Openldap migration – slapd wont start “olcDbDirectory: value #0: invalid path: Permission denied”

centos7openldapslapd

i have migrated my old slapd DB to a new server, these are the steps i took:

  1. on old server run:
slapcat -n 0 -l config.ldif

slapcat -n 2 -l data.ldif

I had to run slapcat -n 2… because with -n 1 I get slapcat: database doesn't support necessary operations.

  1. copy the two ldif files to new server

  2. install openldap:

yum install -y openldap openldap-servers openldap-clients
  1. edit config.ldif and change the lines
dn: olcDatabase={2}bdb,cn=config
olcDatabase: {2}bdb

to be

dn: olcDatabase={1}bdb,cn=config
olcDatabase: {1}bdb
  1. run slapadd for the two ldif files:
slapadd -c -F /etc/openldap/slapd.d -n 0 -l config.ldif

First time round this gave me the error about olcOverlay not being allowed so i removed the line for the config.ldif file then it worked ok.

slapadd -c -F /etc/openldap/slapd.d -n 1 -l data.ldif

this appeared to work fine.

  1. start slapd this is where my problem is, slapd wont start and i get the error:
 olcDbDirectory: value #0: invalid path: Permission denied
config error processing olcDatabase={1}bdb,cn=config: olcDbDirectory: value #0: invalid path: Permission denied

my olcDbDirectory in the config.ldif file is set to /usr/local/openldap/ldap and this folder exists and is owned by ldap:ldap and ive even tried giving it 777 permissions but i still get this error.

i would expect slapd to start. If anyone can give me any help it would be amazing, either steps i may have missed or what i should do to resolve this error.

Best Answer

When you import your config.ldif, slapadd won't overwrite the existing content deployed by the yum installation. To import the configuration correctly, you have to delete the current configuration first:

rm -r /etc/openldap/slapd.d/cn=config*
sudo -u ldap slapadd -F /etc/openldap/slapd.d -n0 -l config.ldif

(If you run slapadd as root, then you should chown -R ldap:ldap /etc/openldap/slapd.d afterward. sudo -u ldap avoids needing to do that.)

If you do it all correctly, slapadd will succeed without needing -c.

Related Topic