Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I start with a fresh installation of openldap 2.4.28 on debian. They are some problem with the debian package, and with gnuTLS, so i compile a version with opennSSL library.

It's hard to understand with the official documentation how to start a from scratch installation with the new cn=config administration of openLDAP. So, i make a conversion from slapd.conf to cn=config on the first launch of openLDAP with this commands :

/usr/local/libexec/slapd -u openldap -g openldap -f slapd.conf.seb -F /usr/local/etc/openldap/slapd.d/ -d -1

My slapd.conf.seb equal :

include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/ppolicy.schema
include         /usr/local/etc/openldap/schema/gosa/samba3.schema
include         /usr/local/etc/openldap/schema/gosa/trust.schema
include         /usr/local/etc/openldap/schema/gosa/gofax.schema
include         /usr/local/etc/openldap/schema/gosa/gofon.schema
include         /usr/local/etc/openldap/schema/gosa/gosystem.schema
include         /usr/local/etc/openldap/schema/gosa/goto-mime.schema
include         /usr/local/etc/openldap/schema/gosa/goto.schema
include         /usr/local/etc/openldap/schema/gosa/goserver.schema
include         /usr/local/etc/openldap/schema/gosa/gosa-samba3.schema
include         /usr/local/etc/openldap/schema/gosa/openssh-lpk.schema
include         /usr/local/etc/openldap/schema/gosa/dnszone.schema
include         /usr/local/etc/openldap/schema/gosa/nagios.schema
include         /usr/local/etc/openldap/schema/gosa/dhcp.schema
include         /usr/local/etc/openldap/schema/gosa/sudo.schema

pidfile         /usr/local/var/run/slapd.pid
argsfile        /usr/local/var/run/slapd.args

database        bdb
suffix          "dc=parisgeo,dc=cnrs,dc=fr"
rootdn          "cn=admin,cn=config,dc=parisgeo,dc=cnrs,dc=fr"
rootpw  {SSHA} secret
directory       /srv/openldap-data
index   objectClass     eq

I have no problem with this simple conversion, but after that, it's impossible to import data with this command ldapadd or ldapmodify.

I don't understand the default right for read/write for openLDAP, i try with ldapmodify, with bind and password, and i have the same problem :

root@xxxx:/usr/local/etc/openldap# ldapadd -x -D "cn=admin,cn=config,dc=parisgeo,dc=cnrs,dc=fr" -W -f sauvegarde.ldif 
Enter LDAP Password: xxx
adding new entry "cn=admin,dc=parisgeo,dc=cnrs,dc=fr"
ldap_add: Constraint violation (19)
    additional info: structuralObjectClass: no user modification allowed

I try to modify the right for cn=config with this sample :

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
delete: olcAccess

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootDN
olcRootDN: cn=admin,cn=config

dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA} secret

dn: olcDatabase={0}config,cn=config
changetype: modify
delete: olcAccess

ldapadd -Y EXTERNAL -H ldapi:/// -f slapd.modify.root.ldif 

Same problem, i have no right todo that, with or without option the password entry -W or bind option -D "cn=config,cn=admin,dc=parisgeo,dc=cnrs,dc=fr"

root@xxxx:/usr/local/etc/openldap# ldapadd -Y EXTERNAL -H ldapi:/// -f slapd.modify.root.ldif 

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={-1}frontend,cn=config"
ldap_modify: Insufficient access (50)

root@xxxx:/usr/local/etc/openldap# ldapadd -x -W -H ldapi:/// -f slapd.modify.root.ldif Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

root@xxxxx:/usr/local/etc/openldap# ldapadd -D "cn=config,cn=admin,dc=parisgeo,dc=cnrs,dc=fr" -W -Y EXTERNAL -H ldapi:/// -f slapd.modify.root.ldif 
Enter LDAP Password: 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={-1}frontend,cn=config"
ldap_modify: Insufficient access (50)

Do you have an idea of the solution for this from scratch installation ?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

I understand my mistake, we need to add this three line to slapd.conf before conversion :

database config
rootdn "cn=admin,cn=config"
rootpw {SSHA} secret 

After conversion, we can test this :

ldapwhoami -x -D cn=config -W
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.