0

I installed a new OpenLDAP in Ubuntu 14.04 (slapd) and export fully LDIF file from an old OpenLDAP on FreeBSD and imported in the new one.

Everything is there and works fine. The anonymous search, user binding, and admin can do everything. But the problem is when an bind user wants to modify some of its own attributes such as description, givenName, etc. It gives:

LDAP error code 50 - Insufficient Access Rights

Is there something in "slapd.conf" that stops self write for the user? I haven't touched the "slapd.conf" or anything in "/slapd.d/cn=config/".

Test ENV: Same application has error with new LDAP server and it works fine with the old one when I change the LDAP address So it's not the application. Also I tested this with "apachedirectorystudio". Both same result. Works fine on the old one and not on the new server.

Please let me know if you need further information. Thanks

UPDATE: I ran "ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config" and got these results:

{0}hdb, config
dn: olcBackend={0}hdb,cn=config
objectClass: olcBackendConfig
olcBackend: {0}hdb

# {-1}frontend, config
dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth manage by * break
olcAccess: {1}to dn.exact="" by * read
olcAccess: {2}to dn.base="cn=Subschema" by * read
olcSizeLimit: 500

# {0}config, config
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth manage by * break

# {1}hdb, config
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=iscpif,dc=fr
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
 s auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read
olcLastMod: TRUE
olcRootDN: cn=admin,dc=example,dc=com
olcRootPW: {SSHA}
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: objectClass eq

# search result
search: 2
result: 0 Success

# numResponses: 12
# numEntries: 11

Is it possible that olcAccess causes this? Shouldn't slapd.conf overwrite these?

1

slapd either uses slapd.conf or cn=config for its configuration. My hunch is that the "working" server is using the former while the "broken" server is using the latter. Prove this hypothesis by looking at the slapd process with the 'ps' command on each server:

ps ax | grep slapd
2
  • Hi @pmatulis, the new server gives me "/usr/sbin/slapd -h ldap:/// ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d". But I have slapd.conf in this folder as well. Was my guess true about olcAccess in ""/slapd.d/cn=config/"? tnx – Maziyar Jan 6 '16 at 1:38
  • You are using the "new style" configuration on the new server, as I suspected. The slapd.conf file is not being used. You now need to inspect the ACLs (olcAccess) to discover why your permissions are not doing what you want. > olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read The above says the admin can write anything but anyone else can only read. – pmatulis Jan 6 '16 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.