Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up an OpenLDAP server to authenticate users in a domain on Ubuntu 9.04.

What's interesting/strange is that in the newest version of openldap for Ubuntu, the default is not to use the /etc/ldap/slapd.conf file - instead it stores its configs in cn=config in the database (this has lead to some headaches trying to follow tutorials that specify slapd.conf instead of the newer version).

Whenever I try to add to the database using ldapadd, it returns ldap_bind (49) Invalid Credentials (even when I'm sure I'm using the right password).

The database doesn't have anything in it yet, so starting from scratch isn't a problem, I've just encountered this several times (even after reconfiguring slapd). What's the solution?

share|improve this question
up vote 2 down vote accepted

I do not know if OpenLDAP returns subcodes on error 49's like Active Directory does. AD returns a subtype of the error code for bad password, versus bad DN.

Are you confident the DN is correct?

share|improve this answer
+1 For coming up with the same answer I figured out. I was using the wrong credentials - should have been using cn=admin,dc=example,dc=com instead of cn=admin,cn=config. Dumb mistake. Easy fix though. – Cory Plastek Jul 15 '09 at 15:25

Try specifying "-x" on the commandline. By default, the LDAP tools use SASL authentication, -x specifies "simple authentication".

share|improve this answer
The command I'm using to try to add some example entries in the db: ldapadd -x -D cn=admin,dc=example,dc=com -W -f -x disables SALS authentication, and -W makes sure it prompts for a the administrator password (which I enter). Still no joy. Any other thoughts? – Cory Plastek Jul 14 '09 at 21:33
Hmm. I am not familiar with configurations that don't use slapd.conf so I am not entirely sure where to go. Off the top of my head I would try running slapcat to print out the ldif of the database directly and verify that the rootdn matches what you are entering for your bind. – Alex Jul 15 '09 at 0:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.