Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My installation and setup of slapd 2.4.21 is done on Ubuntu 10.04 according to the official doc. Now ldapsearch -x will give me nothing, but ldapsearch -x -Drootdn -w rootpw will output everything. I do have

olcAccess: to * by dn="cn=Manager,dc=a,dc=b" write by * read

in the backend configuration. What's wrong? "getent passwd testuser" output nothing, must be due to it. Thank you in advance.

share|improve this question

You have to perform authentication, and olcAccess is for configuring authorization. In simple words, slapd still requires you to prove who you are (authenticate, which in LDAP slang is called "bind" for some strange reason) before allowing you to read data.

This is normal. If you don't want to provide -D and -w each time, use corresponding bind* options in ldap.conf, which is located in various places in various unices. Google says on Ubuntu 10.04 it's

share|improve this answer
kubanczyk, thank you for your reply. What I wondered was that why my other openldap server (on Mac os x) didn't require binding. The reason could be that I have some olcAccess statements in cn=config of the ubuntu server, while in the other openldap server I don't have any 'access' entry in slapd.conf. – Jun Zhang Oct 31 '10 at 19:52

Try to look in slapd's log file, in most case answer to "wtf is going on?" is there. To read data anonymous user also should be able to read root DSE and "cn=Subschema". Corresponding entries looks like this:

access to dn.base="" by * read
access to dn.base="cn=Subschema" by * read

These entries should be placed in global configuration, not in backend.

P.S.: rootdn always have write access to backend, so you don't need to specify it in ACLs

share|improve this answer
-Drootdn -w rootpw

-D/-w is used to bind a dn, then searching LDAP tree as authenticated user. Please make sure your OpenLDAP is allowed anonymous binding.

If you're using slapd.conf for server configuration, you can use this setting in slapd.conf:

allow bind_anon_cred

And below setting is used to disable anonymous binding:

disallow    bind_anon

Also, below setting won't work at all:

olcAccess: to * by dn="cn=Manager,dc=a,dc=b" write by * read

Because root dn always has ALL privileges, including read, write.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.