I am getting started with openLdap 2.4 and am having a bit of trouble, all the examples I see seem to refer to previous versions which used the text config file slapd.conf but from what I see on discussions about v2.4, this has been deprecated.

I thought prehaps I needed to add a user, and log in as them> but when I try and run an ldapadd command, I get a prompt to enter a password:

Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

Notes: I installed openldap server via yum (in fedora 15), and have installed phpldapadminbut also can try things on the command line if anyone has suggestions.

After installing and starting I get the following response from a search:

# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
# extended LDIF
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts 
namingContexts: dc=my-domain,dc=com    
# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

I am glad to remove and reinstall the server if that helps, can anyone provide a link to tips that works for version 2.4 for a new setup?


slapd.conf still works in OpenLDAP 2.4, however 'de-emphasised' it may be in the documentation.


This is old, but the question and non-answer pop up on searches a lot. First, run slappasswd to generate a password.

New password: ************
Re-enter new password: *************

Then use that value to populate your backend's config.

ldapmodify -Q -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}qUoTRPwppaedqHQTgYOPYWokr3SiXjbK

Your dn may be different than the dn shown here. The config databases are found, on RHEL7, in /etc/openldap/slapd.d/cn=config. Now you can log in using the default rootdn.

If you wish, you can set your own value for the root dn:

ldapmodify -Q -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=manager,dc=example,dc=com
  • 1
    Is there no cleaner way to do this? – wieczorek1990 Jun 14 '19 at 10:47
  • What if I get this: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) – wieczorek1990 Jun 14 '19 at 10:51

Here my working solution:

ldapsearch -LLL -Y EXTERNAL -H  ldapi:/// -b cn=config olcRootDN=cn=admin,dc=my,dc=company,dc=com dn olcRootDN olcRootPW

Now create new password by:


PWD_HASH=$(slappasswd -s ${NEW_PWD})
echo "Your password hash is \"${PWD_HASH}\"."

Paste the following code:

ldapmodify -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={1}mdb,cn=config
replace: olcRootPW
olcRootPW: ${PWD_HASH}

You will get:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
dn: olcDatabase={1}mdb,cn=config
olcRootDN: cn=admin,dc=my,dc=company,dc=com
olcRootPW: {SSHA}k1S8N/A4eb7Ds8oBgAhb9TmPfVT9vl2U

To fix the two passwords access (the old and new one), paste:


ldappasswd -h localhost -p 389 -x -D "cn=admin,dc=my,dc=company,dc=com" -w "${OLD_PWD}" -a "${OLD_PWD}" -s "${NEW_PWD}"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.