diff --git a/README.md b/README.md index 11074d4..0f72b6d 100644 --- a/README.md +++ b/README.md @@ -50,37 +50,12 @@ root@example:/# ldapsearch -x -H ldap://localhost -b "dc=example,dc=com" -s base # base with scope baseObject ... ``` +## _Create an Administrator account_ - +**`why is this needed?`** _unnecesary long explanation, but just in case:_ in openLDAP, by default a special administrative account is created as core base to execute first hand tasks, however aside being able to bypass ACLs (Access Control Lists), and therefore any other account created, being allowed to authenthicate for operations like ldapadd, ldapmodify and ldapsearch, etc. it has not an actual entry in the dc=example,dc=com tree (our parentDN). This account it is only configured as olcRootDN in the core base directory/database, cn=config (/etc/ldap/slapd.d/'cn=config') and nothing more. It does not create the corresponding entry in any data tree, therefore the server cannot locate the full entry cn=admin,dc=example,dc=com because it does not exists. In pragmatic terms, we need to create an administrative account for our DN and our parentDN, the later being our domain name as previously explained. ## _Users administrative tasks_