From ef7b6215bdceb448fcce578391e3591328dd7d7b Mon Sep 17 00:00:00 2001 From: William Mantly Date: Sat, 11 Jul 2026 21:41:27 -0400 Subject: [PATCH] Load the theta42 (dateOfBirth) schema in the all-in-one image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The app (nodejs/models/user_ldap.js) adds objectClass theta42Person whenever a user has a dateOfBirth, and lists it among every new user's objectClasses. But the all-in-one image's static slapd.conf only included core/cosine/inetorgperson/ nis — never the project's own theta42 schema — so slapd rejects objectClass: theta42Person with LDAP 0x15 (objectClass: value #0 invalid per syntax). Symptom: PUT /api/user/ (and user creation) failing. ops/ldap-setup.sh loads this schema for bare-metal (as a cn=config LDIF); the Docker image uses slapd.conf, so ship it as a .schema file and include it. - ops/schema/theta42.schema: dateOfBirth attribute + theta42Person auxiliary objectClass (same OIDs/definition as ldap-setup.sh section 5). - Dockerfile.openldap: COPY it to /etc/openldap/schema/theta42.schema. - docker-entrypoint.sh: include it in the generated slapd.conf (after nis). Co-Authored-By: Claude --- Dockerfile.openldap | 7 +++++++ docker-entrypoint.sh | 1 + ops/schema/theta42.schema | 23 +++++++++++++++++++++++ 3 files changed, 31 insertions(+) create mode 100644 ops/schema/theta42.schema diff --git a/Dockerfile.openldap b/Dockerfile.openldap index 4268153..fddd1c7 100644 --- a/Dockerfile.openldap +++ b/Dockerfile.openldap @@ -68,6 +68,13 @@ COPY tos.md /tos.md COPY docker-entrypoint.sh /usr/local/bin/ RUN chmod +x /usr/local/bin/docker-entrypoint.sh +# theta42 custom schema (dateOfBirth + theta42Person). The app adds +# objectClass theta42Person when a user has a dateOfBirth, so the directory +# must know it or user create/update fails with LDAP 0x15. Mirrors the +# cn=config LDIF ops/ldap-setup.sh loads on bare metal, in .schema form so +# docker-entrypoint.sh can `include` it in the static slapd.conf. +COPY ops/schema/theta42.schema /etc/openldap/schema/theta42.schema + # Expose ports # 3001: SSO Manager web interface (HTTP — terminate TLS at the front proxy) # 389: LDAP (plain + StartTLS) — used internally by the app; map to host only diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index e898f90..514cf47 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -78,6 +78,7 @@ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema +include /etc/openldap/schema/theta42.schema # Module loading (pw-sha2 provides {SSHA512} used by the app for user passwords; # ppolicy/memberof/refint are the overlays the app depends on). On OpenLDAP 2.5+ diff --git a/ops/schema/theta42.schema b/ops/schema/theta42.schema new file mode 100644 index 0000000..5be03b8 --- /dev/null +++ b/ops/schema/theta42.schema @@ -0,0 +1,23 @@ +# theta42 custom schema — dateOfBirth (ISO 8601 YYYY-MM-DD) + the theta42Person +# auxiliary objectClass that carries it. +# +# This mirrors the cn=config LDIF that ops/ldap-setup.sh section 5 loads on +# bare-metal deployments, in slapd.conf .schema form so the all-in-one Docker +# image (which uses a static slapd.conf) can `include` it. The app +# (nodejs/models/user_ldap.js) adds objectClass theta42Person when a user has a +# dateOfBirth, so the directory must know this objectClass or user +# create/update fails with LDAP 0x15 (objectClass: value invalid per syntax). + +attributetype ( 1.3.6.1.4.1.99999.1.1 + NAME 'dateOfBirth' + DESC 'Date of birth in ISO 8601 format YYYY-MM-DD' + EQUALITY caseExactMatch + SUBSTR caseExactSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 + SINGLE-VALUE ) + +objectclass ( 1.3.6.1.4.1.99999.2.1 + NAME 'theta42Person' + DESC 'Theta42 SSO extended person attributes' + AUXILIARY + MAY ( dateOfBirth ) ) \ No newline at end of file