[CentOS] Howto for LDAP authentication with replication

Sat Jan 12 23:35:55 UTC 2008
Craig White <craigwhite at azapple.com>

On Sat, 2008-01-12 at 17:00 -0600, Sean Carolan wrote:
> Thanks for your patience, Craig.   So I took your advice and started
> with a fresh install of CentOS 5, and followed the instructions in the
> documentation exactly as they are written.  I got this far:
> 
> [root at server migration]# ./migrate_all_online.sh
> Enter the X.500 naming context you wish to import into: [dc=domain,dc=com]
> Enter the hostname of your LDAP server [ldap]: server.domain.com
> Enter the manager DN: [cn=manager,dc=domain,dc=com]:
> Enter the credentials to bind with:
> Do you wish to generate a DUAConfigProfile [yes|no]? no
> 
> Importing into dc=domain,dc=com...
> 
> Creating naming context entries...
> Migrating groups...
> Migrating hosts...
> Migrating networks...
> Migrating users...
> Migrating protocols...
> Migrating rpcs...
> Migrating services...
> Migrating netgroups...
> Migrating netgroups (by user)...
> Migrating netgroups (by host)...
> ldap_bind: Invalid credentials (49)
> Importing into LDAP...
> ldap_bind: Invalid credentials (49)
> /usr/bin/ldapadd: returned non-zero exit status: saving failed LDIF to
> /tmp/nis.ldif.Hh9210
> 
> I will go and read all of the links you sent me, but it's very
> frustrating to follow even a simple tutorial for the OS and have it
> not work.  Because I have little experience with LDAP I don't know
> whether it's a problem with the documentation, or human error.
----
Just so we're clear here, you are actually trying to learn two distinct
things simultaneously, how to use LDAP and how to use LDAP to
authenticate. They are not the same thing. If you knew how to use LDAP,
adding authentication to the knowledge base would be relatively trivial.
Likewise, if you knew how to use LDAP, configuring Webmin would be
relatively trivial.

I can tell you that Gerald Carter's book makes the entire process
painless but you are going to do it your way and I respect that to a
point...but ask that you recognize that you do so at the peril of
massive frustration.

invalid credentials (error 49) is what you get when the binddn you are
using doesn't work. To do a live add, it presumes that you have already
created the password with the slappasswd command and entered that value
for the password as rootbinddn in slapd.conf and that you are telling
migrate_all_online.sh to use that exact same rootbinddn.

Make sense?

Craig