How to activate "ppolicy" module in OpenLDAP?

Question

I trie to activate ppolicy module in OpenLDAP.

OS Version :     Debian 8.4
LDAP Version:    @(#) $OpenLDAP: slapd  (Jan 16 2016 23:00:08)
$root@chimera:   /tmp/buildd/openldap-2.4.40+dfsg/debian/build/servers/slap

I have the next message:

# ldapmodify -x -a -H ldap://localhost -D cn=admin,dc=domain,dc=local -w adminpassword -f /etc/ldap/schema/ppolicy.ldif

adding new entry "cn=ppolicy,cn=schema,cn=config"
ldap_add: Insufficient access (50)

# ldapsearch -x -s one -H ldap://localhost -D cn=admin,dc=domain,dc=local -w adminpassword -b cn=schema,cn=config cn -LLL

No such object (32)

Logs :

[13-03-2018 13:08:06] slapd debug  conn=1002 fd=14 ACCEPT from IP=[::1]:45318 (IP=[::]:389)
[13-03-2018 13:08:06] slapd debug  conn=1002 op=0 BIND dn="cn=admin,dc=domain,dc=local" method=128
[13-03-2018 13:08:06] slapd debug  conn=1002 op=0 BIND dn="cn=admin,dc=domain,dc=local" mech=SIMPLE ssf=0
[13-03-2018 13:08:06] slapd debug  conn=1002 op=0 RESULT tag=97 err=0 text=
[13-03-2018 13:08:06] slapd debug  conn=1002 op=1 SRCH base="cn=schema,cn=config" scope=1 deref=0 filter="(objectClass=*)"
[13-03-2018 13:08:06] slapd debug  conn=1002 op=1 SRCH attr=cn
[13-03-2018 13:08:06] slapd debug  conn=1002 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=
[13-03-2018 13:08:06] slapd debug  conn=1002 op=2 UNBIND
[13-03-2018 13:08:06] slapd debug  conn=1002 fd=14 closed

Any idea please?

Thank you.

Answer 1

You can use slapadd to add a schema (where -n0 selects the configuration database). First stop your ldap server.

sudo -u openldap slapadd -n0 -l /etc/ldap/schema/ppolicy.ldif

Then create a file ppolicy-module.ldif with this content:

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModuleLoad: ppolicy

And load it the same way:

sudo -u openldap slapadd -n0 -l ppolicy-module.ldif

Then you can check the module is correctly loaded:

$ sudo slapcat -n 0 | grep olcModuleLoad | grep ppolicy
olcModuleLoad: {0}ppolicy

Then restart your ldap server.