ldap/slapd.d/cn=config.ldif
     /etc/ldap/slapd.d/cn=config
-    /etc/ldap/slapd.d/cn=config/cn=module{0}.ldif
     /etc/ldap/slapd.d/cn=config/cn=schema
+    /etc/ldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif
     /etc/ldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif
-    /etc/ldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif
     /etc/ldap/slapd.d/cn=config/cn=schema/cn={2}nis.ldif
     /etc/ldap/slapd.d/cn=config/cn=schema/cn={3}inetorgperson.ldif
-    /etc/ldap/slapd.d/cn=config/cn=schema.ldif
-    /etc/ldap/slapd.d/cn=config/olcBackend={0}hdb.ldif
+    /etc/ldap/slapd.d/cn=config/cn=module{0}.ldif
     /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif
     /etc/ldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif
-    /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif
-    /etc/ldap/slapd.d/cn=config.ldif
+    /etc/ldap/slapd.d/cn=config/olcDatabase={1}mdb.ldif
+    /etc/ldap/slapd.d/cn=config/olcBackend={0}mdb.ldif
+    /etc/ldap/slapd.d/cn=config/cn=schema.ldif
 </computeroutput>
 </screen>
 
@@ -254,12 +254,6 @@
 		This is what the slapd-config DIT looks like via the LDAP protocol:
 		</para>
 
-<caution>
-  <para>
-    On Ubuntu server 14.10, and possibly higher, the following command may not work due to a <ulink url="https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1392018">bug</ulink> 
-  </para>
-</caution>
-
 <screen>
 <command>sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn</command>
 <computeroutput>
@@ -277,13 +271,13 @@
 
 dn: cn={3}inetorgperson,cn=schema,cn=config
 
-dn: olcBackend={0}hdb,cn=config
+dn: olcBackend={0}mdb,cn=config
 
 dn: olcDatabase={-1}frontend,cn=config
 
 dn: olcDatabase={0}config,cn=config
 
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 </computeroutput>
 </screen>
 
@@ -337,7 +331,7 @@
 
 			<listitem>
 			<para>
-			<emphasis>olcBackend={0}hdb,cn=config</emphasis>: the 'hdb' backend storage type
+			<emphasis>olcBackend={0}mdb,cn=config</emphasis>: the 'mdb' backend storage type
 			</para>
 			</listitem>
 
@@ -355,7 +349,7 @@
 
 			<listitem>
 			<para>
-			<emphasis>olcDatabase={1}hdb,cn=config</emphasis>: your database instance (dc=examle,dc=com)
+			<emphasis>olcDatabase={1}mdb,cn=config</emphasis>: your database instance (dc=example,dc=com)
 			</para>
 			</listitem>
 		
@@ -559,14 +553,14 @@
 
 	<listitem>
 	<para>
-	Use <application>ldapmodify</application> to add an "Index" (DbIndex attribute) to your <application>{1}hdb,cn=config</application>
+	Use <application>ldapmodify</application> to add an "Index" (DbIndex attribute) to your <application>{1}mdb,cn=config</application>
 	database (dc=example,dc=com). Create a file, call it <filename>uid_index.ldif</filename>, with the following contents:              
 	</para>
 
 <programlisting>
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 add: olcDbIndex
-olcDbIndex: uid eq,pres,sub
+olcDbIndex: mail eq,sub
 </programlisting>
 
 	<para>
@@ -576,7 +570,7 @@
 <screen>
 <command>sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f uid_index.ldif</command>
 <computeroutput>
-modifying entry "olcDatabase={1}hdb,cn=config"
+modifying entry "olcDatabase={1}mdb,cn=config"
 </computeroutput>
 </screen>
 
@@ -586,11 +580,14 @@
 
 <screen>
 <command>sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \
-cn=config '(olcDatabase={1}hdb)' olcDbIndex</command>
+cn=config '(olcDatabase={1}mdb)' olcDbIndex</command>
 <computeroutput>
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 olcDbIndex: objectClass eq
-olcDbIndex: uid eq,pres,sub
+olcDbIndex: cn,uid eq
+olcDbIndex: uidNumber,gidNumber eq
+olcDbIndex: member,memberUid eq
+olcDbIndex: mail eq,sub
 </computeroutput>
 </screen>
 
@@ -681,7 +678,7 @@
 <screen>
 <command>slapcat -f schema_convert.conf -F ldif_output -n 0 | grep corba,cn=schema</command>
 <computeroutput>
-cn={1}corba,cn=schema,cn=config
+cn={2}corba,cn=schema,cn=config
 </computeroutput>
 </screen>
 
@@ -701,7 +698,7 @@
 
 <screen>
 <command>slapcat -f schema_convert.conf -F ldif_output -n0 -H \
-ldap:///cn={1}corba,cn=schema,cn=config -l cn=corba.ldif</command>
+ldap:///cn={2}corba,cn=schema,cn=config -l cn=corba.ldif</command>
 </screen>
 
 		<para>
@@ -889,7 +886,7 @@
 
 <programlisting>
 # Add indexes to the frontend db.
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 changetype: modify
 add: olcDbIndex
 olcDbIndex: entryCSN eq
@@ -907,10 +904,10 @@
 olcModuleLoad: accesslog
 
 # Accesslog database definitions
-dn: olcDatabase={2}hdb,cn=config
+dn: olcDatabase={2}mdb,cn=config
 objectClass: olcDatabaseConfig
-objectClass: olcHdbConfig
-olcDatabase: {2}hdb
+objectClass: olcMdbConfig
+olcDatabase: {2}mdb
 olcDbDirectory: /var/lib/ldap/accesslog
 olcSuffix: cn=accesslog
 olcRootDN: cn=admin,dc=example,dc=com
@@ -918,7 +915,7 @@
 olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart
 
 # Accesslog db syncprov.
-dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config
+dn: olcOverlay=syncprov,olcDatabase={2}mdb,cn=config
 changetype: add
 objectClass: olcOverlayConfig
 objectClass: olcSyncProvConfig
@@ -927,7 +924,7 @@
 olcSpReloadHint: TRUE
 
 # syncrepl Provider for primary db
-dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config
+dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
 changetype: add
 objectClass: olcOverlayConfig
 objectClass: olcSyncProvConfig
@@ -935,7 +932,7 @@
 olcSpNoPresent: TRUE
 
 # accesslog overlay definitions for primary db
-dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config
+dn: olcOverlay=accesslog,olcDatabase={1}mdb,cn=config
 objectClass: olcOverlayConfig
 objectClass: olcAccessLogConfig
 olcOverlay: accesslog
@@ -953,36 +950,24 @@
         </step>
 
         <step>
-		<para>
-		The <application>apparmor</application> profile for slapd will not need to be adjusted for the 
-		accesslog database location since <filename>/etc/apparmor.d/local/usr.sbin.slapd</filename> contains:
-		</para>
-
-<programlisting>
-/var/lib/ldap/ r,
-/var/lib/ldap/** rwk,
-</programlisting>
-
-		<para>
-		Create a directory, set up a databse config file, and reload the apparmor profile:
+
+		<para>
+		Create a directory:
 		</para>
 
 <screen>
 <command>sudo -u openldap mkdir /var/lib/ldap/accesslog</command>
-<command>sudo -u openldap cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog</command>
-<command>sudo systemctl reload apparmor.service</command>
 </screen>
 
 	</step>
 
 	<step>
 		<para>
-		Add the new content and, due to the apparmor change, restart the daemon:
+		Add the new content:
 		</para>
 
 <screen>
 <command>sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif</command>
-<command>sudo systemctl restart slapd.service</command>
 </screen>
 
 	</step>
@@ -1007,7 +992,7 @@
 	<step>
 		<para>
 		Install the software by going through <xref linkend="openldap-server-installation"/>. Make sure the slapd-config
-		databse is identical to the Provider's. In particular, make sure schemas and the databse suffix are the same.
+		database is identical to the Provider's. In particular, make sure schemas and the databse suffix are the same.
 		</para>
 	</step>
 
@@ -1022,16 +1007,16 @@
 add: olcModuleLoad
 olcModuleLoad: syncprov
 
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 changetype: modify
 add: olcDbIndex
 olcDbIndex: entryUUID eq
 -
 add: olcSyncRepl
-olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple binddn="cn=admin,dc=example,dc=com" 
- credentials=secret searchbase="dc=example,dc=com" logbase="cn=accesslog" 
- logfilter="(&amp;(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on 
- type=refreshAndPersist retry="60 +" syncdata=accesslog
+olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple binddn="cn=admin,dc=example,dc=com"
+  credentials=secret searchbase="dc=example,dc=com" logbase="cn=accesslog"
+  logfilter="(&amp;(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on
+  type=refreshAndPersist retry="60 +" syncdata=accesslog
 -
 add: olcUpdateRef
 olcUpdateRef: ldap://ldap01.example.com
@@ -1148,15 +1133,15 @@
 	To get the effective ACL for an LDAP query we need to look at the ACL entries of the database being queried as well as those of the
 	special frontend database instance. The ACLs belonging to the latter act as defaults in case those of the former do not match. The
 	frontend database is the second to be consulted and the ACL to be applied is the first to match ("first match wins") among these 2
-	ACL sources. The following commands will give, respectively, the ACLs of the hdb database ("dc=example,dc=com") and those of the
+	ACL sources. The following commands will give, respectively, the ACLs of the mdb database ("dc=example,dc=com") and those of the
 	frontend database:
 	</para>
 
 <screen>
 <command>sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \
-cn=config '(olcDatabase={1}hdb)' olcAccess</command>
+cn=config '(olcDatabase={1}mdb)' olcAccess</command>
 <computeroutput>
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous
               auth by dn="cn=admin,dc=example,dc=com" write by * none
 olcAccess: {1}to dn.base="" by * read
@@ -1662,7 +1647,7 @@
 		</para>
 
 <programlisting>
-dn: olcDatabase={1}hdb,cn=config
+dn: olcDatabase={1}mdb,cn=config
 replace: olcSyncRepl
 olcSyncRepl: rid=0 provider=ldap://ldap01.example.com bindmethod=simple
  binddn="cn=admin,dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com"
@@ -3592,11 +3577,11 @@
 <screen>
 <command>sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///</command>
 <computeroutput>
-<userinput>dn: olcDatabase={1}hdb,cn=config
+<userinput>dn: olcDatabase={1}mdb,cn=config
 add: olcDbIndex
 olcDbIndex: krbPrincipalName eq,pres,sub</userinput>
 
-modifying entry "olcDatabase={1}hdb,cn=config"</computeroutput>
+modifying entry "olcDatabase={1}mdb,cn=config"</computeroutput>
 </screen>
       
                 </step>
@@ -3609,7 +3594,7 @@
 <screen>
 <command>sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///</command>
 <computeroutput>
-<userinput>dn: olcDatabase={1}hdb,cn=config
+<userinput>dn: olcDatabase={1}mdb,cn=config
 replace: olcAccess
 olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by
  dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none
@@ -3620,7 +3605,7 @@
 add: olcAccess
 olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read</userinput>
 
-modifying entry "olcDatabase={1}hdb,cn=config"
+modifying entry "olcDatabase={1}mdb,cn=config"
 </computeroutput>
 </screen>