Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day to everybody.

I'm trying to add a new schema inside OpenLDAP. But getting an error:

ldap_add: Insufficient access (50)

root@ldap:/# ldapadd -c -x -D cn=admin,dc=domain,dc=com -W -f /tmp/test.d/cn\=config/cn\=schema/cn\=\{5\}microsoft.ldif

root@ldap:/# cat /tmp/test.d/cn\=config/cn\=schema/cn\=\{5\}microsoft.ldif
dn: cn=microsoft,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: microsoft
olcAttributeTypes: {0}( 1.2.840.113556.1.4.302 NAME 'sAMAccountType' DESC 'Fss
 ssully qualified name of distinguished Java class or interface' SYNTAX 1.3.6. SINGLE-VALUE )
olcAttributeTypes: {1}( 1.2.840.113556.1.4.146 NAME 'objectSid' DESC 'Fssssull
 y qualified name of distinguished Java class or interfaced' SYNTAX
 1.1466. SINGLE-VALUE )
olcAttributeTypes: {2}( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' DESC 'Fds
 sssully qualified name of distinguished Java class or interfaced' SYNTAX 1.3. SINGLE-VALUE )
olcAttributeTypes: {3}( 1.2.840.113556.1.4.1412 NAME 'primaryGroupToken' SYNTA
olcAttributeTypes: {4}( 1.2.840.113556.1.2.102 NAME 'memberOf' SYNTAX
 4.1.1466. SINGLE-VALUE )
olcAttributeTypes: {5}( 1.2.840.113556.1.4.98 NAME 'primaryGroupID' SYNTAX 1.3
olcObjectClasses: {0}( 1.2.840.113556.1.5.6 NAME 'securityPrincipal' DESC 'Cso
 ntainer for a Java object' SUP top AUXILIARY MUST ( objectSid $ sAMAccountNam
 e ) MAY ( primaryGroupToken $ memberOf $ primaryGroupID ) )

I also tried to add the schema by phpldapadmin, but gain the same error.

I'm using the admin user which is specified by default from the begging of the slpad installation. How may I add permissions to this user ?

Best wishes

share|improve this question
I'm not using slapd.conf file. Using CN=CONFIG – Yosifov Sep 5 '12 at 9:50
up vote 3 down vote accepted

The default access config for cn=config is to only allow via external auth. Try:

ldapadd -c -Y EXTERNAL -H ldapi:/// -f '/tmp/test.d/cn=config/cn=schema/cn={5}microsoft.ldif'

share|improve this answer
root@ldap:/# ldapadd -c -Y EXTERNAL -H ldap:// -f '/tmp/test.d/cn=config/cn=schema/cn={5}microsoft.ldif' SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: is a private IP placed in private network. I guess the problem may come because the local DNS is not resolving this address correctly ? – Yosifov Sep 5 '12 at 9:49
Stupidity is something dangerous nowadays ... ldapadd -c -Y EXTERNAL -H ldapi:/// -f '/tmp/test.d/cn=config/cn=schema/cn={5}microsoft.ldif' SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=microsoft,cn=schema,cn=config" – Yosifov Sep 5 '12 at 10:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.