First of all I am new to OpenLDAP setup. I have followed instructions coming from:
HowToForge.com linux openldap setup
#root
dn: dc=localhost,dc=com
dc: localhost
objectClass: dcObject
objectClass: organizationalUnit
ou: rootObject
ou: localhost.com
dn: ou=People,dc=localhost,dc=com
ou: People
objectClass: organizationalUnit
dn: uid=root,ou=People,dc=localhost,dc=com
uid: root
cn: Manager
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword {crypt}$6$l4IzdQnUVegcZdxH$L3winJgau4xxFBcvXgg2dzLs0eQ.8LS9rKWx6DeV/JPNnCZW6i9oCS/9rCtAzrdCie3qrgSMYvz4zKhJXIwcL1
shadowLastChange: 15792
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 0
gidNumber: 0
homeDirectory: /root
gecos: root
dn: uid=operator,ou=People,dc=localhost,dc=com
uid: operator
cn: operator
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}*
shadowLastChange: 15628
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /sbin/nologin
uidNumber: 11
gidNumber: 0
homeDirectory: /root
gecos: operator
dn: uid=adam,ou=People,dc=localhost,dc=com
uid: adam
cn: adam
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$oZVvz21C$HCHh90xQhCYN.9YCHG7P3d.y7Kx3Od6qkBjJy.S0QDSh57STBPJyHjxhuBbe73BB0QGFqj86JqnJCe3HqCJmD.
shadowLastChange: 15806
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 502
gidNumber: 502
homeDirectory: /home/adam
dn: uid=eve,ou=People,dc=localhost,dc=com
uid: eve
cn: eve
......
When I imported all uses contained within this ldif file using command:
slapadd -n 2 -l /etc/openldap/localhost.com.ldif
I ran into NO errors.
Then I used JXplorer to confirm that all objects are there in thr LDAP tree, under localhost.com.
However when I try to authenticate against LDAP users, I always got the feedback from applications that user password is not correct? Why this?!
Is it because of the "hased/shadowed" passwd as defined in this ldif? Shall I use plain passwd instead?
Also I cannot modify the user passwords from within JXploprer GUI as it complains:
"unable to perform modify operation"...
I figured out that it must have something to do with my slapd.conf. Like I cannot modify user passwords. Is there a way to resolve this in slapd.conf?
#######################################################################
# database definitions
#######################################################################
database bdb
suffix "dc=localhost,dc=com"
checkpoint 1024 15
rootdn "cn=Manager,dc=localhost,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
# rootpw {crypt}ijFYNcSNctBYg
rootpw {SSHA}ITG/tKlnULV84uCPuZRVUoSvKpqKTwjB
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap
# Indices to maintain for this database
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
Many thanks in advance
How are you hashing your password?
userPassword {crypt}$6$l4IzdQnUVegcZdxH$L3winJgau4xxFBcvXgg2dzLs0eQ.8LS9rKWx6DeV/JPNnCZW6i9oCS/9rCtAzrdCie3qrgSMYvz4zKhJXIwcL1
That looks like the hash is wrong. It should be a lot shorter. I ran into something that looks similar a while back, and fixed by adding a random salt to my crypt function.