OpenLDAP is the standard open-source LDAP server for Linux. It runs as slapd (Stand-Alone LDAP Daemon). FreeIPA and 389 Directory Server also build on OpenLDAP. Configuration uses LDIF files applied to a special cn=config backend.
| Item | Syntax / Value | Description |
|---|---|---|
| Install | sudo apt install slapd ldap-utils | Install OpenLDAP server + client tools |
| Reconfigure | sudo dpkg-reconfigure slapd | Re-run setup wizard to set domain/admin |
| slapd service | sudo systemctl start/stop/restart/status slapd | Manage slapd service |
| Base DN | Derived from domain: example.com → dc=example,dc=com | Default base DN from installation |
| Admin DN | cn=admin,dc=example,dc=com | Default admin account |
| slapcat | sudo slapcat > backup.ldif | Export entire database (stop slapd first) |
| slapadd | sudo slapadd -l backup.ldif | Import database (stop slapd first) |
| slappasswd | slappasswd -s mypassword | Generate hashed password for LDIF |
| cn=config | ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config | Query live configuration |
| Add schema | ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif | Add schema via LDIF |
| TLS config | olcTLSCertificateFile / olcTLSCertificateKeyFile / olcTLSCACertificateFile | TLS certificate configuration |
| Log level | olcLogLevel: stats | Set logging level in cn=config |
| Access control | olcAccess: to * by self write by users read by anonymous auth | ACL rules |
| Size limit | olcSizeLimit: 500 | Max entries returned per search |
| Time limit | olcTimeLimit: 60 | Max seconds for a search |
| Overlay | olcOverlay: memberof | Add functionality via overlay |
| memberof overlay | Automatically maintain memberOf attribute | When added to group, user gets memberOf |
| ppolicy overlay | Password policy overlay | Enforce password complexity, expiry |
| syncprov overlay | Sync provider for replication | Enable LDAP replication |
| /etc/ldap/ldap.conf | BASE/URI/TLS_CACERT settings | Client configuration file |
| ldap.conf TLS | TLS_REQCERT demand / TLS_CACERTFILE /etc/ssl/certs/ca.crt | Client TLS verification |
# ── Install OpenLDAP on Ubuntu ────────────────────────────────
sudo apt update
sudo apt install -y slapd ldap-utils
# Reconfigure (set domain and admin password)
sudo dpkg-reconfigure slapd
# Select: No (don't omit), domain: mywebuniversity.com,
# org: MyWebUniversity, admin password, MDB, No, Yes
# Verify
sudo slapcat | head -20
ldapsearch -x -H ldap://localhost -b "dc=mywebuniversity,dc=com" -LLL
# ── Add extra schemas ─────────────────────────────────────────
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
# ── Add memberOf overlay (auto-update memberOf attribute) ─────
cat > /tmp/memberof.ldif << 'EOF'
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: memberof.la
dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
EOF
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/memberof.ldif
# ── Enable TLS ────────────────────────────────────────────────
# Generate self-signed cert
sudo openssl req -newkey rsa:2048 -nodes -keyout /etc/ldap/certs/ldap.key -x509 -days 365 -out /etc/ldap/certs/ldap.crt -subj "/CN=ldap.mywebuniversity.com"
sudo chown openldap:openldap /etc/ldap/certs/*
# Apply TLS configuration
cat > /tmp/tls.ldif << 'EOF'
dn: cn=config
changetype: modify
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/certs/ldap.crt
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/certs/ldap.key
-
EOF
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/tls.ldif
# ── Client config /etc/ldap/ldap.conf ────────────────────────
sudo tee /etc/ldap/ldap.conf << 'EOF'
BASE dc=mywebuniversity,dc=com
URI ldap://localhost ldaps://localhost
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
TLS_REQCERT demand
EOF
# ── Backup and restore ────────────────────────────────────────
# Backup (while running)
ldapsearch -x -H ldap://localhost -D "cn=admin,dc=mywebuniversity,dc=com" -W -b "dc=mywebuniversity,dc=com" "(objectClass=*)" "*" "+" > /backup/ldap-backup.ldif
# Full backup (stop slapd)
sudo systemctl stop slapd
sudo slapcat -n 0 > /backup/config-backup.ldif # config
sudo slapcat -n 1 > /backup/data-backup.ldif # data
sudo systemctl start slapd
# ── Set access controls ───────────────────────────────────────
cat > /tmp/acl.ldif << 'EOF'
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword
by self write
by anonymous auth
by dn.base="cn=admin,dc=mywebuniversity,dc=com" write
by * none
olcAccess: {1}to *
by self write
by users read
by anonymous auth
EOF
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/acl.ldif
# ── Test authentication ───────────────────────────────────────
ldapwhoami -x -H ldap://localhost -D "uid=alice,ou=users,dc=mywebuniversity,dc=com" -W
# Should return: dn:uid=alice,ou=users,dc=mywebuniversity,dc=com