Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're in the process of setting up a Jabber server on Amazon EC2 right now, and we'd like to have our internal users authenticate via LDAP so we don't have to create/manage a separate set of user accounts than the master directory in the office.

My question is: is there a way to copy, unidirectionally, a segment of our internal LDAP directory (the user accounts OU) to an external LDAP server and authenticate Jabber against that?

We're trying to work around having our externally hosted machines out in the cloud accessing our internal network directly... If we can replicate in one direction only a subset of the user accounts, then if that gets compromised we don't necessarily have a critical security breach into our internal network.

share|improve this question
up vote 1 down vote accepted

you can export part of your ldaptree with ldapsearch to an ldif file and add it too your other ldap server with ldapadd or ldapmodify.

there are also products which support automatic or semi automatic replication in one direction like the fedora directory server.

jabber can be authenticated against ldap, but i can't tell you how. perhaps someone else can answer this part.

share|improve this answer
Our main LDAP directory is on Snow Leopard Server, and I found this KB article about exporting with ldapsearch:, but I'm getting an error: "ldap_sasl_interactive_bind_s: Local error (-2)". Seems I can't query the LDAP server for any results... – colemanm Jan 12 '10 at 19:43
you do not get authenticated to the ldap server. the article is missing any authentication parameters. take a look at the manpage of ldapsearch. try it with the simple authentication method. – Christian Jan 12 '10 at 21:18
It worked with the "-x" switch for simple authentication, but now I'm getting a No such object (32) error. The command I'm running is: sudo ldapsearch -x -LLL -H ldap:// -b "cn=users,dc=domain,dc=net" -- should be the correct DN for the "users" container on OS X Server... – colemanm Jan 12 '10 at 21:33
i don't know you ldaptree. try the search with a shorter searchstring (dc=domain,dc=net or dc=net) or access the ldaptree with a ldap browser to see the structure. – Christian Jan 12 '10 at 22:57
Open Directory may not allow anonymous queries... you might need to authenticate to the LDAP server first. Use -D to specify a user (e.g. cn=foo,dc=blah,dc=com) – James Jan 13 '10 at 15:57

Once you get an LDIF file created, ldapdiff ( is an awesome tool for syncing changes between LDAP servers.

share|improve this answer
That definitely looks like something we could use once we get a proper LDIF file exported... Thanks. – colemanm Jan 13 '10 at 15:03

If I understand correctly, you want to "push" some accounts from your internal LDAP directory out to another directory in the cloud?

If your directory is OpenLDAP, you can set up partial replication, using a push based config. See their admin guide.

If not, you can use a synchronization tool, that will connect to your internal directory, query it for the accounts you want to push out, and connect to your directory in the cloud to update them there. Ldap Synchronization Connector (LSC) is one such tool that would do this, available as open source.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.