5

I am getting started with openLdap 2.4 and am having a bit of trouble, all the examples I see seem to refer to previous versions which used the text config file slapd.conf but from what I see on discussions about v2.4, this has been deprecated.

I thought prehaps I needed to add a user, and log in as them> but when I try and run an ldapadd command, I get a prompt to enter a password:

Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

Notes: I installed openldap server via yum (in fedora 15), and have installed phpldapadminbut also can try things on the command line if anyone has suggestions.

After installing and starting I get the following response from a search:

# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
# extended LDIF
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts 
dn:
namingContexts: dc=my-domain,dc=com    
# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

I am glad to remove and reinstall the server if that helps, can anyone provide a link to tips that works for version 2.4 for a new setup?

2

4 Answers 4

0

slapd.conf still works in OpenLDAP 2.4, however 'de-emphasised' it may be in the documentation.

5

This is old, but the question and non-answer pop up on searches a lot. First, run slappasswd to generate a password.

slappasswd 
New password: ************
Re-enter new password: *************
{SSHA}OM5mbC3/kQPAg8MH6FOqXkATjLjt2IZ2

Then use that value to populate your backend's config.

ldapmodify -Q -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}qUoTRPwppaedqHQTgYOPYWokr3SiXjbK
E0F

Your dn may be different than the dn shown here. The config databases are found, on RHEL7, in /etc/openldap/slapd.d/cn=config. Now you can log in using the default rootdn.

If you wish, you can set your own value for the root dn:

ldapmodify -Q -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=manager,dc=example,dc=com
E0F
2
  • 2
    Is there no cleaner way to do this? Jun 14, 2019 at 10:47
  • 1
    What if I get this: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Jun 14, 2019 at 10:51
2

[2022] OpenLDAP 2.4.49

CVVS's answer from 2014 is almost still applicable. There are only 2 changes necessary to make it work again:

  1. The index of the database is now olcDatabase={1}mdb instead of {2}hdb. (cn=config is kept).
  2. You must use the modification type replace instead of add.

Putting it together:

ldapmodify -Q -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}qUoTRPwppaedqHQTgYOPYWokr3SiXjbK
E0F
1

Here my working solution:

ldapsearch -LLL -Y EXTERNAL -H  ldapi:/// -b cn=config olcRootDN=cn=admin,dc=my,dc=company,dc=com dn olcRootDN olcRootPW

Now create new password by:

NEW_PWD={{TYPE_NEW_PASSWORD_HERE}}

PWD_HASH=$(slappasswd -s ${NEW_PWD})
echo "Your password hash is \"${PWD_HASH}\"."

Paste the following code:

ldapmodify -Y EXTERNAL -H ldapi:/// << E0F
dn: olcDatabase={1}mdb,cn=config
replace: olcRootPW
olcRootPW: ${PWD_HASH}
E0F

You will get:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={1}mdb,cn=config
olcRootDN: cn=admin,dc=my,dc=company,dc=com
olcRootPW: {SSHA}k1S8N/A4eb7Ds8oBgAhb9TmPfVT9vl2U

To fix the two passwords access (the old and new one), paste:

OLD_PWD=admin

ldappasswd -h localhost -p 389 -x -D "cn=admin,dc=my,dc=company,dc=com" -w "${OLD_PWD}" -a "${OLD_PWD}" -s "${NEW_PWD}"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .