Free Online Course · Self-paced · Hands-on

OpenLDAP Tutorial for Beginners - Install, Configure, Replicate

Free OpenLDAP tutorial for Linux admins: cn=config and MDB, TLS, ACLs, password policy, SSSD clients, replication, and backup, tested on OpenLDAP 2.6.

  • 8 chapters
  • 21 lessons
  • ~15h
  • Beginner to Intermediate
  • Tested with OpenLDAP 2.6.x
  • Updated Sep 2026
Start the course View syllabus
OpenLDAP Tutorial for Beginners - Install, Configure, Replicate
By Last updated

About this course

This is a free, hands-on course that takes you from LDAP basics to a TLS-secured, replicated OpenLDAP directory that Linux clients log in against. It follows the OpenLDAP 2.6 Administrator's Guide and makes every configuration change through cn=config, the runtime configuration that replaces the deprecated slapd.conf file.

The labs target the RHEL family, where the server package now comes from EPEL rather than the base repositories. The client chapters go past a working login to NFS home directories and sudo rules served from the directory, because that is where most real deployments end up and where most of the SSSD problems appear.

If you are new to LDAP, start with LDAP and OpenLDAP basics and install the server before you move on to TLS. If you already run slapd, jump straight to multi-provider replication, ACLs, or SSSD clients. If you are still choosing a server, OpenLDAP vs 389 Directory Server compares the two.

What you'll learn

  • Explain DNs, RDNs, schema, and object classes, and how OpenLDAP differs from Active Directory
  • Install OpenLDAP 2.6 from EPEL on RHEL-family Linux and manage it through cn=config and the MDB backend
  • Add indexes that speed up searches, and secure the server with a private CA, StartTLS, and LDAPS
  • Manage POSIX users and groups with LDIF, including the memberOf and refint overlays, and migrate existing Linux users
  • Write ACLs and password policies, and fix LDAP errors 49 and 50
  • Log Linux clients in through SSSD with NFS home directories and sudo rules from the directory, and add Apache LDAP authentication
  • Configure provider-consumer and multi-provider replication with syncrepl
  • Back up and restore configuration and data with slapcat and slapadd

Who this course is for

  • Linux administrators who need central logins, sudo rules, and home directories across a fleet of servers
  • Directory engineers already running OpenLDAP who want cn=config, TLS, and replication set up properly
  • RHEL-family admins who still need slapd now that the server package comes from EPEL
  • Anyone heading toward 389 Directory Server or Keycloak who needs solid LDAP fundamentals first

Prerequisites

  • Linux command-line basics: systemctl, firewall-cmd, and a text editor, with root or sudo access
  • One RHEL-family VM (Rocky Linux, AlmaLinux, RHEL, or Oracle Linux 9 or 10) with EPEL enabled for the server chapters
  • A second VM for the replication and client chapters, plus an NFS export if you follow the autofs lesson
  • No LDAP experience, because the LDAP concepts chapter covers DNs, schema, and object classes first

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
OpenLDAP 2.6.x openldap-servers and openldap-clients 2.6.10 from EPEL
Rocky Linux 10.2 Lab host OS for the server and client chapters. The Active Directory comparison was run on Rocky Linux 9.4
SSSD 2.12.x Client login, autofs home directories, and sudo rules
RHEL, AlmaLinux, Oracle Linux, CentOS Stream 9 and 10 Same commands. Only the way you enable EPEL or the developer repository differs

Syllabus

8 chapters · 21 lessons · ~15h of reading

  1. 1 LDAP Concepts (start here if new to LDAP) 2 lessons · ~33 min
    1. Part 1 LDAP basics — DN, RDN, schema 19 min read
    2. Part 2 OpenLDAP vs Active Directory 14 min read
  2. 2 Fundamentals and Installation 3 lessons · ~1h 1m
    1. Part 3 Install and configure OpenLDAP server 17 min read
    2. Part 4 cn=config and MDB 25 min read
    3. Part 5 Speed up LDAP searches 19 min read
  3. 3 Secure with TLS 1 lesson · ~21 min
    1. Part 6 TLS, StartTLS, and LDAPS 21 min read
  4. 4 Directory Users and Groups 4 lessons · ~1h 27m
    1. Part 7 Users and groups (LDIF) 23 min read
    2. Part 8 memberOf and refint overlays 15 min read
    3. Part 9 Migrate OpenLDAP to a new server 20 min read
    4. Part 10 Migrate Linux users to LDAP 29 min read
  5. 5 Access Control and Password Policy 4 lessons · ~1h 39m
    1. Part 11 ACL examples 29 min read
    2. Part 12 Password policy (ppolicy) 26 min read
    3. Part 13 Fix Error 49 invalid credentials 18 min read
    4. Part 14 Fix Error 50 insufficient access 26 min read
  6. 6 Clients and Integration 4 lessons · ~1h 6m
    1. Part 15 Client with SSSD 16 min read
    2. Part 16 Apache LDAP authentication 15 min read
    3. Part 17 NFS home directories with autofs 16 min read
    4. Part 18 sudo rules with SSSD 19 min read
  7. 7 Replication 2 lessons · ~38 min
    1. Part 19 Provider-consumer replication 16 min read
    2. Part 20 Multi-provider replication 22 min read
  8. 8 Backup and Recovery 1 lesson · ~33 min
    1. Part 21 Backup and restore 33 min read

Hands-on labs

6 guided builds you run yourself

  1. Install OpenLDAP and build the base directory tree

    Install slapd from EPEL, configure the MDB database through cn=config, create the base DIT, and search it locally and from another host.

  2. Secure LDAP with StartTLS and LDAPS

    Issue a server certificate from a private CA, load it through cn=config, and connect with both StartTLS and LDAPS.

  3. Log in to Linux clients with directory accounts

    Configure SSSD and authselect over StartTLS so directory users can log in and get a home directory on first login.

  4. Serve sudo rules from the directory

    Store sudoRole entries in OpenLDAP and have SSSD clients enforce them instead of local sudoers files.

  5. Replicate between two writable providers

    Set server IDs, accesslog, and delta-syncrepl on two servers, then test what happens when both accept conflicting writes.

  6. Back up and restore the whole server

    Export cn=config and every MDB database with slapcat, schedule it with a systemd timer, and rebuild from the files with slapadd.

Where to go after this course

Frequently Asked Questions

What is the difference between LDAP and OpenLDAP?

LDAP is the protocol: a standard way for clients to search and update a directory over the network. OpenLDAP is one open-source implementation of it, made up of the slapd server, client tools such as ldapsearch and ldapmodify, and the libraries other programs link against. Active Directory and 389 Directory Server also speak LDAP, which is why the client commands you learn here work against them too.

Is OpenLDAP still maintained?

Yes. The project maintains a long-term support line, 2.6, alongside a newer feature release line, 2.7. This course uses 2.6 because that is what EPEL packages for RHEL-family systems. Check the OpenLDAP download page for the current releases before you plan an upgrade.

Why is openldap-servers missing from the RHEL repositories?

Red Hat deprecated the OpenLDAP server in RHEL 7.4 and dropped it from the supported repositories in later major releases. The client libraries and tools are still there. EPEL provides a community-maintained openldap-servers package, which is what these labs install, but Red Hat does not support it. Red Hat points its customers to Red Hat Directory Server or Identity Management instead.

Should I still use slapd.conf?

No. The OpenLDAP documentation marks slapd.conf as deprecated and says support will be removed in a future release. cn=config stores configuration as LDAP entries, so you change a running server with ldapmodify and most changes apply without a restart. If you have an old slapd.conf, convert it with slaptest -f slapd.conf -F slapd.d and keep the original as a reference.

Does this course work on Ubuntu or Debian?

Most of it does. The cn=config LDIF, the ldap* client commands, ACLs, overlays, and replication work the same way. What changes is the packaging: the server package is slapd, the configuration lives under /etc/ldap, the installer sets up the first database for you, and AppArmor replaces SELinux. The OpenLDAP on Ubuntu guide covers that install.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)