openldap-bugs December 2012

openldap-bugs@openldap.org

17 participants
50 discussions

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307811d0eb756704d0342092 Content-Type: text/plain; charset=ISO-8859-1 Actualy I had this before and that did not change anything. I don't think this directive is used for this kind of "timeouts"... I also tried : *chase-referrals yes (this is default)* *rebind-as-user yes (as suggested here)** * *single-conn yes (default to NO)** * * * I also tried some combinings of idassert-bind options with no luck (as the backend does not support identity assertion). 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > --20cf307811d0d379c404d032d6ee > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Config is basic (with special timeout tests commented out) : > > > > database ldap > > suffix "o=corp" > > uri ldaps://10.100.120.153 > > > > # close connection after a timeout > > #idletimeout 100 > > # causes a cached connection to be dropped an recreated after a given ttl > > #conn-ttl 4294967294 > > # close connection after a timeout for ldap backend > > #idle-timeout 4294967294 > > # Discards current cached connection when the client rebinds - default to > > No > > #single-conn no > > > Try adding a "rebind-as-user" here. This forces back-ldap to store > client's credentials in order to rebind when needed (e.g. because a > persistent connection timed out). > > p. > > > overlay rwm > > rwm-suffixmassage "o=corp" "o=int" > > > > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > >> > >> > Full_Name: Sebastien Prune THOMAS > >> > Version: slapd 2.4.31 > >> > OS: Linux CentOS > >> > URL: ftp://ftp.openldap.org/incoming/ > >> > Submission from: (NULL) (206.167.157.64) > >> > > >> > > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > >> LDAP > >> > server. > >> > Every once and a while I have long lasting connections re-binding as > >> > anonymous, > >> > breaking the actual bind. > >> > This usualy happen after hitting either the idle-timeout or the > >> conn-ttl > >> > limit. > >> > I wasn't able to find out what these values are when not set... but > >> > setting them > >> > low can help reproduce the problem : > >> > >> What is the configuration of back-ldap? Can you post it (after > >> sanitizing > >> sensitive info)? > >> > >> p. > >> > >> -- > >> Pierangelo Masarati > >> Associate Professor > >> Dipartimento di Ingegneria Aerospaziale > >> Politecnico di Milano > >> > >> > > > > --20cf307811d0d379c404d032d6ee > > Content-Type: text/html; charset=ISO-8859-1 > > Content-Transfer-Encoding: quoted-printable > > > > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with > > spec= > > ial timeout tests commented out) :</div><div > > style=3D"font-family:Tahoma;fo= > > nt-size:13px">=A0</div><div > > style=3D"font-family:Tahoma;font-size:13px">dat= > > abase =A0 =A0 =A0ldap > > suffix =A0 =A0 =A0 =A0 =A0 > > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= > > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div > > style= > > =3D"font-family:Tahoma;font-size:13px">=A0</div><div > > style=3D"font-family:T= > > ahoma;font-size:13px"># close connection after a timeout > > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be > dropped > > = > > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 > > 4294967294= > > # close connection after a timeout for ldap > > backend #idle-timeout=A0= > > =A0=A0 4294967294 # Discards current cached connection when the client > > r= > > ebinds - default to No > > #single-conn=A0=A0=A0=A0 no</div><div > > style=3D"font-family:Tahoma;font-size= > > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage > > "o= > > =3Dcorp" "o=3Dint"</div><div > > class=3D"gmail_extra"> <= > > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati > dir=3D"ltr">&= > > lt;<a href=3D"mailto:masarati@aero.polimi.it" > > target=3D"_blank">masarati@ae= > > ro.polimi.it</a>> > > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > > .8ex;border-left:1p= > > x #ccc solid;padding-left:1ex"> > > > Full_Name: Sebastien Prune THOMAS > > > Version: slapd 2.4.31 > > > OS: Linux CentOS > > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" > > target=3D"_blank">ft= > > p://ftp.openldap.org/incoming/</a> > > > Submission from: (NULL) (206.167.157.64) > > > > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > > LD= > > AP > > > server. > > > Every once and a while I have long lasting connections re-binding > > as<b= > > r> > > > anonymous, > > > breaking the actual bind. > > > This usualy happen after hitting either the idle-timeout or the > > conn-t= > > tl > > > limit. > > > I wasn't able to find out what these values are when not set... > > bu= > > t > > > setting them > > > low can help reproduce the problem : > > > > What is the configuration of back-ldap? =A0Can you post it (after > > sanitizin= > > g > > sensitive info)? > > > > p. > > > > -- > > Pierangelo Masarati > > Associate Professor > > Dipartimento di Ingegneria Aerospaziale > > Politecnico di Milano > > > > </blockquote></div> </div> > > > > --20cf307811d0d379c404d032d6ee-- > > > > > > > > > > > > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d0eb756704d0342092 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Actualy I had t= his before and that did not change anything. I don't think this directi= ve is used for this kind of "timeouts"... <div> </div><div>I also tried :</div><div> </div><div>chase-referrals yes (this is defau= lt) </div><div>rebind-as-user yes (as suggested here) </div><di= v> s= ingle-conn yes (default to NO) </div><div> </div><div>I also tried some combinings of=A0idassert-bind o= ptions with no luck (as the backend does not support identity assertion).</= span></div> <div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012/12/6 Pie= rangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> <blockqu= ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s= olid;padding-left:1ex"> > --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=3DISO-8859-1 <div class=3D"im">> > Config is basic (with special timeout tests commented out) : > > database =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" > uri =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ldaps://<a href=3D"http://10.100.1= 20.153" target=3D"_blank">10.100.120.153</a> > > # close connection after a timeout > #idletimeout =A0 =A0 100 > # causes a cached connection to be dropped an recreated after a given = ttl > #conn-ttl =A0 =A0 =A0 =A04294967294 > # close connection after a timeout for ldap backend > #idle-timeout =A0 =A04294967294 > # Discards current cached connection when the client rebinds - default= to > No > #single-conn =A0 =A0 no </div>Try adding a "rebind-as-user" here. =A0This forces back-lda= p to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. <div><div class=3D"h5"> > overlay =A0 =A0 =A0 =A0 rwm > rwm-suffixmassage "o=3Dcorp" "o=3Dint" > > > 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it">masarati(a)aero.polimi.it</a>> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_= blank">ftp://ftp.openldap.org/incoming/</a> >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-bin= ding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or t= he >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not = set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? =A0Can you post it (after<= br> >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > </div></div>> --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=3DISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D3D"font-family:Tahoma;font-size:13px">Con= fig is basic (with > spec=3D > ial timeout tests commented out) :</div><div > style=3D3D"font-family:Tahoma;fo=3D > nt-size:13px">=3DA0</div><div > style=3D3D"font-family:Tahoma;font-size:13px">dat=3D > abase =3DA0 =3DA0 =3DA0ldap > suffix =3DA0 =3DA0 =3DA0 =3DA0 =3DA0 > =3DA0&quot;o=3D3Dcorp&quot; uri=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3D > =3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0 =3DA0 =3DA0<a>ldaps://<a hre= f=3D"http://10.100.120.153" target=3D"_blank">10.100.120.153</a></a>&= lt;/div><div > style=3D > =3D3D"font-family:Tahoma;font-size:13px">=3DA0</div&gt= ;<div > style=3D3D"font-family:T=3D > ahoma;font-size:13px"># close connection after a timeout<br= > > #idletimeout=3DA0=3DA0=3DA0=3DA0 100 # causes a cached connec= tion to be dropped > =3D > an recreated after a given ttl #conn-ttl=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3DA0 > 4294967294=3D > # close connection after a timeout for ldap > backend #idle-timeout=3DA0=3D > =3DA0=3DA0 4294967294 # Discards current cached connection wh= en the client > r=3D > ebinds - default to No > #single-conn=3DA0=3DA0=3DA0=3DA0 no</div><div > style=3D3D"font-family:Tahoma;font-size=3D > :13px"> overlay=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3D= A0 rwm rwm-suffixmassage > &quot;o=3D > =3D3Dcorp&quot; &quot;o=3D3Dint&quot;</div><div<b= r> > class=3D3D"gmail_extra"> <=3D > div class=3D3D"gmail_quote">2012/12/6 Pierangelo Masarati= <span > dir=3D3D"ltr">&=3D > lt;<a href=3D3D"mailto:<a href=3D"mailto:masarati@aero.polimi.= it">masarati(a)aero.polimi.it</a>" > target=3D3D"_blank">masarati@ae=3D > <a href=3D"http://ro.polimi.it" target=3D"_blank">ro.polimi.it</a><= /a>&gt; > <blockquote class=3D3D"gmail_quote" style=3D3D"margi= n:0 0 0 > .8ex;border-left:1p=3D > x #ccc solid;padding-left:1ex"> > &gt; Full_Name: Sebastien Prune THOMAS > &gt; Version: slapd 2.4.31 > &gt; OS: Linux CentOS > &gt; URL: <a href=3D3D"<a href=3D"ftp://ftp.openldap.org/i= ncoming/" target=3D"_blank">ftp://ftp.openldap.org/incoming/</a>" > target=3D3D"_blank">ft=3D > p://<a href=3D"http://ftp.openldap.org/incoming/" target=3D"_blank">ft= p.openldap.org/incoming/</a></a> > &gt; Submission from: (NULL) (206.167.157.64) > &gt; > &gt; > &gt; I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory > LD=3D > AP > &gt; server. > &gt; Every once and a while I have long lasting connections re-bin= ding > as<b=3D > r> > &gt; anonymous, > &gt; breaking the actual bind. > &gt; This usualy happen after hitting either the idle-timeout or t= he > conn-t=3D > tl > &gt; limit. > &gt; I wasn&#39;t able to find out what these values are when = not set... > bu=3D > t > &gt; setting them > &gt; low can help reproduce the problem : > > What is the configuration of back-ldap? =3DA0Can you post it (after<br= > > sanitizin=3D > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> &lt= ;/div> > > --20cf307811d0d379c404d032d6ee-- <div class=3D"HOEnZb"><div class=3D"h5">> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> --20cf307811d0eb756704d0342092--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=ISO-8859-1 > > Config is basic (with special timeout tests commented out) : > > database ldap > suffix "o=corp" > uri ldaps://10.100.120.153 > > # close connection after a timeout > #idletimeout 100 > # causes a cached connection to be dropped an recreated after a given ttl > #conn-ttl 4294967294 > # close connection after a timeout for ldap backend > #idle-timeout 4294967294 > # Discards current cached connection when the client rebinds - default to > No > #single-conn no Try adding a "rebind-as-user" here. This forces back-ldap to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. > overlay rwm > rwm-suffixmassage "o=corp" "o=int" > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: ftp://ftp.openldap.org/incoming/ >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-binding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or the >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? Can you post it (after >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > > --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=ISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with > spec= > ial timeout tests commented out) :</div><div > style=3D"font-family:Tahoma;fo= > nt-size:13px">=A0</div><div > style=3D"font-family:Tahoma;font-size:13px">dat= > abase =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div > style= > =3D"font-family:Tahoma;font-size:13px">=A0</div><div > style=3D"font-family:T= > ahoma;font-size:13px"># close connection after a timeout > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be dropped > = > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 > 4294967294= > # close connection after a timeout for ldap > backend #idle-timeout=A0= > =A0=A0 4294967294 # Discards current cached connection when the client > r= > ebinds - default to No > #single-conn=A0=A0=A0=A0 no</div><div > style=3D"font-family:Tahoma;font-size= > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage > "o= > =3Dcorp" "o=3Dint"</div><div > class=3D"gmail_extra"> <= > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati dir=3D"ltr">&= > lt;<a href=3D"mailto:masarati@aero.polimi.it" > target=3D"_blank">masarati@ae= > ro.polimi.it</a>> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > .8ex;border-left:1p= > x #ccc solid;padding-left:1ex"> > > Full_Name: Sebastien Prune THOMAS > > Version: slapd 2.4.31 > > OS: Linux CentOS > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" > target=3D"_blank">ft= > p://ftp.openldap.org/incoming/</a> > > Submission from: (NULL) (206.167.157.64) > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > LD= > AP > > server. > > Every once and a while I have long lasting connections re-binding > as<b= > r> > > anonymous, > > breaking the actual bind. > > This usualy happen after hitting either the idle-timeout or the > conn-t= > tl > > limit. > > I wasn't able to find out what these values are when not set... > bu= > t > > setting them > > low can help reproduce the problem : > > What is the configuration of back-ldap? =A0Can you post it (after > sanitizin= > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> </div> > > --20cf307811d0d379c404d032d6ee-- > > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307811d0d379c404d032d6ee Content-Type: text/plain; charset=ISO-8859-1 Config is basic (with special timeout tests commented out) : database ldap suffix "o=corp" uri ldaps://10.100.120.153 # close connection after a timeout #idletimeout 100 # causes a cached connection to be dropped an recreated after a given ttl #conn-ttl 4294967294 # close connection after a timeout for ldap backend #idle-timeout 4294967294 # Discards current cached connection when the client rebinds - default to No #single-conn no overlay rwm rwm-suffixmassage "o=corp" "o=int" 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > Full_Name: Sebastien Prune THOMAS > > Version: slapd 2.4.31 > > OS: Linux CentOS > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (206.167.157.64) > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP > > server. > > Every once and a while I have long lasting connections re-binding as > > anonymous, > > breaking the actual bind. > > This usualy happen after hitting either the idle-timeout or the conn-ttl > > limit. > > I wasn't able to find out what these values are when not set... but > > setting them > > low can help reproduce the problem : > > What is the configuration of back-ldap? Can you post it (after sanitizing > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d0d379c404d032d6ee Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with spec= ial timeout tests commented out) :</div><div style=3D"font-family:Tahoma;fo= nt-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px">dat= abase =A0 =A0 =A0ldap suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div style= =3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"font-family:T= ahoma;font-size:13px"># close connection after a timeout #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be dropped = an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 4294967294= # close connection after a timeout for ldap backend #idle-timeout=A0= =A0=A0 4294967294 # Discards current cached connection when the client r= ebinds - default to No #single-conn=A0=A0=A0=A0 no</div><div style=3D"font-family:Tahoma;font-size= :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage "o= =3Dcorp" "o=3Dint"</div><div class=3D"gmail_extra"> <= div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati &= lt;<a href=3D"mailto:masarati@aero.polimi.it" target=3D"_blank">masarati@ae= ro.polimi.it</a>> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> > Full_Name: Sebastien Prune THOMAS > Version: slapd 2.4.31 > OS: Linux CentOS > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ft= p://ftp.openldap.org/incoming/</a> > Submission from: (NULL) (206.167.157.64) > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LD= AP > server. > Every once and a while I have long lasting connections re-binding as<b= r> > anonymous, > breaking the actual bind. > This usualy happen after hitting either the idle-timeout or the conn-t= tl > limit. > I wasn't able to find out what these values are when not set... bu= t > setting them > low can help reproduce the problem : What is the configuration of back-ldap? =A0Can you post it (after sanitizin= g sensitive info)? p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </blockquote></div> </div> --20cf307811d0d379c404d032d6ee--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> Full_Name: Sebastien Prune THOMAS > Version: slapd 2.4.31 > OS: Linux CentOS > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (206.167.157.64) > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP > server. > Every once and a while I have long lasting connections re-binding as > anonymous, > breaking the actual bind. > This usualy happen after hitting either the idle-timeout or the conn-ttl > limit. > I wasn't able to find out what these values are when not set... but > setting them > low can help reproduce the problem : What is the configuration of back-ldap? Can you post it (after sanitizing sensitive info)? p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

Full_Name: Sebastien Prune THOMAS Version: slapd 2.4.31 OS: Linux CentOS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (206.167.157.64) I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP server. Every once and a while I have long lasting connections re-binding as anonymous, breaking the actual bind. This usualy happen after hitting either the idle-timeout or the conn-ttl limit. I wasn't able to find out what these values are when not set... but setting them low can help reproduce the problem : Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 fd=39 ACCEPT from IP=10.100.64.68:33906 (IP=0.0.0.0:389) Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 BIND dn="cn=ldapintbind,o=corp" method=128 Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 BIND dn="cn=ldapintbind,o=shq" mech=SIMPLE ssf=0 Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 RESULT tag=97 err=0 text= Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SRCH base="o=corp" scope=2 deref=3 filter="(&(objectClass=*)(uid=pry))" Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SRCH attr=uid Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=2 CMP dn="cn=00-BASICAUTH,o=corp" attr="member" Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=2 RESULT tag=111 err=6 text= Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SRCH base="o=corp" scope=2 deref=3 filter="(&(objectClass=*)(uid=dln))" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SRCH attr=uid Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 ldap_back_retry: retrying URI="ldaps://10.100.120.153" DN="cn=ldapintbindo=corp" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 ldap_back_dobind_int: DN="cn=ldapintbind,o=corp" without creds, binding anonymously Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=4 CMP dn="cn=00-BASICAUTH,o=corp" attr="member" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=4 RESULT tag=111 err=5 text= Dec 6 09:23:28 qxpldp01 slapd[40707]: conn=1095 fd=39 closed (slapd shutdown) There, the connection is opened on december the 5... then idle... then another search is done on december the 6... and leads to a re-bind... Either, I don't understand why : - openldap don't re-use the credential of the first bind OR - openldap simply end the TCP connection when the timeout is reached instead of re-using it like if it was a new connection --- > the client is not aware of that and still thinks the last bind is valid. I tried every option I could without success... For now, I set the conn-ttl and idle-timeout to the max an unsigned long could support : 4294967294 Any other solution apreciated...

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by michael＠stroeder.com 04 Dec '12

04 Dec '12

This is a cryptographically signed message in MIME format. --------------ms080001080509060504090401 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Quanah Gibson-Mount wrote: > I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talk= ing > about the commits for ITS7308 and ITS7309, which touched a significant = number > of files. Generally we need someone to go through contrib and verify t= hings > build ok. Yeah, no problem. My build script currently contains the lines below for overlays I'm alway= s using. Please apply the patches to RE24 and I will test as many overlays = as possible. Ciao, Michael. ------------------------------- snip ------------------------------- # Build selected contrib overlays # slapo-allowed cd ${OPENLDAP_CONTRIB_MOD}/allowed make clean ; make PREFIX=3D${OPENLDAP_PREFIX} # slapo-lastbind cd ${OPENLDAP_CONTRIB_MOD}/lastbind make clean ; make prefix=3D${OPENLDAP_PREFIX} # slapo-noopsrch cd ${OPENLDAP_CONTRIB_MOD}/noopsrch make clean ; make prefix=3D${OPENLDAP_PREFIX} # slapo-smbk5pwd cd ${OPENLDAP_CONTRIB_MOD}/smbk5pwd make clean ; make prefix=3D${OPENLDAP_PREFIX} DEFS=3D"-DDO_SAMBA -DDO_SHA= DOW" --------------ms080001080509060504090401 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMjA0MTg0NzI4WjAjBgkq hkiG9w0BCQQxFgQU0i74cGCINoBUMa+SopgnSm/SyfgwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAj+hC4vk+9YseHBkFV80S/vi18exEl55i068Bjjr7P/A5gt0BpJP2jIIKnPEzxikfnIhv OogXkVWpOD1VL+dHZouNKWHx2rLu8IYgU+sZKFtqRShfevc25HniCGKs0g50HRsjrI1BcrK2 bOp+dDxmt+9z9kaQXkVqCMgMDSqvLY90JPNSssW2RXwezIpoo0Sk06bxwsnXploF0qZYYPTO alGNv3uCckWCVd6gna63jMz51aV7c/7+sJYG/hZz/ps5C0IFeZ07mhANeAMKjC793/U+MEwu A9CQgrkBMKKHOjmQOvQyNKQ4YHQ8BzU5/Ql0xkTMBY2/4CDdtw+D6874MwAAAAAAAA== --------------ms080001080509060504090401--

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by quanah＠zimbra.com 04 Dec '12

04 Dec '12

--On Tuesday, December 04, 2012 7:36 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > quanah(a)zimbra.com wrote: >> --On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: >> >>> fumiyas(a)osstech.jp wrote: >>>> At Wed, 28 Nov 2012 20:04:41 GMT, >>>> michael(a)stroeder.com wrote: >>>>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>>>> to ease building it without installed OpenLDAP client libs: >>>> >>>> This ITS is a dup of #7309. >>>> http://www.openldap.org/its/index.cgi?findid=7309 >>>> >>>> And see also: >>>> http://www.openldap.org/its/index.cgi?findid=7308 >>>> >>>> This problem is fixed in master, but not in 2.4 branch... >>> >>> Ah, thanks for the hint. The Makefile in master looks much better than >>> my suggestion. >>> >>> @Quanah: Could you please port this to RE24 branch? >> >> My recollection is we've been waiting on someone to go through and test >> the changes. Are you willing to do that? it sounds like you've >> started... > > Which tests do you expect? > > I usually build without the KRB5 support. If you want this to be also > tested I have to reactivate my rusty heimdal knowledge a bit. I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talking about the commits for ITS7308 and ITS7309, which touched a significant number of files. Generally we need someone to go through contrib and verify things build ok. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by michael＠stroeder.com 04 Dec '12

04 Dec '12

quanah(a)zimbra.com wrote: > --On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: > >> fumiyas(a)osstech.jp wrote: >>> At Wed, 28 Nov 2012 20:04:41 GMT, >>> michael(a)stroeder.com wrote: >>>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>>> to ease building it without installed OpenLDAP client libs: >>> >>> This ITS is a dup of #7309. >>> http://www.openldap.org/its/index.cgi?findid=7309 >>> >>> And see also: >>> http://www.openldap.org/its/index.cgi?findid=7308 >>> >>> This problem is fixed in master, but not in 2.4 branch... >> >> Ah, thanks for the hint. The Makefile in master looks much better than my >> suggestion. >> >> @Quanah: Could you please port this to RE24 branch? > > My recollection is we've been waiting on someone to go through and test the > changes. Are you willing to do that? it sounds like you've started... Which tests do you expect? I usually build without the KRB5 support. If you want this to be also tested I have to reactivate my rusty heimdal knowledge a bit. Ciao, Michael.

1 0

RE: (ITS#7434) idassert-bind fails after restarting slapd
by blance3459＠hotmail.com 04 Dec '12

04 Dec '12

--_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Quanah=2C=20 =20 I finally got back around to working on this over the last couple of days. = Where I'm at with my project is: I have two servers (virtual machines)=2C = named master and replica=2C with slapd configured with my directory inform= ation and single-master replication between them. =20 I created a Kerberos realm and various principals in open ldap. =20 Replication access is authenticated using sasl/gssapi with the slapd princ= ipal=2C ldap/replica.example.net. =20 k5start has been added to system startup to buid the credential cache for = slapd. =20 That brings me to configuring referrals and proxyAuth on replica. What ap= pears to be happening is that at the initial configuration (before restarti= ng the daemon) is the client binds to the replica and authenticates with it= s kerberos ticket. The "magic" is performed on the sasl user and the ldap directory entry is returned. It then proceeds into the modifi= cation and notices the update referral. It then checks to determine if the= binddn used in in the olcDbIDAssertBind statems can authzTo the bound user. It can and the proxy of the modificati= on proceeds. On the master=2C the proxy request is received=2C more "magic= " is done on the user id to make sure it is in=20 the correct form=2C the authzTo attribute is again checked and allowed. Th= e update is performed as the user=2C and success is returned back through t= he chain to the user. This is how I would expect=20 the process to proceed. However=2C if I restart the server (or slapd daemo= n)=2C this behavior changes. After restarting=2C the bind occurs at the re= plica=2C does "magic"=2C and then sees the referral and attempts the proxy.= What's notable here is that the check of authzTo is NOT performed. The refereal is then chased=2C but the authzTo check was never made. Since= there is no user to "authzTo"=2C does the referral get chased with perhaps= a "null" or anonymous user? Whatever the case=2C it appears the the original binding user is never sent= over the proxy. Over at the master=2C I see the bind request come on from= the replica which is treated as an anonymous bind request. No magic=2C no authzTo check=2C no nothing. It then goes straight into the= modification and tries to perform=2C but is blocked due to the bound user = being anonymous and the stronger authentication error (8) is returned. =20 Given that the bind occured anonymously=2C I feel that error is expected an= d wanted. =20 I had been trying to use sasl binding here=2C but was not having the same s= ucess that I had with syncrepl. In order to only fight one battle at a tim= e=2C I changed by proxy config to use a simple bind instead of sasl/gssapi.= =20 =20 Referrals and proxy authentication are configured on replica with the follo= wing ldif. I tried setting the override flag because the man page makes it= sound like it forces the authzTo check at bind time. By doing that I was hoping I could force the check and see the authzTo proc= ess in my logs. Is this what the ITS you mentions is referring to?=20 dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig changetype: modify add: olcUpdateref olcUpdateref: "ldap://master.example.net:389/" =20 dn: cn=3Dmodule{0}=2Ccn=3Dconfig changetype: modify add: olcModuleLoad olcModuleLoad: {1}back_ldap =20 dn: olcOverlay=3Dchain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE =20 dn: olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}fronten= d=2Ccn=3Dconfig changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://master.example.net:389/" olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=3Dsimple binddn=3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" credentials=3Dshhh-secret mode=3Dself flags=3Doverride starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem =20 =20 After adding that information via ldapmodify=2C I attempt to perform an upd= ate on the replica. For testing=2C i simply change the description attribu= te for uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. I'm us= ing this simple ldif to test with: dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet changetype: modify replace: description description: Network Administrator Initially after configuring the proxy and obtainng a kerberos ticket for th= e account (administrator=2C self write)=2C this update succeeds. Looking a= t syslog on replica=2C I see happiness. The ldap modify binds using gssapi= =2C I see SASL name being correctly converted to uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. Dec 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: auth= cid=3D"administrator" Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: conn 1005 id=3Dadmini= strator [len=3D13] Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: u:id converted to uid= =3Dadministrator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <uid=3Dadministrator= =2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth> Dec 3 22:17:01 replica slapd[994]: <<< dnNormalize: <uid=3Dadministrator= =2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth> Dec 3 22:17:01 replica slapd[994]: =3D=3D>slap_sasl2dn: converting SASL n= ame uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth to a D= N Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_context_apply [depth= =3D1] string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth' Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth'= string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth= ' [1 pass(es)] Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3D= administrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' [1 pass(es)] Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_context_apply [depth= =3D1] res=3D{0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dn= et'} Dec 3 22:17:01 replica slapd[994]: [rw] authid: "uid=3Dadministrator=2Ccn= =3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -> "uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: slap_parseURI: parsing uid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <=3D=3Dslap_sasl2dn: Converted SASL na= me to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: dn:id converted to ui= d=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: slapA= uthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: SASL proxy authorize [conn=3D1005]: au= thcid=3D"administrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND authcid=3D"adm= inistrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:17:01 replica slapd[994]: SASL Authorize [conn=3D1005]: proxy a= uthorization allowed authzDN=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_sasl: err=3D0 len=3D-1 Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND dn=3D"uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ssf= =3D56 ssf=3D56 Dec 3 22:17:01 replica slapd[994]: do_bind: SASL/GSSAPI bind: dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 Dec 3 22:17:01 replica slapd[994]: send_ldap_response: msgid=3D3 tag=3D97= err=3D0 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 RESULT tag=3D97 err= =3D0 text=3D Dec 3 22:17:01 replica slapd[994]: <=3D=3D slap_sasl_bind: rc=3D0 All good=2C so far on replica. I believe the sasl/gssapi authntication pr= ocess is completed. Now to perform the modify. Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 do_modify Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 modifications: Dec 3 22:17:01 replica slapd[994]: #011replace: description Dec 3 22:17:01 replica slapd[994]: #011#011one value=2C length 21 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD dn=3D"uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD attr=3Ddescript= ion Dec 3 22:17:01 replica slapd[994]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p= =3D3 Dec 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D10 matched=3D"= " text=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_result: referral=3D"ldap://m= aster.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" -> "ldap://master.example.net:389" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet": URI=3D"ldap://master.example.net:389" found in cache =20 Okay=2C now it seems that the referral is returned and chased on behalf of= the client. Finally=2C from the perspective of replica=2C success! Modif= ied data comes back to replica via syncrepl. Dec 3 22:17:01 replica slapd[994]: =3D>ldap_back_getconn: conn 0x7fe0b01= 47c30 fetched refcnt=3D1. Dec 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p= =3D3 Dec 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D0 matched=3D""= text=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_response: msgid=3D4 tag=3D10= 3 err=3D0 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 RESULT tag=3D103 er= r=3D0 text=3D =20 Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]: 15r Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: daemon: read active on 15 Dec 3 22:17:01 replica slapd[994]: connection_get(15) Dec 3 22:17:01 replica slapd[994]: connection_get(15): got connid=3D0 Dec 3 22:17:01 replica slapd[994]: =3D>do_syncrepl rid=3D123 Dec 3 22:17:01 replica slapd[994]: =3D>do_syncrep2 rid=3D123 Dec 3 22:17:01 replica slapd[994]: do_syncrep2: rid=3D123 cookie=3Drid=3D= 123=2Ccsn=3D20121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: >>> dnPretty: <cn=3Dadmin=2Cdc=3Dexamp= le=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPretty: <cn=3Dadmin=2Cdc=3Dexamp= le=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <cn=3Dadmin=2Cdc=3Dex= ample=2Cdc=3Dnet> Dec 3 22:17:01 replica rsyslogd-2177: imuxsock begins to drop messages fr= om pid 994 due to rate-limiting So everything looks good (correct?) on replica. Meanwhile=2C back at the = master....=20 Dec 3 22:17:01 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:17:01 master slapd[947]: daemon: activity on: Dec 3 22:17:01 master slapd[947]: 51r Dec 3 22:17:01 master slapd[947]:=20 Dec 3 22:17:01 master slapd[947]: daemon: read active on 51 Dec 3 22:17:01 master slapd[947]: connection_get(51) Dec 3 22:17:01 master slapd[947]: connection_get(51): got connid=3D1054 Dec 3 22:17:01 master slapd[947]: connection_read(51): checking for input= on id=3D1054 Dec 3 22:17:01 master slapd[947]: op tag 0x66=2C time 1354591021 Dec 3 22:17:01 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:17:01 master slapd[947]: daemon: activity on: Dec 3 22:17:01 master slapd[947]:=20 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 do_modify Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:17:01 master slapd[947]: =3D> get_ctrls Dec 3 22:17:01 master slapd[947]: =3D> get_ctrls: oid=3D"2.16.840.1.11373= 0.3.4.18" (noncritical) Dec 3 22:17:01 master slapd[947]: parseProxyAuthz: conn 1054 authzid=3D"d= n:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: slap_sasl_getdn: conn 1054 id=3Ddn:uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet [len=3D48] Dec 3 22:17:01 master slapd[947]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl2dn: converting SASL na= me uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet to a DN Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_context_apply [depth=3D= 1] string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth'= string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' [1 = pass(es)] Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' [1 pass(es)] Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_context_apply [depth=3D= 1] res=3D{0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'= } Dec 3 22:17:01 master slapd[947]: [rw] authid: "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" -> "uid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: slap_parseURI: parsing uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <=3D=3Dslap_sasl2dn: Converted SASL nam= e to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: slap_sasl_getdn: dn:id converted to uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: parseProxyAuthz: conn=3D1054 "uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl_authorized: can cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet become uid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet? Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl_check_authz: does uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet match authzTo rule= in cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet? Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "cn=3Dreplica= =2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "authzTo" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("cn=3Dreplica=2Cou=3Dhosts= =2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "cn=3D= replica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (authzTo) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: auth access to "cn= =3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" "authzTo" requested Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [2] attr authzTo Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "cn=3Dre= plica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "authzTo" requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [1] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [1] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: auth access g= ranted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: auth access grante= d by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result was in cach= e (authzTo) Dec 3 22:17:01 master slapd[947]: =3D=3D=3D>slap_sasl_match: comparing DN= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet to rule dn:* Dec 3 22:17:01 master slapd[947]: slap_parseURI: parsing dn:* Dec 3 22:17:01 master slapd[947]: <=3D=3D=3Dslap_sasl_match: comparison r= eturned 0 Dec 3 22:17:01 master slapd[947]: <=3D=3Dslap_sasl_check_authz: authzTo c= heck returning 0 Dec 3 22:17:01 master slapd[947]: <=3D=3D slap_sasl_authorized: return 0 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 PROXYAUTHZ dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: <=3D get_ctrls: n=3D1 rc=3D0 err=3D"" Dec 3 22:17:01 master slapd[947]: >>> dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 modifications: Dec 3 22:17:01 master slapd[947]: #011replace: description Dec 3 22:17:01 master slapd[947]: #011#011one value=2C length 21 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 MOD dn=3D"uid=3Dadmi= nistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 MOD attr=3Ddescripti= on Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> test_filter Dec 3 22:17:01 master slapd[947]: PRESENT Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr objectClass Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: search access= granted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access gran= ted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: <=3D test_filter 6 Dec 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fscope = 1 rc 6 Dec 3 22:17:01 master slapd[947]: hdb_modify: uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: slap_queue_csn: queing 0x7fa90f0fe110 2= 0121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: 0x0000000b: uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (description) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: delete access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "description" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr description Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "description"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] applying write(=3Dwr= scxd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] mask: write(=3Dwrscx= d) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: delete access= granted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: delete access gran= ted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (description) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: add access to "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "description" req= uested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr description Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "description"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to value by "uid=3Dadmin= istrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] applying write(=3Dwr= scxd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] mask: write(=3Dwrscx= d) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: add access gr= anted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: add access granted= by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: acl: internal mod entryCSN: modify acce= ss granted Dec 3 22:17:01 master slapd[947]: acl: internal mod modifiersName: modify= access granted Dec 3 22:17:01 master slapd[947]: acl: internal mod modifyTimestamp: modi= fy access granted Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace descriptio= n Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace entryCSN Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace modifiersN= ame Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace modifyTime= stamp Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "inetOrgPerso= n" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "posixAccount= " Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "shadowAccoun= t" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbPrincipal= Aux" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbTicketPol= icyAux" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "objectClass" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "cn" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "sn" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "uidNumber" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "gidNumber" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "userPassword" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "homeDirectory" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "structuralObject= Class" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "uid" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "entryUUID" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "creatorsName" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "createTimestamp" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbPrincipalName= " Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbPrincipalKey" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastPwdChange= " Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastFailedAut= h" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLoginFailedCo= unt" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastSuccessfu= lAuth" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbExtraData" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "description" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "entryCSN" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "modifiersName" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "modifyTimestamp" Dec 3 22:17:01 master slapd[947]: =3D> key_change(DELETE=2Cb) Dec 3 22:17:01 master slapd[947]: bdb_idl_delete_key: b=20 Dec 3 22:17:01 master slapd[947]: <=3D key_change 0 Dec 3 22:17:01 master slapd[947]: =3D> key_change(ADD=2Cb) Dec 3 22:17:01 master slapd[947]: bdb_idl_insert_key: b=20 Dec 3 22:17:01 master slapd[947]: <=3D key_change 0 Dec 3 22:17:01 master slapd[947]: =3D> entry_encode(0x0000000b):=20 Dec 3 22:17:01 master slapd[947]: <=3D entry_encode(0x0000000b):=20 Dec 3 22:17:01 master slapd[947]: hdb_modify: updated id=3D0000000b dn=3D"= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: send_ldap_result: conn=3D1054 op=3D3 p= =3D3 Dec 3 22:17:01 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" = text=3D"" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> test_filter Dec 3 22:17:01 master slapd[947]: PRESENT Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr objectClass Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: search access= granted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access gran= ted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: <=3D test_filter 6 Dec 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fscope = 1 rc 6 Dec 3 22:17:01 master slapd[947]: syncprov_sendresp: cookie=3Drid=3D123= =2Ccsn=3D20121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Everything looks good on the master. I see uid=3Dadministrator gets sent = over from the the proxy on replica and the update proceeds as expected. No= w if I restart slapd on replica=2C things change. performing the same modi= fucation=2C we again see sasl/gssapi authentication occuring on replica jus= t as before Dec 3 22:20:38 replica slapd[1412]: [rw] authid: "uid=3Dadministrator=2C= cn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -> "uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: slap_parseURI: parsing uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <=3D=3Dslap_sasl2dn: Converted SASL n= ame to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: slap_sasl_getdn: dn:id converted to u= id=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: SASL Canonicalize [conn=3D1000]: slap= AuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: SASL proxy authorize [conn=3D1000]: a= uthcid=3D"administrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND authcid=3D"ad= ministrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:20:38 replica slapd[1412]: SASL Authorize [conn=3D1000]: proxy = authorization allowed authzDN=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_sasl: err=3D0 len=3D-1 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND dn=3D"uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ss= f=3D56 ssf=3D56 Dec 3 22:20:38 replica slapd[1412]: do_bind: SASL/GSSAPI bind: dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 Dec 3 22:20:38 replica slapd[1412]: send_ldap_response: msgid=3D3 tag=3D9= 7 err=3D0 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 RESULT tag=3D97 er= r=3D0 text=3D Dec 3 22:20:38 replica slapd[1412]: <=3D=3D slap_sasl_bind: rc=3D0 Again=2C we head into the modification: Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 do_modify Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:20:38 replica slapd[1412]: >>> dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 modifications: Dec 3 22:20:38 replica slapd[1412]: #011replace: description Dec 3 22:20:38 replica slapd[1412]: #011#011one value=2C length 21 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 MOD dn=3D"uid=3Dad= ministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 MOD attr=3Ddescrip= tion Dec 3 22:20:38 replica slapd[1412]: bdb_dn2entry("uid=3Dadministrator=2Co= u=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: =3D> hdb_dn2id("ou=3Dpeople=2Cdc=3Dex= ample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: <=3D hdb_dn2id: got id=3D0x3 Dec 3 22:20:38 replica slapd[1412]: daemon: activity on 1 descriptor Dec 3 22:20:38 replica slapd[1412]: daemon: activity on: Dec 3 22:20:38 replica slapd[1412]: =20 So far=2C so good (I think)=2C replica sees the need to refer the action a= nd tries to chase it on behalf of the clent: Dec 3 22:20:38 replica slapd[1412]: =3D> hdb_dn2id("uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: <=3D hdb_dn2id: got id=3D0xb Dec 3 22:20:38 replica slapd[1412]: entry_decode: "" Dec 3 22:20:38 replica slapd[1412]: <=3D entry_decode() Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D10 matched=3D= "" text=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: referral=3D"ldap://= master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet" Dec 3 22:20:38 replica slapd[1412]: >>> dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" -> "ldap://master.example.net:389" Dec 3 22:20:38 replica slapd[1412]: ldap_back_db_open: URI=3Dldap://maste= r.example.net:389 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" temporary Dec 3 22:20:38 replica slapd[1412]: =3D>ldap_back_getconn: conn=3D1000 op= =3D3: lc=3D0x7f213015a7d0 inserted refcnt=3D1 rc=3D0 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 =20 At this point=2C I "assume" the modification has been passed off to master.= However=2C I notice that I never see the replica checking authzTo like be= fore the restart. I think this is where it's falling apart for me and the e= rr=3D8 back is returned from master. =20 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matched=3D"= " text=3D"modifications require authentication" Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matched=3D"= " text=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_response: msgid=3D4 tag=3D1= 03 err=3D8 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 RESULT tag=3D103 e= rr=3D8 text=3D Dec 3 22:20:38 replica slapd[1412]: daemon: activity on 1 descriptor Dec 3 22:20:38 replica slapd[1412]: daemon: activity on: Dec 3 22:20:38 replica slapd[1412]: 18r =20 Over on the master we see the proxy connection occurs=2C but the client cr= edentials never apper to arrive. I say that because=2C it looks to me like= the proxy connection from replica appears to bind anonymously. Dec 3 22:20:38 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]:=20 Dec 3 22:20:38 master slapd[947]: slap_listener_activate(8):=20 Dec 3 22:20:38 master slapd[947]: >>> slap_listener(ldap:///) Dec 3 22:20:38 master slapd[947]: daemon: listen=3D8=2C new connection on= 51 Dec 3 22:20:38 master slapd[947]: daemon: added 51r (active) listener=3D(= nil) Dec 3 22:20:38 master slapd[947]: conn=3D1056 fd=3D51 ACCEPT from IP=3D19= 2.168.1.2:34759 (IP=3D0.0.0.0:389) Dec 3 22:20:38 master slapd[947]: daemon: activity on 2 descriptors Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]: 51r Dec 3 22:20:38 master slapd[947]:=20 Dec 3 22:20:38 master slapd[947]: daemon: read active on 51 Dec 3 22:20:38 master slapd[947]: connection_get(51) Dec 3 22:20:38 master slapd[947]: connection_get(51): got connid=3D1056 Dec 3 22:20:38 master slapd[947]: connection_read(51): checking for input= on id=3D1056 Dec 3 22:20:38 master slapd[947]: op tag 0x60=2C time 1354591238 Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 do_bind Dec 3 22:20:38 master slapd[947]: >>> dnPrettyNormal: <> Dec 3 22:20:38 master slapd[947]: <<< dnPrettyNormal: <>=2C <> Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 BIND dn=3D"" method= =3D128 Dec 3 22:20:38 master slapd[947]: do_bind: version=3D3 dn=3D"" method=3D1= 28 Dec 3 22:20:38 master slapd[947]: send_ldap_result: conn=3D1056 op=3D0 p= =3D3 Dec 3 22:20:38 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" = text=3D"" Dec 3 22:20:38 master slapd[947]: send_ldap_response: msgid=3D1 tag=3D97 = err=3D0 Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 RESULT tag=3D97 err= =3D0 text=3D Dec 3 22:20:38 master slapd[947]: do_bind: v3 anonymous bind Dec 3 22:20:38 master slapd[947]: daemon: activity on 2 descriptors Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]: 51r Dec 3 22:20:38 master slapd[947]:=20 After=2C the (anonymous) bind=2C the master never attempts to if the proxya= uth request is allowed via authzTo or anything else (perhaps obviously). T= he modification just proceeds anonymously and eventually fails. =20 Not sure if I'm saying this in a way that makes any sense to you. Hopeful= ly=2C it does. It appears=2C that the proxy on replica after restarting=2C= never tries to determine if the olcDbIDAssertBind binddn is permitted to i= mpersonate the client via the authzTo attribute and proceeds with the refer= al chase anonymously. =20 I'll copy paste configs below. Sorry this is so long=2C but I figure the= more information=2C the better when trying to solve any problem. =20 Thanks =20 Barry =20 vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv master configuration vvvvvvvvvvvvvvvvv= vvvvvvvvvvv dn: cn=3Dconfig objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: ea6bf008-d108-1031-912d-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/master_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/master_slapd_key.pem olcAuthzPolicy: to olcSaslHost: master.example.net olcSaslRealm: EXAMPLE.NET olcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet olcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet olcLogLevel: -1 entryCSN: 20121204013949.466434Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204013949Z dn: cn=3Dmodule{0}=2Ccn=3Dconfig objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: ea6dda08-d108-1031-9135-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121203054749.860918Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z dn: cn=3Dschema=2Ccn=3Dconfig objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: ea6c3a0e-d108-1031-9130-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.672699Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z <snip schemas > dn: olcBackend=3D{0}hdb=2Ccn=3Dconfig objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: ea6f949c-d108-1031-9136-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.694663Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break olcAccess: {1}to dn.exact=3D"" by * read olcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: ea6c0bf6-d108-1031-912e-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.671512Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{0}config=2Ccn=3Dconfig objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal=2Ccn=3Dauth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: ea6c325c-d108-1031-912f-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.672495Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=3Dexample=2Cdc=3Dnet olcLastMod: TRUE olcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet olcRootPW:: e1NTSEF9cGhKNWtqME9rOGJnVXp0dy9hYzZEaWFmU1U1Z0FTZk0=3D olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: krbPrincipalName eq=2Cpres=2Csub olcDbIndex: krbPwdPolicyReference eq structuralObjectClass: olcHdbConfig entryUUID: ea6fa3ce-d108-1031-9137-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z olcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange by group.exact=3D= "cn=3Dreplic ators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by self write by anon= ymous auth olcAccess: {1}to attrs=3DauthzTo=2CauthzFrom=2Ccn=2CuidNumber=2CgidNumber= =2Cuid by users r ead by anonymous none olcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFai= ledAuth=2Ckr bLoginFailedCount by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc= =3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" wr= ite by dn=3D"cn=3Dadm-sr v=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by self read by * none olcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by= group.exact=3D"cn =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by dn=3D"cn= =3Dkdc-srv=2Cou=3Dkerberos=2C dc=3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc= =3Dexample=2Cdc=3Dnet" writ e by * none olcAccess: {4}to dn.base=3D"" by * read olcAccess: {5}to * by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C= dc=3Dnet" write by s elf write by users read entryCSN: 20121203054749.804561Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z dn: olcOverlay=3D{0}syncprov=2ColcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 structuralObjectClass: olcSyncProvConfig entryUUID: b77dc36a-d158-1031-9917-2f12ddec6588 creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121203054749Z entryCSN: 20121203054749.962179Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv dc=3D= example=2Cdc=3Dnet vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv dn: dc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: dcObject objectClass: organization o: example.net dc: example structuralObjectClass: organization entryUUID: eac01854-d108-1031-95b6-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.222029Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z contextCSN: 20121204035116.890381Z#000000#000#000000 dn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: eac2e160-d108-1031-95b7-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.240572Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z dn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: people description: user account objects structuralObjectClass: organizationalUnit entryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.299880Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: groups description: group objects structuralObjectClass: organizationalUnit entryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.394485Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: hosts description: host/computer objects structuralObjectClass: organizationalUnit entryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.400935Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: kerberos description: kerberos realm container structuralObjectClass: organizationalUnit entryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.409140Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: replica objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica structuralObjectClass: organizationalRole entryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/replica.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRU= RAxZ oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6= Mn3k f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu= 6lb/ QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065600Z krbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D userPassword:: <secret> entryCSN: 20121203233422.105322Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203233422Z dn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: master objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica userPassword:: e0NSWVBUfSo=3D structuralObjectClass: organizationalRole entryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/master.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW= +aWr 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5= 522A i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH1= 5xNZ VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060855Z krbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203060855.932134Z#000000#000#000000 modifiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203060855Z dn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: posixGroup cn: administrator gidNumber: 50000 structuralObjectClass: posixGroup entryUUID: 1d079216-d12b-1031-978d-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.465616Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: groupOfNames cn: replicators member: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet member: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet structuralObjectClass: groupOfNames entryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.477792Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: administrator sn: administrator uidNumber: 50000 gidNumber: 50000 userPassword:: <secret> homeDirectory: /home/administrator structuralObjectClass: inetOrgPerson uid: administrator entryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: administrator(a)EXAMPLE.NET krbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ecqcdxa= iluD o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/= Ot7l cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADm= Ozq8 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8o= AcwB aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6= yoME 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo= 8yyO mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgED= oSgE JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLR= VhBT VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXG= a5U+ g=3D krbLastPwdChange: 20121203054848Z krbLastFailedAuth: 20121204013714Z krbLoginFailedCount: 0 description: Network Administrator krbLastSuccessfulAuth: 20121204035116Z krbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204035116.890381Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204035116Z dn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: kdc-srv description: Kerberos KDC userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.563692Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: adm-srv description: Kerberos Admin Server userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.575773Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet cn: EXAMPLE.NET objectClass: top objectClass: krbRealmContainer objectClass: krbTicketPolicyAux krbSubTrees: dc=3Dexample=2Cdc=3Dnet krbSearchScope: 2 krbMaxRenewableAge: 604800 krbMaxTicketLife: 36000 structuralObjectClass: krbRealmContainer entryUUID: c03d58b8-d134-1031-83e7-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.757228Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 192 krbPrincipalName: K/M(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/= c4Ks HI=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAkBAAEArgC8UA=3D=3D krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c04d9282-d134-1031-83e8-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.863568Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: krbtgt/EXAMPLE.NET(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNn= fmRR GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7= UKy1 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9= KwFT B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8= oR krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0518180-d134-1031-83e9-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.889347Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3D= kerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/admin(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtC= kdsY 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M2= 8Ix6 SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZ= M5wu tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3a= Qz krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c05346be-d134-1031-83ea-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.900950Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 300 krbMaxRenewableAge: 604800 krbTicketFlags: 8196 krbPrincipalName: kadmin/changepw(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceW= qIB2 ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0w= wSqU ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd= 423Z epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9z= Pl krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c054d88a-d134-1031-83eb-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.911237Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/history(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: kadmin/history(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd= /N+Z 2g=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0562d3e-d134-1031-83ec-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.919957Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/master.example.net(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABhOeGOuo9UBDjK7hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4= Ta3z Y4ZaEYItXr2awBW6QXSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtG= g1qY oev8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj= 0sgn ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf4UwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qYDwpK0Hycj+cwyCjFsVKTsjzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAxTSMEh/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZA= Bm krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAANAD4gA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0581144-d134-1031-83ed-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.932349Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/master.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203060105Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPU= S2wz qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14TYWZyLZem= 5kvD yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAb= Nr3p vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060153Z krbLastSuccessfulAuth: 20121203061721Z krbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203061721.358939Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203061721Z dn: krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE= .NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/replica.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203065511Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUX= FMNw 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKb= ipUj AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOv= mT4x MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065628Z krbLastSuccessfulAuth: 20121204032538Z krbExtraData:: AAIcTbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204032538.048010Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204032538Z =20 =20 =20 vvvvvvvvvvvvvvvvvvvv replica config vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv =20 dn: cn=3Dconfig objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: af9b0068-d108-1031-9417-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/replica_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/replica_slapd_key.pem olcLogLevel: stats olcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet olcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet olcSaslHost: replica.example.net olcSaslRealm: EXAMPLE.NET entryCSN: 20121204023449.956406Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204023449Z dn: cn=3Dmodule{0}=2Ccn=3Dconfig objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}back_ldap structuralObjectClass: olcModuleList entryUUID: af9d1e34-d108-1031-941f-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z entryCSN: 20121204041212.292184Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: cn=3Dschema=2Ccn=3Dconfig objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: af9b564e-d108-1031-941a-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.995860Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z < snip schemas > dn: olcBackend=3D{0}hdb= =2Ccn=3Dconfig objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: af9e498a-d108-1031-9420-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z entryCSN: 20121202201457.015189Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201457Z dn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break olcAccess: {1}to dn.exact=3D"" by * read olcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: af9b211a-d108-1031-9418-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.994497Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z dn: olcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE structuralObjectClass: olcChainConfig entryUUID: 8605cc76-d214-1031-93d2-613cc62fd42f creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121204041212Z entryCSN: 20121204041212.352767Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: olcDatabase=3D{0}ldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}fron= tend=2Ccn=3Dconfig objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://master.example.net:389/" olcDbIDAssertBind: bindmethod=3Dsimple binddn=3D"cn=3Dreplica=2Cou=3Dhosts= =2Cdc=3Dexample=2Cdc =3Dnet" credentials=3D<secret> mode=3Dself flags=3Doverride starttls=3Dcr= itical tls_req cert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem olcDbRebindAsUser: TRUE structuralObjectClass: olcLDAPConfig entryUUID: 8609b6f6-d214-1031-93d3-613cc62fd42f creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121204041212Z entryCSN: 20121204041212.378432Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: olcDatabase=3D{0}config=2Ccn=3Dconfig objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: af9b4528-d108-1031-9419-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.995421Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=3Dexample=2Cdc=3Dnet olcLastMod: TRUE olcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet olcRootPW:: e1NTSEF9eW1nS3JTR0VkMW5LQ0VaQ0Y4UjJBTDlPTlEveENDbzY=3D olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: krbPrincipalName eq=2Cpres=2Csub olcDbIndex: krbPwdPolicyReference eq structuralObjectClass: olcHdbConfig entryUUID: af9e5d12-d108-1031-9421-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z olcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange by group.exact=3D= "cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by self wri= te by anonymous auth olcAccess: {1}to attrs=3DauthzTo=2CauthzFrom by group.exact=3D"cn=3Dreplic= ators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by users read by anonym= ous none olcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFai= ledAuth=2CkrbLoginFailedCount by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3D= example=2Cdc=3Dnet" read by dn =3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by self = read by * none olcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by= dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by dn= =3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C dc=3Dnet" read by * none olcAccess: {4}to dn.base=3D"" by * read olcAccess: {5}to * by self write by users read olcSyncrepl: {0}rid=3D123 provider=3D"ldap://master.example.net:389/" type= =3DrefreshAndPersist retry=3D"60 30 300 +" searchbase=3D"dc=3Dexample=2Cdc= =3Dnet" bindmethod=3Dsasl saslmech=3Dgssapi starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D= /etc/ssl/certs/cacert.pem olcUpdateRef: "ldap://master.example.net:389/" entryCSN: 20121204041212.283590Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z =20 =20 =20 dn: dc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: dcObject objectClass: organization o: example.net dc: example structuralObjectClass: organization entryUUID: eac01854-d108-1031-95b6-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.222029Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z contextCSN: 20121204035116.890381Z#000000#000#000000 dn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: eac2e160-d108-1031-95b7-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.240572Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z dn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: people description: user account objects structuralObjectClass: organizationalUnit entryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.299880Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: groups description: group objects structuralObjectClass: organizationalUnit entryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.394485Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: hosts description: host/computer objects structuralObjectClass: organizationalUnit entryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.400935Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: kerberos description: kerberos realm container structuralObjectClass: organizationalUnit entryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.409140Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: replica objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica structuralObjectClass: organizationalRole entryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/replica.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRU= RAxZ oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6= Mn3k f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu= 6lb/ QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065600Z krbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D userPassword:: <secret> entryCSN: 20121203233422.105322Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203233422Z dn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: master objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/master.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW= +aWr 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5= 522A i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH1= 5xNZ VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060855Z krbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203060855.932134Z#000000#000#000000 modifiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203060855Z dn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: posixGroup cn: administrator gidNumber: 50000 structuralObjectClass: posixGroup entryUUID: 1d079216-d12b-1031-978d-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.465616Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: groupOfNames cn: replicators member: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet member: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet structuralObjectClass: groupOfNames entryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.477792Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: administrator sn: administrator uidNumber: 50000 gidNumber: 50000 userPassword:: <secret> homeDirectory: /home/administrator structuralObjectClass: inetOrgPerson uid: administrator entryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: administrator(a)EXAMPLE.NET krbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ecqcdxa= iluD o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/= Ot7l cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADm= Ozq8 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8o= AcwB aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6= yoME 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo= 8yyO mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgED= oSgE JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLR= VhBT VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXG= a5U+ g=3D krbLastPwdChange: 20121203054848Z krbLastFailedAuth: 20121204013714Z krbLoginFailedCount: 0 description: Network Administrator krbLastSuccessfulAuth: 20121204035116Z krbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204035116.890381Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204035116Z dn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: kdc-srv description: Kerberos KDC userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.563692Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: adm-srv description: Kerberos Admin Server userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.575773Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet cn: EXAMPLE.NET objectClass: top objectClass: krbRealmContainer objectClass: krbTicketPolicyAux krbSubTrees: dc=3Dexample=2Cdc=3Dnet krbSearchScope: 2 krbMaxRenewableAge: 604800 krbMaxTicketLife: 36000 structuralObjectClass: krbRealmContainer entryUUID: c03d58b8-d134-1031-83e7-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.757228Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3D net krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 192 krbPrincipalName: K/M(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/= c4Ks HI=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAkBAAEArgC8UA=3D=3D krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c04d9282-d134-1031-83e8-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.863568Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos =2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: krbtgt/EXAMPLE.NET(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNn= fmRR GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7= UKy1 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9= KwFT B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8= oR krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0518180-d134-1031-83e9-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.889347Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3D= kerberos=2Cdc=3Dex ample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/admin(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtC= kdsY 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M2= 8Ix6 SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZ= M5wu tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3a= Qz krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c05346be-d134-1031-83ea-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.900950Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc =3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 300 krbMaxRenewableAge: 604800 krbTicketFlags: 8196 krbPrincipalName: kadmin/changepw(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceW= qIB2 ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0w= wSqU ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd= 423Z epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9z= Pl krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c054d88a-d134-1031-83eb-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.911237Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/history(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3D example=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: kadmin/history(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd= /N+Z 2g=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0562d3e-d134-1031-83ec-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.919957Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dk erberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/master.example.net(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABhOeGOuo9UBDjK7hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4= Ta3z Y4ZaEYItXr2awBW6QXSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtG= g1qY oev8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj= 0sgn ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf4UwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qYDwpK0Hycj+cwyCjFsVKTsjzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAxTSMEh/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZA= Bm krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAANAD4gA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0581144-d134-1031-83ed-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.932349Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dker beros=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/master.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203060105Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPU= S2wz qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14TYWZyLZem= 5kvD yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAb= Nr3p vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060153Z krbLastSuccessfulAuth: 20121203061721Z krbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203061721.358939Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203061721Z dn: krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE= .NET=2Cou=3Dke rberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/replica.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203065511Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUX= FMNw 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKb= ipUj AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOv= mT4x MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065628Z krbExtraData:: AAIcTbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D krbLastSuccessfulAuth: 20121204032538Z entryCSN: 20121204032538.048010Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204032538Z > Date: Fri=2C 9 Nov 2012 01:55:32 +0000 > From: openldap-its(a)OpenLDAP.org > To: blance3459(a)hotmail.com > Subject: Re: (ITS#7434) idassert-bind fails after restarting slapd >=20 >=20 > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** >=20 > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7434. >=20 > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. >=20 > If you need to provide additional information in regards to your > issue report=2C you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7434) > in the subject will automatically be attached to the issue report. >=20 > mailto:openldap-its@openldap.org?subject=3D(ITS#7434) >=20 > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=3D7434 >=20 > Please remember to retain your issue tracking number (ITS#7434) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. >=20 > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. >=20 > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ >=20 > -------------- > Copyright 1998-2007 The OpenLDAP Foundation=2C All Rights Reserved. >=20 = --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style></style></head> <body class=3D'hmmessage'><div dir=3D'ltr'>Quanah=2C &nbsp=3B I fina= lly got back around to working on this over the last couple of days.&nbsp= =3B Where I'm at with my project is: &nbsp=3BI have two servers (virtual machines)=2C named master an= d replica=2C&nbsp=3B with slapd configured with my directory information an= d single-master replication between them.&nbsp=3B &nbsp=3BI created a K= erberos realm and various principals in open ldap.&nbsp=3B &nbsp=3BRepl= ication access is authenticated using sasl/gssapi with the slapd principal= =2C ldap/replica.example.net.&nbsp=3B &nbsp=3Bk5start has been added to= system startup to buid the credential cache for slapd. &nbsp=3B &nb= sp=3BThat brings me to configuring referrals and proxyAuth on replica.&nbsp= =3B What appears to be happening is that at the initial configuration (= before restarting the daemon) is the client binds to the replica and authen= ticates with its kerberos ticket.&nbsp=3B The "magic" is performed on the s= asl user and the ldap directory entry is returned.&nbsp=3B It then proce= eds into the modification and notices the update referral.&nbsp=3B It then = checks to determine if the binddn used in&nbsp=3B in the olcDbIDAssertBind<= br>statems can authzTo the bound user.&nbsp=3B It can and the proxy of the = modification proceeds.&nbsp=3B On the master=2C the proxy request is receiv= ed=2C more "magic" is done on the user id to make sure it is in the cor= rect form=2C the authzTo attribute is again checked and allowed.&nbsp=3B Th= e update is performed as the user=2C and success is returned back through t= he chain to the user.&nbsp=3B This is how I would expect the process to= proceed.&nbsp=3B However=2C if I restart the server (or slapd daemon)=2C t= his behavior changes.&nbsp=3B After restarting=2C the bind occurs at th= e replica=2C does "magic"=2C and then sees the referral and attempts the pr= oxy.&nbsp=3B What's notable here is that the check of authzTo is NOT perfor= med. The refereal is then chased=2C but the authzTo check was never made= .&nbsp=3B Since there is no user to "authzTo"=2C does the referral get chas= ed with perhaps a "null" or anonymous user? Whatever the case=2C it appe= ars the the original binding user is never sent over the proxy.&nbsp=3B Ove= r at the master=2C I see the bind request come on from the replica which is= treated as an anonymous bind request. No magic=2C no authzTo check=2C n= o nothing.&nbsp=3B It then goes straight into the modification and tries to= perform=2C but is blocked due to the bound user being anonymous and the st= ronger authentication error (8) is returned.&nbsp=3B Given that the bin= d occured anonymously=2C I feel that error is expected and wanted. &nbsp= =3B I had been trying to use sasl binding here=2C but was not having the= same sucess that I had with syncrepl.&nbsp=3B In order to only fight one b= attle at a time=2C I changed by proxy config to use a simple bind instead o= f sasl/gssapi.&nbsp=3B &nbsp=3B Referrals and proxy authentication a= re configured on replica with the following ldif.&nbsp=3B I tried setting t= he override flag because the man page makes it sound like it forces the aut= hzTo check at bind time. By doing that I was hoping I could force the ch= eck and see the authzTo process in my logs.&nbsp=3B Is this what the ITS yo= u mentions is referring to? &nbsp=3B dn: olcDatabase=3D{1}hdb=2Ccn=3D= config &nbsp=3Bchangetype: modify &nbsp=3Badd: olcUpdateref &nbsp= =3BolcUpdateref: "<a href=3D"ldap://master.example.net:389/">ldap://master.= example.net:389/</a>" &nbsp=3B &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dcon= fig &nbsp=3Bchangetype: modify &nbsp=3Badd: olcModuleLoad &nbsp=3B= olcModuleLoad: {1}back_ldap &nbsp=3B &nbsp=3Bdn: olcOverlay=3Dchain= =2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bchangetype: add &= nbsp=3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcChainConfig= &nbsp=3BolcOverlay: {0}chain &nbsp=3BolcChainReturnError: TRUE &n= bsp=3B &nbsp=3Bdn: olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcData= base=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bchangetype: add &nbsp=3Bobj= ectClass: olcLDAPConfig &nbsp=3BobjectClass: olcChainDatabase &nbsp= =3BolcDatabase: {0}ldap &nbsp=3BolcDbURI: "<a href=3D"ldap://master.exam= ple.net:389/">ldap://master.example.net:389/</a>" &nbsp=3BolcDbRebindAsU= ser: TRUE &nbsp=3BolcDbIDAssertBind: bindmethod=3Dsimple &nbsp=3B&nbs= p=3B binddn=3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" &nbs= p=3B&nbsp=3B credentials=3Dshhh-secret &nbsp=3B&nbsp=3B mode=3Dself &= nbsp=3B&nbsp=3B flags=3Doverride &nbsp=3B&nbsp=3B starttls=3Dcritical<br= >&nbsp=3B&nbsp=3B tls_reqcert=3Ddemand &nbsp=3B&nbsp=3B tls_cacert=3D/et= c/ssl/certs/cacert.pem &nbsp=3B &nbsp=3B After adding that infor= mation via ldapmodify=2C I attempt to perform an update on the replica.&nbs= p=3B For testing=2C i simply change the description attribute for uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet.&nbsp=3B I'm using this = simple ldif to test with: &nbsp=3B dn: uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bchangetype: modify &nbsp=3Brep= lace: description &nbsp=3Bdescription: Network Administrator Init= ially after configuring the proxy and obtainng a kerberos ticket for the ac= count (administrator=2C self write)=2C this update succeeds.&nbsp=3B Lookin= g at syslog on replica=2C I see happiness.&nbsp=3B The ldap modify binds us= ing gssapi=2C I see SASL name being correctly converted to uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. &nbsp=3B Dec&nbsp=3B 3 = 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: authcid=3D"ad= ministrator" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: slap_sas= l_getdn: conn 1005 id=3Dadministrator [len=3D13] &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 replica slapd[994]: slap_sasl_getdn: u:id converted to uid=3Dadmini= strator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth &nbsp=3BDec&nbsp=3B= 3 22:17:01 replica slapd[994]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid= =3Dadministrator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth&gt=3B &nbs= p=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &lt=3B&lt=3B&lt=3B dnNormali= ze: &lt=3Buid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth&= gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D=3D&gt=3Bsla= p_sasl2dn: converting SASL name uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn= =3Dgssapi=2Ccn=3Dauth to a DN &nbsp=3BDec&nbsp=3B 3 22:17:01 replica sla= pd[994]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] string=3D'uid=3Dadm= inistrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' &nbsp=3BDec&nbs= p=3B 3 22:17:01 replica slapd[994]: =3D=3D&gt=3B rewrite_rule_apply rule=3D= 'uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Da= uth' string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3D= auth' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = =3D=3D&gt=3B rewrite_rule_apply rule=3D'uid=3D([^=2C]+)=2Ccn=3Dexample.net= =2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3Dadministrator=2Ccn=3Dexample.ne= t=2Ccn=3Dgssapi=2Ccn=3Dauth' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] res=3D{= 0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'} &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: [rw] authid: "uid=3Dadministr= ator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -&gt=3B "uid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 replica slapd[994]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 replica = slapd[994]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 = 22:17:01 replica slapd[994]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL name = to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BD= ec&nbsp=3B 3 22:17:01 replica slapd[994]: slap_sasl_getdn: dn:id converted = to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BD= ec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: = slapAuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL proxy authorize= [conn=3D1005]: authcid=3D"<a href=3D"mailto:administrator@EXAMPLE.NET">adm= inistrator(a)EXAMPLE.NET</a>" authzid=3D"<a href=3D"mailto:administrator@EXAM= PLE.NET">administrator(a)EXAMPLE.NET</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 r= eplica slapd[994]: conn=3D1005 op=3D2 BIND authcid=3D"<a href=3D"mailto:adm= inistrator(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"<a href= =3D"mailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" &nb= sp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL Authorize [conn=3D1005= ]:&nbsp=3B proxy authorization allowed authzDN=3D"" &nbsp=3BDec&nbsp=3B = 3 22:17:01 replica slapd[994]: send_ldap_sasl: err=3D0 len=3D-1 &nbsp=3B= Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: activity on:= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: Dec&nbsp=3B 3 22= :17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND dn=3D"uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ssf=3D56 ssf= =3D56 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: do_bind: SASL/G= SSAPI bind: dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dn= et" sasl_ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: sen= d_ldap_response: msgid=3D3 tag=3D97 err=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:= 01 replica slapd[994]: conn=3D1005 op=3D2 RESULT tag=3D97 err=3D0 text=3D<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &lt=3B=3D=3D slap_sasl= _bind: rc=3D0 &nbsp=3BAll good=2C so far on replica.&nbsp=3B I belie= ve the sasl/gssapi authntication process is completed.&nbsp=3B Now to perfo= rm the modify. Dec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D100= 5 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: co= nn=3D1005 op=3D3 do_modify: dn (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dex= ample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &gt= =3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slap= d[994]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: conn=3D1005 op=3D3 modifications: &nbsp=3BDec&nbsp= =3B 3 22:17:01 replica slapd[994]: #011replace: description &nbsp=3BDec&= nbsp=3B 3 22:17:01 replica slapd[994]: #011#011one value=2C length 21 &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD dn= =3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD attr= =3Ddescription &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: bdb_dn= 2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1= 005 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send= _ldap_result: err=3D10 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 replica slapd[994]: send_ldap_result: referral=3D"<a href=3D"ldap://ma= ster.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd= [994]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 re= plica slapd[994]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3= 22:17:01 replica slapd[994]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3= 22:17:01 replica slapd[994]: Dec&nbsp=3B 3 22:17:01 replica slapd[994]= : &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica= slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap://mas= ter.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet</a>" -&gt=3B "<a href=3D"ldap://master.example.net:3= 89">ldap://master.example.net:389</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 re= plica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap:= //master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet</a>": URI=3D"<a href=3D"ldap://master.example.n= et:389">ldap://master.example.net:389</a>" found in cache &nbsp=3B <= br>&nbsp=3BOkay=2C now it seems that the referral is returned and chased on= behalf of the client.&nbsp=3B Finally=2C from the perspective of replica= =2C success!&nbsp=3B Modified data comes back to replica via syncrepl. &= nbsp=3B Dec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&gt=3Bldap_back_g= etconn: conn 0x7fe0b0147c30 fetched refcnt=3D1. &nbsp=3BDec&nbsp=3B 3 22= :17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p=3D3 &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D0 = matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]= : send_ldap_response: msgid=3D4 tag=3D103 err=3D0 &nbsp=3BDec&nbsp=3B 3 = 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 RESULT tag=3D103 err=3D0 te= xt=3D &nbsp=3B Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon:= activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]:&nbsp=3B 15r &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: read active on 15 &nb= sp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: connection_get(15) &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: connection_get(15): got conni= d=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&gt=3Bdo_syn= crepl rid=3D123 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&g= t=3Bdo_syncrep2 rid=3D123 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]: do_syncrep2: rid=3D123 cookie=3Drid=3D123=2Ccsn=3D20121204031701.56069= 7Z#000000#000#000000 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica = slapd[994]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:= 01 replica slapd[994]: &gt=3B&gt=3B&gt=3B dnPretty: &lt=3Bcn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd= [994]: &lt=3B&lt=3B&lt=3B dnPretty: &lt=3Bcn=3Dadmin=2Cdc=3Dexample=2Cdc=3D= net&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &gt=3B&gt= =3B&gt=3B dnNormalize: &lt=3Bcn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B = &nbsp=3BDec&nbsp=3B 3 22:17:01 replica rsyslogd-2177: imuxsock begins to dr= op messages from pid 994 due to rate-limiting &nbsp=3BSo everything = looks good (correct?) on replica.&nbsp=3B Meanwhile=2C back at the master..= .. &nbsp=3B Dec&nbsp=3B 3 22:17:01 master slapd[947]: daemon: activi= ty on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: dae= mon: activity on: &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:&nbsp= =3B 51r &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: Dec&nbsp= =3B 3 22:17:01 master slapd[947]: daemon: read active on 51 &nbsp=3BDec&= nbsp=3B 3 22:17:01 master slapd[947]: connection_get(51) &nbsp=3BDec&nbs= p=3B 3 22:17:01 master slapd[947]: connection_get(51): got connid=3D1054<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: connection_read(51): che= cking for input on id=3D1054 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: op tag 0x66=2C time 1354591021 &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: Dec&nbsp=3B 3 22:17:01 master slapd[947]: con= n=3D1054 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[94= 7]: conn=3D1054 op=3D3 do_modify: dn (uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B get_ctrls &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D&gt=3B get_ctrls: oid=3D"2.16.840.1.113730.3.4.18" (noncritical) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: parseProxyAuthz: conn 1054 au= thzid=3D"dn:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_sasl_getdn: conn 10= 54 id=3Ddn:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet [len= =3D48] &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &gt=3B&gt=3B&gt= =3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B&l= t=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexam= ple=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D=3D&gt=3Bslap_sasl2dn: converting SASL name uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet to a DN &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] string=3D'= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: =3D=3D&gt=3B rewrite_rule_apply rule= =3D'uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth' string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3D= net' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= =3D&gt=3B rewrite_rule_apply rule=3D'uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] res=3D{0=2C'uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'} &nbsp=3BDec&n= bsp=3B 3 22:17:01 master slapd[947]: [rw] authid: "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" -&gt=3B "uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master sl= apd[947]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3De= xample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &gt= =3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master= slapd[947]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL name to uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:= 17:01 master slapd[947]: slap_sasl_getdn: dn:id converted to uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 master slapd[947]: parseProxyAuthz: conn=3D1054 "uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01= master slapd[947]: =3D=3D&gt=3Bslap_sasl_authorized: can cn=3Dreplica=2Cou= =3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet become uid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet? &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: =3D=3D&gt=3Bslap_sasl_check_authz: does uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet match authzTo rule in cn=3Dreplica=2Cou=3Dho= sts=2Cdc=3Dexample=2Cdc=3Dnet? &nbsp=3BDec&nbsp=3B 3 22:17:01 master sla= pd[947]: =3D&gt=3B bdb_entry_get: ndn: "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dex= ample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&= gt=3B bdb_entry_get: oc: "(null)"=2C at: "authzTo" &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: bdb_dn2entry("cn=3Dreplica=2Cou=3Dhosts=2Cdc= =3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B bdb_entry_get: found entry: "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3De= xample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb= _entry_get: rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B access_allowed: result not in cache (authzTo) &nbsp=3BDec&nbsp=3B= 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: auth access to "cn= =3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" "authzTo" requested &= nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [2] att= r authzTo &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B ac= l_mask: access to entry "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dne= t"=2C attr "authzTo" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 master sla= pd[947]: =3D&gt=3B acl_mask: to all values by "cn=3Dreplica=2Cou=3Dhosts=2C= dc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 master slapd[= 947]: &lt=3B=3D check a_dn_pat: users &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D acl_mask: [1] applying read(=3Drscxd) (stop) &= nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [1] ma= sk: read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B slap_access_allowed: auth access granted by read(=3Drscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: auth= access granted by read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master = slapd[947]: =3D&gt=3B access_allowed: result was in cache (authzTo) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D=3D=3D&gt=3Bslap_sasl_matc= h: comparing DN uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet= to rule dn:* &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_par= seURI: parsing dn:* &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &l= t=3B=3D=3D=3Dslap_sasl_match: comparison returned 0 &nbsp=3BDec&nbsp=3B = 3 22:17:01 master slapd[947]: &lt=3B=3D=3Dslap_sasl_check_authz: authzTo ch= eck returning 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B= =3D=3D slap_sasl_authorized: return 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: conn=3D1054 op=3D3 PROXYAUTHZ dn=3D"uid=3Dadministrator=2Co= u=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D get_ctrls: n=3D1 rc=3D0 err=3D"" &nbsp=3BDec&n= bsp=3B 3 22:17:01 master slapd[947]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt= =3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nb= sp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B&lt=3B&lt=3B dnPrettyN= ormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt= =3B=2C &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt= =3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3= modifications: &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: #011re= place: description &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: #01= 1#011one value=2C length 21 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: conn=3D1054 op=3D3 MOD dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:= conn=3D1054 op=3D3 MOD attr=3Ddescription &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B bdb_entry_get: ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3De= xample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B bdb_entry_get: oc: "(null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slap= d[947]: =3D&gt=3B bdb_entry_get: found entry: "uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: bdb_entry_get: rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D&gt=3B test_filter &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]:&nbsp=3B&nbsp=3B&nbsp=3B&nbsp=3B PRESENT &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: search access to "ui= d=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" re= quested &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: = [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: =3D&gt=3B dn: [5] Dec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D&gt=3B acl_get: [6] attr objectClass &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: =3D&gt=3B acl_mask: access to entry "uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass" r= equested &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl= _mask: to all values by "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dne= t"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check = a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: self= &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_= pat: users &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D a= cl_mask: [3] applying read(=3Drscxd) (stop) &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: &lt=3B=3D acl_mask: [3] mask: read(=3Drscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B slap_access_allowed:= search access granted by read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 = master slapd[947]: =3D&gt=3B access_allowed: search access granted by read(= =3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D te= st_filter 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_m= atchops: sid ffffffff fscope 1 rc 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 maste= r slapd[947]: hdb_modify: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_queue= _csn: queing 0x7fa90f0fe110 20121204031701.560697Z#000000#000#000000 &nb= sp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: bdb_modify_internal: 0x0000000b: uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: =3D&gt=3B access_allowed: result not in cache (descri= ption) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acces= s_allowed: delete access to "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexamp= le=2Cdc=3Dnet" "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 ma= ster slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [5] = Dec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [6] attr descr= iption &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_m= ask: access to entry "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet"=2C attr "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D&gt=3B acl_mask: to all values by "uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17= :01 master slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerber= os=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D acl_mask: [2] applying write(=3Dwrscxd) (stop)<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [2] = mask: write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:= =3D&gt=3B slap_access_allowed: delete access granted by write(=3Dwrscxd)<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowe= d: delete access granted by write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: =3D&gt=3B access_allowed: result not in cache (descr= iption) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acce= ss_allowed: add access to "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 mast= er slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [5] De= c&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [6] attr descrip= tion &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_mas= k: access to entry "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet"=2C attr "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D&gt=3B acl_mask: to value by "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 m= aster slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: &lt=3B=3D acl_mask: [2] applying write(=3Dwrscxd) (stop) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [2] mask:= write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&= gt=3B slap_access_allowed: add access granted by write(=3Dwrscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: add = access granted by write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master= slapd[947]: acl: internal mod entryCSN: modify access granted &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: acl: internal mod modifiersName: m= odify access granted &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: a= cl: internal mod modifyTimestamp: modify access granted &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: bdb_modify_internal: replace description<= br>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_modify_internal: r= eplace entryCSN &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_mo= dify_internal: replace modifiersName &nbsp=3BDec&nbsp=3B 3 22:17:01 mast= er slapd[947]: bdb_modify_internal: replace modifyTimestamp &nbsp=3BDec&= nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "inetOrgPer= son" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required= entry (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C obj= ectClass "posixAccount" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : oc_check_required entry (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet)=2C objectClass "shadowAccount" &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: oc_check_required entry (uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbPrincipalAux" &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required entry (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "k= rbTicketPolicyAux" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_= check_allowed type "objectClass" &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: oc_check_allowed type "cn" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: oc_check_allowed type "sn" &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: oc_check_allowed type "uidNumber" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "gidNumber" &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "userPa= ssword" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allow= ed type "homeDirectory" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : oc_check_allowed type "structuralObjectClass" &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: oc_check_allowed type "uid" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "entryUUID" &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "creato= rsName" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allow= ed type "createTimestamp" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[94= 7]: oc_check_allowed type "krbPrincipalName" &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: oc_check_allowed type "krbPrincipalKey" &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastPwdC= hange" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowe= d type "krbLastFailedAuth" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[9= 47]: oc_check_allowed type "krbLoginFailedCount" &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 master slapd[947]: oc_check_allowed type "krbLastSuccessfulAuth"<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "k= rbExtraData" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_= allowed type "description" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[9= 47]: oc_check_allowed type "entryCSN" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: oc_check_allowed type "modifiersName" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "modifyTimestamp"<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B key_change(DE= LETE=2Cb) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_idl_dele= te_key: b Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D key_chang= e 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B key_chan= ge(ADD=2Cb) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_idl_in= sert_key: b Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D key_cha= nge 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B entry_= encode(0x0000000b): Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D= entry_encode(0x0000000b): Dec&nbsp=3B 3 22:17:01 master slapd[947]: hd= b_modify: updated id=3D0000000b dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : send_ldap_result: conn=3D1054 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" text=3D"" = &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: = ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: oc: "= (null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet= ") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry= _get: found entry: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_entry_get:= rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B test= _filter &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:&nbsp=3B&nbsp= =3B&nbsp=3B&nbsp=3B PRESENT &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: =3D&gt=3B access_allowed: search access to "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" requested &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D&gt=3B dn: [5] Dec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B a= cl_get: [6] attr objectClass &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: =3D&gt=3B acl_mask: access to entry "uid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass" requested &nbsp=3BDe= c&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_mask: to all values b= y "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&n= bsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B = 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: users &nbsp=3BDe= c&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [3] applying re= ad(=3Drscxd) (stop) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &l= t=3B=3D acl_mask: [3] mask: read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: =3D&gt=3B slap_access_allowed: search access granted b= y read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&g= t=3B access_allowed: search access granted by read(=3Drscxd) &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D test_filter 6 &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fs= cope 1 rc 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_s= endresp: cookie=3Drid=3D123=2Ccsn=3D20121204031701.560697Z#000000#000#00000= 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_= get: ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" = &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: = oc: "(null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb= _entry_get: found entry: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" &nbsp=3BEverything looks good on the master.&nbsp=3B I = see uid=3Dadministrator gets sent over from the the proxy on replica and th= e update proceeds as expected.&nbsp=3B Now if I restart slapd on replica=2C= things change.&nbsp=3B performing the same modifucation=2C we again see sa= sl/gssapi authentication occuring on replica just as before &nbsp=3B <BR= >Dec&nbsp=3B 3 22:20:38 replica slapd[1412]: [rw] authid: "uid=3Dadministra= tor=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -&gt=3B "uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20= :38 replica slapd[1412]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:20:38 replica = slapd[1412]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:38= replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL nam= e to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: slap_sasl_getdn: dn:id conve= rted to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL Canonicalize [conn=3D1= 000]: slapAuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL proxy a= uthorize [conn=3D1000]: authcid=3D"<a href=3D"mailto:administrator@EXAMPLE.= NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"<a href=3D"mailto:administra= tor(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" &nbsp=3BDec&nbsp=3B 3 22= :20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND authcid=3D"<a href=3D"m= ailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"= <a href=3D"mailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>"= &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL Authorize [con= n=3D1000]:&nbsp=3B proxy authorization allowed authzDN=3D"" &nbsp=3BDec&= nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_sasl: err=3D0 len=3D-1<br= >&nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIN= D dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech= =3DGSSAPI sasl_ssf=3D56 ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica = slapd[1412]: do_bind: SASL/GSSAPI bind: dn=3D"uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:2= 0:38 replica slapd[1412]: send_ldap_response: msgid=3D3 tag=3D97 err=3D0<br= >&nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 RES= ULT tag=3D97 err=3D0 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]: &lt=3B=3D=3D slap_sasl_bind: rc=3D0 &nbsp=3BAgain=2C we hea= d into the modification: &nbsp=3B Dec&nbsp=3B 3 22:20:38 replica sla= pd[1412]: conn=3D1000 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:20:38 re= plica slapd[1412]: conn=3D1000 op=3D3 do_modify: dn (uid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:20:38 re= plica slapd[1412]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BD= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 modifications= : &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: #011replace: descr= iption &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: #011#011one v= alue=2C length 21 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: co= nn=3D1000 op=3D3 MOD dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D= 1000 op=3D3 MOD attr=3Ddescription &nbsp=3BDec&nbsp=3B 3 22:20:38 replic= a slapd[1412]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexamp= le=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: =3D&= gt=3B hdb_dn2id("ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbs= p=3B 3 22:20:38 replica slapd[1412]: &lt=3B=3D hdb_dn2id: got id=3D0x3 &= nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemon: activity on 1 de= scriptor &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemon: act= ivity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: &nbsp= =3B &nbsp=3BSo far=2C so good (I think)=2C replica sees the need to refe= r the action and tries to chase it on behalf of the clent: &nbsp=3BD= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: =3D&gt=3B hdb_dn2id("uid=3Dadmin= istrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B=3D hdb_dn2id: got id=3D0xb &nbsp= =3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: entry_decode: "" &nbsp=3B= Dec&nbsp=3B 3 22:20:38 replica slapd[1412]: &lt=3B=3D entry_decode() &nb= sp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1= 000 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: sen= d_ldap_result: err=3D10 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:= 20:38 replica slapd[1412]: send_ldap_result: referral=3D"<a href=3D"ldap://= master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2C= dc=3Dexample=2Cdc=3Dnet</a>" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:38= replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp= =3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"<a href=3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeo= ple=2Cdc=3Dexample=2Cdc=3Dnet">ldap://master.example.net:389/uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet</a>" -&gt=3B "<a href=3D"ldap= ://master.example.net:389">ldap://master.example.net:389</a>" &nbsp=3BDe= c&nbsp=3B 3 22:20:38 replica slapd[1412]: ldap_back_db_open: URI=3Dldap://m= aster.example.net:389 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]= : conn=3D1000 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap://master.example= .net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet">ldap:= //master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet</a>" temporary &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[= 1412]: =3D&gt=3Bldap_back_getconn: conn=3D1000 op=3D3: lc=3D0x7f213015a7d0 = inserted refcnt=3D1 rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[= 1412]: send_ldap_result: conn=3D1000 op=3D3 p=3D3 &nbsp=3B &nbsp=3B<= br>At this point=2C I "assume" the modification has been passed off to mast= er.&nbsp=3B However=2C I notice that I never see the replica checking authz= To like before the restart. I think this is where it's falling apart for me= and the err=3D8 back is returned from master. &nbsp=3B &nbsp=3B D= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matche= d=3D"" text=3D"modifications require authentication" &nbsp=3BDec&nbsp=3B= 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 p=3D3= &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: e= rr=3D8 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica sla= pd[1412]: send_ldap_response: msgid=3D4 tag=3D103 err=3D8 &nbsp=3BDec&nb= sp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 RESULT tag=3D103 e= rr=3D8 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemo= n: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd= [1412]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]:&nbsp=3B 18r &nbsp=3B &nbsp=3BOver on the master we see the = proxy connection occurs=2C but the client credentials never apper to arrive= .&nbsp=3B I say that because=2C it looks to me like the proxy connection fr= om replica appears to bind anonymously. &nbsp=3B Dec&nbsp=3B 3 22:20= :38 master slapd[947]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: Dec&nbsp=3B 3 22:20:38 master slapd[9= 47]: slap_listener_activate(8): Dec&nbsp=3B 3 22:20:38 master slapd[947= ]: &gt=3B&gt=3B&gt=3B slap_listener(<a href=3D"ldap:///">ldap:///</a>) &= nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemon: listen=3D8=2C new = connection on 51 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemo= n: added 51r (active) listener=3D(nil) &nbsp=3BDec&nbsp=3B 3 22:20:38 ma= ster slapd[947]: conn=3D1056 fd=3D51 ACCEPT from IP=3D192.168.1.2:34759 (IP= =3D0.0.0.0:389) &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemon= : activity on 2 descriptors &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[= 947]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[9= 47]:&nbsp=3B 51r &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: D= ec&nbsp=3B 3 22:20:38 master slapd[947]: daemon: read active on 51 &nbsp= =3BDec&nbsp=3B 3 22:20:38 master slapd[947]: connection_get(51) &nbsp=3B= Dec&nbsp=3B 3 22:20:38 master slapd[947]: connection_get(51): got connid=3D= 1056 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: connection_read(5= 1): checking for input on id=3D1056 &nbsp=3BDec&nbsp=3B 3 22:20:38 maste= r slapd[947]: op tag 0x60=2C time 1354591238 &nbsp=3BDec&nbsp=3B 3 22:20= :38 master slapd[947]: conn=3D1056 op=3D0 do_bind &nbsp=3BDec&nbsp=3B 3 = 22:20:38 master slapd[947]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3B&gt=3B= &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: &lt=3B&lt=3B&lt=3B dn= PrettyNormal: &lt=3B&gt=3B=2C &lt=3B&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:3= 8 master slapd[947]: conn=3D1056 op=3D0 BIND dn=3D"" method=3D128 &nbsp= =3BDec&nbsp=3B 3 22:20:38 master slapd[947]: do_bind: version=3D3 dn=3D"" m= ethod=3D128 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: send_ldap_= result: conn=3D1056 op=3D0 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:20:38 master s= lapd[947]: send_ldap_result: err=3D0 matched=3D"" text=3D"" &nbsp=3BDec&= nbsp=3B 3 22:20:38 master slapd[947]: send_ldap_response: msgid=3D1 tag=3D9= 7 err=3D0 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: conn=3D1056 = op=3D0 RESULT tag=3D97 err=3D0 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 ma= ster slapd[947]: do_bind: v3 anonymous bind &nbsp=3BDec&nbsp=3B 3 22:20:= 38 master slapd[947]: daemon: activity on 2 descriptors &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]:&nbsp=3B 51r &nbsp=3BDec&nbsp=3B 3 22:2= 0:38 master slapd[947]: After=2C the (anonymous) bind=2C the master= never attempts to if the proxyauth request is allowed via authzTo or anyth= ing else (perhaps obviously).&nbsp=3B The modification just proceeds anonym= ously and eventually fails. &nbsp=3B &nbsp=3BNot sure if I'm saying = this in a way that makes any sense to you.&nbsp=3B Hopefully=2C it does.&nb= sp=3B It appears=2C that the proxy on replica after restarting=2C never tri= es to determine if the olcDbIDAssertBind binddn is permitted to impersonate= the client via the authzTo attribute and proceeds with the referal chase a= nonymously. &nbsp=3B &nbsp=3BI'll copy paste configs below.&nbsp=3B&= nbsp=3B Sorry this is so long=2C but I figure the more information=2C the b= etter when trying to solve any problem. &nbsp=3B &nbsp=3BThanks &= nbsp=3B &nbsp=3BBarry &nbsp=3B &nbsp=3Bvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvvvv master configuration vvvvvvvvvvvvvvvvvvvvvvvvvvvv &nbsp=3Bdn:= cn=3Dconfig &nbsp=3BobjectClass: olcGlobal &nbsp=3Bcn: config &nb= sp=3BolcArgsFile: /var/run/slapd/slapd.args &nbsp=3BolcPidFile: /var/run= /slapd/slapd.pid &nbsp=3BolcToolThreads: 1 &nbsp=3BstructuralObjectCl= ass: olcGlobal &nbsp=3BentryUUID: ea6bf008-d108-1031-912d-8fbb37ee6dd9<b= r>&nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201= 635Z &nbsp=3BolcTLSCACertificateFile: /etc/ssl/certs/cacert.pem &nbsp= =3BolcTLSCertificateFile: /etc/ssl/certs/master_slapd_cert.pem &nbsp=3Bo= lcTLSCertificateKeyFile: /etc/ldap/master_slapd_key.pem &nbsp=3BolcAuthz= Policy: to &nbsp=3BolcSaslHost: master.example.net &nbsp=3BolcSaslRea= lm: EXAMPLE.NET &nbsp=3BolcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.= net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BolcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3D= example.net=2Ccn=3Dgssapi=2Ccn=3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BolcLogLevel: -1 &nbsp=3BentryCSN: 20121204013949.= 466434Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber= =3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp= : 20121204013949Z &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dconfig &nbsp=3Bob= jectClass: olcModuleList &nbsp=3Bcn: module{0} &nbsp=3BolcModulePath:= /usr/lib/ldap &nbsp=3BolcModuleLoad: {0}back_hdb &nbsp=3BolcModuleLo= ad: {1}syncprov &nbsp=3BstructuralObjectClass: olcModuleList &nbsp=3B= entryUUID: ea6dda08-d108-1031-9135-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn= =3Dconfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: = 20121203054749.860918Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumbe= r=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3B= modifyTimestamp: 20121203054749Z &nbsp=3Bdn: cn=3Dschema=2Ccn=3Dconfig<b= r>&nbsp=3BobjectClass: olcSchemaConfig &nbsp=3Bcn: schema &nbsp=3Bstr= ucturalObjectClass: olcSchemaConfig &nbsp=3BentryUUID: ea6c3a0e-d108-103= 1-9130-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateT= imestamp: 20121202201635Z &nbsp=3BentryCSN: 20121202201635.672699Z#00000= 0#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig &nbsp=3BmodifyTimesta= mp: 20121202201635Z &nbsp=3B&lt=3Bsnip schemas &gt=3B &nbsp=3Bdn: olc= Backend=3D{0}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olcBackendConfig = &nbsp=3BolcBackend: {0}hdb &nbsp=3BstructuralObjectClass: olcBackendConf= ig &nbsp=3BentryUUID: ea6f949c-d108-1031-9136-8fbb37ee6dd9 &nbsp=3Bcr= eatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbs= p=3BentryCSN: 20121202201635.694663Z#000000#000#000000 &nbsp=3Bmodifiers= Name: cn=3Dconfig &nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn= : olcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatab= aseConfig &nbsp=3BobjectClass: olcFrontendConfig &nbsp=3BolcDatabase:= {-1}frontend &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uid= Number=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2Ccn=3Dauth manage = by * break &nbsp=3BolcAccess: {1}to dn.exact=3D"" by * read &nbsp=3Bo= lcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read &nbsp=3BolcSizeLimi= t: 500 &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp=3Bentry= UUID: ea6c0bf6-d108-1031-912e-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dco= nfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: 20121= 202201635.671512Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig<b= r>&nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn: olcDatabase=3D{0}= config=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3Bo= lcDatabase: {0}config &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber= =3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth manage by * = break &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp=3BentryU= UID: ea6c325c-d108-1031-912f-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dcon= fig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: 201212= 02201635.672495Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig<br= >&nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn: olcDatabase=3D{1}h= db=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3Bobjec= tClass: olcHdbConfig &nbsp=3BolcDatabase: {1}hdb &nbsp=3BolcDbDirecto= ry: /var/lib/ldap &nbsp=3BolcSuffix: dc=3Dexample=2Cdc=3Dnet &nbsp=3B= olcLastMod: TRUE &nbsp=3BolcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BolcRootPW:: e1NTSEF9cGhKNWtqME9rOGJnVXp0dy9hYzZEaWFmU1U1Z0FTZk0= =3D &nbsp=3BolcDbCheckpoint: 512 30 &nbsp=3BolcDbConfig: {0}set_cache= size 0 2097152 0 &nbsp=3BolcDbConfig: {1}set_lk_max_objects 1500 &nbs= p=3BolcDbConfig: {2}set_lk_max_locks 1500 &nbsp=3BolcDbConfig: {3}set_lk= _max_lockers 1500 &nbsp=3BolcDbIndex: objectClass eq &nbsp=3BolcDbInd= ex: uid eq &nbsp=3BolcDbIndex: cn eq &nbsp=3BolcDbIndex: ou eq &nb= sp=3BolcDbIndex: dc eq &nbsp=3BolcDbIndex: uidNumber eq &nbsp=3BolcDb= Index: gidNumber eq &nbsp=3BolcDbIndex: memberUid eq &nbsp=3BolcDbInd= ex: uniqueMember eq &nbsp=3BolcDbIndex: entryUUID eq &nbsp=3BolcDbInd= ex: entryCSN eq &nbsp=3BolcDbIndex: krbPrincipalName eq=2Cpres=2Csub = &nbsp=3BolcDbIndex: krbPwdPolicyReference eq &nbsp=3BstructuralObjectCla= ss: olcHdbConfig &nbsp=3BentryUUID: ea6fa3ce-d108-1031-9137-8fbb37ee6dd9= &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 201212022= 01635Z &nbsp=3BolcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange = by group.exact=3D"cn=3Dreplic &nbsp=3B ators=2Cou=3Dgroups=2Cdc=3Dexampl= e=2Cdc=3Dnet" read by self write by anonymous auth &nbsp=3BolcAccess: {1= }to attrs=3DauthzTo=2CauthzFrom=2Ccn=2CuidNumber=2CgidNumber=2Cuid by users= r &nbsp=3B ead by anonymous none &nbsp=3BolcAccess: {2}to attrs=3Dkr= bLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFailedAuth=2Ckr &nbsp=3B bLo= ginFailedCount by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet" &nbsp=3B&nbsp=3B read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerbe= ros=2Cdc=3Dexample=2Cdc=3Dnet" write by dn=3D"cn=3Dadm-sr &nbsp=3B v=2Co= u=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by self read by * none &nb= sp=3BolcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet= " by group.exact=3D"cn &nbsp=3B =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet" read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2C &nbsp=3B d= c=3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3De= xample=2Cdc=3Dnet" writ &nbsp=3B e by * none &nbsp=3BolcAccess: {4}to= dn.base=3D"" by * read &nbsp=3BolcAccess: {5}to * by dn=3D"cn=3Dadm-srv= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by s &nbsp=3B elf writ= e by users read &nbsp=3BentryCSN: 20121203054749.804561Z#000000#000#0000= 00 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2C= cn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp: 20121203054749Z &n= bsp=3Bdn: olcOverlay=3D{0}syncprov=2ColcDatabase=3D{1}hdb=2Ccn=3Dconfig = &nbsp=3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcSyncProvCo= nfig &nbsp=3BolcOverlay: {0}syncprov &nbsp=3BolcSpCheckpoint: 100 10<= br>&nbsp=3BolcSpSessionlog: 100 &nbsp=3BstructuralObjectClass: olcSyncPr= ovConfig &nbsp=3BentryUUID: b77dc36a-d158-1031-9917-2f12ddec6588 &nbs= p=3BcreatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dextern= al=2Ccn=3Dauth &nbsp=3BcreateTimestamp: 20121203054749Z &nbsp=3Bentry= CSN: 20121203054749.962179Z#000000#000#000000 &nbsp=3BmodifiersName: gid= Number=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nb= sp=3BmodifyTimestamp: 20121203054749Z &nbsp=3Bvvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvv&nbsp=3B dc=3Dexample=2Cdc=3Dnet&nbsp=3B vvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvvvvvvvvvvvvvvv &nbsp=3Bdn: dc=3Dexample=2Cdc=3Dnet &nbsp=3Bobj= ectClass: top &nbsp=3BobjectClass: dcObject &nbsp=3BobjectClass: orga= nization &nbsp=3Bo: example.net &nbsp=3Bdc: example &nbsp=3Bstruct= uralObjectClass: organization &nbsp=3BentryUUID: eac01854-d108-1031-95b6= -31806daa9e45 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BcreateTimestamp: 20121202201636Z &nbsp=3BentryCSN: 201212022= 01636.222029Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121202201636Z &nbsp= =3BcontextCSN: 20121204035116.890381Z#000000#000#000000 &nbsp=3Bdn: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecurityOb= ject &nbsp=3BobjectClass: organizationalRole &nbsp=3Bcn: admin &nb= sp=3Bdescription: LDAP administrator &nbsp=3BuserPassword:: &lt=3Bsecret= &gt=3B &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3Bentr= yUUID: eac2e160-d108-1031-95b7-31806daa9e45 &nbsp=3BcreatorsName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121202201636Z<= br>&nbsp=3BentryCSN: 20121202201636.240572Z#000000#000#000000 &nbsp=3Bmo= difiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestam= p: 20121202201636Z &nbsp=3Bdn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet = &nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: people &nbsp=3Bde= scription: user account objects &nbsp=3BstructuralObjectClass: organizat= ionalUnit &nbsp=3BentryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.299880Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: ou=3Dgroups=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organizationalUnit &nbsp= =3Bou: groups &nbsp=3Bdescription: group objects &nbsp=3BstructuralOb= jectClass: organizationalUnit &nbsp=3BentryUUID: 1cfcb788-d12b-1031-9788= -4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 201212030= 02123.394485Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp= =3Bdn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organiz= ationalUnit &nbsp=3Bou: hosts &nbsp=3Bdescription: host/computer obje= cts &nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUU= ID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmi= n=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z = &nbsp=3BentryCSN: 20121203002123.400935Z#000000#000#000000 &nbsp=3Bmodif= iersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: = 20121203002123Z &nbsp=3Bdn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &= nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: kerberos &nbsp=3Bd= escription: kerberos realm container &nbsp=3BstructuralObjectClass: orga= nizationalUnit &nbsp=3BentryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93<b= r>&nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcre= ateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.409140Z#0= 00000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn=3Drepl= ica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: replica &nbsp= =3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: organizational= Role &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTic= ketPolicyAux &nbsp=3BauthzTo: dn:* &nbsp=3Bdescription: LDAP server= =2C replica &nbsp=3BstructuralObjectClass: organizationalRole &nbsp= =3BentryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 &nbsp=3BcreatorsName:= cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212030= 02123Z &nbsp=3BkrbPrincipalName: <a href=3D"mailto:host/replica.example.= net(a)EXAMPLE.NET">host/replica.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbLog= inFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDA= gEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gADgZgDa20URzdHW= Q1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRURAxZ &nbsp=3B oJVqBI/zPGh/FDf9= m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6Mn3k &nbsp=3B f= 62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu6lb= / &nbsp=3B QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNS= kxswPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB6= 38xMCex7sQ1zfzZkLiViiKpw=3D=3D &nbsp=3BkrbPasswordExpiration: 1970010100= 0000Z &nbsp=3BkrbLastPwdChange: 20121203065600Z &nbsp=3BkrbExtraData:= : AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: = AAgBAA=3D=3D &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BentryC= SN: 20121203233422.105322Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212032334= 22Z &nbsp=3Bdn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &n= bsp=3Bcn: master &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3Bob= jectClass: organizationalRole &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BauthzTo: dn:* &nbsp=3Bd= escription: LDAP server=2C replica &nbsp=3BuserPassword:: e0NSWVBUfSo=3D= &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3BentryUUID:= 1d0514dc-d12b-1031-978c-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin= =2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &= nbsp=3BkrbPrincipalName: <a href=3D"mailto:host/master.example.net@EXAMPLE.= NET">host/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbLoginFailedCount= : 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCAS= gwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMd= eygNYlf/SiWtzll+A7x/QBVoz7zFW+aWr &nbsp=3B 8/FMEBj49p4Bn0Goa371TBEoAcwBa= ADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5522A &nbsp=3B i/CCoCVDIVBZHO= I48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH15xNZ &nbsp=3B= VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWgA= wIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3= DaIILvcKv0w=3D=3D &nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbs= p=3BkrbLastPwdChange: 20121203060855Z &nbsp=3BkrbExtraData:: AAL3QbxQYWR= taW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D<= br>&nbsp=3BentryCSN: 20121203060855.932134Z#000000#000#000000 &nbsp=3Bmo= difiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3BmodifyTimestamp: 20121203060855Z &nbsp=3Bdn: cn=3Dadministrator=2Cou= =3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: posixGroup &= nbsp=3Bcn: administrator &nbsp=3BgidNumber: 50000 &nbsp=3BstructuralO= bjectClass: posixGroup &nbsp=3BentryUUID: 1d079216-d12b-1031-978d-4f8d9a= bcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.4= 65616Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexampl= e=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn= =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectCla= ss: top &nbsp=3BobjectClass: groupOfNames &nbsp=3Bcn: replicators = &nbsp=3Bmember: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3Bmember: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bs= tructuralObjectClass: groupOfNames &nbsp=3BentryUUID: 1d096db6-d12b-1031= -978e-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 201= 21203002123.477792Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin= =2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &= nbsp=3Bdn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &= nbsp=3BobjectClass: top &nbsp=3BobjectClass: inetOrgPerson &nbsp=3Bob= jectClass: posixAccount &nbsp=3BobjectClass: shadowAccount &nbsp=3Bob= jectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &n= bsp=3Bcn: administrator &nbsp=3Bsn: administrator &nbsp=3BuidNumber: = 50000 &nbsp=3BgidNumber: 50000 &nbsp=3BuserPassword:: &lt=3Bsecret&gt= =3B &nbsp=3BhomeDirectory: /home/administrator &nbsp=3BstructuralObje= ctClass: inetOrgPerson &nbsp=3Buid: administrator &nbsp=3BentryUUID: = 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbs= p=3BkrbPrincipalName: <a href=3D"mailto:administrator@EXAMPLE.NET">administ= rator(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIB= AaMDAgEBpIICUzCCAk8wVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gALWKtjcuVI= PL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+EcqcdxailuD &nbsp=3B o3oHvU0K11Y= iAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/Ot7l &nbsp= =3B cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYA= DmOzq8 &nbsp=3B 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/L= Nz2jwAqIwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQI= Cvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8oAcwB &nbsp=3B aADAgEBoTEwL6ADAgEDoSgEJgg= A0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6yoME &nbsp=3B 2gGDAWoAMCA= QKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo8yyO &nbsp= =3B mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAg= EDoSgE &nbsp=3B JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEug= FjAUoAMCAQWhDQQLRVhBT &nbsp=3B VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEE= YGOMA8CDwINmmJXgnKPQr8jRDsxGToXGa5U+ &nbsp=3B g=3D &nbsp=3BkrbLastPwd= Change: 20121203054848Z &nbsp=3BkrbLastFailedAuth: 20121204013714Z &n= bsp=3BkrbLoginFailedCount: 0 &nbsp=3Bdescription: Network Administrator<= br>&nbsp=3BkrbLastSuccessfulAuth: 20121204035116Z &nbsp=3BkrbExtraData::= AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBA= A=3D=3D &nbsp=3BentryCSN: 20121204035116.890381Z#000000#000#000000 &n= bsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BmodifyTimestamp: 20121204035116Z &nbsp=3Bdn: cn=3Dkdc-srv=2C= ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecur= ityObject &nbsp=3BobjectClass: organizationalRole &nbsp=3Bcn: kdc-srv= &nbsp=3Bdescription: Kerberos KDC &nbsp=3BuserPassword:: &lt=3Bsecre= t&gt=3B &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3Bent= ryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3D= admin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z= &nbsp=3BentryCSN: 20121203002123.563692Z#000000#000#000000 &nbsp=3Bm= odifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimesta= mp: 20121203002123Z &nbsp=3Bdn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexam= ple=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3Bobje= ctClass: organizationalRole &nbsp=3Bcn: adm-srv &nbsp=3Bdescription: = Kerberos Admin Server &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp= =3BstructuralObjectClass: organizationalRole &nbsp=3BentryUUID: 1d18610e= -d12b-1031-9791-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexa= mple=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3Bentr= yCSN: 20121203002123.575773Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212030021= 23Z &nbsp=3Bdn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3Bcn: EXAMPLE.NET &nbsp=3BobjectClass: top &nbsp=3Bobject= Class: krbRealmContainer &nbsp=3BobjectClass: krbTicketPolicyAux &nbs= p=3BkrbSubTrees: dc=3Dexample=2Cdc=3Dnet &nbsp=3BkrbSearchScope: 2 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbMaxTicketLife: 36000 &nbs= p=3BstructuralObjectClass: krbRealmContainer &nbsp=3BentryUUID: c03d58b8= -d134-1031-83e7-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexa= mple=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3Bentr= yCSN: 20121203013022.757228Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212030130= 22Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3DK/M@EXAMPLE.NET=2Cc= n=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName= =3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc= =3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 3= 6000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 192<b= r>&nbsp=3BkrbPrincipalName: <a href=3D"mailto:K/M@EXAMPLE.NET">K/M(a)EXAMPLE.= NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPr= incipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+gAwIB<b= r>&nbsp=3B EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxT= uO7OIrbK/c4Ks &nbsp=3B HI=3D &nbsp=3BkrbLastPwdChange: 19700101000000= Z &nbsp=3BkrbExtraData:: AAkBAAEArgC8UA=3D=3D &nbsp=3BkrbExtraData:: = AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIA= AgAAAAAAAAA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectClass:= krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3Bstru= cturalObjectClass: krbPrincipal &nbsp=3BentryUUID: c04d9282-d134-1031-83= e8-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN: 2012120= 3013022.863568Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp= =3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkrbtgt/EXAMPLE.NET@EXAMPLE.NET= =2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipal= Name=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3Bkr= bMaxTicketLife: 36000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbT= icketFlags: 0 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:krbtgt/EXAMPLE= .NET(a)EXAMPLE.NET">krbtgt/EXAMPLE.NET(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipa= lExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCA= QGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAOy= PPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNnfmRR &nbsp=3B GQI5= lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7UKy1<b= r>&nbsp=3B 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEK= E4BDYYAM9KwFT &nbsp=3B B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQV= R0PWLB2OM5q1llQwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NE= ctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgED= oSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8oR &nbsp=3BkrbLast= PwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb2= 5ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAAAAAAA=3D &nbs= p=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krb= Principal &nbsp=3BentryUUID: c0518180-d134-1031-83e9-0707760cf534 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.889347Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailt= o:krbPrincipalName=3Dkadmin/admin@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dker= beros=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NE= T=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp= =3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &nbsp=3Bkrb= MaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3BkrbPrincipa= lName: <a href=3D"mailto:kadmin/admin@EXAMPLE.NET">kadmin/admin(a)EXAMPLE.NET= </a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPrinc= ipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &= nbsp=3B MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7= CF2xtCkdsY &nbsp=3B 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAEL= hAAwMe5Vpq5Hd2Zy1E8M28Ix6 &nbsp=3B SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfA= wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZM5wu &nbsp=3B tIcsdKbsYTDZgUzqIADtNt= 4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWgAwIB &nbsp=3B AKExMC+= gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8oAcwB &= nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM= +9bG3aQz &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtraDa= ta:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAc= BAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectC= lass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp= =3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c05346be-d134-= 1031-83ea-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN= : 20121203013022.900950Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z<= br>&nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/changepw@EXAMPLE= .NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrinc= ipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbMaxTicketLife: 300 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3Bk= rbTicketFlags: 8196 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/c= hangepw(a)EXAMPLE.NET">kadmin/changepw(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipa= lExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCA= QGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAHN= xSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceWqIB2 &nbsp=3B ic80= wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0wwSqU<b= r>&nbsp=3B ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEK= E4BDYYACd423Z &nbsp=3B epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbp= L0kTawz9zdg60IgwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAs= CALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgED= oSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9zPl &nbsp=3BkrbLast= PwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb2= 5ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbs= p=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krb= Principal &nbsp=3BentryUUID: c054d88a-d134-1031-83eb-0707760cf534 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.911237Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailt= o:krbPrincipalName=3Dkadmin/history@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dk= erberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/history@EXAMPL= E.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &= nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp= =3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 0 &nbsp=3BkrbPr= incipalName: <a href=3D"mailto:kadmin/history@EXAMPLE.NET">kadmin/history@E= XAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp= =3BkrbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD= +gAwIB &nbsp=3B EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHp= jECIfASUXjBoB+Pkd/N+Z &nbsp=3B 2g=3D &nbsp=3BkrbLastPwdChange: 197001= 01000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQ= A &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: = krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass= : krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal &nbs= p=3BentryUUID: c0562d3e-d134-1031-83ec-0707760cf534 &nbsp=3BcreatorsName= : cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203= 013022Z &nbsp=3BentryCSN: 20121203013022.919957Z#000000#000#000000 &n= bsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodify= Timestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalNam= e=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerbero= s=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/master.example.net@E= XAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a>= &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3Bkr= bPrincipalName: <a href=3D"mailto:kadmin/master.example.net@EXAMPLE.NET">ka= dmin/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: = 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAg= EApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABhOeGOuo9UBDjK7= hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4Ta3z &nbsp=3B Y4ZaEYItXr2awBW6Q= XSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtGg1qY &nbsp=3B oe= v8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj0sgn= &nbsp=3B ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf= 4UwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qY= DwpK0Hycj+cwyCjFsVKTsjzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAxTSME= h/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZABm &nbsp=3BkrbLastPwdChange: 19= 700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5= ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAANAD4gA=3D &nbsp=3BobjectCla= ss: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectC= lass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal = &nbsp=3BentryUUID: c0581144-d134-1031-83ed-0707760cf534 &nbsp=3Bcreators= Name: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012= 1203013022Z &nbsp=3BentryCSN: 20121203013022.932349Z#000000#000#000000<b= r>&nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmo= difyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipa= lName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerbe= ros=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dldap/master.example.net@E= XAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a>= &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ldap/master.example.net@EXA= MPLE.NET">ldap/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: k= rbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass:= krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp= =3BentryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 &nbsp=3BcreatorsName:= cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203060105Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPr= incipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ<b= r>&nbsp=3B MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pK= gmUyVdsPUS2wz &nbsp=3B qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoT= AELhAAkzwNhAF14TYWZyLZem5kvD &nbsp=3B yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf= 09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAbNr3p &nbsp=3B vkmNXkIZNgUtw2FJ3Vt= GEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWgAwIB &nbsp=3B AKEx= MC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D=3D<br= >&nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange= : 20121203060153Z &nbsp=3BkrbLastSuccessfulAuth: 20121203061721Z &nbs= p=3BkrbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp= =3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203061721.358939Z#= 000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203061721Z &nbs= p=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dldap/replica.example.net@EXAMP= LE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPri= ncipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbPrincipalName: <a h= ref=3D"mailto:ldap/replica.example.net@EXAMPLE.NET">ldap/replica.example.ne= t(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectCla= ss: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3Bs= tructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: 205686f2-d162-1031= -9537-2fa18b539eb9 &nbsp=3BcreatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203065511Z &nbs= p=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQG= iAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABVJB= bD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUXFMNw &nbsp=3B 2R8oC1= rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKbipUj = &nbsp=3B AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4= BDYYAOvmT4x &nbsp=3B MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaB= sgthQCj3BCDmkwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2m= xhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D=3D &nbsp=3BkrbPasswordExpiration: = 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203065628Z &nbsp=3Bkrb= LastSuccessfulAuth: 20121204032538Z &nbsp=3BkrbExtraData:: AAIcTbxQYWRta= W5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D<br= >&nbsp=3BentryCSN: 20121204032538.048010Z#000000#000#000000 &nbsp=3Bmodi= fiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BmodifyTimestamp: 20121204032538Z &nbsp=3B &nbsp=3B &nbsp=3B <= br>&nbsp=3Bvvvvvvvvvvvvvvvvvvvv replica config vvvvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvv &nbsp=3B &nbsp=3Bdn: cn=3Dconfig &nbsp=3BobjectClass: ol= cGlobal &nbsp=3Bcn: config &nbsp=3BolcArgsFile: /var/run/slapd/slapd.= args &nbsp=3BolcPidFile: /var/run/slapd/slapd.pid &nbsp=3BolcToolThre= ads: 1 &nbsp=3BstructuralObjectClass: olcGlobal &nbsp=3BentryUUID: af= 9b0068-d108-1031-9417-cd3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig = &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BolcTLSCACertificateFile= : /etc/ssl/certs/cacert.pem &nbsp=3BolcTLSCertificateFile: /etc/ssl/cert= s/replica_slapd_cert.pem &nbsp=3BolcTLSCertificateKeyFile: /etc/ldap/rep= lica_slapd_key.pem &nbsp=3BolcLogLevel: stats &nbsp=3BolcAuthzRegexp:= {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BolcAuthzR= egexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth uid= =3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BolcSaslHost: repli= ca.example.net &nbsp=3BolcSaslRealm: EXAMPLE.NET &nbsp=3BentryCSN: 20= 121204023449.956406Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber= =3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3Bm= odifyTimestamp: 20121204023449Z &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dconfig= &nbsp=3BobjectClass: olcModuleList &nbsp=3Bcn: module{0} &nbsp=3B= olcModulePath: /usr/lib/ldap &nbsp=3BolcModuleLoad: {0}back_hdb &nbsp= =3BolcModuleLoad: {1}back_ldap &nbsp=3BstructuralObjectClass: olcModuleL= ist &nbsp=3BentryUUID: af9d1e34-d108-1031-941f-cd3569532aaf &nbsp=3Bc= reatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201457Z &nb= sp=3BentryCSN: 20121204041212.292184Z#000000#000#000000 &nbsp=3Bmodifier= sName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Da= uth &nbsp=3BmodifyTimestamp: 20121204041212Z &nbsp=3Bdn: cn=3Dschema= =2Ccn=3Dconfig &nbsp=3BobjectClass: olcSchemaConfig &nbsp=3Bcn: schem= a &nbsp=3BstructuralObjectClass: olcSchemaConfig &nbsp=3BentryUUID: a= f9b564e-d108-1031-941a-cd3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig<br= >&nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BentryCSN: 201212022014= 56.995860Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig &nbsp= =3BmodifyTimestamp: 20121202201456Z &nbsp=3B&lt=3B snip schemas &gt=3B<B= R>&nbsp=3Bdn: olcBackend=3D{0}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olc= BackendConfig &nbsp=3BolcBackend: {0}hdb &nbsp=3BstructuralObjectClas= s: olcBackendConfig &nbsp=3BentryUUID: af9e498a-d108-1031-9420-cd3569532= aaf &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 201212= 02201457Z &nbsp=3BentryCSN: 20121202201457.015189Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dconfig &nbsp=3BmodifyTimestamp: 201212022014= 57Z &nbsp=3Bdn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bobje= ctClass: olcDatabaseConfig &nbsp=3BobjectClass: olcFrontendConfig &nb= sp=3BolcDatabase: {-1}frontend &nbsp=3BolcAccess: {0}to * by dn.exact=3D= gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2C= cn=3Dauth manage by * break &nbsp=3BolcAccess: {1}to dn.exact=3D"" by * = read &nbsp=3BolcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read &n= bsp=3BolcSizeLimit: 500 &nbsp=3BstructuralObjectClass: olcDatabaseConfig= &nbsp=3BentryUUID: af9b211a-d108-1031-9418-cd3569532aaf &nbsp=3Bcrea= torsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp= =3BentryCSN: 20121202201456.994497Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dconfig &nbsp=3BmodifyTimestamp: 20121202201456Z &nbsp=3Bdn:= olcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp= =3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcChainConfig = &nbsp=3BolcOverlay: {0}chain &nbsp=3BolcChainReturnError: TRUE &nbsp= =3BstructuralObjectClass: olcChainConfig &nbsp=3BentryUUID: 8605cc76-d21= 4-1031-93d2-613cc62fd42f &nbsp=3BcreatorsName: gidNumber=3D0+uidNumber= =3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BcreateTimestamp= : 20121204041212Z &nbsp=3BentryCSN: 20121204041212.352767Z#000000#000#00= 0000 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred= =2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp: 20121204041212Z<br= >&nbsp=3Bdn: olcDatabase=3D{0}ldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D= {-1}frontend=2Ccn=3Dconfig &nbsp=3BobjectClass: olcLDAPConfig &nbsp= =3BobjectClass: olcChainDatabase &nbsp=3BolcDatabase: {0}ldap &nbsp= =3BolcDbURI: "<a href=3D"ldap://master.example.net:389/">ldap://master.exam= ple.net:389/</a>" &nbsp=3BolcDbIDAssertBind: bindmethod=3Dsimple binddn= =3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc &nbsp=3B =3Dnet" crede= ntials=3D&lt=3Bsecret&gt=3B mode=3Dself flags=3Doverride starttls=3Dcritica= l tls_req &nbsp=3B cert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem<= br>&nbsp=3BolcDbRebindAsUser: TRUE &nbsp=3BstructuralObjectClass: olcLDA= PConfig &nbsp=3BentryUUID: 8609b6f6-d214-1031-93d3-613cc62fd42f &nbsp= =3BcreatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexterna= l=2Ccn=3Dauth &nbsp=3BcreateTimestamp: 20121204041212Z &nbsp=3BentryC= SN: 20121204041212.378432Z#000000#000#000000 &nbsp=3BmodifiersName: gidN= umber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbs= p=3BmodifyTimestamp: 20121204041212Z &nbsp=3Bdn: olcDatabase=3D{0}config= =2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3BolcData= base: {0}config &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber=3D0+u= idNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2Ccn=3Dauth manag= e by * break &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp= =3BentryUUID: af9b4528-d108-1031-9419-cd3569532aaf &nbsp=3BcreatorsName:= cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BentryCS= N: 20121202201456.995421Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3D= config &nbsp=3BmodifyTimestamp: 20121202201456Z &nbsp=3Bdn: olcDataba= se=3D{1}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbs= p=3BobjectClass: olcHdbConfig &nbsp=3BolcDatabase: {1}hdb &nbsp=3Bolc= DbDirectory: /var/lib/ldap &nbsp=3BolcSuffix: dc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BolcLastMod: TRUE &nbsp=3BolcRootDN: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BolcRootPW:: e1NTSEF9eW1nS3JTR0VkMW5LQ0VaQ0Y4UjJBTDlP= TlEveENDbzY=3D &nbsp=3BolcDbCheckpoint: 512 30 &nbsp=3BolcDbConfig: {= 0}set_cachesize 0 2097152 0 &nbsp=3BolcDbConfig: {1}set_lk_max_objects 1= 500 &nbsp=3BolcDbConfig: {2}set_lk_max_locks 1500 &nbsp=3BolcDbConfig= : {3}set_lk_max_lockers 1500 &nbsp=3BolcDbIndex: objectClass eq &nbsp= =3BolcDbIndex: uid eq &nbsp=3BolcDbIndex: cn eq &nbsp=3BolcDbIndex: o= u eq &nbsp=3BolcDbIndex: dc eq &nbsp=3BolcDbIndex: uidNumber eq &n= bsp=3BolcDbIndex: gidNumber eq &nbsp=3BolcDbIndex: memberUid eq &nbsp= =3BolcDbIndex: uniqueMember eq &nbsp=3BolcDbIndex: entryUUID eq &nbsp= =3BolcDbIndex: entryCSN eq &nbsp=3BolcDbIndex: krbPrincipalName eq=2Cpre= s=2Csub &nbsp=3BolcDbIndex: krbPwdPolicyReference eq &nbsp=3Bstructur= alObjectClass: olcHdbConfig &nbsp=3BentryUUID: af9e5d12-d108-1031-9421-c= d3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp= : 20121202201457Z &nbsp=3BolcAccess: {0}to attrs=3DuserPassword=2Cshadow= LastChange by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample= =2Cdc=3Dnet" read by self write by anonymous auth &nbsp=3BolcAccess: {1}= to attrs=3DauthzTo=2CauthzFrom by group.exact=3D"cn=3Dreplicators=2Cou=3Dgr= oups=2Cdc=3Dexample=2Cdc=3Dnet" read by users read by anonymous none &nb= sp=3BolcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLas= tFailedAuth=2CkrbLoginFailedCount by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cd= c=3Dexample=2Cdc=3Dnet" read by dn &nbsp=3B =3D"cn=3Dadm-srv=2Cou=3Dkerb= eros=2Cdc=3Dexample=2Cdc=3Dnet" read by self read by * none &nbsp=3BolcA= ccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by dn= =3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by dn=3D"c= n=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C &nbsp=3B dc=3Dnet" read by= * none &nbsp=3BolcAccess: {4}to dn.base=3D"" by * read &nbsp=3BolcAc= cess: {5}to * by self write by users read &nbsp=3BolcSyncrepl: {0}rid=3D= 123 provider=3D"<a href=3D"ldap://master.example.net:389/">ldap://master.ex= ample.net:389/</a>" type=3DrefreshAndPersist retry=3D"60 30 300 +" searchba= se=3D"dc=3Dexample=2Cdc=3Dnet" bindmethod=3Dsasl &nbsp=3B&nbsp=3B saslme= ch=3Dgssapi starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D/etc/ssl/= certs/cacert.pem &nbsp=3BolcUpdateRef: "<a href=3D"ldap://master.example= .net:389/">ldap://master.example.net:389/</a>" &nbsp=3BentryCSN: 2012120= 4041212.283590Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber=3D0+u= idNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyT= imestamp: 20121204041212Z &nbsp=3B &nbsp=3B &nbsp=3B &nbsp= =3Bdn: dc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3Bobjec= tClass: dcObject &nbsp=3BobjectClass: organization &nbsp=3Bo: example= .net &nbsp=3Bdc: example &nbsp=3BstructuralObjectClass: organization<= br>&nbsp=3BentryUUID: eac01854-d108-1031-95b6-31806daa9e45 &nbsp=3Bcreat= orsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2= 0121202201636Z &nbsp=3BentryCSN: 20121202201636.222029Z#000000#000#00000= 0 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BmodifyTimestamp: 20121202201636Z &nbsp=3BcontextCSN: 20121204035116.8= 90381Z#000000#000#000000 &nbsp=3Bdn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: orga= nizationalRole &nbsp=3Bcn: admin &nbsp=3Bdescription: LDAP administra= tor &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjec= tClass: organizationalRole &nbsp=3BentryUUID: eac2e160-d108-1031-95b7-31= 806daa9e45 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BcreateTimestamp: 20121202201636Z &nbsp=3BentryCSN: 201212022016= 36.240572Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dex= ample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121202201636Z &nbsp=3Bdn:= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organization= alUnit &nbsp=3Bou: people &nbsp=3Bdescription: user account objects<b= r>&nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUUID: 1= cee4810-d12b-1031-9787-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cd= c=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp= =3BentryCSN: 20121203002123.299880Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121= 203002123Z &nbsp=3Bdn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3B= objectClass: organizationalUnit &nbsp=3Bou: groups &nbsp=3Bdescriptio= n: group objects &nbsp=3BstructuralObjectClass: organizationalUnit &n= bsp=3BentryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 &nbsp=3BcreatorsNa= me: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212= 03002123Z &nbsp=3BentryCSN: 20121203002123.394485Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodi= fyTimestamp: 20121203002123Z &nbsp=3Bdn: ou=3Dhosts=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: hosts &= nbsp=3Bdescription: host/computer objects &nbsp=3BstructuralObjectClass:= organizationalUnit &nbsp=3BentryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abce= a93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.400= 935Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: ou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organizationa= lUnit &nbsp=3Bou: kerberos &nbsp=3Bdescription: kerberos realm contai= ner &nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUU= ID: 1cfef412-d12b-1031-978a-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmi= n=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z = &nbsp=3BentryCSN: 20121203002123.409140Z#000000#000#000000 &nbsp=3Bmodif= iersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: = 20121203002123Z &nbsp=3Bdn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cd= c=3Dnet &nbsp=3Bcn: replica &nbsp=3BobjectClass: simpleSecurityObject= &nbsp=3BobjectClass: organizationalRole &nbsp=3BobjectClass: krbPrin= cipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BauthzTo: dn:= * &nbsp=3Bdescription: LDAP server=2C replica &nbsp=3BstructuralObjec= tClass: organizationalRole &nbsp=3BentryUUID: 1d02dae6-d12b-1031-978b-4f= 8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a h= ref=3D"mailto:host/replica.example.net@EXAMPLE.NET">host/replica.example.ne= t(a)EXAMPLE.NET</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipal= Key:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp= =3B MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhb= RURAxZ &nbsp=3B oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz= 54uBWIC4AFa66jXa6Mn3k &nbsp=3B f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKA= HMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu6lb/ &nbsp=3B QQQHgCnrL6XaSAYoh3A5GHF0xa= 2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWgAwIB &nbsp=3B AKExMC+gAwI= BAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D=3D &nbsp= =3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 2012= 1203065600Z &nbsp=3BkrbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFL= k5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BuserPassword:: = &lt=3Bsecret&gt=3B &nbsp=3BentryCSN: 20121203233422.105322Z#000000#000#0= 00000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BmodifyTimestamp: 20121203233422Z &nbsp=3Bdn: cn=3Dmaster=2Cou=3Dhos= ts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: master &nbsp=3BobjectClass: = simpleSecurityObject &nbsp=3BobjectClass: organizationalRole &nbsp=3B= objectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux = &nbsp=3BauthzTo: dn:* &nbsp=3Bdescription: LDAP server=2C replica &nb= sp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectClass: or= ganizationalRole &nbsp=3BentryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93= &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bc= reateTimestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a href=3D"mai= lto:host/master.example.net@EXAMPLE.NET">host/master.example.net(a)EXAMPLE.NE= T</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRK= ADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIB= EqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW+aWr &n= bsp=3B 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86Xg= WwWj5522A &nbsp=3B i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKF= BMD+gAwIBEKE4BDYYAH15xNZ &nbsp=3B VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsS= WdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGu= LUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D=3D &nbsp=3BkrbPasswor= dExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203060855Z<b= r>&nbsp=3BkrbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D = &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203060855.932= 134Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadm-srv=2Cou=3Dkerber= os=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203060855Z<br= >&nbsp=3Bdn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet = &nbsp=3BobjectClass: posixGroup &nbsp=3Bcn: administrator &nbsp=3Bgid= Number: 50000 &nbsp=3BstructuralObjectClass: posixGroup &nbsp=3Bentry= UUID: 1d079216-d12b-1031-978d-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dad= min=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z<b= r>&nbsp=3BentryCSN: 20121203002123.465616Z#000000#000#000000 &nbsp=3Bmod= ifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp= : 20121203002123Z &nbsp=3Bdn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3BobjectClass: groupOfN= ames &nbsp=3Bcn: replicators &nbsp=3Bmember: cn=3Dreplica=2Cou=3Dhost= s=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmember: cn=3Dmaster=2Cou=3Dhosts=2Cd= c=3Dexample=2Cdc=3Dnet &nbsp=3BstructuralObjectClass: groupOfNames &n= bsp=3BentryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 &nbsp=3BcreatorsNa= me: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212= 03002123Z &nbsp=3BentryCSN: 20121203002123.477792Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodi= fyTimestamp: 20121203002123Z &nbsp=3Bdn: uid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3BobjectC= lass: inetOrgPerson &nbsp=3BobjectClass: posixAccount &nbsp=3BobjectC= lass: shadowAccount &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3Bobje= ctClass: krbTicketPolicyAux &nbsp=3Bcn: administrator &nbsp=3Bsn: adm= inistrator &nbsp=3BuidNumber: 50000 &nbsp=3BgidNumber: 50000 &nbsp= =3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BhomeDirectory: /home/admini= strator &nbsp=3BstructuralObjectClass: inetOrgPerson &nbsp=3Buid: adm= inistrator &nbsp=3BentryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 &n= bsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateT= imestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ad= ministrator(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a> &nbsp=3BkrbPrinci= palKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIBAKFJ &n= bsp=3B MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ec= qcdxailuD &nbsp=3B o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELh= AAQRTIM4QI0IPjmA1xg/Ot7l &nbsp=3B cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkw= TKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADmOzq8 &nbsp=3B 96TliwJM9J3X0Dxb/Y+bcTz= 3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWgAwIB &nbsp=3B AKExMC+g= AwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8oAcwB &n= bsp=3B aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4= HaK+6yoME &nbsp=3B 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCY= IAHKR4PzhneCY8c8tLpo8yyO &nbsp=3B mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADA= gEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgEDoSgE &nbsp=3B JggA4e6VizsvWUEKEqAt58P= rPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLRVhBT &nbsp=3B VBMRS5OR= VShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXGa5U+ &n= bsp=3B g=3D &nbsp=3BkrbLastPwdChange: 20121203054848Z &nbsp=3BkrbLast= FailedAuth: 20121204013714Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3Bde= scription: Network Administrator &nbsp=3BkrbLastSuccessfulAuth: 20121204= 035116Z &nbsp=3BkrbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA= =3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121204035= 116.890381Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212040= 35116Z &nbsp=3Bdn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: orga= nizationalRole &nbsp=3Bcn: kdc-srv &nbsp=3Bdescription: Kerberos KDC<= br>&nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectCla= ss: organizationalRole &nbsp=3BentryUUID: 1d168924-d12b-1031-9790-4f8d9a= bcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.5= 63692Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexampl= e=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn= =3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass= : simpleSecurityObject &nbsp=3BobjectClass: organizationalRole &nbsp= =3Bcn: adm-srv &nbsp=3Bdescription: Kerberos Admin Server &nbsp=3Buse= rPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectClass: organizati= onalRole &nbsp=3BentryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 &nbs= p=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTim= estamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.575773Z#000000#= 000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<b= r>&nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: EXAMPLE.NET &n= bsp=3BobjectClass: top &nbsp=3BobjectClass: krbRealmContainer &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BkrbSubTrees: dc=3Dexample=2Cd= c=3Dnet &nbsp=3BkrbSearchScope: 2 &nbsp=3BkrbMaxRenewableAge: 604800<= br>&nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3BstructuralObjectClass: krbRea= lmContainer &nbsp=3BentryUUID: c03d58b8-d134-1031-83e7-0707760cf534 &= nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcreate= Timestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.757228Z#0000= 00#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mai= lto:krbPrincipalName=3DK/M@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc">krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc</a>=3D &nbsp=3B net &nbsp=3BkrbL= oginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3BkrbMaxRene= wableAge: 604800 &nbsp=3BkrbTicketFlags: 192 &nbsp=3BkrbPrincipalName= : <a href=3D"mailto:K/M@EXAMPLE.NET">K/M(a)EXAMPLE.NET</a> &nbsp=3BkrbPrin= cipalExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MGagAwIBAaEDA= gEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+gAwIB &nbsp=3B EKE4BDYYALvAYAT= OnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/c4Ks &nbsp=3B = HI=3D &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtraData:= : AAkBAAEArgC8UA=3D=3D &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARV= hBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAAAAAAA=3D &nbsp=3B= objectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPri= ncipal &nbsp=3BentryUUID: c04d9282-d134-1031-83e8-0707760cf534 &nbsp= =3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTime= stamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.863568Z#000000#0= 00#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:= krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos">krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMP= LE.NET=2Cou=3Dkerberos</a> &nbsp=3B =2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3Bkrb= MaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 0 &nbsp=3BkrbPrincipa= lName: <a href=3D"mailto:krbtgt/EXAMPLE.NET@EXAMPLE.NET">krbtgt/EXAMPLE.NET= @EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbs= p=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgA= wIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwF= c2CqS9kNvgpTNujaNnfmRR &nbsp=3B GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN= 6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7UKy1 &nbsp=3B 93EQx3jtSTiD0aa2tNK9Fbkom= kYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9KwFT &nbsp=3B B9MqvfMfba= 37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWgAwIB &nbs= p=3B AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTT= A8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9= HckLfrcVL5goKRVOV8oR &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp= =3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbEx= traData:: AAcBAAIAAgAAAAAAAAA=3D &nbsp=3BobjectClass: krbPrincipal &n= bsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyA= ux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c05= 18180-d134-1031-83e9-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp= =3BentryCSN: 20121203013022.889347Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121= 203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/admin= @EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dex">krbPrincipalName= =3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dex</a= > &nbsp=3B ample=2Cdc=3Dnet &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbMaxTicketLife: 10800 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp= =3BkrbTicketFlags: 4 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/= admin(a)EXAMPLE.NET">kadmin/admin(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpi= ration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAw= IBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAMjLoWHT= DPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtCkdsY &nbsp=3B 5WwobkGKF= vGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M28Ix6 &nb= sp=3B SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDY= YAGZM5wu &nbsp=3B tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFiv= BmdH1kEy8cwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84= Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJ= ggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3aQz &nbsp=3BkrbLastPwdCh= ange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVh= BTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbsp=3Bo= bjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPri= ncipal &nbsp=3BentryUUID: c05346be-d134-1031-83ea-0707760cf534 &nbsp= =3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTime= stamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.900950Z#000000#0= 00#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:= krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dke= rberos=2Cdc">krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dkerberos=2Cdc</a> &nbsp=3B =3Dexample=2Cdc=3Dnet &nbsp=3Bk= rbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 300 &nbsp=3BkrbMaxRen= ewableAge: 604800 &nbsp=3BkrbTicketFlags: 8196 &nbsp=3BkrbPrincipalNa= me: <a href=3D"mailto:kadmin/changepw@EXAMPLE.NET">kadmin/changepw(a)EXAMPLE.= NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPr= incipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ<b= r>&nbsp=3B MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaB= p9l1hsceWqIB2 &nbsp=3B ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoT= AELhAAt+ZrWZKAjKkUhSJt0wwSqU &nbsp=3B ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2= M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd423Z &nbsp=3B epUHmGMVf2I5sRQZRuo= ypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWgAwIB &nbsp=3B AKEx= MC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8oAcwB<b= r>&nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/= w7dmvqU9zPl &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtr= aData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: = AAcBAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3Bobje= ctClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbs= p=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c054d88a-d134= -1031-83eb-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN= : 20121203013022.911237Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z<= br>&nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/history@EXAMPLE.= NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc">krbPrincipalName=3Dkadmin/hist= ory(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc</a>=3D &nbsp=3B = example=2Cdc=3Dnet &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicke= tLife: 36000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlag= s: 0 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/history@EXAMPLE.= NET">kadmin/history(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 1970= 0101000000Z &nbsp=3BkrbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME= 4wTKAHMAWgAwIBAKFBMD+gAwIB &nbsp=3B EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKb= f2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd/N+Z &nbsp=3B 2g=3D &nbsp=3BkrbL= astPwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXR= pb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &= nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux<br= >&nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: = krbPrincipal &nbsp=3BentryUUID: c0562d3e-d134-1031-83ec-0707760cf534 = &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcreat= eTimestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.919957Z#000= 000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"ma= ilto:krbPrincipalName=3Dkadmin/master.example.net@EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dk">krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2C= cn=3DEXAMPLE.NET=2Cou=3Dk</a> &nbsp=3B erberos=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3Bkr= bPrincipalName: <a href=3D"mailto:kadmin/master.example.net@EXAMPLE.NET">ka= dmin/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: = 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAg= EApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABhOeGOuo9UBDjK7= hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4Ta3z &nbsp=3B Y4ZaEYItXr2awBW6Q= XSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtGg1qY &nbsp=3B oe= v8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj0sgn= &nbsp=3B ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf= 4UwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qY= DwpK0Hycj+cwyCjFsVKTsjzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAxTSME= h/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZABm &nbsp=3BkrbLastPwdChange: 19= 700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5= ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAANAD4gA=3D &nbsp=3BobjectCla= ss: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectC= lass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal = &nbsp=3BentryUUID: c0581144-d134-1031-83ed-0707760cf534 &nbsp=3Bcreators= Name: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012= 1203013022Z &nbsp=3BentryCSN: 20121203013022.932349Z#000000#000#000000<b= r>&nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmo= difyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipa= lName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dker">= krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dker</a> &nbsp=3B beros=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BkrbP= rincipalName: <a href=3D"mailto:ldap/master.example.net@EXAMPLE.NET">ldap/m= aster.example.net(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: krbPrincipal &= nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicy= Aux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: 91= a6199c-d15a-1031-9919-2f12ddec6588 &nbsp=3BcreatorsName: cn=3Dadm-srv=2C= ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012120= 3060105Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MII= BRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegA= wIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPUS2wz<br= >&nbsp=3B qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14T= YWZyLZem5kvD &nbsp=3B yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIB= AKFBMD+gAwIBEKE4BDYYAAbNr3p &nbsp=3B vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4= kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYI= APc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D=3D &nbsp=3BkrbPass= wordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203060153= Z &nbsp=3BkrbLastSuccessfulAuth: 20121203061721Z &nbsp=3BkrbExtraData= :: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData::= AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203061721.358939Z#000000#000#000000= &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BmodifyTimestamp: 20121203061721Z &nbsp=3Bdn: <a href= =3D"mailto:krbPrincipalName=3Dldap/replica.example.net@EXAMPLE.NET=2Ccn=3DE= XAMPLE.NET=2Cou=3Dke">krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.N= ET=2Ccn=3DEXAMPLE.NET=2Cou=3Dke</a> &nbsp=3B rberos=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ldap/replica.example.= net(a)EXAMPLE.NET">ldap/replica.example.net(a)EXAMPLE.NET</a> &nbsp=3Bobject= Class: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3Bobje= ctClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal<= br>&nbsp=3BentryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 &nbsp=3Bcreat= orsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3B= createTimestamp: 20121203065511Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAw= IBAKFJ &nbsp=3B MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3= wddcUmq3o092v7mUXFMNw &nbsp=3B 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6= ADAgEXoTAELhAApsEJiySukR8L5M3DKbipUj &nbsp=3B AITSVQQL2YSqY7xr/BY7Hm3huN= /juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOvmT4x &nbsp=3B MDAmgH2qTgq= XTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWgAwIB &nbsp= =3B AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA= =3D=3D &nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLast= PwdChange: 20121203065628Z &nbsp=3BkrbExtraData:: AAIcTbxQYWRtaW5pc3RyYX= RvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3B= krbLastSuccessfulAuth: 20121204032538Z &nbsp=3BentryCSN: 20121204032538.= 048010Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dker= beros=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121204032538Z= &nbsp=3B <div><div id=3D"SkyDrivePlaceholder"></div>&gt=3B Date: Fri= =2C 9 Nov 2012 01:55:32 +0000 &gt=3B From: openldap-its(a)OpenLDAP.org = &gt=3B To: blance3459(a)hotmail.com &gt=3B Subject: Re: (ITS#7434) idasser= t-bind fails after restarting slapd &gt=3B &gt=3B &gt=3B *** THI= S IS AN AUTOMATICALLY GENERATED REPLY *** &gt=3B &gt=3B Thanks for y= our report to the OpenLDAP Issue Tracking System. Your &gt=3B report ha= s been assigned the tracking number ITS#7434. &gt=3B &gt=3B One of o= ur support engineers will look at your report in due course. &gt=3B Note= that this may take some time because our support engineers &gt=3B are v= olunteers. They only work on OpenLDAP when they have spare &gt=3B time.= &gt=3B &gt=3B If you need to provide additional information in rega= rds to your &gt=3B issue report=2C you may do so by replying to this mes= sage. Note that &gt=3B any mail sent to openldap-its(a)openldap.org with = (ITS#7434) &gt=3B in the subject will automatically be attached to the i= ssue report. &gt=3B &gt=3B mailto:openldap-its@openldap.org?subject= =3D(ITS#7434) &gt=3B &gt=3B You may follow the progress of this repo= rt by loading the following &gt=3B URL in a web browser: &gt=3B h= ttp://www.OpenLDAP.org/its/index.cgi?findid=3D7434 &gt=3B &gt=3B Ple= ase remember to retain your issue tracking number (ITS#7434) &gt=3B on a= ny further messages you send to us regarding this report. If &gt=3B you= don't then you'll just waste our time and yours because we &gt=3B won't= be able to properly track the report. &gt=3B &gt=3B Please note tha= t the Issue Tracking System is not intended to &gt=3B be used to seek he= lp in the proper use of OpenLDAP Software. &gt=3B Such requests will be = closed. &gt=3B &gt=3B OpenLDAP Software is user supported. &gt=3B= http://www.OpenLDAP.org/support/ &gt=3B &gt=3B -------------- &= gt=3B Copyright 1998-2007 The OpenLDAP Foundation=2C All Rights Reserved.<b= r>&gt=3B </div> </div></body> </html>= --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_--

1 0

(ITS#7462) olcPcache cannot be modified
by tioteath＠gmail.com 04 Dec '12

04 Dec '12

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.172.239.4) I'm getting 'LDAP: error code 80 - cannot delete olcPcache' while I'm trying to perform olcPcache modification: dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config changetype: modify replace: olcPcache olcPcache: hdb 10000 4 500 100 - I have to perform this action in case, I need to extend the number of pcacheAttrset directives.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs December 2012