Introduction

OpenLDAP's slapd stores directory entries and its own runtime configuration in LDAP-style data. Administrators must understand schemas, Distinguished Names, access rules, indexes, and safe offline tools.

What you should be able to do after this lesson:

Explain entries, attributes, object classes, and OIDs.
Navigate directory-based cn=config configuration.
Import and export LDIF safely.
Write basic access controls.
Build indexes and inspect logs.
Back up configuration and data.

Big Idea: OpenLDAP Stores Typed Entries in a Named Tree

LDAP is not a free-form key-value store. Every entry has a unique DN, object classes define required and allowed attributes, and schemas assign stable object identifiers. The database suffix defines where one managed naming context begins.

“White pages” directory data describes people and organizations for lookup. Authentication directories may reuse those schemas but add Unix IDs, groups, credentials, and stricter access rules.

Data Model

An entry has one DN and a set of attributes. Object classes define required and allowed attributes. Schemas assign names and globally unique object identifiers to definitions.

Example:

dn: dc=example,dc=test
objectClass: top
objectClass: domain
dc: example

The directory suffix is the root of a database's naming context.

Runtime Configuration

Modern OpenLDAP commonly stores configuration below cn=config, represented on disk as a slapd.d tree. Modify it with LDAP operations rather than editing generated files manually.

ldapsearch -Q -Y EXTERNAL -H ldapi:/// -b cn=config dn

The local ldapi:/// socket and SASL EXTERNAL can authorize the local root identity for configuration tasks, depending on installation policy.

The slapd-config manual documents the configuration backend. Runtime data is commonly stored below /var/lib/ldap/, but the exact backend and path depend on distribution configuration. Do not copy live database files as though they were ordinary portable backups.

Add Base Data

ldapadd -x -H ldaps://localhost -D '<admin-dn>' -W -f base.ldif

Use ldapmodify for online changes. slapadd is an offline database-loading tool and normally requires slapd to be stopped for the target database.

Access Control

OpenLDAP access rules evaluate in order and commonly express:

what data is targeted
who is requesting it
which access level is granted

Protect password attributes from anonymous reads while allowing users appropriate self-service and administrators managed access. Test anonymous, normal-user, self, and administrator behavior separately.

Indexes

Indexes improve selected searches but consume storage and write work. Define indexes based on actual filters such as equality lookups for uid.

After an offline index change, rebuild with:

slapindex

Run offline utilities with the correct service account and restore ownership before starting slapd.

Backup and Restore

slapcat -n 0 -l config.ldif
slapcat -n 1 -l directory.ldif

Back up both configuration and data. A restore commonly uses slapadd into an empty, stopped database, followed by ownership and index verification.

Logging and Validation

OpenLDAP loglevel controls diagnostic categories. Increase logging temporarily for a specific problem and avoid leaving verbose output enabled without retention controls.

Validate connectivity, TLS, bind policy, search results, and ACL behavior before exposing the service broadly.

Guided Practice: Build and Validate a Small Directory Tree

On an isolated OpenLDAP lab server, design this hierarchy first:

dc=example,dc=test
|-- ou=People
|   `-- uid=alice
`-- ou=Groups
    `-- cn=operators

For each entry, list its structural object class, required attributes, and complete DN. Validate the LDIF visually before importing it. After ldapadd, query each level with base, one-level, and subtree scopes.

Test ACLs with four identities:

anonymous client
authenticated normal user
the entry itself
directory administrator

Back up configuration and data separately with slapcat. Inspect the resulting LDIF and document the stopped-service restore procedure with slapadd, ownership correction, and slapindex.

Troubleshooting Scenario

Equality searches for uid become slow as the directory grows. The attribute is frequently queried but has no equality index.

Add an appropriate index through cn=config, follow backend-specific online or offline indexing requirements, and compare measured query behavior. Adding indexes for every attribute would increase write and storage cost without evidence of benefit.

Exam Focus

Understand DNs, RDNs, attributes, object classes, schemas, OIDs, and changetype operations.
Know cn=config, slapd, slapd-config, LDIF, and common database paths.
Distinguish online LDAP tools from offline slapadd, slapcat, and slapindex.
Access rules are ordered and must be tested as several identities.

Recap

Schemas define valid directory data.
cn=config is managed through LDAP operations.
ldapadd is online; slapadd, slapcat, and slapindex are administrative database tools.
Access rules are ordered and must be tested from several identities.

210.4 Configuring an OpenLDAP server