LDAP ldapwhoami返回“ldap_bind: Invalid credentials (49)”问题求助

Hey there! I know you're just getting started with LDAP and working toward implementing SSO for your web app—super exciting goal. Let’s dig into why ldapwhoami is giving you trouble while other commands like ldapsearch and ldapadd work fine.

First, Let’s Look at Your Config Clues #

From the slapd.conf snippet you shared:

access to * by self write by * read by anonymous auth
database ldif
suffix "dc=test,dc=com"
directory openldap-data
rootdn "cn=admin,dc=test,dc=com"

rootpw = secret r... #

A few things jump out here that could be causing the ldapwhoami issue:

1. You Might Be Missing Critical Command Parameters #

Unlike ldapsearch which can work with anonymous binds out of the box, ldapwhoami behaves differently depending on how you call it. Here’s what to try:

• Test anonymous bind: Run this command to check if anonymous authentication works (your access rule allows anonymous auth, so this should return something):

  ldapwhoami -x -h localhost -p 389
  

  The -x flag forces simple authentication (bypasses SASL, which Mac’s OpenLDAP client might default to—and if your server isn’t configured for SASL, that’s a common failure point).
• Test admin bind: If you want to verify your admin user’s identity, specify the bind DN and password explicitly:

  ldapwhoami -x -D "cn=admin,dc=test,dc=com" -w your_root_password -h localhost -p 389
  

2. Your rootpw Might Be Disabled or Misconfigured #

In your config, rootpw = secret is commented out (the ## means it’s inactive). If you’re using the cn=admin DN for commands like ldapadd, you must have a valid password set for it. Here’s how to fix this:

1. Generate an encrypted password using slappasswd:

   slappasswd -s your_secure_password
   

2. Update your slapd.conf to use this encrypted password (replace the commented line):

   rootpw {SSHA}your_generated_hash_here
   

3. Restart the OpenLDAP service to apply the change:

   sudo launchctl stop org.openldap.slapd
   sudo launchctl start org.openldap.slapd
   

3. Check Slapd Logs for Exact Errors #

Logs are your best friend for debugging LDAP issues. On Mac High Sierra, you can view slapd logs with:

tail -f /var/log/slapd.log

Run ldapwhoami while watching the logs—this will show you exactly why the command is failing (e.g., invalid credentials, missing SASL config, or permission issues).

4. Ensure Your Config Changes Are Loaded #

If you’ve modified slapd.conf recently but didn’t restart the service, those changes won’t take effect. Always restart slapd after editing the config (use the restart command from step 2 above).

Quick Note for Your SSO Goal #

Since you’re working toward LDAP SSO, getting ldapwhoami working is a great first step—it confirms that your authentication flow is functioning correctly. Once this is sorted, you’ll want to focus on integrating your web app with LDAP (usually via language-specific libraries or framework built-in modules) to handle user authentication and session management seamlessly.

内容的提问来源于stack exchange，提问作者stephen.hanson