I am about to set up a LDAP directory. It is used as a tool to communicate user permissions from a web application to WebDav file system access, e.g. adding a user to the web platform shall allow login to the file system with the same credentials. There are no other usages intended. Following this German tutorial which encourages the use of the attributes c
, o
, ou
etc. over dc
, I configured the following suffix and root:
suffix "ou=webtool,o=myOrg,c=de"
rootdn "cn=ldapadmin,ou=webtool,o=myOrg,c=de"
Server starts and I can connect to it by LDAP Admin, which reports “LDAP error: Object lacks”. Well, there aren’t any objects yet.
I now want to create the root and admin elements from shell. I created an init.ldif
file:
dn: ou=webtool,o=myOrg,c=de
objectclass: dcObject
objectclass: organization
dc: webtool
o: webtool
dn: cn=ldapadmin,ou=webtool,o=myOrg,c=de
objectclass: organizationalRole
cn: ldapadmin
Trying to load the file runs into an error, telling me that ou
is not allowed:
server:~ # ldapadd -x -D "cn=ldapadmin,ou=webtool,o=myOrg,c=de" -W -f init.ldif
Enter LDAP Password:
adding new entry "ou=webtool,o=myOrg,c=de"
ldap_add: Object class violation (65)
additional info: attribute 'ou' not allowed
I am not using ou
anywhere except in the suffix, so the question: Isn’t it allowed here? What is allowed here?