What to do when you accidentally delete the suffix "ou=am-config"?

Setup
, , , , ,
#1

The documentation from Delete and redeploy AM 's instructions in step 3 explicitly state:

"You should either install a new, clean instance of DS, or delete the entries under the configured AM suffix (by default ou=am-config) of an existing instance."

A potential error that customers might encounter involves accidentally deleting the suffix. This can happen either by inadvertent deletion or by executing a command that inadvertently removes the suffix.

For example


./ldapdelete --deleteSubtree --hostname localhost --port 1636 --useSsl --trustAll --bindDN "uid=admin" --bindPassword password "ou=am-config"

The solution is to recreate the suffix

Step 1.

Create this file : backup.ldif and modify the suffix dn dc=openam,dc=forgerock,dc=org to your preferred suffix 


dn: dc=openam,dc=forgerock,dc=org
objectClass: top
objectClass: untypedObject
dc: openam
aci: (targetattr="*")(version 3.0; acl "Read and write application data"; allow (all)(userdn = "ldap:///uid=am-config,ou=admins,dc=openam,dc=forgerock,dc=org");)
aci: (targetattr="+")(version 3.0; acl "Read operational attributes"; allow (read, search, compare)(userdn = "ldap:///uid=am-config,ou=admins,dc=openam,dc=forgerock,dc=org");)
aci: (targetcontrol="PersistentSearch")(version 3.0; acl "Persistent searches"; allow (read)(userdn = "ldap:///uid=am-config,ou=admins,dc=openam,dc=forgerock,dc=org");)

Step 2

import the suffix into the configuration store again

./opendj7/bin/start-ds

./opendj7/bin/import-ldif \
 --hostname localhost \
 --port 4444 \
 --bindDn uid=admin \
 --bindPassword Netscape123 \
 --backendId cfgStore \
 --includeBranch dc=openam,dc=forgerock,dc=org \
 --ldifFile /work/backup.ldif \
 --usePkcs12TrustStore ./opendj7/config/keystore \
 --trustStorePassword:file ./opendj7/config/keystore.pin

Tested with AM 7.3.0

1 Like
#2

Hi @sam.phua! Thank you for bringing attention to a crucial step in the install guide to Delete and Redeploy AM. Your proactive advice in step 3, emphasizing the importance of caution when managing the configured AM suffix, is truly invaluable.

Thanks for sharing this solution and offering examples. It will undoubtedly serve as an invaluable resource for our community members who might encounter this issue. :raised_hands:

#3

The documentation from Delete and redeploy AM 's instructions in step 3 explicitly state:

"You should either install a new, clean instance of DS, or delete the entries under the configured AM suffix (by default ou=am-config) of an existing instance."

A potential error that customers might encounter involves accidentally deleting the suffix. This can happen either by inadvertent deletion or by executing a command that inadvertently removes the suffix.

For example

./ldapdelete --deleteSubtree --hostname localhost --port 1636 --useSsl --trustAll --bindDN "uid=admin" --bindPassword password "ou=am-config"

The solution is to recreate the suffix

Step 1.

Create this file : backup.ldif and modify the suffix dn dc=openam,dc=forgerock,dc=org to your preferred suffix

dn: dc=openam,dc=forgerock,dc=org
objectClass: top
objectClass: untypedObject
dc: openam
aci: (targetattr="*")(version 3.0; acl "Read and write application data"; allow (all)(userdn = "ldap:///uid=am-config,ou=admins,dc=openam,dc=forgerock,dc=org");)
aci: (targetattr="+")(version 3.0; acl "Read operational attributes"; allow (read, search, compare)(userdn = "ldap:///uid=am-config,ou=admins,dc=openam,dc=forgerock,dc=org");)
aci: (targetcontrol="PersistentSearch")(version 3.0; acl "Persistent searches"; allow (read)(userdn = "ldap:///uid=am-config,ou=admins,dc=openam,dc=forgerock,dc=org");)

Step 2

import the suffix into the configuration store again

./opendj7/bin/start-ds

./opendj7/bin/import-ldif \
 --hostname localhost \
 --port 4444 \
 --bindDn uid=admin \
 --bindPassword Netscape123 \
 --backendId cfgStore \
 --includeBranch dc=openam,dc=forgerock,dc=org \
 --ldifFile /work/backup.ldif \
 --usePkcs12TrustStore ./opendj7/config/keystore \
 --trustStorePassword:file ./opendj7/config/keystore.pin

Tested with AM 7.3.0

1 Like