OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

learn more… | top users | synonyms

2
votes
1answer
122 views

Passwords not working after migration from /etc/shadow to LDAP

I've migrated RHEL6 user accounts from traditional /etc/passwd, /etc/shadow, and /etc/group files to OpenLDAP. However, trying to log in as the migrated users does not work because of incorrect user ...
2
votes
1answer
420 views

ldap_add: Protocol error (2) additional info: no attributes provided

I'm following this guide to migrate existing users in /etc/passwd and /etc/group on a RHEL6 machine to a new, external OpenLDAP server. I'm trying to apply this file: # cat people_group.ldif dn: ...
2
votes
1answer
366 views

ldap_modify: Insufficient access (50) when changing password

I'm trying to modify the LDAP admin password on a fresh OpenLDAP install on CentOS 6.7 (similar to RHEL 6.7). I created a file called change_ldap_password.ldif: # Hash your password: # slappasswd -h ...
0
votes
1answer
459 views

ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) for ldapi:/// on CentOS

(This is a follow-up to ldap_modify: Insufficient access (50) when changing password as we identified a separate issue during diagnostics.) Before modifying the cn=config LDAP database, I'm trying to ...
3
votes
1answer
153 views

Master is Dead - Promote LDAP Slave to Master

I have inherited an undocumented openLdap setup - one Master server with two slaves. The Master died hard last night - disc corruption - the backup was a clone system on the same server and disk - so ...
0
votes
1answer
139 views

Reset Passwords of LDAP-Users at the first login

I have an LDAP Installation running on an Centos7 system. I want to create a big number of users. Those users will get a default password, so I want them to change the password at the (only)first ...
3
votes
2answers
2k views

How to add admin users in 389 LDAP, fedora directory server

I want to create couple of Admin users who have access to create/delete users on a particular group/Organization Unit. For example, User: uid=testadmin, ou=people, dc=my,dc=net Should have access ...
0
votes
0answers
26 views

Delete root dse from 389 directory server

I have a mail server with kolab 3 installed, when I was installing the server, for testing purposes, i created a second domain that I'll name test.com, now I want to delete this domain from my ldap ...
0
votes
1answer
659 views

Openldap - ldap user can't add entry: Insufficient access (no write access to parent)

I'ld like to make an addressbook in LDAP (for mailing clients, in first step for my RoundCube). Server is Debian 7.9, slapd 2.4.31 (OpenLDAP). After the successfully installation, I've created a ...
6
votes
2answers
12k views

LDAP: backup with slapcat vs ldapsearch

Used: openldap-servers-2.4.23-34.el6_5.1.x86_64 Task: create script for crontab to create scheduled database full backup. 1) slapcat - create file in in the default format, Berkeley DB. 2) slapcat ...
0
votes
2answers
207 views

Unable to get OpenLDAP with TLS working

I have an OpenLDAP 2.4.39 server running on a Centos 7 host which is populated with a minimal set of data. It work as expected when TLS is not used. I use this for authentication with dokuwiki today. ...
3
votes
4answers
9k views

How to add new attribute to an existing LDAP user objects

I want to add mail attribute to the existing ldap users. I think, its possible with using ldapmodify but not sure how. I have done that using phpldapadmin web GUI manually, but I have like more than ...
0
votes
0answers
38 views

Configure ldap.conf host with ipv6

In my ldap.conf is it possible to use HOST to configure an IPv6 address? I know that I can configure an IPv6 address using URI. The linux manual on ldap.conf doesn't state if it only support IPv4 for ...
0
votes
0answers
14 views

restore parts of an LDAP Database

Let's say I have a replicated LDAP setup and someone comes along and deletes an account by accident. Naturally this deletion then gets replicated to all the slaves. How would one go about restoring ...
1
vote
1answer
51 views

OpenLDAP using ipv6 link-local address “Can't contact LDAP Server (-1)”

I'm trying to use IPV6 to connect to my LDAP server. Everything works if I use ipv4 but I'm not ipv6 link-local address. I used the following command on my server using its own ipv6 address. Any clue ...
0
votes
2answers
359 views

Connection from samba to LDAP server failed

I use samba (3.4) and OpenLDAP (2.4) for file sharing and directory service. Some days ago, I noticed that samba has problem in connection to the LDAP service while beforehand it was working ...
0
votes
0answers
63 views

Requesting parent OU doesn't seem to work right with Meta-Backend OU as child

I got a huge problem here. I’ve been trying to merge users from a local LDAP (ou=local-users,ou=accounts,dc=domain: which authenticates against a remote active directory (which is not ...
1
vote
2answers
44 views

OpenLDAP Server nested Group search string

i got a small problem here regarding OpenLDAP. The problem is to search for the member of nested groups. Lets say i have this construct: dn=domain,dn=local ou=people cn=marvyn (inetOrgPerson) ...
0
votes
1answer
258 views

(Zimbra)OpenLDAP SSHA512

So, our employees use the Zimbra OpenLDAP, however, since this doesnt include PosixAccount we cant automatically link it to our Synology. So my boss wanted me to create an OpenLDAP Database, and ...
0
votes
2answers
524 views

Importing database in LDAP creates error

I have exported my database using the following function slapcat > ldif While I am importing database in other LDAP server it creates error. I am using the following function slapadd -l ldif. ...
0
votes
1answer
23 views

Want to integrate SVN with the apacheds user's

Currently i have SVN installed in the centos server with which currently authenticating with ssh user's from the same server. I have installed ApacheDS in centos intending to authenticate with ...
0
votes
1answer
52 views

Must the name of an ldap group be unique?

As we are setting up an openldap with multiple locations. Must the names of the groups be unique? For example the vpn , adm, sudo group will be in NL but also in BE. What is best practice? Could the ...
0
votes
1answer
138 views

what does it mean ? openldap: TLS: no unlocked certificate for certificate '<some certificate subject>'

just spent a lot of time with centos 6.7 and openldap. it was configured with simple certificates and a root-ca in nice little pem files, but after an upgrade from centos 6.4, connecting to the slapd ...
0
votes
1answer
75 views

Custom schema for OpenLDAP 2.4

I am new to OpenLDAP administration. My aim is to learn how to create custom schemas, and customize "my" directory server this way. I tried to add one optional attribute - ipPhone. Made a schema ...
0
votes
2answers
2k views

ldapsearch returns result, but getent does not

I am setting up a fresh CentOS 7 server to and need to setup LDAP authentication i.e. there already exists a server that authenticates users, which we use for other GNU/Linux servers. For instance, ...
0
votes
1answer
176 views

Allowing OpenLDAP users to change their own password

I seem to be missing something, I have logged in successfully via LDAP as user cent, however I am not able to change the user "cent" (me) password: [cent@elasticmaster2 ~]$ ldappasswd -H ...
0
votes
0answers
96 views

CentOS7 ldap client not authenticating with ldap server

I am using ApacheDS which was a breeze to setup thanks to the apacheds mailing list. I am able to retrieve ldapsearch results, however, I am not able to get anything by doing a:"getent passwd ". ...
2
votes
0answers
33 views

Modules memberof.la and syncprov.la missing

I´ve install a openLDAP on a debian box. To use back-sql I need to compile it from scratch. I also enable modules memberof and syncprov. ./configure --enable-sql --enable-memberof --enable-memberof ...
0
votes
1answer
72 views

Openldap Acl update error

I was trying to modify the current ACL rule in openldap by removing the current rule and updating it with a new one via new acl.ldif file using the below command. ldapmodify -xWD cn=admin,cn=config ...
0
votes
1answer
100 views

How can I use an objectCategory attribute on slapd?

I am a bloody LDAP newbie. I have managed to set up slapd (which is part of OpenLDAP) with LAM as a frontend and have successfully configured several services to connect to it for user/group ...
0
votes
3answers
185 views

OpenLdap Password

I am using OpenLDAP 2.4.23 on Ubuntu 11.04. Every thing is working fine. I am using other server to authenticate via LDAP and that is working well. At the connecting server I am using a configuration ...
0
votes
1answer
60 views

Openldap ACLs don't work

I have following structure: dc=th,dc=company,dc=com | |->dmc | |->dmc_customer_company I create a group to manage write access to dmc_customer_company. Groups, divide by ...
0
votes
1answer
83 views

openldap, crypt passwords do not work for sasl

I've been working on migrating an existing server cluster to using openldap for user/password management. I've run into a problem though - I do not have access to plain text passwords and all SASL ...
8
votes
5answers
20k views

CentOS openLDAP cert trust issues

# LDAPTLS_CACERTDIR=/etc/ssl/certs/ ldapwhoami -x -ZZ -H ldaps://ldap.domain.tld ldap_start_tls: Can't contact LDAP server (-1) additional info: TLS error -8172:Peer's certificate issuer has ...
2
votes
1answer
82 views

different ldapsearches , no output

when I use ldapsearch -LLLZZ -H ldap://centos7s.domen.lan -x I get everything out: dn: dc=domen,dc=lan objectClass: domain dc: domen o: domen.lan organization description: The Domen Company dn: ...
1
vote
1answer
190 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
0
votes
0answers
32 views

Yast authentication server configuration: Global settings empty

I try to enable TLS/SSL for my LDAP-Server on a SLES12. So I enabled LDAP over SSL (ldaps) in Yast > Authentication Server Configuration > Startup Configuration. Fine so far. But when it comes ...
2
votes
3answers
13k views

ldapadd/ldapmodify: clarifications needed about these comamnds

The ldapmodify man page states that: The default for ldapmodify is to modify existing entries Yet when I try to import an LDIF file with ldapmodify I get the below error: ldapmodify: modify ...
3
votes
1answer
279 views

Integrating postfix with LDAP to eMail Users with Access to A Specific Host

I have a working openLDAP v3 installation under Ubuntu 14.04 (slapd 2.4.31-1) with phpldapadmin, sudo-ldap and other packages installed. I'm trying to integrate postfix with LDAP so I can send emails ...
1
vote
4answers
5k views

OpenLDAP & Posix Groups/Account

I'm not able to add posix users/groups to this newly created ldap directory. OpenLDAP version is 2.4.19. The LDIF I've populated the LDAP directory is probably the problem, but I'm not sure what I ...
0
votes
0answers
75 views

Windows Server 2008 R2 + Active Directory + Extended Schema Custom Attribute for RDN

I am migrating my ldap schema from OpenLDAP to Microsoft AD. I have added my schema changed to AD schema. I am using a custom attribute called "UniqueID" to store rdn of each entry in the Ldap Server ...
0
votes
1answer
351 views

Slaptest, bad configuration file

I have been struggling to start LDAP server and I am failing miserably at it, from journalctl -xn I it clearly say bad configuration files!, but there are three configuration files, but what is ...
0
votes
1answer
89 views

OpenLDAP: Why would you ever use refreshOnly for replication?

I'm reading about OpenLDAP replication and I don't understand why you would use refreshOnly mode vs. refreshAndPersist mode. I've tried to do some searching online, but wasn't able to find any ...
6
votes
3answers
11k views

Calculate Days Since 1/1/1970

How can you calculate the number of days since 1/1/1970? This is for updating the shadowLastChange attribute on OpenLDAP. Is there a way to do this using the linux date command?
0
votes
1answer
402 views

phpldapadmin can not connect to openldap

I have a freshly installed openldap server, version 2.4.39. phpldapadmin is also installed on the same server, version 1.2.3 Openldap is working . I can connect to it using other ldap brower tools. ...
1
vote
1answer
221 views

How can I configure openLDAP to lookup userPassword via FreeRadius?

I am running Ubuntu 12.04 and OpenLDAP 2.4.28-1.1ubuntu4.5. I have users populated in LDAP with userPassword attribute being an {SHA1} hash. Users are able to login over SSH and authenticate to web ...
0
votes
1answer
57 views

Store OpenLDAP connection on a php session with cookies [closed]

Só I have a ldap server that should be managed via php, I can modify anything in Apache,OpenLDAP or php. But as this site already covered I can't store a LDAP connection in a _SESSION variable on ...
1
vote
0answers
267 views

Open Directory Password Change Issues on OS X Server 10.10

I'm having a problem with 50+ workstations (10.9 and 10.10) when a user changes their OD password (either at the OS X login screen or the System Preferences). The password change updates on the ...
0
votes
1answer
137 views

slapd running fine and listening on port 389, but still can't contact

Here is my ldapsearch command with debug (I've masked my real IP address): $ sudo /usr/local/bin/ldapsearch -H ldap://99.99.99.99 -b dc=my-domain,dc=com -x -d -1 ...
0
votes
0answers
114 views

olcRequires: difference between authz and bind (with olcDisallows: bind_anon)?

With OpenLDAP, what is the difference between: olcDisallows: bind_anon oldRequires: bind and: olcRequires: authc It seems to me that both configurations would require the client to authenticate ...