I'm trying to add new schema to my OpenLDAP server. The version of slapd is 2.4.23. I'm using Debian 6.

If I understood it well, slapd 2.4+ uses OLC configuration with (cn=config) by default for this version and I don't have to modify anything in slapd.conf or some other point in the cn=config tree (am I wrong?). But when I'm trying to add schema with following command:

ldapadd -x -D "cn=admin,cn=config" -W -f filesystem.ldif

it gives me:

Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

I also tried this command(even if I don't know what I'm doing here):

ldapadd -x -D "cn=admin,dc=linuxcbt,dc=internal" -W -f filesystem.ldif

where dc=linuxcbt,dc=internal is my base, I get:

adding new entry "cn=filesystem,cn=schema,cn=config"
ldap_add: Insufficient access (50)

My filesystem.ldif file is:

dn: cn=filesystem,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: filesystem

olcAttributeTypes: ( 1000.1.1.1 NAME ( 'fn' 'filename' )
   DESC 'Nome del file'
   EQUALITY 'Case exact match'
   SUBSTR caseExactSubstringsMatch

olcAttributeTypes: ( 1000.1.1.2 NAME ( 'fs' 'filesize'  )
   DESC 'Dimensione del file'
   EQUALITY integerMatch
   ORDERING integerOrderingMatch

olcObjectClasses: ( 1000.1.2.1 NAME ( 'dir'
   DESC 'Una directory'
   MUST fn
   MAY fs

olcObjectClasses: ( 1000.1.2.2 NAME ( 'file'
   DESC 'Un file'
   MUST (fn $ fs)

Now I'm stuck with this.



ldapadd -Q -Y EXTERNAL -H ldapi:/// -f filesystem.ldif

This will only work if you work as root (uid=0) or via sudo and on the LDAP server direct. It connects to the LDAP server based on the user id and bypasses the normal auth methods.

This access is granted by the olcAccess rule

{0}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage  by * none

in olcDatabase={0}config,cn=config.

To allow access in the "normal" way, you can add the following lines to olcDatabase={0}config,cn=config:

olcRootDN: cn=admin,cn=config
olcRootPW: <yourpassword>  

where <yourpassword> should be pre-encrypted via slappasswd.

  • Just fantastic, thanks! It worked. But is there a way to grant access to my cn=admin,cn=config? Should I modify some configuration files? – shadox Mar 28 '14 at 11:04
  • @coldSense: See my edit for infos on that. – Sven Mar 28 '14 at 11:12
  • And it works again! Actually on my system it is olcDatabase={0}config.ldif it seems but it works this way. Very helpful, thanks! – shadox Mar 28 '14 at 12:25
  • Glad it helped. One more hint though: This sounds like you edited the ldif files containing the cn=config tree directly. Be careful with this and use it only(!!!) if you have lost access due to changes you did and while slapd is stopped to avoid damages to these files. The normal way to modify the configuration is to create appropriate ldif files and feed them to the system via ldapmodify. However, I use this only to create the admin password and use Apache Directory Studio for all subsequent changes afterwards. – Sven Mar 28 '14 at 14:52
  • Good point. In the future I will use ldapmodify as superuser to change configurations. Now I'm only practicing, to understand how OpenLDAP works. – shadox Mar 28 '14 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.