I want to add a schema to an OpenLDAP database that I've inherited.

ldapadd -vY EXTERNAL -H ldapi:/// -f schema.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
adding new entry "cn=openssh-lpk,cn=schema,cn=config"
ldap_add: Insufficient access (50)

A discussion on the mailing list regarding the same external SASL authentication issue leads me to believe that I need to "map a SASL EXTERNAL identity to the cn=config rootdn." How would I accomplish this?

While trying to figure this out, I created a similar VM and installed slapd from the Ubuntu repos. External SASL requests like the one above work right out of the box. I attempted to compare the cn=config settings between the two systems but failed to identify any obvious clues to perform this task. The production database was originally running on Gentoo. I migrated it to Ubuntu and have been happily editing the accounts and using it. However I've been unable to amend the configuration database since converting to the cn=config format during the migration.

  • Who is the rootDN on cn=config? grep olcRootDN: /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{0\}config.ldif – 84104 May 1 '15 at 19:50
  • There is no olcRootDN there – isuldor May 3 '15 at 17:20

Make sure that there is one olcAccess attribute of the {0}config database (/etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif) that looks like this:

olcAccess: {0}to * 
 by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage 
 by * break

In the default config on Ubuntu, this is the only olcAccess entry for the config database. If you have more entries, make sure that the one I mentioned is the first (i. e. {0}) and the others follow ({1}, {2} etc.). Otherwise one of the others could match, assign too low permissions and stop traversing the list.

If there's some other user/DN in that list with sufficient (write, manage) permissions, you should preferably try to amend olcAccess with an LDIF file using ldapmodify with that user/DN.

Failing that, you can do:

sudo service slapd stop
sudo sensible-editor /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{0\}config.ldif
sudo service slapd start

But you should fix the CRC32 in that file afterwards.

  • you saved my day ... no one really no one mentioned someting like that on the arch linux wiki. One week for nothing! – Pascal Sep 25 '18 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.