OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

learn more… | top users | synonyms

3
votes
1answer
5k views

OpenLDAP on Windows and gssapi32

Upon trying to run OpenLDAP on Windows after a non-eventful installation, I get the error that gssapi32.dll is missing. Reinstalling does nothing to alleviate the problem, nor does altering the ...
3
votes
2answers
936 views

Active Directory using Samba/Open LDAP for user accounts

I know this is the wrong way round... but Is it possible to use AD in front of Samba for our PC clients, so that the user accounts are in Samba/Open LDAP. Managing our fleet of Windows PC's is ...
3
votes
4answers
6k views

OpenLDAP Password Expiration with pwdReset=TRUE?

I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work: Password lockouts on too many failed attempts Password Change required once pwdReset=TRUE added to ...
3
votes
3answers
159 views

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
3
votes
1answer
132 views

OpenLDAP advanced ACL configuration

I have a multiple DITs in my OpenLDAP server. I made user cn=config the root so that cn=config has root access to all DITs (each DIT). In addition, there is a per-DIT administrator IDed as cn=admin,$...
3
votes
1answer
1k views

Alternative methods to handle OpenLDAP's new config syntax slapd.d/cn=config?

I for one feel that configuring OpenLDAP with LDIFs instead of basic configuration files is a major step in the wrong direction. Does anyone have some tools/techniques to more easily manage OpenLDAP ...
3
votes
2answers
814 views

OpenDirectory/LDAP Query Syntax to find all users in a Group for GADS

I would like to construct an LDAP query to find all users that are part of the "Google Apps Users" group (short name: googleappsusers) on my OS X 10.9 Server. When I run the following query in Google ...
3
votes
1answer
496 views

Adding apple.schema from OS X Lion Server fails

When I try to add apple.schema to my OpenLDAP running on Debian this is the error I get; root@directory:~# ldapadd -Y EXTERNAL -H ldapi:/// -f apple.schema SASL/EXTERNAL authentication started SASL ...
3
votes
1answer
3k views

Setting up a Linux client for OpenLDAP over SSL

I'm trying to set up SSL with a server running OpenLDAP (and using OpenSSL, not GnuTLS). The server seems to be working fine: I can authenticate using ldap:// and can also use ldaps:// from Apache ...
3
votes
1answer
261 views

Migrating to LDAP

I've started a new job at a house where they've got an amazingly unruly patchwork of Linux, xBSD, and OpenSolaris boxes. Every box has its own user auth using local /etc/passwd, etc. Users/Groups have ...
3
votes
1answer
3k views

OpenLDAP client configuration headache in FreeBSD

I am using FreeBSD 7.2 as an NFS server, and as a client to an OpenLDAP server (which runs Debian etch). When users access their files on the NFS server, the users' UIDs are looked up in the ldap ...
3
votes
3answers
511 views

LDAP Schema Layout

I have found plenty of resources/tutorials on installing OpenLDAP on Ubuntu, and I have successfully configured my server (up and running and successfully authenticating). My question relates to how I ...
3
votes
1answer
370 views

Chasing referrals in Ldap

I'm currently improving a program featuring an ldap integration. This ldap integration is currently not able to handle ldap referrals. I do understand, that i will gen entries back that will hold the ...
3
votes
2answers
212 views

openldap allop overlay configuration

I'm having trouble getting the allop overlay to work. I suspect I'm missing some vital configuration option or that I've done something incorrectly. Any help is greatly appreciated. I need to use ...
3
votes
1answer
1k views

smbk5pwd overlay on OpenLDAP 2.4

I have an OpenLDAP server and I want to configure the smbk5pwd overlay to make OpenLDAP update the sambaNTPassword and sambaLMPassword attributes automatically when a change occurs on userPassword. ...
3
votes
1answer
407 views

inotify in bash script doesn't work with ldapadd command

I have written a bash script which detects if a .ldif file has been written into a directory and if written, executes an ldapadd command and then deletes that file. The scripts is as follows: dir="/...
3
votes
1answer
4k views

Configuring openldap multimaster replication using cn=config

We currently have a single OpenLDAP server using the cn=config backend. We'd like to add a second OpenLDAP server and configure them for multimaster replication. What do we need to do to enable ...
3
votes
1answer
4k views

Why ldapsearch is not working with anonymous bind after upgrading OpenLDAP to v2.4?

I have a setup of OpenLDAP v2.3 which I am using for last few years. Following are the lines in slapd.conf for access control. access to dn.one="o=abc, c=IN" by * read access to dn.base="o=...
3
votes
1answer
3k views

Configure Freeradius to check a connecting user against multiple LDAP groups

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP. The modules/ldap file ...
3
votes
1answer
1k views

Pidgin, OpenLDAP, Users changing own passwords

My issue I think boils down to OpenLDAP. I want my users to be able to change their passwords using the Pidgin chat client. At the moment, I have to set their passwords, and it's a pain. OpenLDAP ...
3
votes
1answer
300 views

Limit VPN login to members of a group

I'm running Cisco ASA5520's with PIXOS 8.2(1). I have my vpn setup to authenticate users from my ldap server. I need to be able to limit them to a specific group. My login base dn is "dc=example,dc=...
3
votes
1answer
2k views

ldapadd, slapadd, ldapmodify hang when trying to add entries

I have recently installed OpenLDAP on Solaris-10. Whether using slapadd, ldapadd, or ldapmodify, I am able to establish the root node and the child, but when I try to add an entry for a person under ...
3
votes
3answers
1k views

How to allow a group to change user passwords?

I have the following openldap server configuration: access to attrs=userPassword by self write by anonymous auth by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" ...
3
votes
1answer
164 views

Master is Dead - Promote LDAP Slave to Master

I have inherited an undocumented openLdap setup - one Master server with two slaves. The Master died hard last night - disc corruption - the backup was a clone system on the same server and disk - so ...
3
votes
0answers
57 views

users in openLDAP Groups on Windows Server not gaining access to share

I have openldap and samba PDC setup. My windows server is a member of the samba Domain. I have a group created with users. I can see the group on the windows 2008 server, however when I add this group ...
3
votes
2answers
534 views

Apache/PHP ldap stops working. Requires restart of apache

I currently have a setup where users log in to a website using LDAP credentials. It's all internal so I don't really care a ton about certificates. So, in my /etc/openldap/ldap.conf file I have ...
3
votes
1answer
2k views

Mac OS X 10.9 Server authentication using OpenLDAP not working

I have a Debian server that is running OpenLDAP version 2.4.31, and now I am trying to connect my Mac OS X 10.9 Server, so that I can authenticate existing LDAP users. I successfully connected them ...
3
votes
2answers
4k views

OpenLDAP memberOf attribute is not updated after group update

I have an OpenLDAP setup on Debian 7.1, (OpenLDAP 2.4.31), and I am trying to set up the memberof overlay. My configuration is just like I have read at lots of sites throughout the internet, however, ...
3
votes
1answer
931 views

Add memberOf attribute to all users in OpenLDAP on OS X Lion Server Open Directory

Our school's website has the ability to pull user authentication from a LDAP source. They "support" and LDAP. Unfortunately, to pull group membership you must have a memberOf attribute in each users' ...
3
votes
2answers
8k views

Unable to modify schema in OpenLDAP using run-time configuration cn=config

I'm having trouble modifying the schema of an OpenLDAP installation using the run-time configuration (cn=config). What I'm trying to do is modify existing attributes and add new ones to a custom ...
3
votes
2answers
3k views

How to add admin users in 389 LDAP, fedora directory server

I want to create couple of Admin users who have access to create/delete users on a particular group/Organization Unit. For example, User: uid=testadmin, ou=people, dc=my,dc=net Should have access ...
2
votes
8answers
5k views

Find users currently logged in using ldap?

We have Openldap configured here and users are able to use ldap for login to client machines. But any way to check the users currently logged into machines using LDAP ? I would like to find which ...
2
votes
2answers
6k views

Is there any bad thing happens if I change /etc/ldap/slapd.d/cn=config.ldif manually?

Since 2.3, OpenLDAP uses a configuration engine called slapd-config. They said that use it make all LDAP configuration can be changed on fly. This is the header of /etc/ldap/slapd.d/cn=config.ldif: #...
2
votes
4answers
7k views

LDAP: attribute 'givenName' is not allowed

OK, so I am learning and configuring openLDAP for the first time based partly on this tutorial: http://www.rjsystems.nl/en/2100-d6-openldap-provider.php I am trying to add a sample user, but I think ...
2
votes
1answer
4k views

OpenLDAP ACL to allow users to change their password

What ACL should be added slapd.conf to allow users to change their password. We are now having the default ACL allowing only rootdn the rights to modify while allowing reading by everyone including ...
2
votes
2answers
9k views

How to configure OpenLDAP 2.4 with bdb backend?

It seems like OpenLDAP will prefer to using slapd-config(5) instead of slapd.conf(5). But I don't know how to start with slapd-config(5) because I don't know how to set a root password for it. So I'...
2
votes
2answers
3k views

Using Linux & Open LDAP for a Mac Network

I'm looking for resources/suggestions/experience on administering a medium sized network of Macs (300ish) using Open LDAP on Linux rather than using Open or Active Directory. Would like the following ...
2
votes
2answers
9k views

ldap_modify: Other (e.g., implementation specific) error (80), <olcAccess> handler exited with 1

When modifying the Open-LDAP configuration using: dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=...
2
votes
1answer
26k views

ldap_modify: Insufficient access (50)

I am running an OpenLDAP 2.4 server that uses the SSL service for communication. It works for lookups. I am trying to add mirror mode replication. So this is the command that I'm executing: ...
2
votes
1answer
11k views

User not found for cn=config in OpenLDAP?

We're running OpenLDAP on Ubuntu 10.04. I'm able to access and use the front end with cn=admin,dc=ourcompany,dc=com and my password. But I'm unable to change the server's configuration (like loglevel)...
2
votes
1answer
2k views

Is openldap fit for large production deployments?

For about 1 year we've been using openldap on ubuntu server 10.04LTS for authenticating about 20 IT users and everything has been running fine (the operations on the LDAP server were basically limited ...
2
votes
2answers
4k views

How to read a Berkeley DB log file for slapd?

I am running OpenLDAP's slapd on Fedora 14, and I see that in the directory for the database, there is a log.0000000001 file. I would like to be able to read this file, as I am interested in recent ...
2
votes
1answer
137 views

ldap schema in development should it match production?

I been using LDAP for many years now and most of the firms I worked for used a development LDAP schema that was identical to the production and QA (staging) schemas. An example suffix would be: "dc=...
2
votes
1answer
3k views

Impossible to modify or add information after conversion of slapd.conf to cn=config with fresh install of OpenLdap

I start with a fresh installation of openldap 2.4.28 on debian. They are some problem with the debian package, and with gnuTLS, so i compile a version with opennSSL library. It's hard to understand ...
2
votes
2answers
2k views

OpenLDAP on Ubuntu Server 10.04

I've configured OpenLDAP following the Ubuntu guide (with some minor edits, such as setting a proper password, my own domain name, and creating a staff group instead of an example one under people) ...
2
votes
1answer
4k views

Adding inetOrgPerson to account/posixAccount LDAP entries

I have a LDAP database we have been using for managing user accounts on our hosts, these entries have account and posixAccount as objectClass. Now we'd like to extend this to also use it as an adress ...
2
votes
2answers
8k views

Open LDAP Authentication - How to verify userPassword without bind?

What I am doing... Trying to implement single-sign-on for our organization’s all machines, blogs, wiki’s, CRM, HRM, project management tools, SVN, etc, etc... We have OpenLDAP installed and ...
2
votes
1answer
28 views

How to use ldapsearch with SSL on different port (-p does not work)?

I have an OpenLDAP server running in a test environment with a firewall on the LAN forwarding port 8636 back to slapd listening on 636 (for an older application which does not support START_TLS). To ...
2
votes
1answer
540 views

ldap_add: Protocol error (2) additional info: no attributes provided

I'm following this guide to migrate existing users in /etc/passwd and /etc/group on a RHEL6 machine to a new, external OpenLDAP server. I'm trying to apply this file: # cat people_group.ldif dn: ou=...
2
votes
1answer
3k views

openLDAP how to remove the nis schema from the current configuration

openLDAP 2.4 Ubuntu 14.04 I have found this question dn-based linux groups from ldap. I am trying to include the rfc2307bis schema, but it seems the nis schema must be removed from the configuration ...