openldap 2.3.43 directory read only user

craigmyster · 03-08-2011, 07:37 PM

I am very new to openldap but got users added into the People ou and have authentication working over TLS. I have no ACLs in place yet but want to use a user called ldap-auth-user to bind to the ldap servers directory from the client servers. However I keep on getting ldap_bind: Invalid credentials (49). Error. I know the UserPassword is correct because I can log into a server using that id and password through the LDAP directory. I am guessing it has something to do with the way I created the account.

This Works:
ldapsearch -D 'cn=Manager,dc=test,dc=com' -x 'uid=testuser' -W

This Doesn't:
ldapsearch -D 'cn=ldap-auth-user,dc=test,dc=com' -x 'uid=testuser' -W

Here is the ldap-auth-users entry in the directory

[root@ldap-build-01 ~]# ldapsearch -D 'cn=Manager,dc=test,dc=com' -x 'uid=ldap-auth-user' -W
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <> with scope subtree
# filter: uid=ldap-auth-user
# requesting: ALL
#

# ldap-auth-user, People, glbb.jp
dn: uid=ldap-auth-user,ou=People,dc=test,dc=com
uid:: bGRhcC1hdXRoLXVzZXIg
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e1NTSEF9VVU4eWQ1WDZkbGc5U2JOc21JSHR5YzkzazBwTzdOWjA=
shadowLastChange: 15008
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 503
gidNumber: 1000
homeDirectory: /home/ldap-auth-user
cn: ldap-auth-user
gecos: ldap-auth-user

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
[root@ldap-build-01 ~]#

quanta · 03-08-2011, 10:24 PM

The binddn you use from command line is different the dn from ldif content:

Code:

This Doesn't:
 ldapsearch -D 'cn=ldap-auth-user,dc=test,dc=com' -x 'uid=testuser' -W

Code:

# ldap-auth-user, People, glbb.jp
dn: uid=ldap-auth-user,ou=People,dc=test,dc=com
uid:: bGRhcC1hdXRoLXVzZXIg

Which attribute you want to use to authenticate: cn or uid?

Try this:

Code:

ldapsearch -D 'uid=ldap-auth-user,ou=People,dc=test,dc=com' -x 'uid=testuser' -W

Remember input the password of ldap-auth-user, not rootdn.

craigmyster · 03-09-2011, 02:27 AM

thank you. didn't realize you needed to specify the OU also. Kind of curious why I cannot bind with the cn though. the cn is ldap-auth-user just like the uid.

quanta · 03-09-2011, 02:43 AM

Quote:

Originally Posted by craigmyster

Kind of curious why I cannot bind with the cn though. the cn is ldap-auth-user just like the uid.

Because there is no dn which has name 'cn=ldap-auth-user,ou=People,dc=test,dc=com' in your LDAP directory.