Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up an OpenLDAP server on ubuntu 9.10, which uses slapd version 2.4.18.

After initializing and populating a new hdb database, everything seems OK, but I can not get the server to return a root DSE. Running

ldapsearch -x -W -D 'cn=manager,dc=example,dc=org' \
    -b '' -s base '(objectclass=*)' +

just returns

# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: +
#

# search result
search: 2
result: 0 Success

# numResponses: 1

My hdb database ACLs are set up as follows:

olcAccess: to attrs=userPassword,shadowLastChange
  by self write
  by anonymous auth
  by dn.base="cn=manager,dc=example,dc=org" write
  by * none
olcAccess: to dn.base=""
  by * read
olcAccess: to *
  by self write
  by dn.base="cn=manager,dc=example,dc=org" write
  by * read

From my experience this setup should have returned a valid root DSE, so if anyone could give me a clue as to what is going on...

share|improve this question
up vote 2 down vote accepted

This is actually filed as bug #427842 agains Ubuntu 9.10 (karmic).

To fix this, copy the following to fixRootDSE.ldif:

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcAccess
olcAccess: to dn.base="" by * read
olcAccess: to dn.base="cn=subschema" by * read

And execute

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f fixRootDSE.ldif

This should give anonymous access to the root DSE.

share|improve this answer

Isn't the Root DSE supposed to be queried anonymously, before binding as a user? So you shouldn't be using -W or -D at all.

My OpenLDAP server responds to the following:

$ ldapsearch -x -b '' -s base

with

# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#

#
dn:
objectClass: top
objectClass: OpenLDAProotDSE

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
share|improve this answer
    
You're right, if the ldap server is configured right, you don't need to bind a user. But I get the same result both when I query anonymously and bind a user. And I don't get a unauthenticated response. So somehow the server don't answer any details about itself. – Magne Nov 5 '09 at 18:33

For those who will get this error in Apache Directory Studio.

If you can see root DSE content in other browsers or ldapsearch, try create new connection. It helped me. I think it is a bug in Apache DS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.