Questions tagged [openldap]

OpenLDAP Software is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. LDAP is a platform-independent protocol for querying and modifying data using directory services running over TCP/IP.

Filter by
Sorted by
Tagged with
17 votes
2 answers
37k views

Configure OpenLDAP with TLS=required

Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
Halfgaar's user avatar
  • 8,174
20 votes
2 answers
38k views

How do I configure Reverse Group Membership Maintenance on an openldap server? (memberOf)

I am currently working on integrating LDAP authentication into a system and I would like to restrict access based on LDAP group. The only way to do this is via a search filter and therefore I believe ...
emills's user avatar
  • 774
10 votes
3 answers
20k views

Disallow global anonymous bind with cn=config

With slapd.conf you could globally disable anonymous binding and require authentication with the following static directives: disallow bind_anon require authc How can I achieve the same global ...
Michael P's user avatar
  • 297
35 votes
2 answers
90k views

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less ...
Arlukin's user avatar
  • 1,233
15 votes
2 answers
26k views

Basic openldap setup using slapd.d configuration

I'm trying to set up a test openldap server, having not worked with openldap before. I'm using the standard openldap-servers package on a redhat based machine (using Oracle Linux). I've installed the ...
thecoop's user avatar
  • 287
16 votes
2 answers
42k views

LDAP: backup with slapcat vs ldapsearch

Used: openldap-servers-2.4.23-34.el6_5.1.x86_64 Task: create script for crontab to create scheduled database full backup. 1) slapcat - create file in in the default format, Berkeley DB. 2) slapcat ...
setevoy's user avatar
  • 334
5 votes
2 answers
20k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
Totor's user avatar
  • 95
5 votes
2 answers
8k views

dn-based linux groups from ldap

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass? More broadly, is there any way I can avoid having one set of groups for ...
Brad Mace's user avatar
  • 1,024
1 vote
1 answer
3k views

nagios - Web interface: authentication through kerberos OK, what about authorization on cgi.cfg?

I have successfully installed nagios, and it provides authentication through apache2 which contacts a kerberos authentication server to authenticate users. Now, users are authenticated, but they don'...
philippe's user avatar
  • 2,373
12 votes
9 answers
17k views

OpenLDAP TLS Authentification

I am trying to implement TLS as per https://help.ubuntu.com/lts/serverguide/openldap-server.html When I try to modify cn=config database with this ldif file: dn: cn=config add: ...
Amar Prasovic's user avatar
11 votes
4 answers
44k views

ldap_modify: Other (e.g., implementation specific) error (80), <olcAccess> handler exited with 1

When modifying the Open-LDAP configuration using: dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=...
Mildred's user avatar
  • 825
10 votes
1 answer
18k views

OpenLdap TLS authentication setup

I am trying to setup openldap on ubuntu 12.04 by following this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html When I tried to enable TLS on the server by creating a self signed ...
CrazycodeMonkey's user avatar
8 votes
10 answers
23k views

Using Lets Encrypt certificates with openLDAP

I've been running an openLDAP server for several months now and we use it to authenticate for a number of applications. A previous staff member set up the server and it doesn't seem to be a standard ...
shaneoh's user avatar
  • 424
7 votes
5 answers
82k views

How to set ulimits in Solaris 10

I normally use pam_limits.so and /etc/security/limits.conf to set ulimits on file size, CPU time, etc. for the regular users logging in to my server running Ubuntu. What is the best way of doing ...
user avatar
7 votes
2 answers
23k views

How do you set password-hash for OpenLDAP?

I have the following version on Ubuntu 12.04: OpenLDAP: slapd (Sep 19 2013 22:49:31) $ buildd@batsu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd OpenLDAP now offers SSHA as the default ...
CppLearner's user avatar
6 votes
1 answer
35k views

How can Samba be configured to use LDAP for authentication only?

I'm looking to set up a new Samba file share that uses LDAP for back-end authentication. The LDAP server is already set up, and the machine the Samba server will be on is already set up to allow SSH ...
Brian Bauman's user avatar
4 votes
2 answers
12k views

Is there any bad thing happens if I change /etc/ldap/slapd.d/cn=config.ldif manually?

Since 2.3, OpenLDAP uses a configuration engine called slapd-config. They said that use it make all LDAP configuration can be changed on fly. This is the header of /etc/ldap/slapd.d/cn=config.ldif: #...
HVNSweeting's user avatar
3 votes
3 answers
10k views

How to set Maximum Password Expiry in OpenLDAP Linux

I am trying to find how to change some password policy settings in OpenLDAP (on a system-wide level, not on a per user level) such that all LDAP account users (i.e., existing and new users) have their ...
Dominiqs's user avatar
  • 187
2 votes
1 answer
4k views

LDAP Login fails, but su to ldap users works

I have a new ldap setup and I am trying to login, either directory to the machine or remotely over SSH. When I try to actually login, my authentication fails. If I login with a local user, (root), ...
Tom's user avatar
  • 21
0 votes
1 answer
3k views

LDAP dying for unknown reasons

We're using LDAP as a backend user database for our drupal sites (drupal reads from/and writes to it). LDAP has been running fine for weeks but for some reason it justs stopped running today. I was ...
Max's user avatar
  • 3,563
0 votes
1 answer
2k views

How to setup SASL Proxy Authorization with an OpenLDAP server on Debian

For Kerberos Authentication together with SASL/GSSAPI Authorization on client devices I need Proxy Authorization on an OpenLDAP server running on Raspberry Pi with Debian/Raspbian Buster. I tried to ...
Ingo's user avatar
  • 475
16 votes
5 answers
41k views

Setting up RADIUS + LDAP for WPA2 on Ubuntu

I'm setting up a wireless network for ~150 users. In short, I'm looking for a guide to set RADIUS server to authenticate WPA2 against a LDAP. On Ubuntu. I got a working LDAP, but as it is not in ...
Morten Siebuhr's user avatar
15 votes
4 answers
56k views

Why does this ldapadd command quit with an "Invalid syntax" error?

I'm very new to openldap but extremely well versed in the linux/unix environment. I'm trying to setup my very first test openldap environment using the guide here. I've also read most of the admin ...
nullByteMe's user avatar
14 votes
2 answers
47k views

"no global superior knowledge" while adding a country

I must add an organizationalunit like this into a freshly installed OpenLDAP (on Ubuntu 12.04) : dn: ou=MYREGION, ou=MYAPP, ou=GROUPS, o=myorganization, c=fr ou: MYREGION objectClass: top objectClass:...
Anthony O.'s user avatar
14 votes
3 answers
97k views

ldap_modify: Insufficient access (50)

I am running an OpenLDAP 2.4 server that uses the SSL service for communication. It works for lookups. I am trying to add mirror mode replication. So this is the command that I'm executing: ...
Lynn Owens's user avatar
12 votes
5 answers
12k views

Small, simple LDAP server as an alternative to OpenLDAP [closed]

I have taken a look at the installation and configuration instructions for the newer OpenLDAP releases and decided that it's too much work to set up for my small userbase. Basically, I only use LDAP ...
jstarek's user avatar
  • 638
12 votes
3 answers
33k views

How do I get openldap on Centos 6 to write anything to it's log files

I don't get any information in my log file for openldap on my Centos 6 server. This is how i configured it. SELinux is disabled at the moment. First created a folder where I'd like to store the log ...
Arlukin's user avatar
  • 1,233
10 votes
3 answers
21k views

"wrong attributetype" when using ldapadd

When attempting to load the following configuration dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcMirrorMode olcMirrorMode: TRUE I get the following error: root@box:~# ldapadd -Y ...
seb's user avatar
  • 391
10 votes
5 answers
38k views

ldap_add: Constraint violation (19)

I'm having issues importing users with ldapadd and ldif files. The error I'm getting is: ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed The ...
Max's user avatar
  • 3,563
9 votes
4 answers
31k views

How to disable an LDAP account?

The LDAP uses the posixAccount schema and related attributes and I wonder if there's a standardized way to disable an account. Re-enabling the account should obviously re-enable the former password. ...
Raphaël Hertzog's user avatar
9 votes
6 answers
16k views

No Root DSE returned from OpenLDAP

I'm trying to set up an OpenLDAP server on ubuntu 9.10, which uses slapd version 2.4.18. After initializing and populating a new hdb database, everything seems OK, but I can not get the server to ...
user avatar
9 votes
1 answer
46k views

ldap export and import

Is it possible to export all the data inside openldap for example using ldapsearch or some other tool to a (ldif?) file and then import everything on another server and put this in a script that would ...
Jure1873's user avatar
  • 3,722
8 votes
4 answers
49k views

How to add new attribute to an existing LDAP user objects

I want to add mail attribute to the existing ldap users. I think, its possible with using ldapmodify but not sure how. I have done that using phpldapadmin web GUI manually, but I have like more than ...
Ramesh Kumar's user avatar
  • 1,780
8 votes
2 answers
36k views

ldap_add error (80) <olcModuleLoad> handler exited with 1

I'm trying to follow this tutorial to setup a basic LDAD server (OpenLDAP) for cleint authentication, but I am stuck on the step where I add the back-end configuration. I've created my backend.ldif ...
Nick's user avatar
  • 4,656
8 votes
2 answers
14k views

how to configure open ldap to work on localhost

From the documentation: Use your favorite editor to edit the provided slapd.conf(5) example (usually installed as /usr/local/etc/openldap/slapd.conf) to contain a BDB database definition of ...
Itay Moav -Malimovka's user avatar
7 votes
1 answer
34k views

How to add a new attribute to an existing LDAP objectclass?

I created a custom LDAP objectClass, but forgot a couple attributes before I added it to my OpenLDAP server. I followed the instructions on this Ubuntu doc page: https://help.ubuntu.com/12.04/...
David R.'s user avatar
  • 637
6 votes
2 answers
6k views

Multiple LDAP servers with mod_authn_alias: failover not working when the first LDAP is down?

I've been trying to setup redundant LDAP servers with Apache 2.2.3. /etc/httpd/conf.d/authn_alias.conf <AuthnProviderAlias ldap master> AuthLDAPURL ldap://192.168.5.148:389/dc=domain,dc=...
quanta's user avatar
  • 51.8k
6 votes
4 answers
12k views

Caching OpenLDAP credentials for offline use on laptops

Our clients (Ubuntu 14.04) can login with there LDAP login. As soon as they have no network they cannot login with LDAP. Is there a way to cache those passwords and usernames, so that the laptops ...
Joeri Feyen's user avatar
6 votes
3 answers
8k views

Linux console is unusable when LDAP server is down

When our OpenLDAP server lost power the CentOS machines' console became nearly unusable. We were trying to login with a local account, but each command would take minutes to return. Even simple ...
csexton's user avatar
  • 487
5 votes
1 answer
9k views

OpenLDAP ACL to allow users to change their password

What ACL should be added slapd.conf to allow users to change their password. We are now having the default ACL allowing only rootdn the rights to modify while allowing reading by everyone including ...
nitins's user avatar
  • 2,599
5 votes
2 answers
16k views

OpenLDAP/SSSD Automatically Add User to Local Group

I've got a host of servers running various flavors of Linux all setup as OpenLDAP clients via SSSD. I added an LDAP group (sysadmins). I also added a sysadmins group on all of my servers. The members ...
Ken J's user avatar
  • 201
5 votes
4 answers
12k views

Can't use EXTERNAL authentication after enabling TLS in ldap-2.4

I used the following LDIF file to activate the TLS support for the LDAP server: dn: cn=config changetype: modify add: olcTLSCipherSuite olcTLSCipherSuite: NORMAL - add: olcTLSCRLCheck olcTLSCRLCheck:...
user202's user avatar
  • 53
5 votes
3 answers
24k views

openLDAP ldap_modify: Server is unwilling to perform (53) when trying to delete custom schema

I have created this custom and very basic schema: objectclass ( 2.25.2.2.1 NAME 'myObjectClass' DESC 'myObjectClass objectclass' STRUCTURAL MUST ( cn ) ) I have added it without ...
Marco Antonio Suárez Peña's user avatar
5 votes
3 answers
15k views

Ubuntu OpenLDAP: TLS init def ctx failed: -1

I had a working OpenLDAP but broke it while trying to configure SSL using the instructions here: https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html. Now I'm getting the following error ...
pandoh's user avatar
  • 83
4 votes
2 answers
19k views

what is the simple Command to check password expiry time of an openldap user account

I am running openldap 2.3.43.el5 on RHEL 5.3 I am trying to find a simple command that will tell you when the password for an ldap user will expire, any help would be greatly appreciated.This would ...
Dominiqs's user avatar
  • 187
4 votes
1 answer
17k views

ldap_modify: Insufficient access (50) when changing password

I'm trying to modify the LDAP admin password on a fresh OpenLDAP install on CentOS 6.7 (similar to RHEL 6.7). I created a file called change_ldap_password.ldif: # Hash your password: # slappasswd -h ...
Leo's user avatar
  • 983
4 votes
2 answers
3k views

Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation

What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
pfo's user avatar
  • 5,708
4 votes
3 answers
13k views

Persuading openldap to work with SSL on Ubuntu with cn=config

I simply cannot get this (TLS connection to openldap) to work and would appreciate some assistance. I have a working openldap server on ubuntu 10.04 LTS, it is configured to use cn=config and most of ...
Roger's user avatar
  • 171
4 votes
1 answer
10k views

OpenLDAP cannot add new schema

I'm trying to add new schema to my OpenLDAP server. The version of slapd is 2.4.23. I'm using Debian 6. If I understood it well, slapd 2.4+ uses OLC configuration with (cn=config) by default for this ...
shadox's user avatar
  • 185
4 votes
1 answer
7k views

Configure Freeradius to check a connecting user against multiple LDAP groups

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP. The modules/ldap file ...
spidernik84's user avatar