Questions[ldif](server)

I'm running an OpenLDAP 2.4.44 with the module back_ldap as LDAP Proxy for MS-AD-Servers (see for details: openLDAP as proxy to Active Directory).

Now I need to add the schemata from AD-Server to the OpenLDAP-Server and I have exported the schemata from a MS-AD-Server with ldapsearch into a ldif-file (see for details: How can I fetch schema information from the server?).

Now I need to convert the ldif-format to a schema-format for OpenLDAP slapd.conf. It is not possible to load the ldif with ldapadd, because the OpenLDAP is running in proxy mode, so every request will be forwarded to MS-AD-Servers.

How do I convert the ldif-file to an schema file? Is there any tool. Or how to add a ldif-file to be loaded via slapd.conf.

I am trying to restore my OpenLDAP server from an ldif file I made before it went horribly wrong.

All of the websites I found talk about using slapadd but when I run slapadd -v -l ~ns01/openldap_config.ldif it returns the error Could not stat config file "/etc/ldap/slapd.conf" : No such file or directory (2) slapadd: bad configuration file!

When I look in the directory indeed the file does not exist, but this is because Ubuntu 11.10 is running in RTC mode, my LDAP server uses the /etc/slapd.d/cn=config for the configuration. So? What am I missing? Is slapadd the wrong tool to use?

As I said above I running on Ubuntu 11.10 server edition 64-bit.

The ldapmodify man page states that:

The default for ldapmodify is to modify existing entries

Yet when I try to import an LDIF file with ldapmodify I get the below error:

ldapmodify: modify operation type is missing at line X

Q1: Why, which arguments should I add to my ldapmodify command?

If I import an LDIF file using ldapadd and the entry already exists I get the below error:

ldap_add: Already exists (68)

This can be ignored using the -c switch (for continue), however ldap_add won't update existing entries. Instead, in order to update existing entries one should use ldapmodify, however ldapmodify won't add missing entries.

Q2: Is there a way to import an LDIF files by creating missing entries AND updating existing ones at the same time?

I'm having issues importing users with ldapadd and ldif files. The error I'm getting is:

ldap_add: Constraint violation (19)
additional info: structuralObjectClass: no user modification allowed

The users imported are all part of ou=People,dc=example,dc=org. The LDAP server already contains this base DN.

The /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif file contains the following ACL entry:

olcAccess: {2}to dn.base="ou=People,dc=example,dc=org" attrs=children by gr
 oup.exact="cn=Manager,ou=Roles,dc=example,dc=org" manage

The ldif file is imported as follows:

ldapadd -f import.ldif -xv -D "cn=drupal,ou=Apps,dc=example,dc=org" -h localhost -W

The cn=drupal,ou=Apps[...] entry is a member of cn=Manager,ou=Roles,dc=example,dc=org so accordingly it should have sufficient permissions to write (since manage is the highest level of permissions available).

When I issue the ldapadd command the import fails on the very first ldif entry. The full command output is then:

add objectClass:
    top
    person
    inetOrgPerson
add uid:
    John.Merrell
add mail:
    [email protected]
add cn:
    John D Merrell
add structuralObjectClass:
    inetOrgPerson
add entryUUID:
    65236c42-09b7-1020-9318-9fca7c043dfc
add creatorsName:
    cn=drupal,ou=Apps,dc=bidnetwork,dc=org
add createTimestamp:
    20110503095643Z
add userPassword:
    2678u8yyy
add givenName:
    John D
add sn:
    Merrell
add entryCSN:
    20110629121956.880164Z#000000#000#000000
add modifiersName:
    cn=drupal,ou=Apps,dc=bidnetwork,dc=org
add modifyTimestamp:
    20110629121956Z
adding new entry "[email protected],ou=People,dc=example,dc=org"
ldap_add: Constraint violation (19)
    additional info: structuralObjectClass: no user modification allowed

I've tested importing users that did or did not exist on the LDAP and I get the aforementioned error in either case.

Can someone explain the origin of the problem and how it may be circumvented?

Using command-line (Linux) or LDIF, I could find many examples of creating a new group and defining its members, but no examples of this:

How to add a user to an existing group?

Let's say the person also already exists.

For instance adding user uid=fred,ou=people,dc=example,dc=com to group cn=vipb,ou=groups,dc=example,dc=com.