1

We're trying to get an instance of OpenLDAP up and running. I'm using ApacheDS as the browser. When I go to create my objects in the LDAP database, I see that a number of objects and attributes don't fit the purpose for which I intend on using it. So, naturally I want to extend the schema.

I'm following instructions from http://www.rainingpackets.com/how-to-add-schema-file-openldap-24/ and I see that there is a "path" cn=schema,cn=config. Should I be able to see this path through my LDAP browser? Whenever I try to connect to that location, it errors out (says invalid credentials).

The README has the path "dc=maxcrc,dc=com" as the default one and ApacheDS confirms this and I can log in just fine here.

If anyone can offer some insight into the mind of OpenLDAP, I'd appreciate it.

2
  • As an aside, did you try phpldapadmin? phpldapadmin.sourceforge.net or for the Debian package packages.debian.org/squeeze/phpldapadmin It's another helpful tool to manage LDAP databases.
    – aseq
    Aug 20, 2012 at 21:02
  • Not enough detail. slapd.conf or slapd-config? Can you successfully bind with those credentials to another DSE on that server? Which distribution did you use? The configuration defaults are uniform across distributions.
    – 84104
    Aug 20, 2012 at 21:32

2 Answers 2

2

Typically in your OpenLDAP installation you have at least two trees:

  • One is the DIT ("data information tree") where you enter your nodes
  • One is cn=config, where the configuration information is put (which can be manipulated with just the same LDAP commands, as itself is setup as a DIT!).

Normally, cn=config is not readable for any account of the DIT (for obvious reasons, hm?). So in order to access cn=config you typically use a dedicated account, which is determined by the database's olcRootDN attribute (in my case cn=admin,cn=config).

However, in some distros that account might not exist or does not have an initial password set.

To change this, you would do following:

  1. Encrypt the password with sudo slappasswd
  2. Set the password by modifying the LDAP entry:
sudo ldapmodify -Y EXTERNAL -H ldapi:///
dn: olcDatabase={0}config,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,cn=config
-
add: olcRootPW
olcRootPW: <encrypted password>
1

No, "you" should not. By default only the rootdn of "cn=config" (if defined) will be able to read from the cn=config DSE.

$ sudo ldapsearch -H ldapi:/// -Y external -b cn=config olcrootdn=* olcrootdn olcaccess
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: olcrootdn=*
# requesting: olcrootdn olcaccess 
#

# {0}config, config
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by * none
olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .