Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My installation and setup of slapd 2.4.21 is done on Ubuntu 10.04 according to the official doc. Now ldapsearch -x will give me nothing, but ldapsearch -x -Drootdn -w rootpw will output everything. I do have

olcAccess: to * by dn="cn=Manager,dc=a,dc=b" write by * read

in the backend configuration. What's wrong? "getent passwd testuser" output nothing, must be due to it. Thank you in advance.

share|improve this question

3 Answers 3

You have to perform authentication, and olcAccess is for configuring authorization. In simple words, slapd still requires you to prove who you are (authenticate, which in LDAP slang is called "bind" for some strange reason) before allowing you to read data.

This is normal. If you don't want to provide -D and -w each time, use corresponding bind* options in ldap.conf, which is located in various places in various unices. Google says on Ubuntu 10.04 it's

/etc/ldap/ldap.conf
share|improve this answer
    
kubanczyk, thank you for your reply. What I wondered was that why my other openldap server (on Mac os x) didn't require binding. The reason could be that I have some olcAccess statements in cn=config of the ubuntu server, while in the other openldap server I don't have any 'access' entry in slapd.conf. –  Jun Zhang Oct 31 '10 at 19:52

Try to look in slapd's log file, in most case answer to "wtf is going on?" is there. To read data anonymous user also should be able to read root DSE and "cn=Subschema". Corresponding entries looks like this:

access to dn.base="" by * read
access to dn.base="cn=Subschema" by * read

These entries should be placed in global configuration, not in backend.

P.S.: rootdn always have write access to backend, so you don't need to specify it in ACLs

share|improve this answer
-Drootdn -w rootpw

-D/-w is used to bind a dn, then searching LDAP tree as authenticated user. Please make sure your OpenLDAP is allowed anonymous binding.

If you're using slapd.conf for server configuration, you can use this setting in slapd.conf:

allow bind_anon_cred

And below setting is used to disable anonymous binding:

disallow    bind_anon

Also, below setting won't work at all:

olcAccess: to * by dn="cn=Manager,dc=a,dc=b" write by * read

Because root dn always has ALL privileges, including read, write.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.