openldap migration - slapd wont start "olcDbDirectory: value #0: invalid path: Permission denied"

Question

I have migrated my old slapd DB to a new server, these are the steps I took:

1. On old server run:

   slapcat -n 0 -l config.ldif
   
   slapcat -n 2 -l data.ldif
   

   I had to run slapcat -n 2 because with -n 1 I get slapcat: database doesn't support necessary operations.

2. Copy the two ldif files to new server

3. Install openldap:

   yum install -y openldap openldap-servers openldap-clients
   

4. Edit config.ldif and change the lines

   dn: olcDatabase={2}bdb,cn=config
   olcDatabase: {2}bdb
   

   to be

   dn: olcDatabase={1}bdb,cn=config
   olcDatabase: {1}bdb
   

5. Run slapadd for the two ldif files:

   slapadd -c -F /etc/openldap/slapd.d -n 0 -l config.ldif
   

   First time round this gave me the error about olcOverlay not being allowed so I removed the line for the config.ldif file then it worked ok.

   slapadd -c -F /etc/openldap/slapd.d -n 1 -l data.ldif
   

   this appeared to work fine.

6. Start slapd. This is where my problem is, slapd won't start and I get the error:

   olcDbDirectory: value #0: invalid path: Permission denied
   config error processing olcDatabase={1}bdb,cn=config: olcDbDirectory: value #0: invalid path: Permission denied
   

   my olcDbDirectory in the config.ldif file is set to /usr/local/openldap/ldap and this folder exists and is owned by ldap:ldap and I've even tried giving it 777 permissions but I still get this error.

I would expect slapd to start. If anyone can give me any help it would be amazing, either steps I may have missed or what I should do to resolve this error.

Answer 1

When you import your config.ldif, slapadd won't overwrite the existing content deployed by the yum installation. To import the configuration correctly, you have to delete the current configuration first:

rm -r /etc/openldap/slapd.d/cn=config*
sudo -u ldap slapadd -F /etc/openldap/slapd.d -n0 -l config.ldif

(If you run slapadd as root, then you should chown -R ldap:ldap /etc/openldap/slapd.d afterward. sudo -u ldap avoids needing to do that.)

If you do it all correctly, slapadd will succeed without needing -c.