Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're trying to get an instance of OpenLDAP up and running. I'm using ApacheDS as the browser. When I go to create my objects in the LDAP database, I see that a number of the objects and attributes don't fit the purpose for which I intend on using it. So, naturally I want to extend the schema.

I'm following instructions from and I see that there is a "path" cn=schema,cn=config. Should I be able to see this path through my LDAP browser? Whenever I try to connect to that location, it errors out (says invalid credentials).

The README has the path "dc=maxcrc,dc=com" as the default one and ApacheDS confirms this and I can log in just fine here.

If anyone can offer some insight into the mind of OpenLDAP, I'd appreciate it.


share|improve this question
As an aside, did you try phpldapadmin? or for the Debian package It's another helpful tool to manage LDAP databases. – aseq Aug 20 '12 at 21:02
Not enough detail. slapd.conf or slapd-config? Can you successfully bind with those credentials to another DSE on that server? Which distribution did you use? The configuration defaults are uniform across distributions. – 84104 Aug 20 '12 at 21:32

No, "you" should not. By default only the rootdn of "cn=config" (if defined) will be able to read from the cn=config DSE.

$ sudo ldapsearch -H ldapi:/// -Y external -b cn=config olcrootdn=* olcrootdn olcaccess
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
# extended LDIF
# LDAPv3
# base <cn=config> with scope subtree
# filter: olcrootdn=*
# requesting: olcrootdn olcaccess 

# {0}config, config
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by * none
olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.