0

I am trying to configure Openldap v2.4 on Centos 7. I have installed slapd and have configuring the server. I have generated the password and add to my configuration via the modify command. This all work fine and I can add to the service and enter my password when prompted. The problem I have is when I restart the service via systemctl restart/start slapd that my password is not recognised. I get the following error:

 ldapadd -x -W -D "cn=ldapadm,dc=nrdevopspoc,dc=com" -f base.ldif
 Enter LDAP Password: 
 ldap_bind: Invalid credentials (49)

What am I missing here?


I basically performed the following steps:

yum install openldap openldap-servers openldap-clients

I then started the system via systemctl start slapd. I then set the slapd password via slappasswd and copied the SSHA key. I then created a db configuration file with the following:

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=itzgeek,dc=local

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=ldapadm,dc=itzgeek,dc=local

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}d/thexcQUuSfe3rx3gRaEhHpNJ52N8D3

I then modify the ldap db by

ldapmodify -Y EXTERNAL  -H ldapi:/// -f db.ldif

This worked fine and accepted the password. At this point I restarted the slapd service via systemctl restart slapd.

Whenever I run a modify command again I get invalid credentials and it doesn't accept my ldap password as it did before the restart.

4
  • 1
    You're currently missing enough information for anyone to help you. We can't see into your systems, or exactly what you did. Only you can do that. In what way did you generate the password? What did the ldif where you added it look like? Did you enable any logging for slapd? What do the logs say? – 84104 May 26 '18 at 16:45
  • I basically did the following; – mike gray May 27 '18 at 6:56
  • Hi no the itgeek,local is incorrect I just copied this from the website I was using to set to configure LDAP. The command above with nrdevopspoc,com is correct. Sorry about the confusion. I have added the password to the ldap configuration. All ldapmodify commands work but when I do an ldapadd I get prompted for a password. The password I enter is correct but get invalida credentials error. I though if I had added the SSHA key the the file (which I have) I would not get prompted for a password when issuing commands? – mike gray May 29 '18 at 10:06
  • Edit your question so that it accurately reflects what you have done. – 84104 Jun 5 '18 at 23:40
1

According to your edit:

You should be using cn=ldapadm,dc=itzgeek,dc=local as your binddn, not cn=ldapadm,dc=nrdevopspoc,dc=com. That is, if your "base.ldif" file is trying to modify itzgeek,dc=local.

If you're trying to do more cn=config manipulation, you should still be using ldapmodify -Y EXTERNAL -H ldapi:///, as it doesn't seem like you've replaced the default cn=config access control.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.