Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up a standalone OpenLDAP on a RHEL box, but I am having a bit of trouble when trying to import users into the system.

If I enter the following command:

ldapadd -x -h localhost -D 'cn=Users,dc=internal,dc=priv' -W -f user.ldif

I get the following response:

Enter LDAP Password:
ldap_bind: Invalid credentials (49)

While on the ldap server itself, the following appears:

>>> slap_listener(ldap:///)
connection_get(11): got connid=1
connection_read(11): checking for input on id=1
ber_get_next: tag 0x30 len 45 contents:
ber_scanf fmt ({imt) ber:
ber_scanf fmt (m}) ber:
>>> dnPrettyNormal: <cn=Users,dc=internal,dc=priv>
<<< dnPrettyNormal: <cn=Users,dc=internal,dc=priv>, <cn=users,dc=internal,dc=priv>
do_bind: version=3 dn="cn=Users,dc=internal,dc=priv" method=128
send_ldap_result: conn=1 op=0 p=3
send_ldap_response: msgid=1 tag=97 err=49
ber_flush: 14 bytes to sd 11
connection_get(11): got connid=1
connection_read(11): checking for input on id=1
ber_get_next on fd 11 failed errno=0 (Success)
connection_closing: readying conn=1 sd=11 for close
connection_close: conn=1 sd=11

I don't know LDAP that well - can anyone suggest a way forward?

share|improve this question
up vote 1 down vote accepted

You should bind to your LDAP DB as the user who has credentials for modifying the database. One way is to use the manager user (rootdn somethinghere) defined in slapd.conf file.

So, if you have rootdn cn=TheMightyRootUser,ou=users,dc=internal,dc=priv in slapd.conf, provide that cn=TheMightyRootUser,ou=users,dc=internal,dc=priv as -D parameter for ldapadd.

share|improve this answer

-D 'cn=Users,dc=internal,dc=priv' probably doesn't make sense. I guess that you want to add a user to ou=Users,dc=internal,dc=priv. ou denotes a subtree in LDAP. cn denotes a LDAP record.

-D should be followed by the entry that contains the LDAP admin account ('binddn').

cn=Users,etc. would be a weird name for the admin user.

May guess there's no cn=Users,etc. You should probably replace it with cn=admin,dc=internal,dc=priv (quotes are superfluous). You should edit the ldif file to reflect the fact that you want to place the entries in the ou=Users subtree

Another possibility is that your LDAP installation is using SASL, not simple authentication (denoted by -x)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.