OpenLDAP cn=config: No such object (32)?

Solution 1:

On a number of modern Linux systems root as identified by SASL/EXTERNAL as gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth is either the rootDN or has manager permissions when openldap-server/slapd is installed.

For your existing installation that is not currently the case.
If you know the password for your various rootDNs, use those. Otherwise, replace your rootDN (or it's password) to something you can use. You'll have to do this outside of LDAP by editing /etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif or your equivalent and restarting slapd.

Solution 2:

I've stumbled over this issue myself but wasn't satisfied by accepted answer as it points out the reason for the issue but is very limited on providing actual instructions on how to fix it. So I kept searching and stumbled over this issue.

Precondition

I like using this SASL/EXTERNAL approach and as I'm trying to create a docker container setting up slapd properly is part of my intention. The problem is: how to set access rights on cn=config. The container is converting some initial slapd.conf file into cn=config on first start when there is no existing cn=config in configuration folder selected with option -F. So there must be some way to have cn=config setting up permissions as desired.

Analysis

Using rootDN seems to be odd as it is configured in scope of different database and according to previously resulting cn=config configuration still is bound to different database.

In addition cn=config is configured to grant none permissions to everyone accessing anything in database at cn=config. Check the file /your/config/dir/cn=config/olcDatabase={0}config.ldif:

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 e01f7658
dn: olcDatabase={0}config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to *  by * none
olcAddContentAcl: TRUE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=config
olcSyncUseSubentry: FALSE
olcMonitoring: FALSE
structuralObjectClass: olcDatabaseConfig
entryUUID: a85462ad-0102-456d-a2d7-e6d082b7e613
creatorsName: cn=config
createTimestamp: 20190429143842Z
entryCSN: 20190429143842.339724Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20190429143842Z

It clearly states olcAccess: {0}to * by * none so I'm pretty sure using rootDN doesn't help either.

In an existing LDAP server there is a different access rule applied:

olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth manage by * break

So, this is what I need in my case!

Solution

When converting from slapd.conf to cn=config slapd and its tools are accepting partial configuration for the resulting database. olcDatabase={0}config is the resulting DN for a database named config. So add configuration for that database in your file. The following excerpt appended to the end of my slapd.conf file has been taken from issue linked before:

database config
access to *
    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
    by * read

Don't miss to remove any existing configuration folder so the updated slapd.conf file will be converted to cn=config once again.