cleanstart/openldap — Debug Guide

Verify LDAP server is running

Check container status

podman ps | grep ldap
podman logs ldap 2>&1 | tail -10

Check what config slapd loaded

podman logs ldap 2>&1 | grep -E "suffix|rootdn|rootpw|slapd starting|Permission denied"

Expected output for a working setup:

slapd.conf: line 63 (suffix    "dc=pathoris,dc=de")
slapd.conf: line 64 (rootdn    "cn=admin,dc=pathoris,dc=de")
slapd.conf: line 68 (rootpw ***)
slapd starting

Red flags: - dc=my-domain,dc=com → custom slapd.conf not mounted - Permission denied → volume or port permission issue - slapd stopped → fatal error, check full logs

Query the server

Check naming contexts (base DN)

podman exec -it ldap ldapsearch -x -H ldap://localhost:389 -s base -b "" namingContexts

Test admin bind and list entries

podman exec -it ldap ldapsearch -x -H ldap://localhost:389 \
  -D "cn=admin,dc=pathoris,dc=de" -w admin \
  -b "dc=pathoris,dc=de" "(objectClass=*)"

Test with wrong password (should fail with "Invalid credentials")

podman exec -it ldap ldapsearch -x -H ldap://localhost:389 \
  -D "cn=admin,dc=pathoris,dc=de" -w wrongpassword \
  -b "dc=pathoris,dc=de"

Check server info

podman exec -it ldap ldapsearch -x -H ldap://localhost:389 -s base -b "" "+"

Check mounted config

Verify slapd.conf is mounted

podman exec -it ldap cat /etc/openldap/slapd.conf | grep -E "suffix|rootdn|rootpw|directory"

Verify data directory exists and is writable

podman exec -it ldap ls -la /var/lib/openldap/openldap-data/

Connectivity from other containers

From phpldapadmin

podman exec -it phpldapadmin sh -c "nc -zv 172.4.0.11 389 2>&1"

From forgejo

podman exec -it forgejo sh -c "nc -zv 172.4.0.11 389 2>&1"

Reset LDAP data

When the database is in a bad state (wrong password, wrong domain, corrupt data):

podman-compose stop ldap
rm -rf /var/lib/cicd/ldap/data/*
podman-compose up -d ldap

Then re-bootstrap the base DN:

podman cp bootstrap.ldif ldap:/tmp/bootstrap.ldif
podman exec -it ldap ldapadd -x -H ldap://localhost:389 \
  -D "cn=admin,dc=pathoris,dc=de" -w admin \
  -f /tmp/bootstrap.ldif

Enable verbose logging

By default, slapd logs minimally. To see bind attempts and search operations, add to slapd.conf:

loglevel stats

Or for maximum verbosity:

loglevel any

Then restart the container and check logs:

podman-compose restart ldap
podman logs -f ldap

Common errors