Merge lp:~ahasenack/serverguide/use-sasl-external-for-config-changes-973981 into lp:serverguide

[Andreas Hasenack]

Use SASL EXTERNAL when dealing with the cn=config backend instead of simple bind.

When dealing with the cn=config backend, one must use the SASL EXTERNAL mechanism via the ldapi:/// socket because of a very specific ACL that the Ubuntu slapd package installs:
dn: olcDatabase={0}config,cn=config
(...)
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break

$ sudo ldapwhoami -Q -Y EXTERNAL -H ldapi:///
dn:gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

Without sudo:
$ ldapwhoami -Q -Y EXTERNAL -H ldapi:///
dn:gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth

This branch changes the few places where I found attempts to read/modify the cn=config backend via the simple bind mechanism (-x), as reported in the linked bug.

There are more changes needed for the given commands to fully work, though. For example, the hdb backend is no longer used in xenial, having been replaced with mdb. But let's fix one thing at a time.

[Doug Smythies (dsmythies)]

Looks good, thanks.

I'll have to take your word for it for the actual content changes, as I don't know.

review: Approve

[Peter Matulis (petermatulis)]

Thanks Andreas. LGTM.

=== modified file 'serverguide/C/network-auth.xml'
--- serverguide/C/network-auth.xml	2016-09-29 17:42:38 +0000
+++ serverguide/C/network-auth.xml	2017-05-09 14:25:36 +0000
@@ -3577,7 +3577,7 @@
                   </para>
 
 <screen>
-<command>ldapadd -x -D cn=admin,cn=config -W -f /tmp/cn\=kerberos.ldif</command>
+<command>sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /tmp/cn\=kerberos.ldif</command>
 </screen>
 
                 </step>
@@ -3588,8 +3588,8 @@
                   </para>
 
 <screen>
-<command>ldapmodify -x -D cn=admin,cn=config -W</command>
-<computeroutput>Enter LDAP Password:
+<command>sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///</command>
+<computeroutput>
 <userinput>dn: olcDatabase={1}hdb,cn=config
 add: olcDbIndex
 olcDbIndex: krbPrincipalName eq,pres,sub</userinput>
@@ -3605,8 +3605,8 @@
                   </para>
 
 <screen>
-<command>ldapmodify -x -D cn=admin,cn=config -W</command>
-<computeroutput>Enter LDAP Password: 
+<command>sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///</command>
+<computeroutput>
 <userinput>dn: olcDatabase={1}hdb,cn=config
 replace: olcAccess
 olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by