OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

learn more… | top users | synonyms

30
votes
2answers
77k views

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less ...
14
votes
2answers
27k views

How do I configure Reverse Group Membership Maintenance on an openldap server? (memberOf)

I am currently working on integrating LDAP authentication into a system and I would like to restrict access based on LDAP group. The only way to do this is via a search filter and therefore I believe ...
12
votes
2answers
10k views

Configure OpenLDAP with TLS=required

Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
6
votes
3answers
8k views

Disallow global anonymous bind with cn=config

With slapd.conf you could globally disable anonymous binding and require authentication with the following static directives: disallow bind_anon require authc How can I achieve the same global ...
4
votes
2answers
4k views

dn-based linux groups from ldap

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass? More broadly, is there any way I can avoid having one set of groups for ...
3
votes
2answers
11k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
1
vote
1answer
1k views

nagios - Web interface: authentication through kerberos OK, what about authorization on cgi.cfg?

I have successfully installed nagios, and it provides authentication through apache2 which contacts a kerberos authentication server to authenticate users. Now, users are authenticated, but they ...
5
votes
2answers
6k views

Basic openldap setup using slapd.d configuration

I'm trying to set up a test openldap server, having not worked with openldap before. I'm using the standard openldap-servers package on a redhat based machine (using Oracle Linux). I've installed the ...
7
votes
5answers
68k views

How to set ulimits in Solaris 10

I normally use pam_limits.so and /etc/security/limits.conf to set ulimits on file size, CPU time, etc. for the regular users logging in to my server running Ubuntu. What is the best way of doing ...
4
votes
2answers
4k views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
0
votes
1answer
1k views

Ubuntu OpenLDAP and Mac OS X Roaming Profiles

Today, I'm installing OpenLDAP on Ubuntu 11.04. I have gone through the installation before a few times, but what I have never been able to do is use Mac OSX Lion's Directory Utility to administer ...
0
votes
3answers
915 views

How to set Maximum Password Expiry in OpenLDAP Linux

I am trying to find how to change some password policy settings in OpenLDAP (on a system-wide level, not on a per user level) such that all LDAP account users (i.e., existing and new users) have their ...
0
votes
1answer
2k views

LDAP dying for unknown reasons

We're using LDAP as a backend user database for our drupal sites (drupal reads from/and writes to it). LDAP has been running fine for weeks but for some reason it justs stopped running today. I was ...
14
votes
5answers
32k views

Setting up RADIUS + LDAP for WPA2 on Ubuntu

I'm setting up a wireless network for ~150 users. In short, I'm looking for a guide to set RADIUS server to authenticate WPA2 against a LDAP. On Ubuntu. I got a working LDAP, but as it is not in ...
5
votes
3answers
4k views

Linux console is unusable when LDAP server is down

When our OpenLDAP server lost power the CentOS machines' console became nearly unusable. We were trying to login with a local account, but each command would take minutes to return. Even simple ...
6
votes
2answers
15k views

How do I get openldap on Centos 6 to write anything to it's log files

I don't get any information in my log file for openldap on my Centos 6 server. This is how i configured it. SELinux is disabled at the moment. First created a folder where I'd like to store the log ...
4
votes
3answers
13k views

Configuring OpenLDAP as a Active Directory Proxy

We try to set up an Active Directory server for company-wide authentication. Some of the servers that should authenticate against the AD are placed in a DMZ, so we thought of using a LDAP-server as ...
2
votes
2answers
5k views

Is there any bad thing happens if I change /etc/ldap/slapd.d/cn=config.ldif manually?

Since 2.3, OpenLDAP uses a configuration engine called slapd-config. They said that use it make all LDAP configuration can be changed on fly. This is the header of /etc/ldap/slapd.d/cn=config.ldif: ...
4
votes
2answers
2k views

Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation

What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
1
vote
3answers
2k views

OpenLDAP & Samba for Mac home drives

We are in the process of setting up our existing OpenLDAP (on Ubuntu) to provide authentication and MCX etc for our Macs. We are hitting a problem with our home directories - they work fine using AFP ...
0
votes
1answer
109 views

SASL Auth against LDAP

So I am running into a whirlwind of issues with my cyrus install. I am setting up a multi-domain kolab groupware solution. I am on centos 6.7 I am getting this flooding my error logs when I try to ...
6
votes
2answers
10k views

LDAP: backup with slapcat vs ldapsearch

Used: openldap-servers-2.4.23-34.el6_5.1.x86_64 Task: create script for crontab to create scheduled database full backup. 1) slapcat - create file in in the default format, Berkeley DB. 2) slapcat ...
6
votes
5answers
4k views

Small, simple LDAP server as an alternative to OpenLDAP [closed]

I have taken a look at the installation and configuration instructions for the newer OpenLDAP releases and decided that it's too much work to set up for my small userbase. Basically, I only use LDAP ...
5
votes
2answers
17k views

“no global superior knowledge” while adding a country

I must add an organizationalunit like this into a freshly installed OpenLDAP (on Ubuntu 12.04) : dn: ou=MYREGION, ou=MYAPP, ou=GROUPS, o=myorganization, c=fr ou: MYREGION objectClass: top ...
4
votes
2answers
2k views

Multiple LDAP servers with mod_authn_alias: failover not working when the first LDAP is down?

I've been trying to setup redundant LDAP servers with Apache 2.2.3. /etc/httpd/conf.d/authn_alias.conf <AuthnProviderAlias ldap master> AuthLDAPURL ...
4
votes
1answer
4k views

how to configure open ldap to work on localhost

From the documentation: Use your favorite editor to edit the provided slapd.conf(5) example (usually installed as /usr/local/etc/openldap/slapd.conf) to contain a BDB database definition ...
2
votes
1answer
5k views

Persuading openldap to work with SSL on Ubuntu with cn=config

I simply cannot get this (TLS connection to openldap) to work and would appreciate some assistance. I have a working openldap server on ubuntu 10.04 LTS, it is configured to use cn=config and most of ...
3
votes
2answers
191 views

openldap allop overlay configuration

I'm having trouble getting the allop overlay to work. I suspect I'm missing some vital configuration option or that I've done something incorrectly. Any help is greatly appreciated. I need to use ...
2
votes
1answer
183 views

ldap_modify: Insufficient access (50) when changing password

I'm trying to modify the LDAP admin password on a fresh OpenLDAP install on CentOS 6.7 (similar to RHEL 6.7). I created a file called change_ldap_password.ldif: # Hash your password: # slappasswd -h ...
2
votes
1answer
22k views

ldap_modify: Insufficient access (50)

I am running an OpenLDAP 2.4 server that uses the SSL service for communication. It works for lookups. I am trying to add mirror mode replication. So this is the command that I'm executing: ...
2
votes
2answers
736 views

Snow Leopard Hangs when Using OpenLDAP on Linux for Authentication

We have a new iMac on Snow Leopard authenticating against an OpenLDAP directory. Homes are on (automounted) NFSv3 (Linux, kernel-server). NFS seems to work pretty well (if a bit slow, but we don't ...
2
votes
3answers
4k views

No Root DSE returned from OpenLDAP

I'm trying to set up an OpenLDAP server on ubuntu 9.10, which uses slapd version 2.4.18. After initializing and populating a new hdb database, everything seems OK, but I can not get the server to ...
1
vote
1answer
3k views

OpenLDAP cannot add new schema

I'm trying to add new schema to my OpenLDAP server. The version of slapd is 2.4.23. I'm using Debian 6. If I understood it well, slapd 2.4+ uses OLC configuration with (cn=config) by default for this ...
1
vote
1answer
3k views

“wrong attributetype” when using ldapadd

When attempting to load the following configuration dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcMirrorMode olcMirrorMode: TRUE I get the following error: root@box:~# ldapadd -Y ...
1
vote
1answer
1k views

ldap fail after ubuntu upgrade to 12.04

I have upgraded ubuntu from 10.4 to 12.04. After it's done, ldap service is stopped and failed to start again! Now none of other services function! :( I checked error logs and found this: Feb 22 ...
1
vote
2answers
6k views

ldap_modify: Other (e.g., implementation specific) error (80), <olcAccess> handler exited with 1

When modifying the Open-LDAP configuration using: dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by ...
1
vote
1answer
896 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
1
vote
1answer
779 views

Delegate administration rights to OU in OpenLDAP?

How would I allow a user to administer subordinates of only a single OU in an OpenLDAP directory? The goal here is I want the user to be able to create and update users under a specific OU only. I ...
1
vote
1answer
892 views

Credentials caching in OpenLDAP proxy

I am creating LDAP proxy server using OpenLDAP, server will be used for user authentication (using simple bind over SSL/TLS). Is there a way to make OpenLDAP proxy to cache simple bind credentials and ...
1
vote
3answers
11k views

ldap_add: Constraint violation (19)

I'm having issues importing users with ldapadd and ldif files. The error I'm getting is: ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed The ...
1
vote
1answer
563 views

How do I migrate from OpenLDAP to Active Directory?

currently we are running samba and openldap as our PDC. our ultimate goal is to migrate completely over to windows active directory. how would i go about doing this?
0
votes
1answer
93 views

ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) for ldapi:/// on CentOS

(This is a follow-up to ldap_modify: Insufficient access (50) when changing password as we identified a separate issue during diagnostics.) Before modifying the cn=config LDAP database, I'm trying to ...
0
votes
1answer
1k views

What is SSHA-512? How can OpenLDAP support it?

I have two OpenLDAP directory servers. One is a standard Zimbra OpenLDAP server. Accounts are with passwords that are using SSHA-512 hash method. When I copy these accounts to a standard OpenLDAP ...
0
votes
1answer
159 views

Split authentication and NSS lookups for users and groups to different servers

I've asked this question previously: Multiple Bind and base DNs in ldap.conf Since that previous question was answered in the negative, I'm looking for other options such as splitting authentication ...
0
votes
2answers
982 views

getting permission denied while creating rpm through rpm package manager on RHEL 5.3

I am trying to create rpm through rpm package manager. Following is my spec file: **# This is a spec file for openldappkg** %define _topdir /osp/rpmBuildOpenLdap %define name openldap %define ...
0
votes
4answers
459 views

How to know which berkley db openldap is refering to?

I have two berkeley dbs installed on the RHEL 5.3. Now, I am confused that which one openldap is referring as its backend. Following is the slapd.conf: include ...
0
votes
1answer
2k views

slapd not running

I am new to Red Hat Enterprise Linux 5.3(Tikanga) as well as to open ldap.As openldap comes by default with the red hat.So i have installed berkeley database db-5.3.15.tar.gz Version of already ...
0
votes
2answers
3k views

LDAP: “Unacceptable log file” after db recovery

My openldap-2.4.21 server died I so checked the syslog messages and found logs reporting a corrupt db which I tried to fix by issuing: $ /usr/bin/db4.8_recover -v -h /var/lib/ldap/ Finding last valid ...
0
votes
1answer
4k views

LDAP/NFS/PAM/AutoFS : mkhomedir PAM plugin failling

I got a working setup with OpenLDAP (authentication and NFS mount options), NFS server, AutoFS (to mount the NFS homedir) and required PAM plugin. Everything works fine except that the mkhomedir PAM ...
-1
votes
0answers
141 views

How to Change maxPasswdAge parameter in OpenLDAP in Linux [duplicate]

I am trying to find how to change some password policy settings in openLDAP (on a system-wide level - not on a per user level) such that ALL LDAP account users (ie existing and new users) have their ...