0

I'm setting up a second LDAP server. I've converted a slapd.conf to a slapd.d database using slaptest. I'm trying to apply this LDIF:

# cat loglevel.ldif
dn: cn=config
changetype:modify
replace: olcLogLevel
olcLogLevel: any

This error comes up:

# ldapmodify -H ldapi:/// -Y EXTERNAL -D 'cn=config' -f loglevel.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Insufficient access (50)

ldapwhoami output:

# ldapwhoami -Y EXTERNAL -H ldapi:///
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn:gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

Config database in slapcat -n0:

dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to *  by * none
olcAddContentAcl: TRUE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=admin,cn=config
olcRootPW:: c2VjcmV0
olcSyncUseSubentry: FALSE
olcMonitoring: FALSE
structuralObjectClass: olcDatabaseConfig
entryUUID: a00805da-2405-1035-8da5-7568f1e7aea1
creatorsName: cn=config
createTimestamp: 20151120190701Z
entryCSN: 20151120190701.894877Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20151120190701Z

How do I make the command work?

Do I need to do something to enable the -Y EXTERNAL mechanism?

Do I need to change the olcRootDN property for cn=config? I can try changing it with a text editor in the /etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif file.

3

Your current rootdn is cn=admin,cn=config, and your current rootpw is "secret".

SASL/EXTERNAL is enabled and working. However, the configuration of your cn=config database does not give root (aka gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth any special permissions.

To convert your rootdn to be local root you should run the following or its equivalent.

ldapmodify -D cn=admin,cn=config -w secret -H ldapi:/// <<EOF
dn: olcDatabase={0}config,cn=config
replace: olcrootdn
olcrootdn: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
-
delete: olcrootpw
-
EOF

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.