ldap_bind: Invalid Credentials (49)

Question

I'm running OpenLDAP 2.4-28 on XUBUNTU 12.04. I'm reading "Mastering OpenLDAP" and configuring along with the book. When I try to perform the following search (page 47): ``` $ ldapsearch -x -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base ``` I am prompted for the password. Then I enter "secret" but I get the following error: ``` ldap_bind: Invalid Credentials (49). ``` The following is my `slapd.conf`: ``` # slapd.conf - Configuration file for LDAP SLAPD ########## # Basics # ########## include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap # modulepath /usr/local/libexec/openldap moduleload back_hdb ########################## # Database Configuration # ########################## database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap # directory /usr/…

Accepted Answer

I don't see an obvious problem with the above.

It's possible your `ldap.conf` is being overridden, but the command-line options will take precedence, `ldapsearch` will ignore `BINDDN` in the main `ldap.conf`, so the only parameter that could be wrong is the URI. (The order is `ETCDIR/ldap.conf` then `~/ldaprc` or `~/.ldaprc` and then `ldaprc` in the current directory, though there environment variables which can influence this too, see `man ldapconf`.)

Try an explicit URI:

```
ldapsearch -x -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base -H ldap://localhost
```

or prevent defaults with:

```
LDAPNOINIT=1 ldapsearch -x -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base
```

If that doesn't work, then some troubleshooting (you'll probably need the full path to the `slapd` binary for these):

make sure your `slapd.conf` is being used and is correct (as root)

`slapd -T test -f slapd.conf -d 65535`

You may have a left-over or default `slapd.d` configuration directory which takes preference over your `slapd.conf` (unless you specify your config explicitly with `-f`, `slapd.conf` is officially deprecated in OpenLDAP-2.4). If you don't get several pages of output then your binaries were built without debug support.

stop OpenLDAP, then manually start `slapd` in a separate terminal/console with debug enabled (as root, ^C to quit)

`slapd -h ldap://localhost -d 481`

then retry the search and see if you can spot the problem (there will be a lot of schema noise in the start of the output unfortunately). (Note: running `slapd` without the `-u`/`-g` options can change file ownerships which can cause problems, you should usually use those options, probably `-u ldap -g ldap` )

if debug is enabled, then try also

`ldapsearch -v -d 63 -W -D 'cn=Manager,dc=example,dc=com' -b "" -s base`

ldap_bind: Invalid Credentials (49)

Solution

Problem