OpenLDAP配置问题排查：RootDSE缺失架构位置、无法显示BaseDN及配置文件审核请求

Hey there! Let’s break down your OpenLDAP issues one by one, and I’ll also go over the config snippet you shared to spot any gaps.

首先，解决ldapsearch无结果的问题 #

Your command has a small typo that’s causing it to return nothing. The correct command should be:

ldapsearch -x -b '' -s base +

You accidentally added an extra ldap parameter after -x — removing that should make the query return the RootDSE attributes as expected. If it still doesn’t work, try specifying your server explicitly with -h ldap://your-server-ip (replace with your actual LDAP server address) and check if slapd is running properly. You can also look into your slapd log file at /opt/openldap/logs/slapd.log (since you enabled logging) for any startup errors.

接下来，处理ApacheDirectoryStudio的“Missing schema location in RootDSE”错误 #

This error happens because your OpenLDAP instance isn’t loading any schema files, so the RootDSE doesn’t expose schema-related metadata that the studio expects. Looking at your slapd.ldif, you only have global config parameters but no entries to load core schemas.

To fix this, you’ll need to add schema configuration to your cn=config tree. Here’s an example LDIF you can use (adjust paths to match your OpenLDAP installation):

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

# Load core schema (required for basic directory functionality)
dn: olcSchemaConfig={0}core,cn=schema,cn=config
objectClass: olcSchemaConfig
olcSchemaConfig: {0}core
olcInclude: file:///opt/openldap/etc/openldap/schema/core.ldif

# Add other common schemas if you need them (like for user accounts)
dn: olcSchemaConfig={1}cosine,cn=schema,cn=config
objectClass: olcSchemaConfig
olcSchemaConfig: {1}cosine
olcInclude: file:///opt/openldap/etc/openldap/schema/cosine.ldif

dn: olcSchemaConfig={2}inetorgperson,cn=schema,cn=config
objectClass: olcSchemaConfig
olcSchemaConfig: {2}inetorgperson
olcInclude: file:///opt/openldap/etc/openldap/schema/inetorgperson.ldif

Import this using ldapadd -x -D cn=config -W -f schema.ldif (you’ll need the password for cn=config; if you haven’t set one yet, you may need to use sudo slapadd for offline configuration).

完善你的slapd.ldif配置 #

Right now, your config only has global settings (like logs, pid files) but no database instance — this means your LDAP server isn’t actually set up to store any directory data. You need to add a database configuration block (using MDB, OpenLDAP’s recommended backend):

dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcSuffix: dc=example,dc=com  # Replace with your actual domain suffix (e.g., dc=yourcompany,dc=com)
olcRootDN: cn=admin,dc=example,dc=com  # Your admin DN for the directory
olcRootPW: {SSHA}xxxxxxxxxx  # Generate this with `slappasswd` tool
olcDbDirectory: /opt/openldap/var/openldap-data  # Ensure this directory exists and has correct permissions for slapd
olcDbIndex: objectClass eq
olcDbIndex: cn,uid eq
olcDbIndex: mail,sn eq
olcDbMaxSize: 1073741824  # 1GB storage limit, adjust as needed

Add this to your slapd.ldif or import it separately.

Final Checks #

• Run slapd -Tt to test your config for syntax errors — it’ll tell you if there are any issues to fix.
• Restart the slapd service after making changes (e.g., systemctl restart slapd if using systemd, or the appropriate command for your init system).
• Re-run the corrected ldapsearch command to verify RootDSE now shows schema attributes, then try connecting with ApacheDirectoryStudio again.

备注：内容来源于stack exchange，提问作者Smok