Product / version: UCS 5.2-7 errata614, DC Master, univention-management-console-module-diagnostic (file: 62_check_slapschema.py)
Description
The UMC “System diagnostic” module reports this warning:
Validating the LDAP configuration and schema files.
The LDAP schema validation failed with the following errors or warnings:
The first database does not allow slapschema; using the first available one (2)
The LDAP schema is valid. Running slapschema manually with the correct base returns no output and exit code 0:
# slapschema -f /etc/ldap/slapd.conf -b "$(ucr get ldap/base)"
# echo $?
0
slapd is running, and univention-ldapsearch -s base dn returns dc=ccm,dc=local with result: 0 Success.
Cause
Verified on the affected host:
- Root cause: any stderr output raises a Warning. The plugin ignores the exit code and raises Warning if stderr is non-empty. In slapd.conf, database config is the first database. slapschema called without -b/-n therefore always prints the following to stderr, even though the schema is valid and the exit code is 0:
The first database does not allow slapschema; using the first available one (2)
Running the plugin’s command from Python gives the same stderr whether or not shell=True is used.
2. Secondary bug: Popen with a list and shell=True. Only the first list element is executed as the command. Test on the host:
Popen([‘/bin/echo’, ‘-f’, ‘/etc/ldap/slapd.conf’], shell=True) → ‘\n’
Popen([‘/bin/echo’, ‘-f’, ‘/etc/ldap/slapd.conf’]) → ‘-f /etc/ldap/slapd.conf\n’
So -f /etc/ldap/slapd.conf is never passed to slapschema. This does not cause the warning above, but the argument list is not honoured.
Suggested fix !?
- Check process.returncode instead of the presence of stderr output.
- Pass -b with the value of ldap/base (or -n with the right database number) so the informational message is not emitted.
- Remove shell=True so the argument list is honoured.