Install and Setup OpenLDAP on CentOS 8

37 thoughts on “Install and Setup OpenLDAP on CentOS 8”

1. First of all, thank you for your write up. it’s the best one i’ve used so far on setting up open ldap on centos8.
   I do have a small question. the services are up and running and firewall is off but i still am unable to browse or connect any sort of ldap browser to the server. It might be the bind credentials that i’m using but i’ve tried cn=admin. i could use some guidance if possible.

   Reply

   • Thanks Ed M for the feedback.
     What LDAP browser are you using? Did you set the right bind dn?
     When you query your DN on command line, any errors?

     Reply

2. Thank you for the document.
   I ran into a problem, when I run ldapadd -Y EXTERNAL -H ldapi:/// -f rootdn.ldif
   it repies with ldap_add: Insufficient access (50)
   I stopped slapd, removed the /etc/openldap/slapd.d content and tweaked a bit with rootdn.ldif, but still I get ldap_add: Insufficient access (50)
   I’m running a fresh CentOS 8 install.

   Reply

3. I have followed this to the tee and although I can bind to ldap I cannot see the base DN.

   [root@localhost openldap]# ldapsearch -LLL -h 10.121.13.160 -b “” -s base +
   ldap_sasl_interactive_bind_s: No such object (32)

   any help would be greatly appreciated.

   Reply

4. I am trying to execute this “certs ldap.conf ldap.conf.default schema slapd.conf slapd.conf.default slapd.ldif slapd.ldif.default” and I am receiving “bash: certs: command not found…” I have a new install of CentOS8 I have went step by step with no problems and lastly the certs in the ls step above is highlighted in blue.

   Reply

   • Which step is this Nate? Clearly, there is no certs command as the error points out.

     Reply

     • Last step in “Installing OpenLDAP on CentOS 8”

       Reply

5. I can not get any further than the below step. Can anyone help?

   Update SLAPD Database…
   # slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif -u

   slapadd: dn=”cn=config” (line=1): no objectClass attribute

   Reply

   • Hi Gray, kindly re-check that your slapd.ldif defines the dn=”cn=config”.

     Reply

     • i appreciate your help. I found it was a format issue when i copied the config supplied in the guide.

       i am however having the below issue now when attempting a dry run.
       [root@web openldap-2.4.50]# slapadd -n 0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif -u
       slapadd: dn=”cn=module,cn=config” (line=11): (65) unrecognized objectClass ‘olcModuleList’
       _##### 29.07% eta none elapsed none spd 735.4 k/s

       Reply

       • slapd.ldif
         https://ibb.co/1qj5jCt

         Reply

       • Hi Gray, am sorry i can’t reproduce the error.

         Did you follow the guide from the beginning part?

         Reply

6. slapd daemon does not start.
   The status is as follows.
   What is the problem?

   [root@host01 openldap]# systemctl status slapd.service
   ● slapd.service – OpenLDAP Server Daemon
   Loaded: loaded (/etc/systemd/system/slapd.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since 목 2020-07-16 18:16:26 KST; 12s ago
   Docs: man:slapd
   man:slapd-mdb
   Process: 10454 ExecStart=/usr/libexec/slapd -u ldap -g ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=203/EXEC)

   7월 16 18:16:26 host01 systemd[1]: Starting OpenLDAP Server Daemon…
   7월 16 18:16:26 host01 systemd[1]: slapd.service: control process exited, code=exited status=203
   7월 16 18:16:26 host01 systemd[1]: Failed to start OpenLDAP Server Daemon.
   7월 16 18:16:26 host01 systemd[1]: Unit slapd.service entered failed state.
   7월 16 18:16:26 host01 systemd[1]: slapd.service failed.

   Reply

7. When I did ldapsearch I cannot have the informations

   ldapsearch -cx -b “dc=ldapmaster,dc=kifarunix-demo,dc=com”
   # extended LDIF
   #
   # LDAPv3
   # base with scope subtree
   # filter: (objectclass=*)
   # requesting: ALL
   #

   # search result
   search: 2
   result: 32 No such object

   # numResponses: 1

   Reply

   • I did not realized that the acl was so restrictive, I modified them

     Reply

8. Thanks for the guide.
   I’m here to ask for some help: I’m getting an error (on centos8) at the “enable log” point and also at at ldapadd -Y EXTERNAL -H ldapi:/// -f basedn.ldif :

   ldapmodify -Y external -H ldapi:/// -f enable-ldap-log.ldif

   I got

   SASL/EXTERNAL authentication started
   SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
   SASL SSF: 0
   adding new entry “olcDatabase=mdb,cn=config”
   ldap_add: Insufficient access (50)

   could you please update the guide (I followed the guide on 2 different VMs and the same issue occurred both times)

   I don’t understand how to grant the needed rights

   Reply

   • Hi David, please try to execute the commands as root or by prefixing them with sudo and see what happens.

     Reply

     • I can confirm David’s experience. Skipping ahead from the log configuration, I also cannot do the rootdn.ldif step. I always get Insufficient access (50). This is as root, or using sudo. selinux is set to permissive, so that is not the problem.

       Reply

   • I had the exact same problem. I found that removing the sudo schema fixed it.
     But I was using the latest openldap as of this time, version 2.4.52. Maybe there was a change between the version that this guide was written for (2.4,48) and 2.4.52.

     Reply

9. I think the chown command needs to be `chown -R ldap:ldap /etc/openldap/slapd.d/*` otherwise it just does it to the directory.

   Reply

   • using wildcard will only change the ownership of the directory contents but wont change the ownership of the directory itself.

     -R, –recursive: operate on files and directories recursively, from man chown.

     Reply

10. Really great document!! Thanks for putting time and effort in putting this up. Everything went well for me but I ended up with the below problem:

    sudo: error in /etc/sudo.conf, line 19 while loading plugin “sudoers_policy”
    sudo: unable to load /usr/libexec/sudo/sudoers.so: libldap-2.4.so.2: cannot open shared object file: Operation not permitted
    sudo: fatal error, unable to load plugins

    I re-did twice thinking I might have done something wrong first time. Why is this happening. I don’t see anybody else having this issue.

    Also.. We use LDAP for managing access to a Java app. Not really POSIX as in Linux/Unix authentication. These accounts don’t need home dir or bash login or anything. Just cn, uid and userPassword and a policy for the passwords. How can I achieve that? What kind of schema should I be using. I tried creating user with the LDIFF by removing certain POSIX elements and I’m getting AD violations errors.

    Reply

11. Hi

    Its my first time installing OpenLDAP and was wondering how do I get the values for this?

    “Replace the domain components, dc=ldapmaster,dc=kifarunix-demo,dc=com with your appropriate names.”

    Reply

    • Hello Kim,

      you can just replace the kifarunix-demo with your domain name. Should be fine.

      Reply

12. Good document! Thank you for taking the time to write this up so thoroughly!!

    Everything worked perfectly for me on CentOS 8.3.2011 with OpenLDAP 2.4.57

    Reply

    • Hi Brian, we are glad you found the tutorial useful.

      Reply

13. After following all the steps correctly im not receiving the users and group information.please help me with it
    [root@ openldap]# ldapsearch -x -b ‘dc=cpms-240,dc=local’ ‘(objectclass=*)’
    # extended LDIF
    #
    # LDAPv3
    # base with scope subtree
    # filter: (objectclass=*)
    # requesting: ALL
    #

    # search result
    search: 2
    result: 32 No such object

    # numResponses: 1

    Reply

14. Hi,

    I have done the setup but when I am trying to configure it in Apache Directory Studio, it gives error as ‘Missing schema location in RootDSE , using default schema’ and then after that AD studio shows nothing.

    Can you please help here?

    Thanks

    Reply

    • Hi Amit, sorry haven’t used Apache DS, will try to setup and update. thanks.

      You can try phpLDAPAdmin for now?

      Reply

      • Ok. Thanks for reply. Can you guide me as per error, what schema it is trying to search? and how to load it?

        Thanks.

        Reply

15. Excellent configuration guide, helped me out immensely. I have phpLDAPAdmin working a treat, but I have been struggling with LDAPAdmin which is windows management program loaded on separate machine. All editing is fine, it just can’t access any of the schema attributes to add them. I assume this is an access control issue, but cannot figure out what is constraining this

    Reply

16. Hi,

    Thanks for this Article its working absolutely fine on the server side, but I am facing the issue with the client side

    trying to login as an ldap user on the client i am facing the “user does not exist”

    ldap search is successfully able to fetch the ldap data from the server.

    Please share the method to install the ldap client on centos 8 machine

    Regards,
    Pranav

    Reply

    • Hi Pranav,

      Please check here https://kifarunix.com/configure-sssd-for-openldap-authentication-on-centos-8/.

      Reply

      • Hi Koromicha,

        I am seeing the error related to dn(err=32), when trying to add the basedn I am getting the message as
        adding new entry “dc=testldap,dc=local”
        ldap_add: Already exists (68)

        but I am getting no such object while searching for the basedn details

        ldapsearch -x -b “dc=testldap,dc=local”
        # extended LDIF
        #
        # LDAPv3
        # base with scope subtree
        # filter: (objectclass=*)
        # requesting: ALL
        #

        # search result
        search: 2
        result: 32 No such object

        While verifying the user attributes all data are being obtained seems like there is some issue with the baseDN

        Thanks,
        Pranav

        Reply

        • ldapsearch -D cn=”admin,dc=testldap,dc=local” -W -b dc=testldap,dc=local objectclass=person
          Enter LDAP Password:
          # extended LDIF
          #
          # LDAPv3
          # base with scope subtree
          # filter: objectclass=person
          # requesting: ALL
          #

          # pranav, dep, testldap.local
          dn: uid=pranav,ou=dep,dc=testldap,dc=local
          objectClass: inetOrgPerson
          objectClass: posixAccount
          objectClass: shadowAccount
          uid: pranav
          cn: Pranav
          sn: Viswanatha
          loginShell: /bin/bash
          uidNumber: xxxx
          gidNumber: xxxx
          homeDirectory: /home/pranav
          shadowMax: 60
          shadowMin: 1
          shadowWarning: 7
          shadowInactive: 7
          shadowLastChange: 0
          userPassword:: e1NTSEF9UUJFSHpucTJjNkpOcFNMMlY0WWViU3lVTkl0V0NkaXQ=

          # search result
          search: 2
          result: 0 Success

          # numResponses: 2
          # numEntries: 1

          I am able to retrieve the user info both from the client and server, May i please get to know what exactly i am missing where I am going wrong

          Apr 1 15:19:54 sdvt002 slapd[2397]: conn=3948 op=2 SRCH base=”dc=ldaptest,dc=local” scope=2 deref=0 filter=”(&(uid=gnome-initial-setup)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))”
          Apr 1 15:19:54 sdvt002 slapd[2397]: conn=3948 op=2 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host rhost loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey userCertificate;binary mail
          Apr 1 15:19:54 sdvt002 slapd[2397]: conn=3948 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text=
          Apr 1 15:26:20 sdvt002 slapd[2397]: conn=3948 op=3 UNBIND
          Apr 1 15:26:20 sdvt002 slapd[2397]: conn=3948 fd=17 closed
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 fd=17 ACCEPT from IP=x.x.x.x:46104 (IP=0.0.0.0:389)
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 op=0 SRCH base=”” scope=0 deref=0 filter=”(objectClass=*)”
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality defaultNamingContext lastUSN highestCommittedUSN
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 op=0 SEARCH RESULT tag=101 err=0 nentries=0 text=
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 op=1 SRCH base=”dc=ldaptest,dc=local” scope=2 deref=0 filter=”(objectClass=sudoRole)”
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 op=1 SRCH attr=objectClass objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp
          Apr 1 15:26:26 sdvt002 slapd[2397]: conn=3951 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=
          Apr 1 15:32:55 sdvt002 slapd[2397]: conn=3952 fd=23 ACCEPT from IP=x.x.x.x:54930 (IP=0.0.0.0:389)
          Apr 1 15:32:55 sdvt002 slapd[2397]: conn=3952 op=0 BIND dn=”cn=admin,dc=ldaptest,dc=local” method=128
          Apr 1 15:32:55 sdvt002 slapd[2397]: conn=3952 op=0 RESULT tag=97 err=49 text=
          Apr 1 15:32:55 sdvt002 slapd[2397]: conn=3952 op=1 UNBIND
          Apr 1 15:32:55 sdvt002 slapd[2397]: conn=3952 fd=23 closed
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 fd=23 ACCEPT from IP=x.x.x.x:54932 (IP=0.0.0.0:389)
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 op=0 BIND dn=”cn=admin,dc=ldaptest,dc=local” method=128
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 op=0 BIND dn=”cn=admin,dc=ldaptest,dc=local” mech=SIMPLE ssf=0
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 op=0 RESULT tag=97 err=0 text=
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 op=1 SRCH base=”dc=ldaptest,dc=local” scope=2 deref=0 filter=”(objectClass=person)”
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 op=2 UNBIND
          Apr 1 15:33:23 sdvt002 slapd[2397]: conn=3953 fd=23 closed

          Reply

        • Hello Pranav,

          Error 32 usually means the object being queried does not exist! Ensure the DN is correct

          Reply

          • I am new to LDAP can you help me to modify the data entry in olcDatabase and olcAccess, I am seeing the issue in the olcDatabase={1}mdb