ldap_modify: Other (e.g., implementation specific) error (80) [closed]

Question

I followed RHEL7: Configure a LDAP directory service for user connection to configure openldap on CentOS Linux release 7.

First I create the /etc/openldap/changes.ldif file and paste the content with replacing the password of course with the previously created password.

Then I get to send the new configuration to the slapd server using the command

# ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/changes.ldif

Once I do that I get the following error:

# ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/changes.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)

All the files are readable for the user slapd is running as. What's wrong there? I couldn't find anything useful to feed SEARCHENGINE with.

It's been a while that I've been looking for a solution but at the moment all what I found is two people

• Re: Error 80 with ldapmodify
• ldap_modify: Other (e.g., implementation specific) error (80)

Having the same problem and asking the same question but no answers.

Answer 1

In my specific case, I was having this error and I literally spent days scouring the Web for an answer. It turned out in my case that the order matters. The correct order was:

1. olcTLSCACertificateFile,
2. olcTLSCertificateKeyFile,
3. olcTLSCertificateFile.

Until the order of the attributes in my file was the one above, I was having that dreaded and unhelpful "ldap_modify: Other (e.g., implementation specific) error (80)" message.

I tried to detect permission errors using sudo -u ldap nano <path to each file>. All was fine for each file.

nano revealed that the files were in DOS format: I converted them to have Linux line endings, to no avail.

In all I read, there was a question as to whether the certificate file was in the proper PEM format. I could not check that, maybe that it's also a cause for this error.

The only thing that worked was commenting out some lines in the file until I saw changes after running ldapsearch -H ldapi:// -Y EXTERNAL -b "cn=config" -LLL -Q -s base.

Note also that I "compressed" the changes in my file to a single change. What I mean with "compressed" is that instead of having three changes, I had only one: instead of this (I'm using Ansible, so this is actually a Jinja2 template)

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: {{ cert_parentdir_ca_chain }}/{{ cert_filename_ca_chain }}

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: {{ cert_parentdir_wildcard_cert }}/{{ cert_filename_wildcard_cert }}

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: {{ ldap_cert_parentdir_key }}/{{ cert_filename_key }}

I had this

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: {{ cert_parentdir_ca_chain }}/{{ cert_filename_ca_chain }}
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: {{ ldap_cert_parentdir_key }}/{{ cert_filename_key }}
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: {{ cert_parentdir_wildcard_cert }}/{{ cert_filename_wildcard_cert }}

HTH.