4

I'm trying to add new schema to my OpenLDAP server. The version of slapd is 2.4.23. I'm using Debian 6.

If I understood it well, slapd 2.4+ uses OLC configuration with (cn=config) by default for this version and I don't have to modify anything in slapd.conf or some other point in the cn=config tree (am I wrong?). But when I'm trying to add schema with following command:

ldapadd -x -D "cn=admin,cn=config" -W -f filesystem.ldif

it gives me:

Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

I also tried this command(even if I don't know what I'm doing here):

ldapadd -x -D "cn=admin,dc=linuxcbt,dc=internal" -W -f filesystem.ldif

where dc=linuxcbt,dc=internal is my base, I get:

adding new entry "cn=filesystem,cn=schema,cn=config"
ldap_add: Insufficient access (50)

My filesystem.ldif file is:

dn: cn=filesystem,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: filesystem

olcAttributeTypes: ( 1000.1.1.1 NAME ( 'fn' 'filename' )
   DESC 'Nome del file'
   EQUALITY 'Case exact match'
   SUBSTR caseExactSubstringsMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

olcAttributeTypes: ( 1000.1.1.2 NAME ( 'fs' 'filesize'  )
   DESC 'Dimensione del file'
   EQUALITY integerMatch
   ORDERING integerOrderingMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )

olcObjectClasses: ( 1000.1.2.1 NAME ( 'dir'
   DESC 'Una directory'
   MUST fn
   MAY fs
   AUXILIARY )

olcObjectClasses: ( 1000.1.2.2 NAME ( 'file'
   DESC 'Un file'
   MUST (fn $ fs)
   AUXILIARY )

Now I'm stuck with this.

1 Answer 1

6

Try

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f filesystem.ldif

This will only work if you work as root (uid=0) or via sudo and on the LDAP server direct. It connects to the LDAP server based on the user id and bypasses the normal auth methods.

This access is granted by the olcAccess rule

{0}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage  by * none

in olcDatabase={0}config,cn=config.

To allow access in the "normal" way, you can add the following lines to olcDatabase={0}config,cn=config:

olcRootDN: cn=admin,cn=config
olcRootPW: <yourpassword>  

where <yourpassword> should be pre-encrypted via slappasswd.

7
  • Just fantastic, thanks! It worked. But is there a way to grant access to my cn=admin,cn=config? Should I modify some configuration files?
    – shadox
    Mar 28, 2014 at 11:04
  • @coldSense: See my edit for infos on that.
    – Sven
    Mar 28, 2014 at 11:12
  • And it works again! Actually on my system it is olcDatabase={0}config.ldif it seems but it works this way. Very helpful, thanks!
    – shadox
    Mar 28, 2014 at 12:25
  • Glad it helped. One more hint though: This sounds like you edited the ldif files containing the cn=config tree directly. Be careful with this and use it only(!!!) if you have lost access due to changes you did and while slapd is stopped to avoid damages to these files. The normal way to modify the configuration is to create appropriate ldif files and feed them to the system via ldapmodify. However, I use this only to create the admin password and use Apache Directory Studio for all subsequent changes afterwards.
    – Sven
    Mar 28, 2014 at 14:52
  • Good point. In the future I will use ldapmodify as superuser to change configurations. Now I'm only practicing, to understand how OpenLDAP works.
    – shadox
    Mar 28, 2014 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .