[phillipg]

Hello,

When your OD database was created, Apple ever so kindly left you a backdoor account should things go awry. The username is ‘root’ (not to be confused with system root) and the password was set to match the password of the first directory administrator (usually UID1000) at the time the directory was established. Subsequent password changes to UID1000 in the directory are not updated in this hidden account (located at /etc/openldap/slapd_macosxserver.conf).

You can try authenticating to your domain in Workgroup Manager using this account. You will be able to change your group RecordName back to admin. All else being equal, you will be back on track. (I have tested this with my own server and it worked a treat – but your mileage may vary).

If that fails, you need to take a few command line steps.

Firstly, get a new root password in your slapd_macosxserver.conf file by taking the following steps:

1. Run “slappasswd -h {SMD5}”. You will be prompted, twice, for your new password. Slappasswd will respond with “{SMD5}text string”.
2. Copy this text string, including {SMD5} to your clipboard.
3. Run “sudo cp /etc/openldap/slapd_macosxserver.conf /etc/openldap/slapd_macosxserver.conf.bak” for a backup.
4. Run “sudo pico /etc/openldap/slapd_macosxserver.conf”
5. Scroll down to the rootpw line. Remove the first {SMD5} string and paste the one you obtained from slappasswd.
6. Control-X to close, making sure you save the buffer.
7. Restart your server. You may be able to get away with just killing slapd, but I’d not take the risk.
8. Open a new command line. You don’t have to be sudo anymore. Run “pico modify.ldif”.
9. In this window, type the following four lines:

dn: cn=dadmin,cn=groups,dc=server,dc=company,dc=com
changetype: modrdn
newrdn: admin
deleteoldrdn: 1

10. Note that the dn should reflect the correct LDAP search base, and the first cn is dadmin – the name of the group as it stands, before changes.
11. Run the following command:

ldapmodify -x -D “uid=root,cn=users,dc=server,dc=company,dc=com” -W -f modify.ldif

-x specifies to use a simple authentication engine – that is, use the one in the slapd_macosxserver.conf file.
-D specifies the user to authenticate as. Note that, again, you should change your DCs to match your server’s search base.
-W specifies to ask the user for the new password that was specified with slappasswd.
-f specifies the LDIF file of changes to make to the database.

Best of luck.

[Author]

Posts