Windows下OpenLDAP无法启动及slapd.conf配置问题求助

Hey there, let’s work through your two OpenLDAP issues step by step—no overly technical jargon, just practical, actionable fixes.

1. Critical Configurations for slapd.conf Before slapd.d Conversion #

The tutorial mentions modifying slapd.conf but skips the key details you need for a functional server. Here’s the minimum you should include in your C:\OpenLDAP\etc\openldap\slapd.conf file:

• Load Essential Schemas: These define LDAP object classes (users, groups, etc.) that your server needs to understand:

  include         C:\OpenLDAP\etc\openldap\schema\core.schema
  include         C:\OpenLDAP\etc\openldap\schema\cosine.schema
  include         C:\OpenLDAP\etc\openldap\schema\inetorgperson.schema
  include         C:\OpenLDAP\etc\openldap\schema\nis.schema
  

  Adjust paths if you installed OpenLDAP in a non-default location.

• Runtime State Files: Track the server’s process ID and arguments:

  pidfile         C:\OpenLDAP\var\run\slapd.pid
  argsfile        C:\OpenLDAP\var\run\slapd.args
  

• Database Setup: Configure your backend storage (MDB is the recommended modern choice):

  database        mdb
  suffix          "dc=yourdomain,dc=com"  # Replace with your actual domain (e.g., dc=mycompany,dc=net)
  rootdn          "cn=Manager,dc=yourdomain,dc=com"  # Your admin user's distinguished name
  rootpw          {SSHA}XYZ123...  # Encrypted admin password (generate with `slappasswd -s YourStrongPassword`)
  directory       C:\OpenLDAP\var\openldap-data  # Where LDAP data will be stored
  index           objectClass eq,pres
  index           cn,uid eq,pres,sub
  

• Basic Access Controls: Set permissions to let your admin write data and others read it:

  access to *
          by dn.base="cn=Manager,dc=yourdomain,dc=com" write
          by * read
  

Your slaptest command succeeded because your config had valid syntax, but it was likely missing these runtime/database details—adding them will make the server functional after conversion.

2. Fixing WSAEACCES (Error 10013) When Starting slapd #

The WSAEACCES error means the server can’t bind to ports 389 (LDAP) or 636 (LDAPS) due to either permission issues or port conflicts. Here’s how to fix it:

• Run Command Prompt as Administrator:
  On Windows, binding to ports below 1024 (like 389 and 636) requires elevated privileges. Right-click Command Prompt > "Run as administrator" before executing your slapd command.

• Check for Port Conflicts:
  Another program (e.g., Active Directory, antivirus tools, or a different LDAP server) might be using ports 389 or 636. Run these commands to check:

  netstat -ano | findstr :389
  netstat -ano | findstr :636
  

  If you see a PID listed, open Task Manager > Details tab, locate that PID, and end the process (only if it’s safe to do so).

• Validate LDAPS Certificate Setup (If Using LDAPS):
  If you’re enabling LDAPS, add TLS config to slapd.conf (before re-running slaptest):

  TLSCertificateFile    C:\OpenLDAP\etc\openldap\cert\server.crt
  TLSCertificateKeyFile C:\OpenLDAP\etc\openldap\cert\server.key
  

  Generate self-signed certificates with tools like openssl if you don’t have official ones. While your specific error points to permissions/ports, missing certs can also break LDAPS binding.

Once you’ve addressed these, re-run slaptest to update the slapd.d config, then start the server with your elevated command prompt:

C:\OpenLDAP>slapd -d 8 -h "ldaps://localhost/ ldap://localhost/"

内容的提问来源于stack exchange，提问作者newbieprogrammer