OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

learn more… | top users | synonyms

4
votes
1answer
4k views

ldap_add no such object (32) matched dn dc=domain dc=com

When im trying to import users to LDAP using this command: ldapadd -x -D "cn=Manager,dc=domain,dc=com" -W -f /etc/openldap/root.ldif I have this error: ldap_add no such object (32) ...
4
votes
2answers
3k views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
4
votes
1answer
407 views

What are best practices to store delegated permissions in OpenLDAP?

My network's core user database is managed by OpenLDAP. Recently we need to introduce a possibility for one user to act on second user's behalf. As all application-related rights and permissions are ...
4
votes
1answer
530 views

Trying to authenticate to a Dell PowerConnect 5324 switch using FreeRADIUS and OpenLDAP

So here's the situation. I want to be able to use my LDAP credentials to log into this switch. Since there is no support for LDAP on the switch itself, I figured that FreeRADIUS has an LDAP module, ...
4
votes
1answer
517 views

openldaps wildcard certificate not accepted

my wildcard certificate doesn't get accepted with ldap 2.4.23. when i try to connect i get the following error: TLS certificate verification: subject: ...
4
votes
3answers
2k views

LDAP change user pass on client

I am trying to allow ldap users to change their password on client machines. I have tried pam every which way I can think of /etc/ldap.conf & /etc/pam_ldap.conf, as well. At this point I'm stuck. ...
3
votes
2answers
12k views

“no global superior knowledge” while adding a country

I must add an organizationalunit like this into a freshly installed OpenLDAP (on Ubuntu 12.04) : dn: ou=MYREGION, ou=MYAPP, ou=GROUPS, o=myorganization, c=fr ou: MYREGION objectClass: top ...
3
votes
3answers
6k views

Disallow global anonymous bind with cn=config

With slapd.conf you could globally disable anonymous binding and require authentication with the following static directives: disallow bind_anon require authc How can I achieve the same global ...
3
votes
2answers
1k views

openldap proxied authorization

I'm having some trouble doing updates with proxied authorization. I'm using UnboundID's LDAP SDK to connect to OpenLDAP, and sending a ProxiedAuthorizationV2RequestControl for dn: ...
3
votes
2answers
3k views

dn-based linux groups from ldap

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass? More broadly, is there any way I can avoid having one set of groups for ...
3
votes
2answers
7k views

How do I migrate user-accounts from OpenLDAP to Active-Directory?

We want to migrate our user-accounts from OpenLDAP to Active-Directory without changing the passwords and such. The users shouldn't notice the difference against which server they're authenticating ...
3
votes
2answers
123 views

Usefulness of an absolute filter on an LDAP query?

I was perusing the source for OpenLDAP and I saw where the root DSE supports something called absolute filters. It looks like it's specified in RFC4526 It looks like the author that originally drafted ...
3
votes
4answers
371 views

How to tag former employees in LDAP structure?

I have ou=People and there I have stored our employees. I have to somehow divide them to our current employees and former employees. What I was thinking about was to create 2 groups, ...
3
votes
2answers
180 views

Is the new cn=config interface in OpenLDAP ready for production?

I recently began learning Samba and OpenLDAP, and have become increasingly frustrated with the apparent disconnect between the old configuration (using slapd.conf) and the new one using the cn=config ...
3
votes
1answer
595 views

Rename base DN in OpenLDAP

I currently have an LDAP directory (OpenLDAP), which does authentication for a bunch of services running across a number of servers. Let's say the base DN is dc=oldcompany,dc=com. I'd now like to ...
3
votes
1answer
936 views

ldapquery an Active Directory server for users that belongs to a group named X

When I do this at the bash prompt on a CentOS 6.4 ldapsearch -LLL -H ldap://adserver.example.com -x -D someuser@example.com -w somepass -b 'OU=Users,DC=example,DC=com' ...
3
votes
1answer
195 views

What are the differences in schemas of main directory servers?

Active Directory, OpenLDAP or Apple's Open Directory have different schemas for holding user info and group membership. Having a Open Directory here I can say for example that user's Distinguished ...
3
votes
1answer
225 views

When updating the schema in OpenLDAP, should we reload the master or the slave first?

We currently have one master server that is replicated to two read-only slaves. We are adding to the schema. Is it recommended to reload the master first or the slaves?
3
votes
2answers
679 views

Authenticating Exchange with OpenLDAP

Got a customer server coming in that's exchange and I want it to talk to the existing setup, users hate more than one login! Can Exchange 2010 get authentication from OpenLDAP? (running on CentOS ...
3
votes
4answers
318 views

Which identity management products are suitable for small to medium business?

Let's scope out an average setup: Web company About 50 users A few User Groups (Management, Support, Developers, Sys-Admins, Testers, Sales) A bunch of permissions (Only management is allowed to ...
3
votes
1answer
82 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
3
votes
1answer
6k views

Unknown LDAP cn=config admin password

when I installed openldap I was asked to create a password for an admin user but now i realize there's another admin user for cn=config whose password i don't know. Does anyone know how should i ...
3
votes
3answers
2k views

How do I renew an expired Ubuntu OpenLDAP SSL Certificate

We went through the steps of revoking an SSL Certificate used by our OpenLDAP server and renewing it but we are unable to start slapd. Here are the commands we used: openssl verify ...
3
votes
2answers
2k views

How do I add olcAuditLogConfig to openldap on Centos 6

Regarding to 'man slapo-auditlog' I should just need to add the following. dn: olcOverlay=auditlog,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: ...
3
votes
1answer
844 views

Where do I find USEFUL official documentation for LDAP authentication on Centos/RHEL 6?

Does it exist any official installation documentation about how to setup an LDAP server that I can connect my clients to with authconfig. I'm will be Centos 6 and RHEL 6.1. What I can find is this. ...
3
votes
2answers
9k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
3
votes
1answer
4k views

OpenLDAP on Windows and gssapi32

Upon trying to run OpenLDAP on Windows after a non-eventful installation, I get the error that gssapi32.dll is missing. Reinstalling does nothing to alleviate the problem, nor does altering the ...
3
votes
2answers
930 views

Active Directory using Samba/Open LDAP for user accounts

I know this is the wrong way round... but Is it possible to use AD in front of Samba for our PC clients, so that the user accounts are in Samba/Open LDAP. Managing our fleet of Windows PC's is ...
3
votes
1answer
3k views

how to configure open ldap to work on localhost

From the documentation: Use your favorite editor to edit the provided slapd.conf(5) example (usually installed as /usr/local/etc/openldap/slapd.conf) to contain a BDB database definition ...
3
votes
4answers
4k views

OpenLDAP Password Expiration with pwdReset=TRUE?

I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work: Password lockouts on too many failed attempts Password Change required once pwdReset=TRUE added to ...
3
votes
1answer
69 views

OpenLDAP advanced ACL configuration

I have a multiple DITs in my OpenLDAP server. I made user cn=config the root so that cn=config has root access to all DITs (each DIT). In addition, there is a per-DIT administrator IDed as ...
3
votes
2answers
131 views

openldap allop overlay configuration

I'm having trouble getting the allop overlay to work. I suspect I'm missing some vital configuration option or that I've done something incorrectly. Any help is greatly appreciated. I need to use ...
3
votes
2answers
630 views

OpenDirectory/LDAP Query Syntax to find all users in a Group for GADS

I would like to construct an LDAP query to find all users that are part of the "Google Apps Users" group (short name: googleappsusers) on my OS X 10.9 Server. When I run the following query in Google ...
3
votes
1answer
9k views

How to add a new attribute to an existing LDAP objectclass?

I created a custom LDAP objectClass, but forgot a couple attributes before I added it to my OpenLDAP server. I followed the instructions on this Ubuntu doc page: ...
3
votes
2answers
611 views

Ubuntu 11.04 and OpenLDAP - where is the config?

I've been asked to setup a multimaster LDAP environment on Ubuntu 11.04 - instead of a single master server. I cloned the master server and recreated it into two VMs. I am trying to follow the ...
3
votes
1answer
452 views

Adding apple.schema from OS X Lion Server fails

When I try to add apple.schema to my OpenLDAP running on Debian this is the error I get; root@directory:~# ldapadd -Y EXTERNAL -H ldapi:/// -f apple.schema SASL/EXTERNAL authentication started SASL ...
3
votes
1answer
2k views

Setting up a Linux client for OpenLDAP over SSL

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS). The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
3
votes
2answers
835 views

Logging authentication failure on OpenLDAP

I need to log authentication failure on OpenLDAP. What is the proper log level bit for that? Or is there another configuration for such a thing?
3
votes
1answer
257 views

Migrating to LDAP

I've started a new job at a house where they've got an amazingly unruly patchwork of Linux, xBSD, and OpenSolaris boxes. Every box has its own user auth using local /etc/passwd, etc. Users/Groups have ...
3
votes
2answers
3k views

Migration from Active directory to OpenLDAP

Im pretty new to LDAP and AD. I have to port our present authorization/authentication structure from AD to OpenLDAP. Is it possible to run the entire setup in windows? What are the steps for migration ...
3
votes
1answer
3k views

OpenLDAP client configuration headache in FreeBSD

I am using FreeBSD 7.2 as an NFS server, and as a client to an OpenLDAP server (which runs Debian etch). When users access their files on the NFS server, the users' UIDs are looked up in the ldap ...
3
votes
3answers
478 views

LDAP Schema Layout

I have found plenty of resources/tutorials on installing OpenLDAP on Ubuntu, and I have successfully configured my server (up and running and successfully authenticating). My question relates to how I ...
3
votes
1answer
147 views

Chasing referrals in Ldap

I'm currently improving a program featuring an ldap integration. This ldap integration is currently not able to handle ldap referrals. I do understand, that i will gen entries back that will hold the ...
3
votes
1answer
291 views

inotify in bash script doesn't work with ldapadd command

I have written a bash script which detects if a .ldif file has been written into a directory and if written, executes an ldapadd command and then deletes that file. The scripts is as follows: ...
3
votes
1answer
2k views

Why ldapsearch is not working with anonymous bind after upgrading OpenLDAP to v2.4?

I have a setup of OpenLDAP v2.3 which I am using for last few years. Following are the lines in slapd.conf for access control. access to dn.one="o=abc, c=IN" by * read access to ...
3
votes
1answer
2k views

Configure Freeradius to check a connecting user against multiple LDAP groups

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP. The modules/ldap file ...
3
votes
1answer
921 views

Pidgin, OpenLDAP, Users changing own passwords

My issue I think boils down to OpenLDAP. I want my users to be able to change their passwords using the Pidgin chat client. At the moment, I have to set their passwords, and it's a pain. OpenLDAP ...
3
votes
1answer
289 views

Limit VPN login to members of a group

I'm running Cisco ASA5520's with PIXOS 8.2(1). I have my vpn setup to authenticate users from my ldap server. I need to be able to limit them to a specific group. My login base dn is ...
3
votes
1answer
2k views

ldapadd, slapadd, ldapmodify hang when trying to add entries

I have recently installed OpenLDAP on Solaris-10. Whether using slapadd, ldapadd, or ldapmodify, I am able to establish the root node and the child, but when I try to add an entry for a person under ...
3
votes
3answers
12k views

Configuring OpenLDAP as a Active Directory Proxy

We try to set up an Active Directory server for company-wide authentication. Some of the servers that should authenticate against the AD are placed in a DMZ, so we thought of using a LDAP-server as ...