OpenDJ

Last modified by Aurelie Bertrand on 2026/09/14 15:43

OpenDJ

Installation

  1. Start by downloading the latest version of the opendj-4.x.x_all.debfile from the website https://github.com/OpenIdentityPlatform/OpenDJ/releases :
wget https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/4.x.x/opendj-4.x.x_all.deb
  1. Start the installation:
sudo dpkg -i opendj_4.x.x_all.deb

Initial configuration​​​​

💡As an alternative to the configuration below, you can use your own certificate. See the page Using your own certificate when configuring OpenDJ for further details.

To simplify the OpenDJ configuration process, we will create a “setupOpenDJ.props” file containing the available options to be passed to OpenDJ’s “setup” utility (this allows you to bypass the configuration interface).
The file is to be created in the directory /opt/opendj with the following contents :

❗Don’t forget to replace the parameters with your own. For example, replace the password with the one you want (here, “adminOpenDJ1”).

#
# Sample properties file to set up OpenDJ directory server
# See OpenDJ Setup command man for more options
#

# Root user Distinguished Name (DN) identifies a user who can perform all operations allowed for the server
rootUserDN                      =cn=Directory Manager

# Password for root user LDAP
rootUserPassword                =adminOpenDJ1

# OpenDJ uses fully qualified host name in self-signed certificates and for identification when you use replication
hostname                        =localhost.localdomain

# Port used for connection with LDAP
ldapPort                        =389

# This is the service port used to configure the server and to run tasks
adminConnectorPort              =4444

# Identifies the implementation of the repository that holds your data
backendType                     =je

# Directory Name for your LDAP
baseDN                          =dc=digdash,dc=com
addBaseEntry                    =true

# Secure LDAP Port used for SSL connection
ldapsPort                       =636

# Use StartTLS to negotiate a secure connection between a client and server
enableStartTLS                  =false

# Self-signed certificates for externally facing ports facilitate testing, but are not intended for production use
generateSelfSignedCertificate   =true

# Start at the end of setup
start                           =true

After saving the file, run the following command line:

sudo /opt/opendj/setup --cli --propertiesFilePath setupOpenDJ.props --acceptLicense --no-prompt

Additional configuration

  1. Navigate to the OpenDJ installation directory:
cd /opt/opendj/bin/

  1. The LDIF files can be downloaded by clicking on the following link LDIF_OpenDJ.

  2. Create the organisations using the “neworganisation.ldif” file below:
sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" neworganisation.ldif
dn: ou=default,dc=digdash,dc=com
objectClass: organizationalUnit
ou: default

ℹ If you encounter the following situation, certificate validation is required:

Certificat

  1. Set the “Custom Character-set Password Validator”:
sudo /opt/opendj/bin/dsconfig create-password-validator --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1"  --validator-name "Custom Character-set Password Validator" --set character-set:1:abcdefghijklmnopqrstuvwxyz --set character-set:1:ABCDEFGHIJKLMNOPQRSTUVWXYZ --set character-set:1:0123456789 --set "character-set:1:\!\"#$%&'()*+,-./:;<=>?@[]^_\`{|}~" --set enabled:true --type character-set --no-prompt --trustAll --set allow-unclassified-characters:true
  1. Apply the password validator:
sudo /opt/opendj/bin/dsconfig set-password-policy-prop --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" --policy-name "Default Password Policy" --set password-validator:"Custom Character-set Password Validator" --no-prompt
  1. Configure the password policy for users using the “ppolicy.ldif” file below:
sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" ppolicy.ldif
dn: cn=ppolicy,ou=default,dc=digdash,dc=com
objectClass: top
objectClass: subentry
objectClass: pwdPolicy
cn: ppolicy
pwdAttribute: userPassword
pwdAllowUserChange: TRUE
pwdCheckQuality: 1
pwdExpireWarning: 600
pwdFailureCountInterval: 30
pwdGraceAuthNLimit: 5
pwdInHistory: 5
pwdLockout: TRUE
pwdLockoutDuration: 900
pwdMaxAge: 0
pwdMaxFailure: 5
pwdMinAge: 0
pwdMustChange: FALSE
pwdSafeModify: FALSE
subtreeSpecification: {base "ou=users", specificationFilter "!(uid=admin)" }
  1. Configure a second password policy for the admin using the “ppolicy-admin.ldif” file below:
sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" ppolicy-admin.ldif
dn: cn=ppolicy-admin,ou=default,dc=digdash,dc=com
objectClass: top
objectClass: subentry
objectClass: pwdPolicy
cn: ppolicy-admin
pwdAttribute: userPassword
pwdAllowUserChange: TRUE
pwdCheckQuality: 1
pwdFailureCountInterval: 30
pwdGraceAuthNLimit: 5
pwdInHistory: 5
pwdLockout: FALSE
pwdMaxAge: 0
pwdMinAge: 0
pwdMustChange: FALSE
pwdSafeModify: FALSE
subtreeSpecification: {base "ou=users", specificationFilter "(uid=admin)" }
  1. Modify the password policy to allow pre-encoded passwords (useful for restores in Digdash):
sudo /opt/opendj/bin/dsconfig set-password-policy-prop --policy-name "Default Password Policy" --set allow-pre-encoded-passwords:true --hostname localhost --trustAll --bindDN "cn=directory manager" --bindPassword "adminOpenDJ1" --no-prompt
  1. Create an admin user for Digdash using the “create_user_admin.ldif” file below:
sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" create_user_admin.ldif
dn: uid=admin,ou=default,dc=digdash,dc=com
objectClass: shadowAccount
objectClass: inetOrgPerson
cn: Admin Domain Default
sn: Default
uid: admin_default
  1. Assign the necessary rights to this user using the “add_admin_right.ldif” and “add_admin_right2.ldif” files below:
sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" add_admin_right.ldif
dn: ou=default,dc=digdash,dc=com
changetype: modify
add: aci
aci: (target ="ldap:///ou=default,dc=digdash,dc=com")(targetattr = "userpassword || shadowlastchange")(version 3.0; acl "allow write on userpassword and shadowlastchange for admin"; allow(write) (userdn = "ldap:///uid=admin,ou=default,dc=digdash,dc=com");)
aci: (target ="ldap:///ou=default,dc=digdash,dc=com")(targetattr = "userpassword || shadowlastchange")(version 3.0; acl "allow read,write on userpassword and shadowlastchange for auth users"; allow(read) (userdn = "ldap:///all");)
aci: (target ="ldap:///ou=default,dc=digdash,dc=com")(targetattr = "userpassword || shadowlastchange")(version 3.0; acl "allow read on userpassword and shadowlastchange for anonymous"; allow(selfwrite) (userdn = "ldap:///anyone");)
aci: (target ="ldap:///ou=default,dc=digdash,dc=com")(targetattr = "*")(version 3.0; acl "allow write on * for admin"; allow(all) (userdn = "ldap:///uid=admin,ou=default,dc=digdash,dc=com");)
aci: (target ="ldap:///ou=default,dc=digdash,dc=com")(targetattr = "*")(version 3.0; acl "allow read on * for anonymous"; allow(read) (userdn = "ldap:///all");)
sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" add_admin_right2.ldif
dn: uid=admin,ou=default,dc=digdash,dc=com
changetype: modify
add: ds-privilege-name
ds-privilege-name: config-read
ds-privilege-name: password-reset
ds-privilege-name: unindexed-search
  1. Generate a password for the administrator and make a note of it for later:
sudo /opt/opendj/bin/ldappasswordmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" --authzID "uid=admin,ou=default,dc=digdash,dc=com"

💡 If you wish to set your own password for the admin user, you must use a variant of the previous command:

sudo /opt/opendj/bin/ldappasswordmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" --authzID "uid=admin,ou=default,dc=digdash,dc=com" --newPassword "mdpAdmin"

Enabling the service to start automatically at boot

  1. Create the opendj.service file:
sudo vi /etc/systemd/system/opendj.service
  1. And paste the following lines into it:
[Unit]

Description=OpenDJ Server Daemon

Wants=network-online.target

After=network-online.target

Conflicts=shutdown.target

 [Service]

Type=simple

Restart=no

TimeoutSec=5min

IgnoreSIGPIPE=no

KillMode=process

GuessMainPID=no

RemainAfterExit=yes

ExecStart=/opt/opendj/bin/start-ds --quiet

ExecStop=/opt/opendj/bin/stop-ds --quiet

 [Install]

WantedBy=multi-user.target
  1. Then enter the following commands:
sudo /opt/opendj/bin/stop-ds

systemctl daemon-reload

systemctl enable --now opendj

systemctl status opendj

Useful function

The operation below is not part of the installation.
However, it may be useful to be aware of it for future reference.

Extending the limit for LDAP searches

To increase the limit on the number of results returned during a search to more than 1,000 users, edit the “extend_search_limit.ldif” file below:

sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "adminOpenDJ1" extend_search_limit.ldif
dn: uid=admin,ou=default,dc=digdash,dc=com
changetype: modify
add: ds-rlim-size-limit
ds-rlim-size-limit: 10000

To increase the number of entries scanned during a search, add the “ds-rlim-lookthrough-limit.ldif” file:

vi ds-rlim-lookthrough-limit.ldif
dn: uid=admin,ou=default,dc=digdash,dc=com
changetype: modify
replace: ds-rlim-lookthrough-limit
ds-rlim-lookthrough-limit: 100000

Then run:

sudo /opt/opendj/bin/ldapmodify --port 389 --bindDN "cn=Directory Manager" --bindPassword "**********" ds-rlim-lookthrough-limit.ldif