Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not able to add posix users/groups to this newly created ldap directory. OpenLDAP version is 2.4.19.

The LDIF I've populated the LDAP directory is probably the problem, but I'm not sure what I need to do next...

dn: dc=company,dc=net,dc=au
objectClass: dcObject
objectClass: organization
o: Company Pty Ltd
dc: company

dn: cn=manager,dc=company,dc=net,dc=au
objectClass: organizationalRole
cn: Manager

dn: ou=People,dc=company,dc=net,dc=au
objectClass: organizationalUnit
objectClass: top
ou: People

dn: ou=Groups,dc=company,dc=net,dc=au
objectClass: organizationalUnit
objectClass: top
ou: Groups

Could someone please educate me :)

Update: I've added nis.schema, which I expected to fix the problem as it has all the posix* classes I was after. However, I now get the following error:

/etc/openldap/schema/nis.schema: line 203 objectclass: AttributeType not found: "manager"
/opt/openldap/etc/openldap/slapd.conf: line 6: <include> handler exited with 1!
slapd destroy: freeing system resources.
slapd stopped.
connections_destroy: nothing to destroy.

The relevant section of nis.schema, ~line 203 is as follows...

objectclass ( NAME 'ipHost'
    DESC 'Abstraction of a host, an IP device'
    MUST ( cn $ ipHostNumber )
    MAY ( l $ description $ manager ) )

I'll continue reading.

share|improve this question
What method are you using to add the users and groups? – TRS-80 Nov 22 '09 at 11:05
Hi TRS-80 - At the moment I'm using phpldapadmin - I should have mentioned that, but didn't want to cloud the problem. Now that I've added the appropriate (I think) schema (nis.schema) - I can't start the LDAP service - /etc/openldap/schema/nis.schema: line 203 objectclass: AttributeType not found: "manager" – Xerxes Nov 22 '09 at 11:21

I cannot help you much with the phpldap, as I've never used it (I'm preferring ApacheDirectoryStudio or the openldap's command line tools), but if you can use a generic LDIF file with it, please try this one:

dn: uid=juser,ou=People,dc=company,dc=net,dc=au
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: posixAccount
objectClass: top
cn: Joe User
gidNumber: 100
homeDirectory: /home/juser
uid: juser
uidNumber: 1004
gecos: Joe User
givenName: Joe
loginShell: /bin/bash

...and see if it works?

In any case, I strongly recommend using ApacheDirectoryStudio as a generic LDAP/schema browser.

share|improve this answer
I did switch over to ApacheDirectoryStudio - very good tool thank you. I eneded up redoing the entire thing from scratch and everything worked - which is good, but also bad as I don't have a nice resolution to close this ticket. – Xerxes Dec 28 '09 at 4:58

I think I've figured it out - Once I'm done reading, I'll post the root cause, and the detailed solution; but for now - and in short - I hadn't included the appropriate schema files.

The posixAccount is an auxiliary class, so it's a completely optional that can be "attached" onto the required structural one - be it person, organizationalPerson, or interOrgPerson.

No, I thought I was close, still no luck. In order to add nis.schema, I had to add a few prerequisite schemas, so now I have...

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

That resolved slapd not starting up, however, I still can't see any posix* classes anywhere in the ldap mgmt web interface.

share|improve this answer

You might try using the migration scripts to generate a base ldif. On my RHEL install, they are at /usr/share/openldap/migration/, of course depending on your distro they may land somewhere else. will give you your users, and you groups (both obvious). If appropriate, you can also use the to suck in everything from your current system and dump it directly into a currently running LDAP (and then prune or add as needed).

share|improve this answer

You had the right answer; you need to add the schemas as followed in your slapd.conf and restart:

note: the order is important!

include         /etc/openldap/schema/corba.schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/duaconf.schema
include         /etc/openldap/schema/dyngroup.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/java.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/openldap.schema
include         /etc/openldap/schema/ppolicy.schema
include         /etc/openldap/schema/collective.schema

Then you can add POSIX user via ldif file:

# User primary group
dn: cn=ussergroup,ou=groups,dc=me,dc=com
cn: ussergroup
objectClass: top
objectClass: posixGroup
gidNumber: 10001

# User account
dn: uid=user,ou=users,dc=me,dc=com
cn: user
givenName: user
sn: user
uid: user
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/user
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
loginShell: /bin/bash
userPassword: {CRYPT}*
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.