ldapwhoami返回无效的凭证

我的ldap配置(/etc/openldap/slapd.conf)文件如下

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema


#pidfile                /usr/local/var/run/slapd.pid
#argsfile       /usr/local/var/run/slapd.args

database config
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=external,cn=auth" manage
        by * none
rootdn "cn=config"
rootpw secret


database monitor
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
        by * none

database bdb
monitoring on
suffix "dc=lift,dc=com"
rootdn "cn=ajith,dc=lift,dc=com"
rootpw secret
directory /var/lift-db

ldif文件(/etc/openldap/slapd.ldif)是

dn: dc=lift,dc=com
objectclass: dcObject
objectclass: organization
dc: lift
o: ldap server
description: lift directory

dn: dc=user,dc=lift,dc=com
objectclass: dcObject
objectclass: organization
dc: user
o: users
description: users info

dn: dc=pilot,dc=lift,dc=com
objectclass: dcObject
objectclass: organization
dc: pilot
o: pilots
description: pilots info

我加了这个

slapadd -f /etc/openldap/slapd.conf -l /etc/openldap/slapd.ldif

它回来了

5c275d2c The first database does not allow slapadd; using the first available one (2)
_#################### 100.00% eta   none elapsed            none fast!         
Closing DB...

然后我开始提供拍打服务

service slapd start

那我试着跑

ldapwhoami  -D "cn=ajith,dc=lift,dc=com" -w secret

它返回

ldap_bind: Invalid credentials (49)

我做错了什么?