1

I'm trying to set up my first LDAP server. I can't get clients to authenticate using it even though everything seems to be working. i suspect the ACLs might be the problem since i can't see the ACLs using the command given by the official ubuntu guide:

ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb olcAccess

i can see them using this command though:

sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcDatabase={1}hdb)' olcAccess

The second command shows that the first entry in the ACL uses dc=nodomain :

dn: olcDatabase={1}hdb,cn=config
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=nodomain" write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=nodomain" write by * read

Is this the problem? how do i fix it? i can't find a way to edit the ACLs without completely changing the installation using dpkg.

1 Answer 1

0

If you have a test system without a real hostname (like ldap.example.org) and name it just ldap, the default configuration of OpenLDAP on Debian(?)/Ubuntu (which I guess you use) will assume an LDAP tree with the name dc=nodomain and create appropriate ACL rules.

Really, your best approach is to set a complete FQDN and let dpkg --reconfigure slapd do it's work. It will destroy everything, but you end up with a valid LDAP tree and an admin user like cn=admin,dc=example,dc=org.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .