I'm trying to backup a LDAP server from version 2.4.23 to a new 2.4.40 one. During the package initial configuration I'm asked some question which I answer with actual facts about the database, looking to get the same configuration of the old server. But as soon as I finish the configuration it is noticeable that it did not yielded the expected configuration.

Here is the configuration of the old server (acquired with slapcat -n0):

dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcPidFile: /var/run/slapd/slapd.pid
structuralObjectClass: olcGlobal
entryUUID: cde5ce8a-bf8f-1030-9594-7f29588dac90
creatorsName: cn=config
createTimestamp: 20111220195151Z
olcLogLevel: Stats
olcTLSCertificateFile: /etc/ssl/certs/ufpa.br.crt
olcTLSCertificateKeyFile: /etc/ssl/private/ufpa.br.key
olcToolThreads: 4
olcSizeLimit: unlimited
entryCSN: 20111222143131.011291Z#000000#000#000000
modifiersName: cn=admin,cn=config
modifyTimestamp: 20111222143131Z

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}back_hdb
olcModuleLoad: {1}syncprov
structuralObjectClass: olcModuleList
entryUUID: cdeca534-bf8f-1030-959c-7f29588dac90
creatorsName: cn=admin,cn=config
createTimestamp: 20111220195151Z
entryCSN: 20111220195151.317803Z#000000#000#000000
modifiersName: cn=admin,cn=config
modifyTimestamp: 20111220195151Z

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
structuralObjectClass: olcSchemaConfig
entryUUID: cde86cda-bf8f-1030-9597-7f29588dac90
creatorsName: cn=admin,cn=config
createTimestamp: 20111220195151Z
entryCSN: 20111220195151.290145Z#000000#000#000000
modifiersName: cn=admin,cn=config
modifyTimestamp: 20111220195151Z

And this is what I get from the freshly installed server (with slapcat):

dn: dc=ufpa,dc=br
objectClass: top
objectClass: dcObject
objectClass: organization
dc: ufpa
structuralObjectClass: organization
entryUUID: 90e79216-16d2-1037-8dbb-11462ab3e25c
creatorsName: cn=admin,dc=ufpa,dc=br
createTimestamp: 20170816132842Z
entryCSN: 20170816132842.412456Z#000000#000#000000
modifiersName: cn=admin,dc=ufpa,dc=br
modifyTimestamp: 20170816132842Z

dn: cn=admin,dc=ufpa,dc=br
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9RC9YcU5KVFF1UHB0c0Nkc2pObUgrV2NSZHFVM3JWUkI=
structuralObjectClass: organizationalRole
entryUUID: 90e8e2b0-16d2-1037-8dbc-11462ab3e25c
creatorsName: cn=admin,dc=ufpa,dc=br
createTimestamp: 20170816132842Z
entryCSN: 20170816132842.421067Z#000000#000#000000
modifiersName: cn=admin,dc=ufpa,dc=br
modifyTimestamp: 20170816132842Z

Trying to import the files generated from the old server yields this:

slapadd: could not add entry dn="cn=config" (line=1):
_                       0.35% eta   none elapsed            none spd   2.0 M/s
Closing DB...

And if I try to import just the users and computers' info, I get this:

slapadd: line 1: database #1 (dc=ufpa,dc=br) not configured to hold "o=UFPA"; no database configured for that naming context
_                       0.00% eta    31s elapsed            none spd   1.9 M/s
Closing DB...

I've also dumped the original database using ldapsearch -x -D "cn=admin,o=UFPA" -w 'admin_passwd' -b "o=UFPA" -H ldap://localhost -LLL "*" "+" > ldap_dump.ldif

And then tried to restore using ldapadd -Wx -D "cn=admin,dc=ufpa,dc=br" -h localhost -f ldap_dump.ldif

But this is what I get:

adding new entry "o=UFPA"
ldap_add: Server is unwilling to perform (53)
        additional info: no global superior knowledge

Can anyone help me out with this issue?


When you want to restore a full cn=config backup from another server, it's best to start with an empty config directory (in my opinion). On Debian and Ubuntu, the installer will create the base configuration for you, which may be why it fails to import cn=config, because it already exists.

Here are 2 options:

  • ignore errors and continue with import using the -c option to slapadd
  • start with blank config directory and import all config from ldif file.

Here is how I've done it.

On old server:

slapcat -b cn=config > config.ldif

On new server:

# backup current config
tar -czf /var/backups/openldap.config-$(date +%y%m%d).gz /etc/ldap/slapd.d
# delete current config
rm -rf /etc/ldap/slapd.d/*
# import config file copied from old server
slapadd -F /etc/ldap/slapd.d/ -b cn=config -l config.ldif

You get the no global superior knowledge error because OpenLDAP does not have a database to store dn: dc=ufpa,dc=br in. If it is configured properly in the old server, the above method should bring it all over to the new server. Then you can also backup and restore that database like follows.

On old server:

slapcat -b dc=ufpa,dc=br > ufpa.br.ldif

On new server:

# backup current database
tar -czf /var/backups/openldap.data-$(date +%y%m%d).tgz /var/lib/ldap
# delete current database
rm -rf /var/lib/ldap/*.*
# restore backup from old server
slapadd -b ufpa.br.ldif

If you get an error that is could not add entry dn="dc=ufpq,dc=br", then something in the config backup likely already created it. Try using the -c option on the last slapadd command.

| improve this answer | |
  • Yeah, I found out how to do this some days after posting this question. Just forgot to answer it. Your answer is wellcome, of course! – hiagop Dec 12 '17 at 15:37
  • When i issue slapadd -b ufpa.br.ldif, I got the error "slap_init invalid suffix" – Josir Jun 11 '19 at 20:53
  • Don't I have to specify a suffix before the filename ? – Josir Jun 11 '19 at 21:41
  • That error says the base you specified with the -b option does not match any suffix configured on the server. See olcSuffix in Section 5, or suffix in Section 6 (depending on which type of config you're using) of the docs for more info, or post a new question. openldap.org/doc/admin24 – mjb2kmn Jun 13 '19 at 14:37

Sane people use syncrepl to replicated / backup their databases.

You've omitted too much detail to be further helped. For instance, that can't possibly the whole, and certainly doesn't have all the relevant parts, of your old servers config. It has no configured suffixes.

| improve this answer | |
  • 1
    Would you point out what is the most relevant information to add to the question? I really thought that what posted would be enough. – hiagop Aug 20 '17 at 13:30

If you can't use -c as slapadd with error, try using slapadd -F /etc/ldap/slapd.d/ -l ufpa.br.ldif . Make sure /var/lib/ldap is empty before using this and set the ownership after restore to ldap user.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.