I add a new domain to openldap mdb database, but I can not access it, what's the problem?
Here is the process:
$ ldapadd -H ldapi:// -Y EXTERNAL -f newdb.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcDatabase=mdb,cn=config"
cat newdb.ldif
dn: olcDatabase=mdb,cn=config
objectClass: olcMdbConfig
olcDatabase: mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=example01,dc=com
olcRootDN: cn=admin,dc=example01,dc=com
olcRootPW: {SSHA}J9qNsUzm8nVDQdqWV6XUC0vZQWtml7Cs
I can list it through search base "cn=config":
$ ldapsearch -H ldapi:// -Y EXTERNAL -b "cn=config" "(olcRootDN=*)" olcSuffix olcRootDN olcRootPW -LLL -Q
dn: olcDatabase={21}mdb,cn=config
olcSuffix: dc=example01,dc=com
olcRootDN: cn=admin,dc=example01,dc=com
olcRootPW: {SSHA}J9qNsUzm8nVDQdqWV6XUC0vZQWtml7Cs
But I can not access it, and I can not add items to it:
$ ldapsearch -H ldapi:// -Y EXTERNAL -b 'dc=example01,dc=com' -s base '(objectclass=*)' -LLL -Q
No such object (32)
Any help is appreciated.
Adding the configuration for a new database doesn't create the top entry of in that database.
You need to use ldapadd to add the entry "dc=example01,dc=com" (with an objectClass Domain)
Related
How to delete one of these 2 enteries. I want delete the first one.
I tryied it but always I have error
ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config olcOverlay={2}auditlog |grep -v "#"
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcOverlay={2}auditlog,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcAuditlogConfig
olcOverlay: {2}auditlog
olcAuditlogFile: /var/log/ldapaudit.log
dn: olcOverlay={3}auditlog,olcDatabase={2}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcAuditlogConfig
olcOverlay: {3}auditlog
olcAuditlogFile: /var/log/ldap.log
search: 2
result: 0 Success
Older versions of OpenLDAP (2.4 or older, I believe) do not support hot removal of overlays – they can only be added via LDAP, but removing them needs to be done offline (i.e. with the slapd service stopped).
The official method is to dump the cn=config database slapcat -n 0 into an LDIF file, edit it as needed, then delete the whole slapd.d directory and rebuild it from LDIF using slapadd -n 0.
The unofficial method is to rm just the corresponding files from within slapd.d/cn=config/.
I have installed LDAP and I am able to start it.
While I am trying to modify the olcDatabase={2}hdb.ldif file I am getting "ldap_modify: No such object (32)" error.
Steps followed to modify
1) created a db.ldif file with below contains
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc= ec2,dc=internal
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc= ec2,dc=internal
dn: olcDatabase={2}hdb,cn=config
changeType: modify
add: olcRootPW
olcRootPW: {SSHA}6zHtA20qkTmdLrJSfxo+VV3QLGS7m0CZ
2) ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
ldap_modify: No such object (32)
I am using centos7 and LDAP version openldap-clients-2.4.44-21.el7_6.x86_64
openldap-2.4.44-21.el7_6.x86_64
openldap-servers-sql-2.4.44-21.el7_6.x86_64
openldap-servers-2.4.44-21.el7_6.x86_64
openldap-devel-2.4.44-21.el7_6.x86_64
collectd-openldap-5.8.1-1.el7.x86_64
compat-openldap-2.3.43-5.el7.x86_64
Please help me fix this!!
There are two reasons for this result.
the entry actually doesn't exist,
it exists but you don't have permission to know that.
I suggest you try to search the cn=config database to see what it actually contains:
ldapsearch -H ldapi:/// -Y EXTERNAL -b 'cn=config'
If the result is No such object (32), then gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth doesn't have access to the config database on your system.
If the search does return output, check whether the entry olcDatabase={2}hdb,cn=config is actually listed.
I had the same problem and to fix it I restarted slapd.service:
systemctl stop slapd.service
systemctl start slapd.service
I'm new to openLdap , I am setting up a module for monitoring using on-line configuration (OLC) based on this guide : https://blog.kmp.or.at/monitoring-openldap/.
i use ldapmodify as bellow :
ldapmodify -x -H ldap:/// -D "cn=config" -W -f module.ldif
result is :
modifying entry "cn=module{0},cn=config"
ldap_modify: No such object (32)
content of module.ldif is :
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: {1}back_monitor
i understand that i can't modify on non-existing entry so i tried to add a new entry for DN = (cn=module,cn=config).
i tried to create new dn using :
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /etc/openldap/libexec/openldap
but i got this error
ldap_add: Invalid syntax (21)
additional info: objectClass: value #0 invalid per syntax
Do i really need to create this DN , or it must be created during setup.
No, this entry is created during setup.
It seems you missed to setup slapd.d directory for online configuration (OLC) :
slapcat -f /path/to/slapd.conf -F /path/to/slapd.d
Also, choose the appropriate SASL mechanism for authentication :
Either use EXTERNAL mechanism with ldapi:/// transport (relies on the client process uid and gid via Unix sockets) :
`ldapmodify -Y EXTERNAL -H ldapi:/// -f module.ldif`
Or LDAP (default) with options -D and -W for binding :
` ldapmodify -x -H ldap://example.com -D cn=manager,dc=example,dc=com -W -f module.ldif`
I have a LDIF file with a test user and I would like to change the password.
I used the ldapmodify command:
ldapmodify -h localhost -D uid=testuser,ou=users,dc=mytest,dc=org -w <password> <<!
dn: uid=testuser,ou=users,dc=mytest,dc=org
changetype: modify
replace: userPassword
userPassword: myNewPassword
!
modifying entry "uid=testuser,ou=users,dc=mytest,dc=org"
It's looks like working
But when I open my file.ldif, the password has don't change and ldapsearch command don't work.
ldapsearch -x -h localhost -D uid=testuser,ou=users,dc=mytest,dc=org -w myNewPassword -b uid=testuser,ou=users,dc=mytest,dc=org
ldap_bind: Invalid credentials (49)
Thank you for the help
I have an LDIF file that contains a bunch of test users.
I would like to change the password for some of these users and was wondering what would be the best way to do so.
Use ldapmodify with LDIF, for example:
ldapmodify -h hostname -p port -D dn -w password <<!
dn: uid=user,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: new-password
!
or specify a filename:
ldapmodify -c -a -f file.ldif -h hostname -p port -D dn -w password
Of course, use the correct attribute names, distinguished names, and so forth. The distinguished name used for the bind of the ldapmodify tool must have access rights to modify the password of the distinguished name specified in the LDIF.
see also
LDIF: rfc2849
LDAP: Using ldapmodify