I have installed OpenLDAP and phpLDAPadmin on Ubuntu 14.04.

I have a default RootDN which is something like:

  • cn=admin,dc=example,dc=com

Then I have created some users and groups organizational units like that:

  • ou=users,dc=example,dc=com
  • ou=groups,dc=example,dc=com

I have also created a Main Admin user which will be the admin for all my services:

  • cn=Main Admin,ou=users,dc=example,dc=com

Now I would like to have the Main Admin as the RootDN (so, just one admin for all services included the LDAP service).

Is it possible to do that and how ? Just by changing the olcRootDN value ?

What's happened for the password ? Should I set the olcRootPW to be the same as the Main Admin password ?

  • 1
    You don't want to do this. You want to use the RootDN only for the server itself. Any action carried out by a human or an application should be done as a user registered in the DIT and having appropriate permissions. The reason is that the RootDN bypasses many checks internally, for example it completely bypasses the password policy overlay. – user207421 Oct 2 '14 at 22:55

Apparently is it possible to do this just by changing the olcRootDN. The password which is taken into account is the Main Admin password.

To do this create a file called rootdn.ldif this way:

dn:  olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Main Admin,ou=users,dc=example,dc=com

And run:

ldapmodify -Y EXTERNAL -H ldapi:/// -f ./rootdn.ldif

This way you can have something like that (after deleting the cn=admin,dc=example,dc=com):

  • dc=example,dc=com
    • ou=groups,dc=example,dc=com
      • cn=service1_admins,ou=groups,dc=example,dc=com
      • cn=service1_users,ou=groups,dc=example,dc=com
      • cn=service2_admins,ou=groups,dc=example,dc=com
      • cn=service2_users,ou=groups,dc=example,dc=com
      • ...
    • ou=users,dc=example,dc=com
      • cn=Main Admin,ou=users,dc=example,dc=com <- The new olcRootDN
      • cn=User1,ou=users,dc=example,dc=com
      • cn=User2,ou=users,dc=example,dc=com
      • ...

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.