1

I am running an LDAP I can connect to, but in wanting to move away from slapd.conf and use ldif's, I am encountering the following problem(s).

When I type:ldapsearch -H ldap:// -x -s base -b "" -LLL "+"

I get

dn:
structuralObjectClass: OpenLDAProotDSE
configContext: cn=config
namingContexts: dc=mysite,dc=com
supportedControl: 1.3.6.1.4.1.4203.1.9.1.1
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 1.3.6.1.4.1.4203.1.10.1
supportedControl: 1.3.6.1.1.22
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.826.0.1.3344810.2.3
supportedControl: 1.3.6.1.1.13.2
supportedControl: 1.3.6.1.1.13.1
supportedControl: 1.3.6.1.1.12
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedExtension: 1.3.6.1.1.8
supportedFeatures: 1.3.6.1.1.14
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
supportedFeatures: 1.3.6.1.4.1.4203.1.5.2
supportedFeatures: 1.3.6.1.4.1.4203.1.5.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.4
supportedFeatures: 1.3.6.1.4.1.4203.1.5.5
supportedLDAPVersion: 3
supportedSASLMechanisms: SRP
supportedSASLMechanisms: SCRAM-SHA-1
supportedSASLMechanisms: GS2-IAKERB
supportedSASLMechanisms: GS2-KRB5
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: OTP
supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: NTLM
entryDN:
subschemaSubentry: cn=Subschema

I then try: sudo ldapsearch -H ldapi:// -Y EXTERNAL -b "cn=config" -LLL -Q

Resulting in: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

When I try using ldap:// instead of ldapi://, I get:

ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
    additional info: SASL(-4): no mechanism available: 

I can find a lot of stuff about TLS and authentication, but I have not configured any TLS/SSL so not sure why this would happen. Anyone experience this?

1
  • What happens if you run ldapsearch with ldapi:/// (note the THREE slashes), e.g. sudo ldapsearch -H ldapi:/// -Y EXTERNAL -b "cn=config" -LLL -Q
    – zymhan
    Oct 22 '18 at 19:56
1

Are you sure that your slapd is listening on LDAPI socket at all?

It has to get started with `slapd -h "ldapi:// ldap://" to e.g. listen on Unix domain socket (default path name depends on build options) and clear-text LDAP (389/tcp).

Depending on your Linux distribution (which one?) there is probably some config file for setting parameters for the start script.

Also note that you would some more config to directly map Linux user root to a LDAP user granted write access to cn=config for more reconfiguration.

In entry cn=config (frontend configuration) you need to rewrite authc-DN to proper authz-DN:

olcAuthzRegexp: {0}"gidnumber=0\+uidnumber=0,cn=peercred,cn=external,cn=auth" "cn=config"

In entry olcDatabase={0}config you would need an ACL like this:

olcAccess: {0}to
  dn.subtree="cn=config"
  by dn.base="cn=config" write
2
  • This does indeed resolve this particular issue. I couldn't find this in documentation, thank you. Now I just get the error "No such object (32)", so i will work on that! Thanks. Oct 23 '18 at 14:05
  • I've added some more information. Oct 23 '18 at 18:25
1

root@ldap:~#ldapmodify -Y EXTERNAL -H ldapi:/// -f mod_ssl.ldif Resulting in: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

root@ldap:~#sudo service slapd start

Job for slapd.service failed because the control process exited with error code. See "systemctl status slapd.service" and "journalctl -xe" for details. Issue:- Failed to start slapd slapd.service: Control process exited, code=exited status=1 "tls init def ctx failed: -1"

Check your SSL certificate .crt/.key should be fine

root@ldap:~#ls -lsrt /etc/ldap/sasl2/ root@ldap:~#grep -R /etc/ldap/slapd.d

root@ldap:~#cat /etc/ldap/slapd.d/'cn=config.ldif'

olcTLSCertificateFile: /etc/ldap/sasl2/maneet.crt olcTLSCertificateKeyFile: /etc/ldap/sasl2/maneet.key

#sudo service slapd start

Issue resolved

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.