OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

learn more… | top users | synonyms

4
votes
1answer
400 views

Should I manage Linux Groups in LDAP on a per machine basis?

I am currently running an OpenLDAP Server managing my Linux Users as posixaccount and posixgroup elements like so: dn: cn=shellinger,ou=groups,dc=company,dc=com cn: shellinger gidNumber: 5001 ...
4
votes
3answers
2k views

Restoring openldap configuration from ldif file?

I am trying to restore my OpenLDAP server from an ldif file I made before it went horribly wrong. All of the websites I found talk about using slapadd but when I run slapadd -v -l ...
4
votes
1answer
5k views

ldap_add no such object (32) matched dn dc=domain dc=com

When im trying to import users to LDAP using this command: ldapadd -x -D "cn=Manager,dc=domain,dc=com" -W -f /etc/openldap/root.ldif I have this error: ldap_add no such object (32) ...
4
votes
1answer
408 views

What are best practices to store delegated permissions in OpenLDAP?

My network's core user database is managed by OpenLDAP. Recently we need to introduce a possibility for one user to act on second user's behalf. As all application-related rights and permissions are ...
4
votes
0answers
129 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
4
votes
2answers
3k views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
4
votes
0answers
2k views

Saslauth with ldapdb on debian

I'm trying to get saslauthd working with openldap. ldapsearch and every service connected to openldap works fine. sasldblistusers2 doesn't work - and ldapwhoami does not work either. getent passwd ...
4
votes
1answer
547 views

Trying to authenticate to a Dell PowerConnect 5324 switch using FreeRADIUS and OpenLDAP

So here's the situation. I want to be able to use my LDAP credentials to log into this switch. Since there is no support for LDAP on the switch itself, I figured that FreeRADIUS has an LDAP module, ...
4
votes
1answer
538 views

openldaps wildcard certificate not accepted

my wildcard certificate doesn't get accepted with ldap 2.4.23. when i try to connect i get the following error: TLS certificate verification: subject: ...
4
votes
3answers
2k views

LDAP change user pass on client

I am trying to allow ldap users to change their password on client machines. I have tried pam every which way I can think of /etc/ldap.conf & /etc/pam_ldap.conf, as well. At this point I'm stuck. ...
3
votes
2answers
13k views

“no global superior knowledge” while adding a country

I must add an organizationalunit like this into a freshly installed OpenLDAP (on Ubuntu 12.04) : dn: ou=MYREGION, ou=MYAPP, ou=GROUPS, o=myorganization, c=fr ou: MYREGION objectClass: top ...
3
votes
2answers
1k views

openldap proxied authorization

I'm having some trouble doing updates with proxied authorization. I'm using UnboundID's LDAP SDK to connect to OpenLDAP, and sending a ProxiedAuthorizationV2RequestControl for dn: ...
3
votes
2answers
7k views

How do I migrate user-accounts from OpenLDAP to Active-Directory?

We want to migrate our user-accounts from OpenLDAP to Active-Directory without changing the passwords and such. The users shouldn't notice the difference against which server they're authenticating ...
3
votes
2answers
139 views

Usefulness of an absolute filter on an LDAP query?

I was perusing the source for OpenLDAP and I saw where the root DSE supports something called absolute filters. It looks like it's specified in RFC4526 It looks like the author that originally drafted ...
3
votes
4answers
382 views

How to tag former employees in LDAP structure?

I have ou=People and there I have stored our employees. I have to somehow divide them to our current employees and former employees. What I was thinking about was to create 2 groups, ...
3
votes
2answers
181 views

Is the new cn=config interface in OpenLDAP ready for production?

I recently began learning Samba and OpenLDAP, and have become increasingly frustrated with the apparent disconnect between the old configuration (using slapd.conf) and the new one using the cn=config ...
3
votes
2answers
9k views

How to disable an LDAP account?

The LDAP uses the posixAccount schema and related attributes and I wonder if there's a standardized way to disable an account. Re-enabling the account should obviously re-enable the former password. ...
3
votes
1answer
8k views

LDAP: backup with slapcat vs ldapsearch

Used: openldap-servers-2.4.23-34.el6_5.1.x86_64 Task: create script for crontab to create scheduled database full backup. 1) slapcat - create file in in the default format, Berkeley DB. 2) slapcat ...
3
votes
1answer
689 views

Rename base DN in OpenLDAP

I currently have an LDAP directory (OpenLDAP), which does authentication for a bunch of services running across a number of servers. Let's say the base DN is dc=oldcompany,dc=com. I'd now like to ...
3
votes
1answer
1k views

ldapquery an Active Directory server for users that belongs to a group named X

When I do this at the bash prompt on a CentOS 6.4 ldapsearch -LLL -H ldap://adserver.example.com -x -D someuser@example.com -w somepass -b 'OU=Users,DC=example,DC=com' ...
3
votes
1answer
198 views

What are the differences in schemas of main directory servers?

Active Directory, OpenLDAP or Apple's Open Directory have different schemas for holding user info and group membership. Having a Open Directory here I can say for example that user's Distinguished ...
3
votes
1answer
236 views

When updating the schema in OpenLDAP, should we reload the master or the slave first?

We currently have one master server that is replicated to two read-only slaves. We are adding to the schema. Is it recommended to reload the master first or the slaves?
3
votes
2answers
693 views

Authenticating Exchange with OpenLDAP

Got a customer server coming in that's exchange and I want it to talk to the existing setup, users hate more than one login! Can Exchange 2010 get authentication from OpenLDAP? (running on CentOS ...
3
votes
4answers
319 views

Which identity management products are suitable for small to medium business?

Let's scope out an average setup: Web company About 50 users A few User Groups (Management, Support, Developers, Sys-Admins, Testers, Sales) A bunch of permissions (Only management is allowed to ...
3
votes
1answer
114 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
3
votes
3answers
2k views

How do I renew an expired Ubuntu OpenLDAP SSL Certificate

We went through the steps of revoking an SSL Certificate used by our OpenLDAP server and renewing it but we are unable to start slapd. Here are the commands we used: openssl verify ...
3
votes
2answers
2k views

How do I add olcAuditLogConfig to openldap on Centos 6

Regarding to 'man slapo-auditlog' I should just need to add the following. dn: olcOverlay=auditlog,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: ...
3
votes
1answer
849 views

Where do I find USEFUL official documentation for LDAP authentication on Centos/RHEL 6?

Does it exist any official installation documentation about how to setup an LDAP server that I can connect my clients to with authconfig. I'm will be Centos 6 and RHEL 6.1. What I can find is this. ...
3
votes
2answers
10k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
3
votes
2answers
3k views

Migration from Active directory to OpenLDAP

Im pretty new to LDAP and AD. I have to port our present authorization/authentication structure from AD to OpenLDAP. Is it possible to run the entire setup in windows? What are the steps for migration ...
3
votes
1answer
4k views

OpenLDAP on Windows and gssapi32

Upon trying to run OpenLDAP on Windows after a non-eventful installation, I get the error that gssapi32.dll is missing. Reinstalling does nothing to alleviate the problem, nor does altering the ...
3
votes
2answers
931 views

Active Directory using Samba/Open LDAP for user accounts

I know this is the wrong way round... but Is it possible to use AD in front of Samba for our PC clients, so that the user accounts are in Samba/Open LDAP. Managing our fleet of Windows PC's is ...
3
votes
1answer
3k views

how to configure open ldap to work on localhost

From the documentation: Use your favorite editor to edit the provided slapd.conf(5) example (usually installed as /usr/local/etc/openldap/slapd.conf) to contain a BDB database definition ...
3
votes
4answers
5k views

OpenLDAP Password Expiration with pwdReset=TRUE?

I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work: Password lockouts on too many failed attempts Password Change required once pwdReset=TRUE added to ...
3
votes
1answer
79 views

OpenLDAP advanced ACL configuration

I have a multiple DITs in my OpenLDAP server. I made user cn=config the root so that cn=config has root access to all DITs (each DIT). In addition, there is a per-DIT administrator IDed as ...
3
votes
2answers
151 views

openldap allop overlay configuration

I'm having trouble getting the allop overlay to work. I suspect I'm missing some vital configuration option or that I've done something incorrectly. Any help is greatly appreciated. I need to use ...
3
votes
1answer
609 views

Alternative methods to handle OpenLDAP's new config syntax slapd.d/cn=config?

I for one feel that configuring OpenLDAP with LDIFs instead of basic configuration files is a major step in the wrong direction. Does anyone have some tools/techniques to more easily manage OpenLDAP ...
3
votes
2answers
651 views

OpenDirectory/LDAP Query Syntax to find all users in a Group for GADS

I would like to construct an LDAP query to find all users that are part of the "Google Apps Users" group (short name: googleappsusers) on my OS X 10.9 Server. When I run the following query in Google ...
3
votes
1answer
9k views

How to add a new attribute to an existing LDAP objectclass?

I created a custom LDAP objectClass, but forgot a couple attributes before I added it to my OpenLDAP server. I followed the instructions on this Ubuntu doc page: ...
3
votes
2answers
685 views

Ubuntu 11.04 and OpenLDAP - where is the config?

I've been asked to setup a multimaster LDAP environment on Ubuntu 11.04 - instead of a single master server. I cloned the master server and recreated it into two VMs. I am trying to follow the ...
3
votes
1answer
460 views

Adding apple.schema from OS X Lion Server fails

When I try to add apple.schema to my OpenLDAP running on Debian this is the error I get; root@directory:~# ldapadd -Y EXTERNAL -H ldapi:/// -f apple.schema SASL/EXTERNAL authentication started SASL ...
3
votes
1answer
3k views

Setting up a Linux client for OpenLDAP over SSL

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS). The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
3
votes
2answers
947 views

Logging authentication failure on OpenLDAP

I need to log authentication failure on OpenLDAP. What is the proper log level bit for that? Or is there another configuration for such a thing?
3
votes
1answer
257 views

Migrating to LDAP

I've started a new job at a house where they've got an amazingly unruly patchwork of Linux, xBSD, and OpenSolaris boxes. Every box has its own user auth using local /etc/passwd, etc. Users/Groups have ...
3
votes
1answer
3k views

OpenLDAP client configuration headache in FreeBSD

I am using FreeBSD 7.2 as an NFS server, and as a client to an OpenLDAP server (which runs Debian etch). When users access their files on the NFS server, the users' UIDs are looked up in the ldap ...
3
votes
3answers
481 views

LDAP Schema Layout

I have found plenty of resources/tutorials on installing OpenLDAP on Ubuntu, and I have successfully configured my server (up and running and successfully authenticating). My question relates to how I ...
3
votes
1answer
175 views

Chasing referrals in Ldap

I'm currently improving a program featuring an ldap integration. This ldap integration is currently not able to handle ldap referrals. I do understand, that i will gen entries back that will hold the ...
3
votes
1answer
317 views

inotify in bash script doesn't work with ldapadd command

I have written a bash script which detects if a .ldif file has been written into a directory and if written, executes an ldapadd command and then deletes that file. The scripts is as follows: ...
3
votes
1answer
2k views

Why ldapsearch is not working with anonymous bind after upgrading OpenLDAP to v2.4?

I have a setup of OpenLDAP v2.3 which I am using for last few years. Following are the lines in slapd.conf for access control. access to dn.one="o=abc, c=IN" by * read access to ...
3
votes
1answer
2k views

Configure Freeradius to check a connecting user against multiple LDAP groups

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP. The modules/ldap file ...