3

We're running OpenLDAP on Ubuntu 10.04. I'm able to access and use the front end with cn=admin,dc=ourcompany,dc=com and my password.

But I'm unable to change the server's configuration (like loglevel) stored in cn=config because I don't seem to have a valid user/password for the backend?

Some examples:

# ldapsearch
SASL/DIGEST-MD5 authentication started
Please enter your password: 
ldap_sasl_interactive_bind_s: Invalid credentials (49)
    additional info: SASL(-13): user not found: no secret in database

or

# ldapadd -x -D "cn=admin,cn=config" -W -f "my.ldif""
Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

How do I create a user for the cn=config backend?

Improve this question

1 Answer 1

Reset to default
9

Ubuntu default configuration sets up cn=admin,dn=example,dn=com as root dn for the backend, but requires SASL authentication as root to modify the online configuration. You can use:

sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config olcAccess

to list the ACL's for your configuration

to add your ldif file try:

sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f "my.ldif"

assuming the LDAP server is on the local machine. If you want your original command to work, you would need to add the cn=admin,cn=config user and either specify her as the rootdn of the cn=config database or setup an ACL to grant her access.

I was unable to add the rootdn with the ldap tools, even as root, I was also unable to add/modify the ACLs for the cn=config DIT. I am assuming that while root is given manager access, it is not enough to add a rootDN. Therefore, to add rootDN for online configuration you need to edit the configuration manually. This is discouraged because it can break slapd.

You need to generate a password hash with slappasswd, for example "somesecret" slappasswd might generate {SSHA}Hg/mI0rBWab3HCysr55B4Ew7/QmK0LBa

Now you can add the RootDN. First stop slapd

sudo service slapd stop

next edit /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif using the editor of your choice (e.g. nano)

sudo nano /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{0\}config.ldif

then add the following lines before the line "structuralObjectClass: olcDatabaseConfig"

olcRootDN: cn=admin,cn=config
olcRootPW: {SSHA}Hg/mI0rBWab3HCysr55B4Ew7/QmK0LBa

then restart slapd

sudo service slapd start

You can now modify the cn=config DIT with a simple bind using cn=admin,cn=config; however, I am not convinced that this is a good idea. I prefer to ssh into server and access configuration as root. Some however, argue that this defeats the entire advantage of an online configuration, where you can modify the configuration without stopping slapd using any LDAP browser as long as you have the necessary credentials.

Improve this answer
7
  • When trying to add the ldif, I get: additional info: object class 'simpleSecurityObject' requires attribute 'userPassword'. I tried adding a userPassword attribute, but then I get: ldap_add: Object class violation (65) - without any further information.
    – Nick
    Apr 9, 2012 at 17:54
  • I'm not sure I see the point of having config stored in an LDAP tree if you can't edit it from an LDAP client. It makes a simple change like increasing the loglevel into a day-long chore. I should be able to edit a config file and restart (like every other server process in the world) or use a client to make the changes. Do you know if other distros, maybe CentOS, might have a more user-friendly version of LDAP?
    – Nick
    Apr 10, 2012 at 21:31
  • You are right. It appears that OpenLDAP (at lease the version that ships with Ubuntu 11.10) does not allow you to add the rootDN to cn=config. See Note 3 at: zytrax.com/books/ldap/ch6/slapd-config.html perhaps this can cause big problems. What I don't understand is that I cannot modify the olcAccess ACL for the database either. It appears that you can only modify some parts of the olc and even then only as root.
    – Chris
    Apr 10, 2012 at 21:33
  • @Nick you can go back to the static slapd.conf and abandon the olc. Many people (much smarter than I) have had problems with the olc. It is supposed to be the future. I am trying to figure out all of its intricacies as well. As to adding logging, this I know can be done using the root SASL ACL.
    – Chris
    Apr 10, 2012 at 21:36
  • I read somewhere that the old way with slapd.conf doesn't work correctly with recent versions of Ubuntu? I don't remember the specific reason though. Are you running an LDAP server on ubuntu with the slapd.conf method?
    – Nick
    Apr 10, 2012 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .