I'm struggling to setup OpenLDAP to allow Asterisk to store information about users. I've tried to follow several howto's, but unfortunately I'm not able to set it up correctly.

It seems like most steps are going fine, until I want to import a user.

Installation of OpenLDAP:

yum install openldap-servers openldap-clients
mkdir /var/lib/ldap
chown -R ldap:ldap /var/lib/ldap
cd /usr/local/src/certified-asterisk-13.1-cert1/contrib/scripts

Copy the asterisk LDAP scheme:

cp asterisk.ldap-schema /etc/openldap/schema/
systemctl restart slapd.service

Import asterisk.ldif:

ldapadd -Y EXTERNAL -H ldapi:/// -f ./asterisk.ldif

Import seems to go fine here:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
adding new entry "cn=asterisk,cn=schema,cn=config"

When I check the configs in "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif", I see that the following config was generated:

dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=my-domain,dc=com
olcRootDN: cn=Manager,dc=my-domain,dc=com
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: c11a9b72-7170-1034-8245-599798aeacb0
creatorsName: cn=config
createTimestamp: 20150407125255Z
entryCSN: 20150407125255.397631Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20150407125255Z

I then created the following file to simulate the import of an existing user (createduser.ldif):

dn: cn=1000,ou=sip,dc=digium,dc=internal
objectClass: AsteriskAccount
objectClass: AsteriskExtension
objectClass: AsteriskSIPUser
objectClass: top
AstAccountName: sip user
cn: 1000
AstAccountDefaultUser: 0
AstAccountExpirationTimestamp: 0
AstAccountFullContact: 0
AstAccountHost: dynamic
AstAccountIPAddress: 0
AstAccountLastQualifyMilliseconds: 0
AstAccountPort: 0
AstAccountRegistrationServer: 0
AstAccountType: 0
AstAccountUserAgent: 0
AstExtension: 1000

Finally, I start the import...

ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=Manager,dc=my-domain,dc=com" -f createduser.ldif

but that returns "no global superior knowledge":

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
adding new entry "cn=1000,ou=sip,dc=digium,dc=internal"
ldap_add: Server is unwilling to perform (53)
    additional info: no global superior knowledge

Should I use "cn=asterisk,cn=schema,cn=config" as rootCDN? What am I doing wrong here?


Your LDAP database has this suffix:


You're trying to add an entry with dn:


LDAP is an hierarchical database, you must fix the DB suffix or the entry DN in order to fit your hierarchy needs.

You can do it changing the entry dn with:


But still the Organisation Unit ou=sip,dc=my-domain,dc=com is missing, you can create it using an LDIF like the following:

dn: ou=sip,dc=my-domain,dc=com
ou: sip
objectClass: organizationalUnit

Now your hierarchy is ready to accept the entry cn=1000,ou=sip,dc=my-domain,dc=com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.