Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running an OpenLDAP 2.4 server that uses the SSL service for communication. It works for lookups.

I am trying to add mirror mode replication.

So this is the command that I'm executing:

ldapmodify -D "cn=myuser,dc=mydomain,dc=com" -H ldaps://myloadbalancer -W -f /etc/ldap/ldif/server_id.ldif

Where this is my server_id.ldif:

dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 1 myserver1
olcServerID: 2 myserver2

and this is my cn\=config.ldif in the slapd.d tree of text files:

dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
structuralObjectClass: olcGlobal
entryUUID: ff9689de-c61d-1031-880b-c3eb45d66183
creatorsName: cn=config
createTimestamp: 20121118224947Z
olcLogLevel: stats
olcTLSCertificateFile: /etc/ldap/certs/ldapscert.pem
olcTLSCertificateKeyFile: /etc/ldap/certs/ldapskey.pem
olcTLSCACertificateFile: /etc/ldap/certs/ldapscert.pem
olcTLSVerifyClient: never
entryCSN: 20121119022009.770692Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20121119022009Z

But unfortunately I'm getting this:

Enter LDAP Password: 
modifying entry "cn=config"
ldap_modify: Insufficient access (50)

If I try to specify the config database I get this:

ldapmodify -H 'ldaps://myloadbalancer/cn=config' -D "cn=myuser,cn=config" -W -f ./server_id.ldif 
Enter LDAP Password: 
ldap_bind: Invalid credentials (49)}

Does anyone know how I can add the serverID to the config database so that I can complete the setup of mirror mode?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

It is exactly what is says on the tin. Your DN cn=myuser,dc=mydomain,dc=com does not have enough permissions to modify the cn=config tree. And when you are trying "to specify the config database" you are using an entirely different DN, cn=myuser,cn=config, which apparently either doesn't exist or you are using a wrong password.

To do modifications like these you need to work with an account privileged enough to modify the various databases. The "admin" account, i.e. the one account that always has all privileges, is specified in the attribute olcRootDN and its password is found in olcRootPW. For the cn=config database those attributes are found in olcDatabase={0}config,cn=config and for the "regular" database, usually of type HDB, in olcDatabase={1}hdb,cn=config.

Which tutorial or documentation did you follow? It doesn't seem like you understand completely what you are doing here.

share|improve this answer
    
Hmm, I am already using the olcRootDN account. -D "cn=myuser,dc=mydomain,dc=com" is my replacement of "cn=Manager,dc=example,dc=com" ... I replaced Manager with myuser for security purposes. I expected it to work. I think that I need to specify serverID at a level higher than the databases, ... at the base configuration of slapd itself, which I would expect to be in cn=config.ldif, not in olcDatabase\=\{1\}hdb.ldif where one finds the olcRootDN. –  Lynn Owens Nov 25 '12 at 4:42
    
If you get "insufficient access" then you are not using the admin user configured in olcRootDN and olcRootPW. That user always has access to everything, by definition. Again, be advised that the different databases have different admin users. For the cn=config tree use the one specified under olcDatabase={0}config,cn=config. And no, the olcServerID attributes do belong in the cn=config DN. It's where I have them, too. –  daff Nov 25 '12 at 5:09
    
Thanks Daff, that was it. I was ignorant to the fact that the config database was the {0} database. There was indeed an admin user in there. I gave it a password and my modifications went through with no problem. :) –  Lynn Owens Nov 26 '12 at 0:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.