Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenLDAP server with the following in its configuration file:

suffix          "o=a.b.priv"
rootdn          "cn=Manager,o=a.b.priv"

I am setting up a new project which will make use of the following:

suffix          "o=c.b.priv"
rootdn          "cn=Manager,o=c.b.priv"

Is it possible for these two to coexist on the same OpenLDAP server instance?

I am guessing it is not possible and that my options will be

  • set up a second instance listening on a different port on the same box
  • 'refactor' the existing data (is that even possible? I'm new to LDAP) so that the root is b.priv and the rootdn is cn=Manager,o=b.priv with children of o=a.b.priv and o=c.b.priv

Is there another option?

share|improve this question
up vote 0 down vote accepted

Multiple DITs do appear to be possible. Take a look at this documentation and example. As for the prudence in doing so, I can't speak to your requirements. Completely understanding the documentation before pursuing does seem wise. Perhaps an OpenLDAP specific group could help you assess your idea. But be warned, they can be testy if you have not done your homework.

\\Greg

share|improve this answer

You can create multiple, separate databases with OpenLDAP. You'll find details in the documentation.

Setting up a second instance on a nonstandard port is not a good idea, IMHO, as you have to be careful to specify the correct port wherever you use this instance.

share|improve this answer
    
Thanks, that's a relief! As I'm quite new to LDAP, I don't really know what I'm looking for in the docs - are you able to be a bit more specific please? Thanks in advance... – Rich Apr 21 '11 at 12:53

I'm quite new to LDAP too, but I was able to do this, so I report the operations I've done, hoping they could be useful.

I've found this information in a mailing list reply.

I needed to work as root user.

First use the command

slapcat -n0

to show the LDAP configuration.

You should see something like this:

dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: <your old root DN>
...

Go to /var/lib/ldap and create a subfolder for your new tree. Ensure that this folder has 755 permission and appropriate owner and group (in my case it must be openldap openldap).

Create a LDIF file in this way:

dn: olcDatabase={2}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap/<NEWDIR>
olcSuffix: <new root DN>
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
 s auth by dn="cn=Manager,<new root DN>" write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=<new root DN>" write by * read
olcLastMod: TRUE
olcRootDN: cn=Manager,<new root DN>
olcRootPW: <manager password>

Then call

ldapmodify -Y EXTERNAL -H ldapi:/// -f <your-ldif-file>

and you should have added a new root.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.