Getting ldap_bind : Invalid credentials(49) error

Rohit_4739 · 09-08-2011, 05:02 AM

Hello LQ Folks,

I am getting this error when ever i am trying to add entries to my home ldap server.

ldap_bind : Invalid credentials(49)

Here is the command and its output :

ldapadd -xh localhost -D "cn=Manager,dc=test,dc=com" -w Redhat -f ldif/test.ldif

ldap_bind: Invalid credentials (49)

Here is my slapd.conf

Quote:

# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# ldbm and/or bdb database definitions
#######################################################################

database bdb
suffix "dc=test,dc=com"
rootdn "cn=Manager,dc=test,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw Redhat
# rootpw {crypt}ijFYNcSNctBYg

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap

# Indices to maintain for this database
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub

So could you please explain me why i am getting this error.

Thanks in advance.

bathory · 09-08-2011, 11:50 AM

Hi,

It should work as the bind dn and password are those defined in slapd.conf. Are you sure you're using that slapd.conf and not a different one?
Also since you didn't mention your distro, check if you're not running openldap with the configuration stored in cn=config instead of slapd.conf.

Regards

gopa · 03-21-2012, 04:49 AM

This is very common error while confugaring openldap.
Follow the below steps for solving

Check the slapd.conf
68 database bdb
69 suffix "dc=example,dc=com"
70 rootdn "cn=Manager,dc=example,dc=com"
71 rootpw secret

#service ldap restart

So create Test users:

#useradd test
#passwd test
Changing password for user test1.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.

The users created here are the users of operating system. Now migrate them to Openldap.

Before doing this create root user with the name "root"

Now migrate:

#/usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif (This is for root migration)
#/usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test /etc/openldap/test.ldif

After adding the root user add contents of the root as per the requirement

#vi /etc/openldap/root.ldif

dn: uid=root,ou=People,dc=adminmart,dc=com
uid: root
cn: Manager
objectClass: account

the invalid credentails are caused mostly when root user is not created.

Create a domain ldif file:

#cat /etc/openldap/example.ldif

dn: dc=adminmart,dc=com
dc: adminmart
description: LDAP Admin
objectClass: dcObject
objectClass: organizationalUnit
ou: rootobject

dn: ou=People, dc=adminmart,dc=com
ou: People
description: Users of adminmart
objectClass: organizationalUnit

Now Import local users:

ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f /etc/openldap/root.ldif

Enter LDAP Password:
adding new entry "uid=root,ou=People,dc=example,dc=com"
adding new entry "uid=operator,ou=People,dc=example,dc=com"

Restart the service:

#service ldap restart

Now test the LDAP Search by command ldapsearch:

# ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'

Test result should be 2. No of entries=...

Hope this should help you.

gopa · 02-12-2013, 04:19 AM

We have to follow clear structure before we add users to openldap.

First we need to Create Organisation (Organisation)

Second we need to create Organisation structure (Bussiness Unit)

Thirdly we have to add inetorgperson (Group/member)

i.e follow the below structure.

dn: o=test
o: test
objectClass: organization

dn: ou=apps,o=test
ou: apps
objectClass: organizationalUnit

dn: uid=testserver.com,o=test
uid: testserver.com
sn: test
cn: group
mail: testserver@testgroup.com
userPassword: password
objectClass: person
objectClass: inetOrgPerson

By following above structure you can overcome the error.

Regards,
Gopal Varma P

TB0ne · 03-15-2013, 12:29 PM

Quote:

Originally Posted by gopa

We have to follow clear structure before we add users to openldap.

First we need to Create Organisation (Organisation)
Second we need to create Organisation structure (Bussiness Unit)
Thirdly we have to add inetorgperson (Group/member)

i.e follow the below structure.

By following above structure you can overcome the error.

Again, as in a couple of other threads that you've re-opened, this is not correct. It will ONLY work for someone who wants the same configuration as you. And this thread has been closed for over a year now....please don't reopen old threads for no reason.