[root@dlp ~]# yum -y install openldap-servers openldap-clients

[root@dlp ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

[root@dlp ~]# chown ldap. /var/lib/ldap/DB_CONFIG

[root@dlp ~]# systemctl start slapd

[root@dlp ~]# systemctl enable slapd 

# generate encrypted password

[root@dlp ~]# slappasswd

New password:

Re-enter new password:

{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

[root@dlp ~]# vi chrootpw.ldif

# specify the password generated above for "olcRootPW" section

 dn: olcDatabase={}config,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=+uidNumber=,cn=peercred,cn=external,cn=auth

SASL SSF:

modifying entry "olcDatabase={0}config,cn=config"

[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=+uidNumber=,cn=peercred,cn=external,cn=auth

SASL SSF:

adding new entry "cn=cosine,cn=schema,cn=config"

[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=+uidNumber=,cn=peercred,cn=external,cn=auth

SASL SSF:

adding new entry "cn=nis,cn=schema,cn=config"

[root@dlp ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=+uidNumber=,cn=peercred,cn=external,cn=auth

SASL SSF:

adding new entry "cn=inetorgperson,cn=schema,cn=config"

# generate directory manager's password

[root@dlp ~]# slappasswd

New password:

Re-enter new password:

{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

[root@dlp ~]# vi chdomain.ldif

# replace to your own domain name for "dc=***,dc=***" section

# specify the password generated above for "olcRootPW" section

 dn: olcDatabase={}monitor,cn=config

changetype: modify

replace: olcAccess

olcAccess: {}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"

  read by dn.base="cn=Manager,dc=srv,dc=world" read by * none

dn: olcDatabase={}hdb,cn=config

changetype: modify

replace: olcSuffix

olcSuffix: dc=srv,dc=world

dn: olcDatabase={}hdb,cn=config

changetype: modify

replace: olcRootDN

olcRootDN: cn=Manager,dc=srv,dc=world

dn: olcDatabase={}hdb,cn=config

changetype: modify

add: olcRootPW

olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx

dn: olcDatabase={}hdb,cn=config

changetype: modify

add: olcAccess

olcAccess: {}to attrs=userPassword,shadowLastChange by

  dn="cn=Manager,dc=srv,dc=world" write by anonymous auth by self write by * none

olcAccess: {}to dn.base="" by * read

olcAccess: {}to * by dn="cn=Manager,dc=srv,dc=world" write by * read

[root@dlp ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif

SASL/EXTERNAL authentication started

SASL username: gidNumber=+uidNumber=,cn=peercred,cn=external,cn=auth

SASL SSF:

modifying entry "olcDatabase={1}monitor,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

modifying entry "olcDatabase={2}hdb,cn=config"

[root@dlp ~]# vi basedomain.ldif

# replace to your own domain name for "dc=***,dc=***" section

 dn: dc=srv,dc=world

objectClass: top

objectClass: dcObject

objectclass: organization

o: Server World

dc: Srv

dn: cn=Manager,dc=srv,dc=world

objectClass: organizationalRole

cn: Manager

description: Directory Manager

dn: ou=People,dc=srv,dc=world

objectClass: organizationalUnit

ou: People

dn: ou=Group,dc=srv,dc=world

objectClass: organizationalUnit

ou: Group

[root@dlp ~]# ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f basedomain.ldif

Enter LDAP Password: # directory manager's password

adding new entry "dc=srv,dc=world"

adding new entry "cn=Manager,dc=srv,dc=world"

adding new entry "ou=People,dc=srv,dc=world"

adding new entry "ou=Group,dc=srv,dc=world"

[root@dlp ~]# firewall-cmd --add-service=ldap --permanent

success

[root@dlp ~]# firewall-cmd --reload

success