I am creating databases like the following (called from an application):

$ ldapadd -Q -Y EXTERNAL -H ldapi:/// <<EOF
dn: olcDatabase={20}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {20}mdb
olcDbDirectory: /var/lib/ldap/domain.tld
olcSuffix: dc=domain,dc=tld
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by * read
olcRootDN: cn=user,dc=domain,dc=tld
olcDbCheckpoint: 512 30
olcDbIndex: objectClass eq
olcDbIndex: cn,uid eq
olcDbIndex: uidNumber,gidNumber eq
olcDbIndex: member,memberUid eq


OpenLDAP responds with

adding new entry "olcDatabase={20}mdb,cn=config"

But the index number in front of mdb is not respected. In reality the database ends up in olcDatabase={2}mdb.ldif.

This can also be seen when dumping the config:

$ slapcat -b cn=config

dn: olcDatabase={2}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {2}mdb
olcDbDirectory: /var/lib/ldap/domain.tld
olcSuffix: dc=domain,dc=tld

The index is just incremented every time I add a new database. Which makes sense but I need to be able to set it explicitly so my program knows where its data is stored.

The strange thing is that I am pretty sure it worked in the beginning. I have tried reinstalling (with --purge) several times to no avail.

I am using Openldap 2.4.40 on Debian:

Linux LINUX_LDAP_DEV 3.16.0-4-686-pae #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19) i686 GNU/Linux

In ldap.confI am only setting TLS_CACERT.

  • 1
    Why does your program need to read con=config at all? It should just connect to the base DN dc=domain,dc=tld and shouldn't care about the internals of OpenLDAPs configuration...
    – Sven
    Feb 6 '17 at 15:05
  • It's because my program creates (and removes) LDAP databases for another program.
    – tiktuk
    Feb 7 '17 at 10:31

Query cn=config for the appropriate olcSuffix and use the resulting dn instead of relying on external knowledge of the numeric index.

  • That would be neat but I need the index to get the filename corresponding to the database in /etc/ldap/slapd.d/cn=config/ so I can delete it later. Of course it would be best if I could delete the database using LDAP itself but that seems to not be possible.
    – tiktuk
    Feb 8 '17 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.