I'm having issues importing users with ldapadd
and ldif
files. The error I'm getting is:
ldap_add: Constraint violation (19)
additional info: structuralObjectClass: no user modification allowed
The users imported are all part of ou=People,dc=example,dc=org
. The LDAP server already contains this base DN.
The /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif
file contains the following ACL entry:
olcAccess: {2}to dn.base="ou=People,dc=example,dc=org" attrs=children by gr
oup.exact="cn=Manager,ou=Roles,dc=example,dc=org" manage
The ldif
file is imported as follows:
ldapadd -f import.ldif -xv -D "cn=drupal,ou=Apps,dc=example,dc=org" -h localhost -W
The cn=drupal,ou=Apps[...]
entry is a member of cn=Manager,ou=Roles,dc=example,dc=org
so accordingly it should have sufficient permissions to write (since manage is the highest level of permissions available).
When I issue the ldapadd
command the import fails on the very first ldif
entry. The full command output is then:
add objectClass:
top
person
inetOrgPerson
add uid:
John.Merrell
add mail:
john.merrell@example.org
add cn:
John D Merrell
add structuralObjectClass:
inetOrgPerson
add entryUUID:
65236c42-09b7-1020-9318-9fca7c043dfc
add creatorsName:
cn=drupal,ou=Apps,dc=bidnetwork,dc=org
add createTimestamp:
20110503095643Z
add userPassword:
2678u8yyy
add givenName:
John D
add sn:
Merrell
add entryCSN:
20110629121956.880164Z#000000#000#000000
add modifiersName:
cn=drupal,ou=Apps,dc=bidnetwork,dc=org
add modifyTimestamp:
20110629121956Z
adding new entry "mail=john.merrell@example.org,ou=People,dc=example,dc=org"
ldap_add: Constraint violation (19)
additional info: structuralObjectClass: no user modification allowed
I've tested importing users that did or did not exist on the LDAP and I get the aforementioned error in either case.
Can someone explain the origin of the problem and how it may be circumvented?