I try to recursively delete our third DIT from our ldap root DSE as it is not needed anymore but I get in our customer's environment the following error:

host:~# ldapdelete -x -W -D cn=admin,cn=config -r -f /tmp/ldap-bck/delete.ldif

ldapdelete: -D previously specified

The same command is working like a charm in my testlab, on my Virtualbox Centos 7.5 server. But not in the customer environment on RHEL 7.6. openldap version number is the same, 2.4.44. I was playing around with the options, have changed the order of the options, changed "" and '' for bindDN (-D) and DN, was using -c and -v options to see more...and I cannot solve the issue...

First I have tried just deleting the DN:

host:~# ldapdelete -x -W -D cn=admin,cn=config 'dc=x,dc=y,dc=z,dc=zzz'

Then I have tried it using option -f :

host:~# ldapdelete -x -W -D cn=admin,cn=config -r -f /tmp/ldap-bck/delete.ldif

Have tried two bindDN-s (cn=admin,cn=config and the rootDN cn=admin,dc=x,dc=y,dc=z,dc=zzz as well, this last one has to work).

Have tried it without -D parameter - then I have got:

host:~# ldapdelete -r -f /tmp/ldap-bck/delete.ldif

Enter LDAP Password:

ldap_delete: Insufficient access (50)

host:~# ldapdelete -r -c -f /tmp/ldap-bck/delete.ldif

Enter LDAP Password:

ldap_bind: Server is unwilling to perform (53)

 additional info: unauthenticated bind (DN with no password) disallowed

host:~# ldapdelete -r -v -f /tmp/ldap-bck/delete.ldif

ldap_initialize( ldapi:///??base )

Enter LDAP Password:

ldap_bind: Server is unwilling to perform (53)

  additional info: unauthenticated bind (DN with no password) disallowed

I suppose because the bindDN and the password, both are needed. (I have the password, the right one, there is no error possible as the same password is used currently for all 3 DITs and the config database.)

I have tried -Y EXTERNAL authentication but that is not working:

host:~# ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/ldap-bck/delete.ldif -n

ldapmodify: incompatible with authentication choice

So I have to use simple authentication. But as soon as I specify the -D option, I get the same error. I have tried to do the same with ldapmodify using an ldif file. The same error:

host:~# ldapmodify -D "cn=admin,cn=config" -x -W -f /tmp/ldap-bck/delete.ldif -n

host:~# ldapmodify -D "cn=admin,dc=x,dc=y,dc=z,dc=zzz" -x -W -f /tmp/ldap-bck/delete.ldif -n

Then I have tried to run ldapsearch to check functionality but the same error if I specify the -D option.

host:~# ldapsearch -x -D "cn=admin,dc=x,dc=y,dc=z,dc=zzz" -W -b 'dc=x,dc=y,dc=z,dc=zzz' '(objectclass=*)' -c

ldapsearch: -D previously specified

And the same error appears on 3 RHEL servers (dev, test and prod), so it is not just one server's strange behaviour.

I am using SSL certificates in both "environment" - so in my testlab and in the customer environment. The openldap configuration of my testlab and of the customer environment is similar.

  • Welcome pucca! Perhaps a "binddn" is already specified (hence "previously specified") within ldap.conf or ~/.ldaprc? – Wieger Jun 8 at 8:04

I have not found any specified binddn in the mentioned files. But we have found defined alias... Someone has set alias for ldapadd, ldapdelete, etc for one of the DITs there with the options -x -W -D -H. And so my commands for this DIT were not working with the standard syntax. And ofcourse my commands were not working for the other DITs neither... Thank you anyway

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.