I try to recursively delete our third DIT from our ldap root DSE as it is not needed anymore but I get in our customer's environment the following error:
host:~# ldapdelete -x -W -D cn=admin,cn=config -r -f /tmp/ldap-bck/delete.ldif ldapdelete: -D previously specified
The same command is working like a charm in my testlab, on my Virtualbox Centos 7.5 server. But not in the customer environment on RHEL 7.6. openldap version number is the same, 2.4.44. I was playing around with the options, have changed the order of the options, changed "" and '' for bindDN (-D) and DN, was using -c and -v options to see more...and I cannot solve the issue...
First I have tried just deleting the DN:
host:~# ldapdelete -x -W -D cn=admin,cn=config 'dc=x,dc=y,dc=z,dc=zzz'
Then I have tried it using option -f :
host:~# ldapdelete -x -W -D cn=admin,cn=config -r -f /tmp/ldap-bck/delete.ldif
Have tried two bindDN-s (cn=admin,cn=config and the rootDN cn=admin,dc=x,dc=y,dc=z,dc=zzz as well, this last one has to work).
Have tried it without -D parameter - then I have got:
host:~# ldapdelete -r -f /tmp/ldap-bck/delete.ldif Enter LDAP Password: ldap_delete: Insufficient access (50) host:~# ldapdelete -r -c -f /tmp/ldap-bck/delete.ldif Enter LDAP Password: ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed host:~# ldapdelete -r -v -f /tmp/ldap-bck/delete.ldif ldap_initialize( ldapi:///??base ) Enter LDAP Password: ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed
I suppose because the bindDN and the password, both are needed. (I have the password, the right one, there is no error possible as the same password is used currently for all 3 DITs and the config database.)
I have tried -Y EXTERNAL authentication but that is not working:
host:~# ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/ldap-bck/delete.ldif -n ldapmodify: incompatible with authentication choice
So I have to use simple authentication. But as soon as I specify the -D option, I get the same error. I have tried to do the same with ldapmodify using an ldif file. The same error:
host:~# ldapmodify -D "cn=admin,cn=config" -x -W -f /tmp/ldap-bck/delete.ldif -n host:~# ldapmodify -D "cn=admin,dc=x,dc=y,dc=z,dc=zzz" -x -W -f /tmp/ldap-bck/delete.ldif -n
Then I have tried to run ldapsearch to check functionality but the same error if I specify the -D option.
host:~# ldapsearch -x -D "cn=admin,dc=x,dc=y,dc=z,dc=zzz" -W -b 'dc=x,dc=y,dc=z,dc=zzz' '(objectclass=*)' -c ldapsearch: -D previously specified
And the same error appears on 3 RHEL servers (dev, test and prod), so it is not just one server's strange behaviour.
I am using SSL certificates in both "environment" - so in my testlab and in the customer environment. The openldap configuration of my testlab and of the customer environment is similar.