Home / server / Questions / 881274
Accepted
mellow-yellow
Asked: 2017-11-01 13:53:36 +0800 CST

When is ldapi:// -Y EXTERNAL needed? Apparently, cosine.ldif breaks without it

  • 772

I'm new to OpenLDAP (but not Microsoft Active Directory) and reading zytrax's openldap guide. I'm using OpenLDAP 2.4.44 on CentOS 7.4, as shown here:

@(#) $OpenLDAP: slapd 2.4.44 (Aug  4 2017 14:23:27) $
    [email protected]:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd

I want to add cosine (and later inetorgperson) schemas, but this fails:

ldapadd -f /etc/openldap/schema/cosine.ldif
ldap_sasl_interactive_bind_s: No such attribute (16)

Whereas this works:

ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/cosine.ldif

Can anybody explain why? Apparently, ldapi:// -Y EXTERNAL seems to indicate SASL, but I haven't found zytrax's explanation of why/when to use ldapi:// instead of ldapadd commands in OLC.

openldap

1 Answers

  1. Best Answer

    You use ldapadd -H ldapi:/// -Y EXTERNAL ... when you want to modify cn=config - the LDAP config itself. LDAP schema is a part of cn=config.

    • -H ldapi:/// - use UNIX-domain socket (/var/run/ldapi)
    • -Y EXTERNAL - use EXTERNAL mechanism for SASL

    I'm not an expert in SASL mechanisms but in this case authentication will succeed if user has UID and GID equal to 0 - is a root.

    • 10