25
votes
Accepted
How to migrate LDAP (database,schema,configuration) to other machine
The solution :
So here's what I did to make this works.
Stop Slapd on main server
Slapcat databases from the main server (There are 2 database that needs to be exported. I use the "-n" tag
slapcat -...
- 608
22
votes
How to disable anonymous access on LDAP
If the accepted answer does not work for you (it didn't for me on Ubuntu), try the following.
Create ldiff file:
nano /usr/share/slapd/ldap_disable_bind_anon.ldif
Paste in this:
dn: cn=config
...
- 529
19
votes
Accepted
Does Linux keeps a cache of groups members if on LDAP ? (Difference between groups vs getent group))
pam_ldap and nsswitch have no caching mechanisms, but nscd or sssd may be present on your system that implement cache.
To invalidate / flush nscd groups cache use:
sudo nscd --invalidate=group
To ...
- 3,313
18
votes
OpenLDAP TLS Authentification
I was following the same guide and had the same issue. It will work if you do the steps to "Tighten up ownership and permissions" listed after the offending ldapmodify command first--namely:
sudo ...
- 180
14
votes
Accepted
openldap sizelimit. Can't receive more than 500 entries
OpenLDAP search limit can be set at server side or client side.
1. Server side in database section of slapd.conf (old style
configuration deprecated but steel usable) or cn=config
(...
12
votes
Accepted
Using Lets Encrypt certificates with openLDAP
The fullchain.pem file is NOT a concatenation of the certificate chain above the cert.pem file, it is a concatenation of the chain.pem and cert.pem file.
The chain.pem file and the root authority ...
11
votes
OpenLDAP No such object (32)
You need to find out what backend databases you have configured:
ldapsearch -H ldapi:/// -Y EXTERNAL -b "cn=config" -LLL -Q "olcDatabase=*" dn
The one you're looking for could be BDB, HDB or MDB.
(...
- 406
11
votes
Accepted
When is ldapi:// -Y EXTERNAL needed? Apparently, cosine.ldif breaks without it
You use ldapadd -H ldapi:/// -Y EXTERNAL ... when you want to modify cn=config - the LDAP config itself. LDAP schema is a part of cn=config.
-H ldapi:/// - use UNIX-domain socket (/var/run/ldapi)
-Y ...
- 506
10
votes
ldap_modify: Insufficient access (50)
As I had a quite similar problem, I tried daff interesting solution but to no avail. Contrary to Lynn Owens I failed to add a password to the admin in olcDatabase={0}config,cn=config. I finally ...
- 414
9
votes
Accepted
sshPublicKey Attribute not showing - OpenLDAP PHPLDAP SSH Key Auth
Since this was really a GUI Issue, (another example of why its best to learn things on the CLI), my answer will be a Picture. But long story short is I was reading the directions to fast!
"Adding a ...
9
votes
Accepted
Setting Up multiple domain in LDAP server
The answer to that is dependent on how you want to use the LDAP server.
If you want to have three complete separate LDAP trees, you would configure multiple databases in the cn=config configuration ...
- 99.6k
8
votes
Persuading openldap to work with SSL on Ubuntu with cn=config
Roger's link has since rotted, here is the same on the Internet Archive's WayBack Machine, as of the last date archived before he changed his site: https://web.archive.org/web/20150530064010/http://...
- 81
8
votes
How to modify/add a new objectClass to an entry in OpenLDAP
Here is an example LDIF file to add the objectClass posixAccount to an existing entry uid=testuser,ou=people,dc=example,dc=com of e.g. objectClass inetOrgPerson:
dn: uid=testuser,ou=people,dc=example,...
- 243
8
votes
OpenLDAP No such object (32)
Perhaps your second configured database isn't of the type bdb. For instance, CentOS 7 uses hdb by default.
dn: olcDatabase={2}hdb,cn=config
- 13k
7
votes
How to properly insert a set of olcAccess attributes to the configuration of an OpenLDAP database?
Another, much easier, answer is to use the ldapvi command to edit the olcAccess entries:
ldapvi -h ldapi:// -Y EXTERNAL -b cn=config
It dumps all of cn=config into VIM, lets you edit it at your ...
- 96
7
votes
Accepted
How to use ldapsearch with SSL on different port (-p does not work)?
ldapsearch: -H incompatible with -p
Huh? Why is this a problem?
You either use the deprecated -h and -p to respectively set the hostname and non-default port number,
or you use -H with a properly ...
- 80.3k
6
votes
How to connect postgresql with LDAP user?
Thanks everyone, I just made a change in /var/lib/pgsql/9.4/data/pg_hba.conf with :
local all all ldap ldapserver=ldap.server ldapport=389 ldaptls=0 ldapprefix=...
- 141
6
votes
Using Lets Encrypt certificates with openLDAP
Do you have any extra security measures enabled (like apparmor) which restrict read access to your certificates? I got the same error message ldap_modify: Other (e.g., implementation specific) error (...
- 61
6
votes
How can Samba be configured to use LDAP for authentication only?
I assume that you want to run Samba in simple WinNT-compatible domain controller mode, not the full Active Directory mode.
First you have to understand that SMB authentication is based on a NTLM ...
- 984
5
votes
How to disable an LDAP account?
You might be interested in trying slapo-ppolicy (Password Policy overlay), as suggested here. That's indeed a sort of standard, though it might be a bit overkill for what you're trying to do. ...
- 222
5
votes
How do I authenticate with LDAP via the command line?
We're using FreeIPA/IDM and I was able to authenticate against this using the following:
$ ldapsearch -h idm-01a.somednsdom.com \
-D 'uid=<my username>,cn=users,cn=accounts,dc=somedcdom,dc=...
- 7,760
5
votes
How do I authenticate with LDAP via the command line?
Note, if you don't know your full bind DN, you can also just use your normal username or email with -U
ldapsearch -v -h contoso.com -U [email protected] -w 'MY_PASSWORD' -b 'DC=contoso,DC=com' '...
- 151
5
votes
OpenLDAP/SSSD Automatically Add User to Local Group
According to the ubuntu documentation you can do a mapping of domain users to local groups, I'm not sure if it is applicable to any OS, but it seems to use standard modules that should be on any *nix ...
- 846
5
votes
Accepted
Are SPNs specific to Windows and Active Directory?
They're a Kerberos thing. MIT Kerberos has them.
I'd have to google other implementations to see if they have them, too.
- 18.6k
5
votes
ldap_result: Can't contact LDAP server (-1)
STARTTLS means "explicit TLS" where the connection is established on regular port and then STARTTLS command is sent to initiate SSL handshake and switch to protection mode.
To connect try add -Z or -...
- 3,313
5
votes
Accepted
Modify openLDAP cn=config without slapd running
I know you've basically solved your problem, but I thought I'd add my own steps for making offline slapd configurations if anybody else comes across this. This is from my own documentation for Debian ...
- 195
5
votes
OpenLDAP cn=config: No such object (32)?
I've stumbled over this issue myself but wasn't satisfied by accepted answer as it points out the reason for the issue but is very limited on providing actual instructions on how to fix it. So I kept ...
- 212
4
votes
OpenLdap 2.4 on centos 6 doesn't listen on port 636
For similar issues on CentOS 7.2 & OpenLDAP 2.4.40-9, you need to modify /etc/sysconfig/slapd and add ldaps:///. It would look like:
SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
Then restart slapd ...
- 141
4
votes
OpenLdap: Why slapd tell me there's no DB_CONFIG when there is one
Maybe others person may hit the same problem. For me, the version of openldap:
openldap.x86_64 2.4.40-13.el7 @base
openldap-clients.x86_64 2.4.40-13....
- 141
4
votes
smbk5pwd overlay on OpenLDAP 2.4
Since the existing answers seems a) lacking in detail or b) advocating a pointless schema addition that is no longer required, I've written up a post that explains how to enable smbk5pwd in simple ...
- 61
Only top scored, non community-wiki answers of a minimum length are eligible