Dwija D via FreeIPA-users wrote:
Hi I am trying to search ldap user using the following command but
with
invalid credentials error: # ldapsearch -x -h
ldap://ipm.example.net
<
http://ldaps//idm.example.net>-p 389 -b "*dc=example,dc=net*" -D
"*uid=ldapbind,cn=users,cn=account,dc=example,dc=net*" uid=ambariadmin1
-W Enter LDAP Password: *ldap_bind: Invalid credentials (49)* I have
double checked the password but the error still persists. Before that, i
have added a ldap bind user with the following procedure *[root@example
~]# cat ldapbind.ldif* dn:
uid=ldapbind,cn=users,cn=accounts,dc=example,dc=net changetype: add
objectclass: account objectclass: simplesecurityobject uid: ambaribind
userPassword: secret123 passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0
I would discourage you from adding bind-only users to cn=users. We
recommend putting into cn=sysaccounts. This isn't a posix user and the
IPA tools shouldn't be used to manage it.
*[root@example ~]# ldapmodify -h **example.net*
<
http://example.net/>*-p 389 -x -D "cn=Directory
Manager" -w 'secret123'
-f ldapbind.ldif* adding new entry
"uid=ldapbind,cn=users,cn=accounts,dc=example,dc=net" *[root@example ~]#
ipa user-show ambaribind --raw --all* dn:
uid=ldapbind,cn=users,cn=accounts,dc=example,dc=net uid: ldapbind
nsaccountlock: FALSE has_password: TRUE has_keytab: FALSE objectClass:
account objectClass: simplesecurityobject objectClass: top Without bind
user, i can search the user *[root@example ~]# ldapsearch -x -h
**ipa.example.net* <
http://idm.infodetics.net/>*-p 389 -b
"cn=ambari,dc=example,dc=net" uid=ambariadmin1* Can any one plz guide me
where is the issue ? Regards
There are some inconsistencies in the naming, I assume related to an
attempt at obfuscation, which makes it difficult to spot real issues.
Otherwise the ldif looks fine. I don't see any reason why the bind would
fail. I'm not aware of any ACI that prevents bind in cn=users for
non-IPA users but as I mentioned, we recommend using cn=sysaccounts per
https://www.freeipa.org/page/HowTo/LDAP
rob