ldap_bind: Invalid Credentials (49)

Question

I'm running OpenLDAP 2.4-28 on XUBUNTU 12.04.

I'm reading "Mastering OpenLDAP" and configuring along with the book.

When I try to perform the following search (page 47):

$ ldapsearch -x -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base

I am prompted for the password. Then I enter "secret" but I get the following error:

ldap_bind: Invalid Credentials (49).

The following is my slapd.conf:

# slapd.conf - Configuration file for LDAP SLAPD
##########
# Basics #
##########
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/inetorgperson.schema
pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args
loglevel none
modulepath /usr/lib/ldap
# modulepath /usr/local/libexec/openldap
moduleload back_hdb

##########################
# Database Configuration #
##########################
database hdb
suffix "dc=example,dc=com"
rootdn "cn=Manager,dc=example,dc=com"
rootpw secret
directory /var/lib/ldap
# directory /usr/local/var/openldap-data
index objectClass,cn eq

########
# ACLs #
########
access to attrs=userPassword
    by anonymous auth
    by self write
    by * none
access to *
    by self write
    by * none

and here is the ldap.conf:

# LDAP Client Settings
URI ldap://localhost
BASE dc=example,dc=com
BINDDN cn=Manager,dc=example,dc=com
SIZELIMIT 0
TIMELIMIT 0

Answer 1

I don't see an obvious problem with the above.

It's possible your ldap.conf is being overridden, but the command-line options will take precedence, ldapsearch will ignore BINDDN in the main ldap.conf, so the only parameter that could be wrong is the URI. (The order is ETCDIR/ldap.conf then ~/ldaprc or ~/.ldaprc and then ldaprc in the current directory, though there environment variables which can influence this too, see man ldapconf.)

Try an explicit URI:

ldapsearch -x -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base -H ldap://localhost

or prevent defaults with:

LDAPNOINIT=1 ldapsearch -x -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base

If that doesn't work, then some troubleshooting (you'll probably need the full path to the slapd binary for these):

• make sure your slapd.conf is being used and is correct (as root)

  slapd -T test -f slapd.conf -d 65535

  You may have a left-over or default slapd.d configuration directory which takes preference over your slapd.conf (unless you specify your config explicitly with -f, slapd.conf is officially deprecated in OpenLDAP-2.4). If you don't get several pages of output then your binaries were built without debug support.

• stop OpenLDAP, then manually start slapd in a separate terminal/console with debug enabled (as root, ^C to quit)

  slapd -h ldap://localhost -d 481

  then retry the search and see if you can spot the problem (there will be a lot of schema noise in the start of the output unfortunately). (Note: running slapd without the -u/-g options can change file ownerships which can cause problems, you should usually use those options, probably -u ldap -g ldap )

• if debug is enabled, then try also

  ldapsearch -v -d 63 -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base