I recently joined an organization and got privileges to add/remove entries or say attributes to the LDAP (OpenDJ ldap and opensource LINUX base ldap).

So far I have added thousand of modification and attributes with no issues, but the very awkward when I added an attribute to the LDAP which was created soon after I see it look some jumble characters to one of the value (i.e. was IP) and I removed it instantly and corrected that through Directory Manager credentials.

My LDAP admin called me and told me not to use Directory Manager access to add the thing it can corrupt the LDAP database using Directory Manager password. I was not convinced and I asked how but did not get an answer.

Is it true changing a value for a special group and specially a attribute can damage entire LDAP?

Any explanation will be helpful.


The point is that the account cn=Directory Manager is created at installation time and used to run rest of the setup. (I forgot the details but OpenDJ allows to have several such admin entries.)

The point is that those admin entities are not subject to any access control or constraints. Especially it can mess up database backend configuration in cn=config. The perfect account to use to shoot yourself in the foot.

So I agree with your LDAP admin: Don't do that.

Use a personal admin account which is properly authorized by OpenDJ's ACI settings. This also gives you better information in logs and operational attributes about who did what.

| improve this answer | |
  • Glad you placed your inputs, I'm also a LDAP admin and part of the LDAP team and doing all teh ldap operations , But my question is does using Directory Manager will corrupt the database if there is space in a attribute while adding it, this makes me crazy , Howevr , DM is being used in many Instances and even they they (Old LDAP admins) using it. So, till date now i got it they are managing only ldap for last 15 years which is also been automated and customized by other peopls and they are Just skeptic about other to do beyond what they learned. Will using DM correpts the DB? – rocky1981 Jul 21 '18 at 16:27
  • I tried to make it more clear and added hint about cn=config. – Michael Ströder Jul 21 '18 at 16:38
  • anyways, that doesn't answer my qustion, I understand using a authorised or personal admin account does add values in many ways but how could it mess until you do complete disaster. Thnx. – rocky1981 Jul 21 '18 at 16:54
  • Your question is pretty broad. Especially since you didn't even mention how you're adding/modifying LDAP entries. You have to provide more details about what went wrong. Otherwise you cannot blame others that their answers are insufficient. – Michael Ströder Jul 21 '18 at 16:59
  • Michael, Did i mentioned anything went wrong ? I asked Does using DM will corrput the database.. as there was no database corrupt happend and the user attribute added also worked as expected. Apologies for not making it clear, I appreciate your brief answer and that does help in understanding, However i'm not blaming anything might be my way of expression laid this confusion. – rocky1981 Jul 21 '18 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.