Running OpenLDAP

Some notes on running OpenLDAP under various releases.

Version 2.4

This documents some experiences using 2.4.7 on FreeBSD (5.x and 6.x). While the locations may change the basic principles should remain the same for Linux. The following lists what you may have to do to get OpenLDAP running. The notes also include some diagnostic aids and procedures:

1. The following is a quick checklist of what you have to do before starting OpenLDAP. Most of this stuff is manual. Some of it is obvious, some not:

   1. Configure log streaming (/etc/syslog.conf) for OpenLDAP (see notes under loglevel).

   2. configure/move/create slapd.conf to a suitable location ([fc] /etc/openldap [bsd] /usr/local/etc/openldap)

   3. Make sure all directories and files exist and have appropriate permissions (pid file locations, database directories). Copy the DB_CONFIG.example file to the DIT directory directive location(s) and rename as DB_CONFIG - it contains enough to get you going.

   4. Recent distributions of OpenLDAP all use scripts that run it with a non-root user and group (typically ldap) following current practise. Permissions for this user and group may be need manual adjustments for all non-standard locations. While permission problems may be avoided by running as user root this is not good practise. Instead use the -d option to debug failing permission problems and rectify them.

   5. FreeBSD: scripts assume the PID file is in /var/run/openldap/slapd.pid - scripts do not read the slapd.conf file so if using a non-standard location edit the script or change the pidfile directive otherwise the termination script will not work since it is looking in the wrong location for the pid.

   6. When running 2.4.7 and an empty database BDB fails to initialize if using slaptest to verify the slapd.conf:

      slaptest
      # fails with missing id2entry.bdb
      
      # try to verify slapd.conf only 
      slaptest -u
      # inhibits database checking
      
      # then try a normal load of LDAP using root
      # 1. make sure database directory exists
      # 2. make sure DB_CONFIG exists in target directory
      slapd -d -1
      
      # adjust permissions to ldap user and restart
      slapd -d -1 -u ldap -g ldap
      
      # once this is working 
      # either use normal start script or
      slapd -u ldap -g ldap
      

      If all this fails - install a 2.3 version of OpenLDAP and repeat process. Once the database files exist - re-install 2.4.

   7. If slapd fails - run it in diagnostic mode from command line using:

      [bsd]/usr/local/libexec/slapd -d -1 -u ldap -g ldap
      # displays all failures on terminal