- openldap-bugs - openldap.org

(ITS#7468) ppolicy and rwm/relay segfaulting
by tim.j.watts＠kcl.ac.uk 08 Dec '12

08 Dec '12

Full_Name: Tim Watts Version: 2.4.23 OS: Debian 6/amd64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.2.78.46) Hi, We load slapd up with actual entries for the dc=new,dc=example,dc=com domain. slapd is configured to map all records with rwm/relay to dc=old,dc=example,dc=com so clients with the old config still work. ie we load a real record: 1) dn: uid=testuser,ou=people,dc=new,dc=example,dc=com and we want clients asking about 2) dn: uid=testuser,ou=people,dc=old,dc=example,dc=com will be served from (1) ======== OK here's an example ================ === Server ==== Running debian 6 server with debian slapd 2.4.23-7.2 /usr/sbin/slapd -d 4 -h "ldap:/// ldaps:/// ldapi:///" -g openldap -u openldap -f /etc/ldap/slapd.conf === Test client === Running test against the "old" realm: ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com # Enter the wrong password and it fails correctly and server runs OK. # Enter the right password and the client says: ldap_result: Can't contact LDAP server (-1) Server says (last few lines from slapd): [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=old,dc=example,dc=com" [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=new,dc=example,dc=com" => ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com,0) <= ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" => bdb_entry_get: ndn: "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" ==> hdb_bind: dn: uid=testuser,ou=people,dc=new,dc=example,dc=com send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" Segmentation fault However, queries against the "new" domain work: ldapwhoami -x -W -D uid=testuser,ou=people,dc=new,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com If I disable ppolicy in slapd.conf, queries agains the "old" domain work: root@ldaptest1:/etc# ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com (the rewrite is not perfect - but that may not matter for my clients). Almost certainly I have done something stupid - and it seems clear that ppolicy is being upset by the relay mappings. Any ideas how to fix would be *very* welcome - I have been all over Google and the man pages. All the best! Tim OK - boring stuff: slapd.conf ########################################### ####################################################################### # Global Directives: # Features to permit allow bind_anon_cred bind_anon_dn update_anon # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel sync stats sizelimit 5000 tool-threads 1 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm moduleload ppolicy overlay rwm rwm-rewriteEngine on backend hdb ####################################################################### # Global ACLs # # Ensure read access to the base for things like # supportedSASLMechanisms. access to dn.base="" by * read # The userPassword by default can be changed # by the entry owning it if they are authenticated. # This ACL must be first or password leakage will happen!!! access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by self write by * auth # The admin dn has full write access, everyone else # can read everything. Local unix domain socket (root only) # Can do everything access to * by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by * read ####################################################################### # Main new.example.com authoritative database # database hdb suffix dc=new,dc=example,dc=com rootdn "cn=admin,dc=new,dc=example,dc=com" rootpw "{SSHA}NoNoNooo..." directory "/var/lib/ldap" dbconfig set_cachesize 0 134217728 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # # Password Policy # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext ####################################################################### # Virtual maps - compatibility with old.example.com only # # map dc=old to dc=new # database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ########################################### Initial database loaded with slapadd from this ldif: ########################################### dn: dc=new,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: new.example.com dc: new dn: cn=admin,dc=new,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: NoNoNoooo... dn: ou=people,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: ou=pwpolicies,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: pwpolicies # # # Standard policy for normal people # dn: cn=default,ou=pwpolicies,dc=new,dc=example,dc=com objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15811200 pwdExpireWarning: 1814400 pwdGraceAuthnLimit: 3 pwdInHistory: 6 pwdCheckQuality: 2 pwdMaxFailure: 5 pwdMinLength: 8 pwdLockout: TRUE pwdLockoutDuration: 300 pwdFailureCountInterval: 300 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE dn: uid=testuser,ou=people,dc=new,dc=example,dc=com objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Test User employeeType: Staff gecos: Test User gidNumber: 1000 givenName: Test homeDirectory: /homes/testuser loginShell: /bin/bash mail: testuser(a)new.example.com sn: User uid: testuser uidNumber: 1000 userPassword: {SSHA}NoNoNoooo... dn: cn=ddh-staff,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: ddh-staff description: Test Group gidNumber: 1000 memberUid: testuser dn: cn=sysadmin,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: sysadmin description: Staff: System Admin Group gidNumber: 1001 memberUid: testuser ###########################################

1 0

(ITS#7467) mdb_stat improvements
by quanah＠OpenLDAP.org 07 Dec '12

07 Dec '12

Full_Name: Quanah Gibson-Mount Version: master OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) It would be helpful to expand the functionality of mdb_stat: a) Merge in mfree b) Show the reader table c) Add option to zero out dead locker entries without interrupting anything

1 0

Re: (ITS#7466) syncreplication causes massive explosion in database size
by quanah＠zimbra.com 07 Dec '12

07 Dec '12

--On Friday, December 07, 2012 7:56 PM +0000 quanah(a)OpenLDAP.org wrote: > Full_Name: Quanah Gibson-Mount > Version: RE24 12/7/2012 > OS: Linux 2.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (74.196.25.250) Closing. Issue was actually triggered by the core dump in ITS#7465, which left a read txn lock on the primary database, causing the freelist to not be able to compact. Rebuilding the database cleared the lock and things went back to normal. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7466) syncreplication causes massive explosion in database size
by quanah＠OpenLDAP.org 07 Dec '12

07 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/7/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) In a master/replica environment, sync replication causes a massive explosion in database size on the replica. For example, with a 25MB database, the size on disk grew from 25MB to 50MB in the space of an hour (and it shows no signs of slowing down). Entries in the freelist grows without reducing: [zimbra@ldap02-zcs ~]$ mdb_stat -f data/ldap/mdb/db Freelist Status Tree depth: 2 Branch pages: 1 Leaf pages: 43 Overflow pages: 0 Entries: 987 Free pages: 7441 In monitoring, it appears every change adds about 6 entries and 40+ free pages. id2e database looks the same as on the master.

1 0

(ITS#7465) mdb_stat core dumps when used with -a -s
by quanah＠OpenLDAP.org 07 Dec '12

07 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/7/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) I believe the mdb_stat options "-a" and "-s <db>" are supposed to be mutually exclusive. However, if they are used in conjunction with one another, mdb_stat core dumps: [zimbra@ldap02-zcs ~]$ mdb_stat -a -e data/ldap/mdb/db -s id2e Environment Info Map address: (nil) Map size: 85899345920 Page size: 4096 Max pages: 20971520 Number of pages used: 6309 Last transaction ID: 434 Max readers: 126 Number of readers used: 7 Status of id2e Tree depth: 3 Branch pages: 6 Leaf pages: 678 Overflow pages: 1957 Entries: 2963 mdb_stat: mdb.c:4297: mdb_cursor_set: Assertion `key->mv_size > 0' failed. Aborted (core dumped)

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 07 Dec '12

07 Dec '12

--20cf307811d03117ef04d043e582 Content-Type: text/plain; charset=ISO-8859-1 Setting the timeout to 4294967294 should to the trick for now... but this is really a sort of bug to me as back-ldap should not behave this way when he have no credentials to use... Surely, closing the connexion with the client may be the best solution... 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > --20cf307811d0eb756704d0342092 > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Actualy I had this before and that did not change anything. I don't think > > this directive is used for this kind of "timeouts"... > > > > I also tried : > > > > *chase-referrals yes (this is default)* > > *rebind-as-user yes (as suggested here)** > > * > > *single-conn yes (default to NO)** > > * > > * > > * > > I also tried some combinings of idassert-bind options with no luck (as > the > > backend does not support identity assertion). > > By backend do you mean the remote server you're trying to proxy? > > I see your problem. Indeed, when a connection is pruned (in your case > because it timed out), information about client's credentials is lost. > Back-ldap is working incorrectly, since it falls back to trying to rebind > anonymously. However, the only other reasonable option could only be to > return a meaningful error (or dropping the connection with the client). > > Things work fine with identity assertion, because in that case the > client's credentials are no longer needed, what counts is that the > client's connection is alive and authenticated, so the client's identity > can be asserted. > > You'd need to do something like > > idassert-bind bindmethod=simple > binddn="<authorizing dn>" > credentials="<authorizing credentials>" > mode=self > flags=override > > (tested, works fine). However, I understood from what you wrote above > that this is not an option. > > I see one quick solution: bail out when the connection is lost and > idassert is not going to take place. This requires a minimal patch. > > An alternative could be to find a decent manner to store the client's > credentials in the frontend's connection with the client (as much as we do > for the client's identity in c_authz). This will live as long as the > client's connection stays alive (something like what we do for paged > results). > > [disclaimer: I'll look into this time permitting; I can't commit to fixing > it any soon] > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d03117ef04d043e582 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Setting the timeout to=A04294967294 should to the trick for now... but = this is really a sort of bug to me as back-ldap should not behave this way = when he have no credentials to use...<div> Surely, closing the connexion =A0with the client may be the best soluti= on...</div><div class=3D"gmail_extra"> <div class=3D"gmail_qu= ote"> 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masar= ati(a)aero.polimi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>></span= > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-le= ft:1px #ccc solid;padding-left:1ex"> > --20cf307811d0eb756704d0342092 > Content-Type: text/plain; charset=3DISO-8859-1 <div class=3D"im">> > Actualy I had this before and that did not change anything. I don'= t think > this directive is used for this kind of "timeouts"... > > I also tried : > </div>> *chase-referrals yes (this is default)* > *rebind-as-user yes (as suggested here)** > * > *single-conn yes (default to NO)** > * > * <div class=3D"im">> * > I also tried some combinings of idassert-bind options with no luck (as= the > backend does not support identity assertion). </div>By backend do you mean the remote server you're trying to proxy?<= br> I see your problem. =A0Indeed, when a connection is pruned (in your case<br= > because it timed out), information about client's credentials is lost.<= br> Back-ldap is working incorrectly, since it falls back to trying to rebind<b= r> anonymously. =A0However, the only other reasonable option could only be to<= br> return a meaningful error (or dropping the connection with the client). Things work fine with identity assertion, because in that case the client's credentials are no longer needed, what counts is that the client's connection is alive and authenticated, so the client's ide= ntity can be asserted. You'd need to do something like idassert-bind bindmethod=3Dsimple =A0 =A0 =A0 =A0 =A0 =A0 =A0 binddn=3D"<authorizing dn>" =A0 =A0 =A0 =A0 =A0 =A0 =A0 credentials=3D"<authorizing credentials= >" =A0 =A0 =A0 =A0 =A0 =A0 =A0 mode=3Dself =A0 =A0 =A0 =A0 =A0 =A0 =A0 flags=3Doverride (tested, works fine). =A0However, I understood from what you wrote above<br= > that this is not an option. I see one quick solution: bail out when the connection is lost and idassert is not going to take place. =A0This requires a minimal patch. An alternative could be to find a decent manner to store the client's<b= r> credentials in the frontend's connection with the client (as much as we= do for the client's identity in c_authz). =A0This will live as long as the= client's connection stays alive (something like what we do for paged<br= > results). [disclaimer: I'll look into this time permitting; I can't commit to= fixing it any soon] <div class=3D"HOEnZb"><div class=3D"h5"> p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> --20cf307811d03117ef04d043e582--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> --20cf307811d0eb756704d0342092 > Content-Type: text/plain; charset=ISO-8859-1 > > Actualy I had this before and that did not change anything. I don't think > this directive is used for this kind of "timeouts"... > > I also tried : > > *chase-referrals yes (this is default)* > *rebind-as-user yes (as suggested here)** > * > *single-conn yes (default to NO)** > * > * > * > I also tried some combinings of idassert-bind options with no luck (as the > backend does not support identity assertion). By backend do you mean the remote server you're trying to proxy? I see your problem. Indeed, when a connection is pruned (in your case because it timed out), information about client's credentials is lost. Back-ldap is working incorrectly, since it falls back to trying to rebind anonymously. However, the only other reasonable option could only be to return a meaningful error (or dropping the connection with the client). Things work fine with identity assertion, because in that case the client's credentials are no longer needed, what counts is that the client's connection is alive and authenticated, so the client's identity can be asserted. You'd need to do something like idassert-bind bindmethod=simple binddn="<authorizing dn>" credentials="<authorizing credentials>" mode=self flags=override (tested, works fine). However, I understood from what you wrote above that this is not an option. I see one quick solution: bail out when the connection is lost and idassert is not going to take place. This requires a minimal patch. An alternative could be to find a decent manner to store the client's credentials in the frontend's connection with the client (as much as we do for the client's identity in c_authz). This will live as long as the client's connection stays alive (something like what we do for paged results). [disclaimer: I'll look into this time permitting; I can't commit to fixing it any soon] p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307d04d2686d3904d0343c02 Content-Type: text/plain; charset=ISO-8859-1 Here is a quick python script that can be used to query a LDAP proxy. Running it while the proxy is configured with conn-ttl = 5 will trigget the error after 5 seconds: import ldap, sys, pprint, time ldap_server = "localhost" dn="cn=ldapintbind,o=corp" pw="your password here" con = ldap.initialize('ldap://' + ldap_server) try: #l.start_tls_s() con.simple_bind_s(dn, pw) con.set_option(ldap.OPT_DEREF,3) scope = ldap.SCOPE_SUBTREE base = "o=corp" filter ="(&(objectClass=*)(uid=dln))" retrieve_attributes = ["uid"] result_data = [] result_set = [] timeout = 0 essai=0 while 1: print(str(essai) + ".") essai+=1 result_id = con.search_s(base, scope, filter, retrieve_attributes) #pprint.pprint(result_id) time.sleep(1) except ldap.LDAPError, e: print e.message['info'] if type(e.message) == dict and e.message.has_key('desc'): print e.message['desc'] else: print e sys.exit() 2012/12/6 Sebastien Thomas <prune(a)lecentre.net> > Actualy I had this before and that did not change anything. I don't think > this directive is used for this kind of "timeouts"... > > I also tried : > > *chase-referrals yes (this is default)* > *rebind-as-user yes (as suggested here)** > * > *single-conn yes (default to NO)** > * > * > * > I also tried some combinings of idassert-bind options with no luck (as > the backend does not support identity assertion). > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > >> >> > --20cf307811d0d379c404d032d6ee >> > Content-Type: text/plain; charset=ISO-8859-1 >> > >> > Config is basic (with special timeout tests commented out) : >> > >> > database ldap >> > suffix "o=corp" >> > uri ldaps://10.100.120.153 >> > >> > # close connection after a timeout >> > #idletimeout 100 >> > # causes a cached connection to be dropped an recreated after a given >> ttl >> > #conn-ttl 4294967294 >> > # close connection after a timeout for ldap backend >> > #idle-timeout 4294967294 >> > # Discards current cached connection when the client rebinds - default >> to >> > No >> > #single-conn no >> >> >> Try adding a "rebind-as-user" here. This forces back-ldap to store >> client's credentials in order to rebind when needed (e.g. because a >> persistent connection timed out). >> >> p. >> >> > overlay rwm >> > rwm-suffixmassage "o=corp" "o=int" >> > >> > >> > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> >> > >> >> >> >> > Full_Name: Sebastien Prune THOMAS >> >> > Version: slapd 2.4.31 >> >> > OS: Linux CentOS >> >> > URL: ftp://ftp.openldap.org/incoming/ >> >> > Submission from: (NULL) (206.167.157.64) >> >> > >> >> > >> >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> >> LDAP >> >> > server. >> >> > Every once and a while I have long lasting connections re-binding as >> >> > anonymous, >> >> > breaking the actual bind. >> >> > This usualy happen after hitting either the idle-timeout or the >> >> conn-ttl >> >> > limit. >> >> > I wasn't able to find out what these values are when not set... but >> >> > setting them >> >> > low can help reproduce the problem : >> >> >> >> What is the configuration of back-ldap? Can you post it (after >> >> sanitizing >> >> sensitive info)? >> >> >> >> p. >> >> >> >> -- >> >> Pierangelo Masarati >> >> Associate Professor >> >> Dipartimento di Ingegneria Aerospaziale >> >> Politecnico di Milano >> >> >> >> >> > >> > --20cf307811d0d379c404d032d6ee >> > Content-Type: text/html; charset=ISO-8859-1 >> > Content-Transfer-Encoding: quoted-printable >> > >> > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with >> > spec= >> > ial timeout tests commented out) :</div><div >> > style=3D"font-family:Tahoma;fo= >> > nt-size:13px">=A0</div><div >> > style=3D"font-family:Tahoma;font-size:13px">dat= >> > abase =A0 =A0 =A0ldap >> > suffix =A0 =A0 =A0 =A0 =A0 >> > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= >> > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div >> > style= >> > =3D"font-family:Tahoma;font-size:13px">=A0</div><div >> > style=3D"font-family:T= >> > ahoma;font-size:13px"># close connection after a timeout >> > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be >> dropped >> > = >> > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 >> > 4294967294= >> > # close connection after a timeout for ldap >> > backend #idle-timeout=A0= >> > =A0=A0 4294967294 # Discards current cached connection when the >> client >> > r= >> > ebinds - default to No >> > #single-conn=A0=A0=A0=A0 no</div><div >> > style=3D"font-family:Tahoma;font-size= >> > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage >> > "o= >> > =3Dcorp" "o=3Dint"</div><div >> > class=3D"gmail_extra"> <= >> > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati > > dir=3D"ltr">&= >> > lt;<a href=3D"mailto:masarati@aero.polimi.it" >> > target=3D"_blank">masarati@ae= >> > ro.polimi.it</a>> >> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 >> > .8ex;border-left:1p= >> > x #ccc solid;padding-left:1ex"> >> > > Full_Name: Sebastien Prune THOMAS >> > > Version: slapd 2.4.31 >> > > OS: Linux CentOS >> > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" >> > target=3D"_blank">ft= >> > p://ftp.openldap.org/incoming/</a> >> > > Submission from: (NULL) (206.167.157.64) >> > > >> > > >> > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> > LD= >> > AP >> > > server. >> > > Every once and a while I have long lasting connections re-binding >> > as<b= >> > r> >> > > anonymous, >> > > breaking the actual bind. >> > > This usualy happen after hitting either the idle-timeout or the >> > conn-t= >> > tl >> > > limit. >> > > I wasn't able to find out what these values are when not set... >> > bu= >> > t >> > > setting them >> > > low can help reproduce the problem : >> > >> > What is the configuration of back-ldap? =A0Can you post it (after >> > sanitizin= >> > g >> > sensitive info)? >> > >> > p. >> > >> > -- >> > Pierangelo Masarati >> > Associate Professor >> > Dipartimento di Ingegneria Aerospaziale >> > Politecnico di Milano >> > >> > </blockquote></div> </div> >> > >> > --20cf307811d0d379c404d032d6ee-- >> > >> > >> > >> > >> > >> >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > --20cf307d04d2686d3904d0343c02 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Here is a quick python script that can be used to query a LDAP proxy. Runni= ng it while the proxy is configured with conn-ttl =3D 5 will trigget the er= ror after 5 seconds:<div> </div><div> </div><div> </div><div><div = style=3D"font-family:Tahoma;font-size:13px"> import ldap, sys, pprint, time</div><div style=3D"font-family:Tahoma;font-s= ize:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px">ldap_se= rver =3D "localhost" dn=3D"cn=3Dldapintbind,o=3Dcorp&quot= ; pw=3D"your password here"</div> <div style=3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"fon= t-family:Tahoma;font-size:13px">con =3D ldap.initialize('ldap://' += ldap_server) try: =A0=A0=A0 #l.start_tls_s() =A0=A0=A0 con.simple= _bind_s(dn, pw) =A0=A0=A0 con.set_option(ldap.OPT_DEREF,3) =A0 =A0=A0</div><div style=3D= "font-family:Tahoma;font-size:13px">=A0=A0=A0 scope =3D ldap.SCOPE_SUBTREE<= br>=A0=A0=A0 base =3D "o=3Dcorp" =A0=A0=A0 filter =3D"(&a= mp;(objectClass=3D*)(uid=3Ddln))" =A0=A0=A0 retrieve_attributes =3D ["uid"] =A0=A0=A0 result_dat= a =3D [] =A0=A0=A0 result_set =3D [] =A0=A0=A0 timeout =3D 0</div><di= v style=3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"font-f= amily:Tahoma;font-size:13px">=A0=A0=A0 essai=3D0 =A0=A0=A0 while 1: =A0=A0=A0=A0=A0=A0=A0 print(str(essai) + ".&quot= ;) =A0=A0=A0=A0=A0=A0=A0 essai+=3D1</div><div style=3D"font-family:Tahom= a;font-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px"= >=A0=A0=A0=A0=A0=A0=A0 result_id =3D con.search_s(base, scope, filter, retr= ieve_attributes) =A0=A0=A0=A0=A0=A0=A0 #pprint.pprint(result_id)</div><div style=3D"font-fam= ily:Tahoma;font-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-s= ize:13px">=A0 =A0 =A0 =A0 time.sleep(1) </div><div style=3D"font-family:= Tahoma;font-size:13px">=A0</div> <div style=3D"font-family:Tahoma;font-size:13px"> except ldap.LDAPError,= e: =A0=A0=A0 print e.message['info'] =A0=A0=A0 if type(e.mes= sage) =3D=3D dict and e.message.has_key('desc'): =A0=A0=A0=A0=A0= =A0=A0 print e.message['desc'] =A0=A0=A0 else: =A0=A0=A0=A0=A0=A0=A0 print e =A0=A0=A0 sys.exit()</d= iv></div><div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012= /12/6 Sebastien Thomas <<a href=3D"mailto:prune@lecent= re.net" target=3D"_blank">prune(a)lecentre.net</a>> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex">Actualy I had this before and that did not change anything.= I don't think this directive is used for this kind of "timeouts&q= uot;... <div> </div><div>I also tried :</div><div> </div><div>chase-referrals yes (this is default) </div><div>= rebind-as-user yes (as suggested here) </div><div> single-conn yes (d= efault to NO)<= br></div><div>= </div><div>= I also tried some combinings of=A0idassert-bind options with no luck (as the backen= d does not support identity assertion).</div> <div class=3D"HOEnZb"><div class=3D"h5"> <div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012/12/6 Pie= rangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> <blockqu= ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s= olid;padding-left:1ex"> > --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=3DISO-8859-1 <div>> > Config is basic (with special timeout tests commented out) : > > database =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" > uri =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ldaps://<a href=3D"http://10.100.1= 20.153" target=3D"_blank">10.100.120.153</a> > > # close connection after a timeout > #idletimeout =A0 =A0 100 > # causes a cached connection to be dropped an recreated after a given = ttl > #conn-ttl =A0 =A0 =A0 =A04294967294 > # close connection after a timeout for ldap backend > #idle-timeout =A0 =A04294967294 > # Discards current cached connection when the client rebinds - default= to > No > #single-conn =A0 =A0 no </div>Try adding a "rebind-as-user" here. =A0This forces back-lda= p to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. <div><div> > overlay =A0 =A0 =A0 =A0 rwm > rwm-suffixmassage "o=3Dcorp" "o=3Dint" > > > 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_= blank">ftp://ftp.openldap.org/incoming/</a> >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-bin= ding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or t= he >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not = set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? =A0Can you post it (after<= br> >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > </div></div>> --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=3DISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D3D"font-family:Tahoma;font-size:13px">Con= fig is basic (with > spec=3D > ial timeout tests commented out) :</div><div > style=3D3D"font-family:Tahoma;fo=3D > nt-size:13px">=3DA0</div><div > style=3D3D"font-family:Tahoma;font-size:13px">dat=3D > abase =3DA0 =3DA0 =3DA0ldap > suffix =3DA0 =3DA0 =3DA0 =3DA0 =3DA0 > =3DA0&quot;o=3D3Dcorp&quot; uri=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3D > =3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0 =3DA0 =3DA0<a>ldaps://<a hre= f=3D"http://10.100.120.153" target=3D"_blank">10.100.120.153</a></a>&= lt;/div><div > style=3D > =3D3D"font-family:Tahoma;font-size:13px">=3DA0</div&gt= ;<div > style=3D3D"font-family:T=3D > ahoma;font-size:13px"># close connection after a timeout<br= > > #idletimeout=3DA0=3DA0=3DA0=3DA0 100 # causes a cached connec= tion to be dropped > =3D > an recreated after a given ttl #conn-ttl=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3DA0 > 4294967294=3D > # close connection after a timeout for ldap > backend #idle-timeout=3DA0=3D > =3DA0=3DA0 4294967294 # Discards current cached connection wh= en the client > r=3D > ebinds - default to No > #single-conn=3DA0=3DA0=3DA0=3DA0 no</div><div > style=3D3D"font-family:Tahoma;font-size=3D > :13px"> overlay=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3D= A0 rwm rwm-suffixmassage > &quot;o=3D > =3D3Dcorp&quot; &quot;o=3D3Dint&quot;</div><div<b= r> > class=3D3D"gmail_extra"> <=3D > div class=3D3D"gmail_quote">2012/12/6 Pierangelo Masarati= <span > dir=3D3D"ltr">&=3D > lt;<a href=3D3D"mailto:<a href=3D"mailto:masarati@aero.polimi.= it" target=3D"_blank">masarati(a)aero.polimi.it</a>" > target=3D3D"_blank">masarati@ae=3D > <a href=3D"http://ro.polimi.it" target=3D"_blank">ro.polimi.it</a><= /a>&gt; > <blockquote class=3D3D"gmail_quote" style=3D3D"margi= n:0 0 0 > .8ex;border-left:1p=3D > x #ccc solid;padding-left:1ex"> > &gt; Full_Name: Sebastien Prune THOMAS > &gt; Version: slapd 2.4.31 > &gt; OS: Linux CentOS > &gt; URL: <a href=3D3D"<a href=3D"ftp://ftp.openldap.org/i= ncoming/" target=3D"_blank">ftp://ftp.openldap.org/incoming/</a>" > target=3D3D"_blank">ft=3D > p://<a href=3D"http://ftp.openldap.org/incoming/" target=3D"_blank">ft= p.openldap.org/incoming/</a></a> > &gt; Submission from: (NULL) (206.167.157.64) > &gt; > &gt; > &gt; I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory > LD=3D > AP > &gt; server. > &gt; Every once and a while I have long lasting connections re-bin= ding > as<b=3D > r> > &gt; anonymous, > &gt; breaking the actual bind. > &gt; This usualy happen after hitting either the idle-timeout or t= he > conn-t=3D > tl > &gt; limit. > &gt; I wasn&#39;t able to find out what these values are when = not set... > bu=3D > t > &gt; setting them > &gt; low can help reproduce the problem : > > What is the configuration of back-ldap? =3DA0Can you post it (after<br= > > sanitizin=3D > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> &lt= ;/div> > > --20cf307811d0d379c404d032d6ee-- <div><div>> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> </div></div></blockquote></div> </div> --20cf307d04d2686d3904d0343c02--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307811d0eb756704d0342092 Content-Type: text/plain; charset=ISO-8859-1 Actualy I had this before and that did not change anything. I don't think this directive is used for this kind of "timeouts"... I also tried : *chase-referrals yes (this is default)* *rebind-as-user yes (as suggested here)** * *single-conn yes (default to NO)** * * * I also tried some combinings of idassert-bind options with no luck (as the backend does not support identity assertion). 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > --20cf307811d0d379c404d032d6ee > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Config is basic (with special timeout tests commented out) : > > > > database ldap > > suffix "o=corp" > > uri ldaps://10.100.120.153 > > > > # close connection after a timeout > > #idletimeout 100 > > # causes a cached connection to be dropped an recreated after a given ttl > > #conn-ttl 4294967294 > > # close connection after a timeout for ldap backend > > #idle-timeout 4294967294 > > # Discards current cached connection when the client rebinds - default to > > No > > #single-conn no > > > Try adding a "rebind-as-user" here. This forces back-ldap to store > client's credentials in order to rebind when needed (e.g. because a > persistent connection timed out). > > p. > > > overlay rwm > > rwm-suffixmassage "o=corp" "o=int" > > > > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > >> > >> > Full_Name: Sebastien Prune THOMAS > >> > Version: slapd 2.4.31 > >> > OS: Linux CentOS > >> > URL: ftp://ftp.openldap.org/incoming/ > >> > Submission from: (NULL) (206.167.157.64) > >> > > >> > > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > >> LDAP > >> > server. > >> > Every once and a while I have long lasting connections re-binding as > >> > anonymous, > >> > breaking the actual bind. > >> > This usualy happen after hitting either the idle-timeout or the > >> conn-ttl > >> > limit. > >> > I wasn't able to find out what these values are when not set... but > >> > setting them > >> > low can help reproduce the problem : > >> > >> What is the configuration of back-ldap? Can you post it (after > >> sanitizing > >> sensitive info)? > >> > >> p. > >> > >> -- > >> Pierangelo Masarati > >> Associate Professor > >> Dipartimento di Ingegneria Aerospaziale > >> Politecnico di Milano > >> > >> > > > > --20cf307811d0d379c404d032d6ee > > Content-Type: text/html; charset=ISO-8859-1 > > Content-Transfer-Encoding: quoted-printable > > > > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with > > spec= > > ial timeout tests commented out) :</div><div > > style=3D"font-family:Tahoma;fo= > > nt-size:13px">=A0</div><div > > style=3D"font-family:Tahoma;font-size:13px">dat= > > abase =A0 =A0 =A0ldap > > suffix =A0 =A0 =A0 =A0 =A0 > > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= > > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div > > style= > > =3D"font-family:Tahoma;font-size:13px">=A0</div><div > > style=3D"font-family:T= > > ahoma;font-size:13px"># close connection after a timeout > > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be > dropped > > = > > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 > > 4294967294= > > # close connection after a timeout for ldap > > backend #idle-timeout=A0= > > =A0=A0 4294967294 # Discards current cached connection when the client > > r= > > ebinds - default to No > > #single-conn=A0=A0=A0=A0 no</div><div > > style=3D"font-family:Tahoma;font-size= > > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage > > "o= > > =3Dcorp" "o=3Dint"</div><div > > class=3D"gmail_extra"> <= > > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati > dir=3D"ltr">&= > > lt;<a href=3D"mailto:masarati@aero.polimi.it" > > target=3D"_blank">masarati@ae= > > ro.polimi.it</a>> > > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > > .8ex;border-left:1p= > > x #ccc solid;padding-left:1ex"> > > > Full_Name: Sebastien Prune THOMAS > > > Version: slapd 2.4.31 > > > OS: Linux CentOS > > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" > > target=3D"_blank">ft= > > p://ftp.openldap.org/incoming/</a> > > > Submission from: (NULL) (206.167.157.64) > > > > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > > LD= > > AP > > > server. > > > Every once and a while I have long lasting connections re-binding > > as<b= > > r> > > > anonymous, > > > breaking the actual bind. > > > This usualy happen after hitting either the idle-timeout or the > > conn-t= > > tl > > > limit. > > > I wasn't able to find out what these values are when not set... > > bu= > > t > > > setting them > > > low can help reproduce the problem : > > > > What is the configuration of back-ldap? =A0Can you post it (after > > sanitizin= > > g > > sensitive info)? > > > > p. > > > > -- > > Pierangelo Masarati > > Associate Professor > > Dipartimento di Ingegneria Aerospaziale > > Politecnico di Milano > > > > </blockquote></div> </div> > > > > --20cf307811d0d379c404d032d6ee-- > > > > > > > > > > > > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d0eb756704d0342092 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Actualy I had t= his before and that did not change anything. I don't think this directi= ve is used for this kind of "timeouts"... <div> </div><div>I also tried :</div><div> </div><div>chase-referrals yes (this is defau= lt) </div><div>rebind-as-user yes (as suggested here) </div><di= v> s= ingle-conn yes (default to NO) </div><div> </div><div>I also tried some combinings of=A0idassert-bind o= ptions with no luck (as the backend does not support identity assertion).</= span></div> <div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012/12/6 Pie= rangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> <blockqu= ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s= olid;padding-left:1ex"> > --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=3DISO-8859-1 <div class=3D"im">> > Config is basic (with special timeout tests commented out) : > > database =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" > uri =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ldaps://<a href=3D"http://10.100.1= 20.153" target=3D"_blank">10.100.120.153</a> > > # close connection after a timeout > #idletimeout =A0 =A0 100 > # causes a cached connection to be dropped an recreated after a given = ttl > #conn-ttl =A0 =A0 =A0 =A04294967294 > # close connection after a timeout for ldap backend > #idle-timeout =A0 =A04294967294 > # Discards current cached connection when the client rebinds - default= to > No > #single-conn =A0 =A0 no </div>Try adding a "rebind-as-user" here. =A0This forces back-lda= p to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. <div><div class=3D"h5"> > overlay =A0 =A0 =A0 =A0 rwm > rwm-suffixmassage "o=3Dcorp" "o=3Dint" > > > 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it">masarati(a)aero.polimi.it</a>> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_= blank">ftp://ftp.openldap.org/incoming/</a> >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-bin= ding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or t= he >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not = set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? =A0Can you post it (after<= br> >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > </div></div>> --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=3DISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D3D"font-family:Tahoma;font-size:13px">Con= fig is basic (with > spec=3D > ial timeout tests commented out) :</div><div > style=3D3D"font-family:Tahoma;fo=3D > nt-size:13px">=3DA0</div><div > style=3D3D"font-family:Tahoma;font-size:13px">dat=3D > abase =3DA0 =3DA0 =3DA0ldap > suffix =3DA0 =3DA0 =3DA0 =3DA0 =3DA0 > =3DA0&quot;o=3D3Dcorp&quot; uri=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3D > =3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0 =3DA0 =3DA0<a>ldaps://<a hre= f=3D"http://10.100.120.153" target=3D"_blank">10.100.120.153</a></a>&= lt;/div><div > style=3D > =3D3D"font-family:Tahoma;font-size:13px">=3DA0</div&gt= ;<div > style=3D3D"font-family:T=3D > ahoma;font-size:13px"># close connection after a timeout<br= > > #idletimeout=3DA0=3DA0=3DA0=3DA0 100 # causes a cached connec= tion to be dropped > =3D > an recreated after a given ttl #conn-ttl=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3DA0 > 4294967294=3D > # close connection after a timeout for ldap > backend #idle-timeout=3DA0=3D > =3DA0=3DA0 4294967294 # Discards current cached connection wh= en the client > r=3D > ebinds - default to No > #single-conn=3DA0=3DA0=3DA0=3DA0 no</div><div > style=3D3D"font-family:Tahoma;font-size=3D > :13px"> overlay=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3D= A0 rwm rwm-suffixmassage > &quot;o=3D > =3D3Dcorp&quot; &quot;o=3D3Dint&quot;</div><div<b= r> > class=3D3D"gmail_extra"> <=3D > div class=3D3D"gmail_quote">2012/12/6 Pierangelo Masarati= <span > dir=3D3D"ltr">&=3D > lt;<a href=3D3D"mailto:<a href=3D"mailto:masarati@aero.polimi.= it">masarati(a)aero.polimi.it</a>" > target=3D3D"_blank">masarati@ae=3D > <a href=3D"http://ro.polimi.it" target=3D"_blank">ro.polimi.it</a><= /a>&gt; > <blockquote class=3D3D"gmail_quote" style=3D3D"margi= n:0 0 0 > .8ex;border-left:1p=3D > x #ccc solid;padding-left:1ex"> > &gt; Full_Name: Sebastien Prune THOMAS > &gt; Version: slapd 2.4.31 > &gt; OS: Linux CentOS > &gt; URL: <a href=3D3D"<a href=3D"ftp://ftp.openldap.org/i= ncoming/" target=3D"_blank">ftp://ftp.openldap.org/incoming/</a>" > target=3D3D"_blank">ft=3D > p://<a href=3D"http://ftp.openldap.org/incoming/" target=3D"_blank">ft= p.openldap.org/incoming/</a></a> > &gt; Submission from: (NULL) (206.167.157.64) > &gt; > &gt; > &gt; I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory > LD=3D > AP > &gt; server. > &gt; Every once and a while I have long lasting connections re-bin= ding > as<b=3D > r> > &gt; anonymous, > &gt; breaking the actual bind. > &gt; This usualy happen after hitting either the idle-timeout or t= he > conn-t=3D > tl > &gt; limit. > &gt; I wasn&#39;t able to find out what these values are when = not set... > bu=3D > t > &gt; setting them > &gt; low can help reproduce the problem : > > What is the configuration of back-ldap? =3DA0Can you post it (after<br= > > sanitizin=3D > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> &lt= ;/div> > > --20cf307811d0d379c404d032d6ee-- <div class=3D"HOEnZb"><div class=3D"h5">> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> --20cf307811d0eb756704d0342092--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=ISO-8859-1 > > Config is basic (with special timeout tests commented out) : > > database ldap > suffix "o=corp" > uri ldaps://10.100.120.153 > > # close connection after a timeout > #idletimeout 100 > # causes a cached connection to be dropped an recreated after a given ttl > #conn-ttl 4294967294 > # close connection after a timeout for ldap backend > #idle-timeout 4294967294 > # Discards current cached connection when the client rebinds - default to > No > #single-conn no Try adding a "rebind-as-user" here. This forces back-ldap to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. > overlay rwm > rwm-suffixmassage "o=corp" "o=int" > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: ftp://ftp.openldap.org/incoming/ >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-binding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or the >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? Can you post it (after >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > > --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=ISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with > spec= > ial timeout tests commented out) :</div><div > style=3D"font-family:Tahoma;fo= > nt-size:13px">=A0</div><div > style=3D"font-family:Tahoma;font-size:13px">dat= > abase =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div > style= > =3D"font-family:Tahoma;font-size:13px">=A0</div><div > style=3D"font-family:T= > ahoma;font-size:13px"># close connection after a timeout > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be dropped > = > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 > 4294967294= > # close connection after a timeout for ldap > backend #idle-timeout=A0= > =A0=A0 4294967294 # Discards current cached connection when the client > r= > ebinds - default to No > #single-conn=A0=A0=A0=A0 no</div><div > style=3D"font-family:Tahoma;font-size= > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage > "o= > =3Dcorp" "o=3Dint"</div><div > class=3D"gmail_extra"> <= > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati dir=3D"ltr">&= > lt;<a href=3D"mailto:masarati@aero.polimi.it" > target=3D"_blank">masarati@ae= > ro.polimi.it</a>> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > .8ex;border-left:1p= > x #ccc solid;padding-left:1ex"> > > Full_Name: Sebastien Prune THOMAS > > Version: slapd 2.4.31 > > OS: Linux CentOS > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" > target=3D"_blank">ft= > p://ftp.openldap.org/incoming/</a> > > Submission from: (NULL) (206.167.157.64) > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > LD= > AP > > server. > > Every once and a while I have long lasting connections re-binding > as<b= > r> > > anonymous, > > breaking the actual bind. > > This usualy happen after hitting either the idle-timeout or the > conn-t= > tl > > limit. > > I wasn't able to find out what these values are when not set... > bu= > t > > setting them > > low can help reproduce the problem : > > What is the configuration of back-ldap? =A0Can you post it (after > sanitizin= > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> </div> > > --20cf307811d0d379c404d032d6ee-- > > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307811d0d379c404d032d6ee Content-Type: text/plain; charset=ISO-8859-1 Config is basic (with special timeout tests commented out) : database ldap suffix "o=corp" uri ldaps://10.100.120.153 # close connection after a timeout #idletimeout 100 # causes a cached connection to be dropped an recreated after a given ttl #conn-ttl 4294967294 # close connection after a timeout for ldap backend #idle-timeout 4294967294 # Discards current cached connection when the client rebinds - default to No #single-conn no overlay rwm rwm-suffixmassage "o=corp" "o=int" 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > Full_Name: Sebastien Prune THOMAS > > Version: slapd 2.4.31 > > OS: Linux CentOS > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (206.167.157.64) > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP > > server. > > Every once and a while I have long lasting connections re-binding as > > anonymous, > > breaking the actual bind. > > This usualy happen after hitting either the idle-timeout or the conn-ttl > > limit. > > I wasn't able to find out what these values are when not set... but > > setting them > > low can help reproduce the problem : > > What is the configuration of back-ldap? Can you post it (after sanitizing > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d0d379c404d032d6ee Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with spec= ial timeout tests commented out) :</div><div style=3D"font-family:Tahoma;fo= nt-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px">dat= abase =A0 =A0 =A0ldap suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div style= =3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"font-family:T= ahoma;font-size:13px"># close connection after a timeout #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be dropped = an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 4294967294= # close connection after a timeout for ldap backend #idle-timeout=A0= =A0=A0 4294967294 # Discards current cached connection when the client r= ebinds - default to No #single-conn=A0=A0=A0=A0 no</div><div style=3D"font-family:Tahoma;font-size= :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage "o= =3Dcorp" "o=3Dint"</div><div class=3D"gmail_extra"> <= div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati &= lt;<a href=3D"mailto:masarati@aero.polimi.it" target=3D"_blank">masarati@ae= ro.polimi.it</a>> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> > Full_Name: Sebastien Prune THOMAS > Version: slapd 2.4.31 > OS: Linux CentOS > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ft= p://ftp.openldap.org/incoming/</a> > Submission from: (NULL) (206.167.157.64) > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LD= AP > server. > Every once and a while I have long lasting connections re-binding as<b= r> > anonymous, > breaking the actual bind. > This usualy happen after hitting either the idle-timeout or the conn-t= tl > limit. > I wasn't able to find out what these values are when not set... bu= t > setting them > low can help reproduce the problem : What is the configuration of back-ldap? =A0Can you post it (after sanitizin= g sensitive info)? p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </blockquote></div> </div> --20cf307811d0d379c404d032d6ee--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> Full_Name: Sebastien Prune THOMAS > Version: slapd 2.4.31 > OS: Linux CentOS > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (206.167.157.64) > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP > server. > Every once and a while I have long lasting connections re-binding as > anonymous, > breaking the actual bind. > This usualy happen after hitting either the idle-timeout or the conn-ttl > limit. > I wasn't able to find out what these values are when not set... but > setting them > low can help reproduce the problem : What is the configuration of back-ldap? Can you post it (after sanitizing sensitive info)? p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

Full_Name: Sebastien Prune THOMAS Version: slapd 2.4.31 OS: Linux CentOS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (206.167.157.64) I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP server. Every once and a while I have long lasting connections re-binding as anonymous, breaking the actual bind. This usualy happen after hitting either the idle-timeout or the conn-ttl limit. I wasn't able to find out what these values are when not set... but setting them low can help reproduce the problem : Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 fd=39 ACCEPT from IP=10.100.64.68:33906 (IP=0.0.0.0:389) Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 BIND dn="cn=ldapintbind,o=corp" method=128 Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 BIND dn="cn=ldapintbind,o=shq" mech=SIMPLE ssf=0 Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 RESULT tag=97 err=0 text= Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SRCH base="o=corp" scope=2 deref=3 filter="(&(objectClass=*)(uid=pry))" Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SRCH attr=uid Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=2 CMP dn="cn=00-BASICAUTH,o=corp" attr="member" Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=2 RESULT tag=111 err=6 text= Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SRCH base="o=corp" scope=2 deref=3 filter="(&(objectClass=*)(uid=dln))" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SRCH attr=uid Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 ldap_back_retry: retrying URI="ldaps://10.100.120.153" DN="cn=ldapintbindo=corp" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 ldap_back_dobind_int: DN="cn=ldapintbind,o=corp" without creds, binding anonymously Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=4 CMP dn="cn=00-BASICAUTH,o=corp" attr="member" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=4 RESULT tag=111 err=5 text= Dec 6 09:23:28 qxpldp01 slapd[40707]: conn=1095 fd=39 closed (slapd shutdown) There, the connection is opened on december the 5... then idle... then another search is done on december the 6... and leads to a re-bind... Either, I don't understand why : - openldap don't re-use the credential of the first bind OR - openldap simply end the TCP connection when the timeout is reached instead of re-using it like if it was a new connection --- > the client is not aware of that and still thinks the last bind is valid. I tried every option I could without success... For now, I set the conn-ttl and idle-timeout to the max an unsigned long could support : 4294967294 Any other solution apreciated...

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by michael＠stroeder.com 04 Dec '12

04 Dec '12

This is a cryptographically signed message in MIME format. --------------ms080001080509060504090401 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Quanah Gibson-Mount wrote: > I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talk= ing > about the commits for ITS7308 and ITS7309, which touched a significant = number > of files. Generally we need someone to go through contrib and verify t= hings > build ok. Yeah, no problem. My build script currently contains the lines below for overlays I'm alway= s using. Please apply the patches to RE24 and I will test as many overlays = as possible. Ciao, Michael. ------------------------------- snip ------------------------------- # Build selected contrib overlays # slapo-allowed cd ${OPENLDAP_CONTRIB_MOD}/allowed make clean ; make PREFIX=3D${OPENLDAP_PREFIX} # slapo-lastbind cd ${OPENLDAP_CONTRIB_MOD}/lastbind make clean ; make prefix=3D${OPENLDAP_PREFIX} # slapo-noopsrch cd ${OPENLDAP_CONTRIB_MOD}/noopsrch make clean ; make prefix=3D${OPENLDAP_PREFIX} # slapo-smbk5pwd cd ${OPENLDAP_CONTRIB_MOD}/smbk5pwd make clean ; make prefix=3D${OPENLDAP_PREFIX} DEFS=3D"-DDO_SAMBA -DDO_SHA= DOW" --------------ms080001080509060504090401 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMjA0MTg0NzI4WjAjBgkq hkiG9w0BCQQxFgQU0i74cGCINoBUMa+SopgnSm/SyfgwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAj+hC4vk+9YseHBkFV80S/vi18exEl55i068Bjjr7P/A5gt0BpJP2jIIKnPEzxikfnIhv OogXkVWpOD1VL+dHZouNKWHx2rLu8IYgU+sZKFtqRShfevc25HniCGKs0g50HRsjrI1BcrK2 bOp+dDxmt+9z9kaQXkVqCMgMDSqvLY90JPNSssW2RXwezIpoo0Sk06bxwsnXploF0qZYYPTO alGNv3uCckWCVd6gna63jMz51aV7c/7+sJYG/hZz/ps5C0IFeZ07mhANeAMKjC793/U+MEwu A9CQgrkBMKKHOjmQOvQyNKQ4YHQ8BzU5/Ql0xkTMBY2/4CDdtw+D6874MwAAAAAAAA== --------------ms080001080509060504090401--

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by quanah＠zimbra.com 04 Dec '12

04 Dec '12

--On Tuesday, December 04, 2012 7:36 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > quanah(a)zimbra.com wrote: >> --On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: >> >>> fumiyas(a)osstech.jp wrote: >>>> At Wed, 28 Nov 2012 20:04:41 GMT, >>>> michael(a)stroeder.com wrote: >>>>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>>>> to ease building it without installed OpenLDAP client libs: >>>> >>>> This ITS is a dup of #7309. >>>> http://www.openldap.org/its/index.cgi?findid=7309 >>>> >>>> And see also: >>>> http://www.openldap.org/its/index.cgi?findid=7308 >>>> >>>> This problem is fixed in master, but not in 2.4 branch... >>> >>> Ah, thanks for the hint. The Makefile in master looks much better than >>> my suggestion. >>> >>> @Quanah: Could you please port this to RE24 branch? >> >> My recollection is we've been waiting on someone to go through and test >> the changes. Are you willing to do that? it sounds like you've >> started... > > Which tests do you expect? > > I usually build without the KRB5 support. If you want this to be also > tested I have to reactivate my rusty heimdal knowledge a bit. I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talking about the commits for ITS7308 and ITS7309, which touched a significant number of files. Generally we need someone to go through contrib and verify things build ok. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by michael＠stroeder.com 04 Dec '12

04 Dec '12

quanah(a)zimbra.com wrote: > --On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: > >> fumiyas(a)osstech.jp wrote: >>> At Wed, 28 Nov 2012 20:04:41 GMT, >>> michael(a)stroeder.com wrote: >>>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>>> to ease building it without installed OpenLDAP client libs: >>> >>> This ITS is a dup of #7309. >>> http://www.openldap.org/its/index.cgi?findid=7309 >>> >>> And see also: >>> http://www.openldap.org/its/index.cgi?findid=7308 >>> >>> This problem is fixed in master, but not in 2.4 branch... >> >> Ah, thanks for the hint. The Makefile in master looks much better than my >> suggestion. >> >> @Quanah: Could you please port this to RE24 branch? > > My recollection is we've been waiting on someone to go through and test the > changes. Are you willing to do that? it sounds like you've started... Which tests do you expect? I usually build without the KRB5 support. If you want this to be also tested I have to reactivate my rusty heimdal knowledge a bit. Ciao, Michael.

1 0

RE: (ITS#7434) idassert-bind fails after restarting slapd
by blance3459＠hotmail.com 04 Dec '12

04 Dec '12

--_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Quanah=2C=20 =20 I finally got back around to working on this over the last couple of days. = Where I'm at with my project is: I have two servers (virtual machines)=2C = named master and replica=2C with slapd configured with my directory inform= ation and single-master replication between them. =20 I created a Kerberos realm and various principals in open ldap. =20 Replication access is authenticated using sasl/gssapi with the slapd princ= ipal=2C ldap/replica.example.net. =20 k5start has been added to system startup to buid the credential cache for = slapd. =20 That brings me to configuring referrals and proxyAuth on replica. What ap= pears to be happening is that at the initial configuration (before restarti= ng the daemon) is the client binds to the replica and authenticates with it= s kerberos ticket. The "magic" is performed on the sasl user and the ldap directory entry is returned. It then proceeds into the modifi= cation and notices the update referral. It then checks to determine if the= binddn used in in the olcDbIDAssertBind statems can authzTo the bound user. It can and the proxy of the modificati= on proceeds. On the master=2C the proxy request is received=2C more "magic= " is done on the user id to make sure it is in=20 the correct form=2C the authzTo attribute is again checked and allowed. Th= e update is performed as the user=2C and success is returned back through t= he chain to the user. This is how I would expect=20 the process to proceed. However=2C if I restart the server (or slapd daemo= n)=2C this behavior changes. After restarting=2C the bind occurs at the re= plica=2C does "magic"=2C and then sees the referral and attempts the proxy.= What's notable here is that the check of authzTo is NOT performed. The refereal is then chased=2C but the authzTo check was never made. Since= there is no user to "authzTo"=2C does the referral get chased with perhaps= a "null" or anonymous user? Whatever the case=2C it appears the the original binding user is never sent= over the proxy. Over at the master=2C I see the bind request come on from= the replica which is treated as an anonymous bind request. No magic=2C no authzTo check=2C no nothing. It then goes straight into the= modification and tries to perform=2C but is blocked due to the bound user = being anonymous and the stronger authentication error (8) is returned. =20 Given that the bind occured anonymously=2C I feel that error is expected an= d wanted. =20 I had been trying to use sasl binding here=2C but was not having the same s= ucess that I had with syncrepl. In order to only fight one battle at a tim= e=2C I changed by proxy config to use a simple bind instead of sasl/gssapi.= =20 =20 Referrals and proxy authentication are configured on replica with the follo= wing ldif. I tried setting the override flag because the man page makes it= sound like it forces the authzTo check at bind time. By doing that I was hoping I could force the check and see the authzTo proc= ess in my logs. Is this what the ITS you mentions is referring to?=20 dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig changetype: modify add: olcUpdateref olcUpdateref: "ldap://master.example.net:389/" =20 dn: cn=3Dmodule{0}=2Ccn=3Dconfig changetype: modify add: olcModuleLoad olcModuleLoad: {1}back_ldap =20 dn: olcOverlay=3Dchain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE =20 dn: olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}fronten= d=2Ccn=3Dconfig changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://master.example.net:389/" olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=3Dsimple binddn=3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" credentials=3Dshhh-secret mode=3Dself flags=3Doverride starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem =20 =20 After adding that information via ldapmodify=2C I attempt to perform an upd= ate on the replica. For testing=2C i simply change the description attribu= te for uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. I'm us= ing this simple ldif to test with: dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet changetype: modify replace: description description: Network Administrator Initially after configuring the proxy and obtainng a kerberos ticket for th= e account (administrator=2C self write)=2C this update succeeds. Looking a= t syslog on replica=2C I see happiness. The ldap modify binds using gssapi= =2C I see SASL name being correctly converted to uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. Dec 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: auth= cid=3D"administrator" Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: conn 1005 id=3Dadmini= strator [len=3D13] Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: u:id converted to uid= =3Dadministrator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <uid=3Dadministrator= =2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth> Dec 3 22:17:01 replica slapd[994]: <<< dnNormalize: <uid=3Dadministrator= =2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth> Dec 3 22:17:01 replica slapd[994]: =3D=3D>slap_sasl2dn: converting SASL n= ame uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth to a D= N Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_context_apply [depth= =3D1] string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth' Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth'= string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth= ' [1 pass(es)] Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3D= administrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' [1 pass(es)] Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_context_apply [depth= =3D1] res=3D{0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dn= et'} Dec 3 22:17:01 replica slapd[994]: [rw] authid: "uid=3Dadministrator=2Ccn= =3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -> "uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: slap_parseURI: parsing uid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <=3D=3Dslap_sasl2dn: Converted SASL na= me to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: dn:id converted to ui= d=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: slapA= uthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: SASL proxy authorize [conn=3D1005]: au= thcid=3D"administrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND authcid=3D"adm= inistrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:17:01 replica slapd[994]: SASL Authorize [conn=3D1005]: proxy a= uthorization allowed authzDN=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_sasl: err=3D0 len=3D-1 Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND dn=3D"uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ssf= =3D56 ssf=3D56 Dec 3 22:17:01 replica slapd[994]: do_bind: SASL/GSSAPI bind: dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 Dec 3 22:17:01 replica slapd[994]: send_ldap_response: msgid=3D3 tag=3D97= err=3D0 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 RESULT tag=3D97 err= =3D0 text=3D Dec 3 22:17:01 replica slapd[994]: <=3D=3D slap_sasl_bind: rc=3D0 All good=2C so far on replica. I believe the sasl/gssapi authntication pr= ocess is completed. Now to perform the modify. Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 do_modify Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 modifications: Dec 3 22:17:01 replica slapd[994]: #011replace: description Dec 3 22:17:01 replica slapd[994]: #011#011one value=2C length 21 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD dn=3D"uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD attr=3Ddescript= ion Dec 3 22:17:01 replica slapd[994]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p= =3D3 Dec 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D10 matched=3D"= " text=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_result: referral=3D"ldap://m= aster.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" -> "ldap://master.example.net:389" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet": URI=3D"ldap://master.example.net:389" found in cache =20 Okay=2C now it seems that the referral is returned and chased on behalf of= the client. Finally=2C from the perspective of replica=2C success! Modif= ied data comes back to replica via syncrepl. Dec 3 22:17:01 replica slapd[994]: =3D>ldap_back_getconn: conn 0x7fe0b01= 47c30 fetched refcnt=3D1. Dec 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p= =3D3 Dec 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D0 matched=3D""= text=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_response: msgid=3D4 tag=3D10= 3 err=3D0 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 RESULT tag=3D103 er= r=3D0 text=3D =20 Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]: 15r Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: daemon: read active on 15 Dec 3 22:17:01 replica slapd[994]: connection_get(15) Dec 3 22:17:01 replica slapd[994]: connection_get(15): got connid=3D0 Dec 3 22:17:01 replica slapd[994]: =3D>do_syncrepl rid=3D123 Dec 3 22:17:01 replica slapd[994]: =3D>do_syncrep2 rid=3D123 Dec 3 22:17:01 replica slapd[994]: do_syncrep2: rid=3D123 cookie=3Drid=3D= 123=2Ccsn=3D20121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: >>> dnPretty: <cn=3Dadmin=2Cdc=3Dexamp= le=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPretty: <cn=3Dadmin=2Cdc=3Dexamp= le=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <cn=3Dadmin=2Cdc=3Dex= ample=2Cdc=3Dnet> Dec 3 22:17:01 replica rsyslogd-2177: imuxsock begins to drop messages fr= om pid 994 due to rate-limiting So everything looks good (correct?) on replica. Meanwhile=2C back at the = master....=20 Dec 3 22:17:01 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:17:01 master slapd[947]: daemon: activity on: Dec 3 22:17:01 master slapd[947]: 51r Dec 3 22:17:01 master slapd[947]:=20 Dec 3 22:17:01 master slapd[947]: daemon: read active on 51 Dec 3 22:17:01 master slapd[947]: connection_get(51) Dec 3 22:17:01 master slapd[947]: connection_get(51): got connid=3D1054 Dec 3 22:17:01 master slapd[947]: connection_read(51): checking for input= on id=3D1054 Dec 3 22:17:01 master slapd[947]: op tag 0x66=2C time 1354591021 Dec 3 22:17:01 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:17:01 master slapd[947]: daemon: activity on: Dec 3 22:17:01 master slapd[947]:=20 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 do_modify Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:17:01 master slapd[947]: =3D> get_ctrls Dec 3 22:17:01 master slapd[947]: =3D> get_ctrls: oid=3D"2.16.840.1.11373= 0.3.4.18" (noncritical) Dec 3 22:17:01 master slapd[947]: parseProxyAuthz: conn 1054 authzid=3D"d= n:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: slap_sasl_getdn: conn 1054 id=3Ddn:uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet [len=3D48] Dec 3 22:17:01 master slapd[947]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl2dn: converting SASL na= me uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet to a DN Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_context_apply [depth=3D= 1] string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth'= string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' [1 = pass(es)] Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' [1 pass(es)] Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_context_apply [depth=3D= 1] res=3D{0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'= } Dec 3 22:17:01 master slapd[947]: [rw] authid: "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" -> "uid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: slap_parseURI: parsing uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <=3D=3Dslap_sasl2dn: Converted SASL nam= e to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: slap_sasl_getdn: dn:id converted to uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: parseProxyAuthz: conn=3D1054 "uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl_authorized: can cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet become uid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet? Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl_check_authz: does uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet match authzTo rule= in cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet? Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "cn=3Dreplica= =2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "authzTo" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("cn=3Dreplica=2Cou=3Dhosts= =2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "cn=3D= replica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (authzTo) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: auth access to "cn= =3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" "authzTo" requested Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [2] attr authzTo Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "cn=3Dre= plica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "authzTo" requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [1] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [1] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: auth access g= ranted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: auth access grante= d by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result was in cach= e (authzTo) Dec 3 22:17:01 master slapd[947]: =3D=3D=3D>slap_sasl_match: comparing DN= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet to rule dn:* Dec 3 22:17:01 master slapd[947]: slap_parseURI: parsing dn:* Dec 3 22:17:01 master slapd[947]: <=3D=3D=3Dslap_sasl_match: comparison r= eturned 0 Dec 3 22:17:01 master slapd[947]: <=3D=3Dslap_sasl_check_authz: authzTo c= heck returning 0 Dec 3 22:17:01 master slapd[947]: <=3D=3D slap_sasl_authorized: return 0 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 PROXYAUTHZ dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: <=3D get_ctrls: n=3D1 rc=3D0 err=3D"" Dec 3 22:17:01 master slapd[947]: >>> dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 modifications: Dec 3 22:17:01 master slapd[947]: #011replace: description Dec 3 22:17:01 master slapd[947]: #011#011one value=2C length 21 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 MOD dn=3D"uid=3Dadmi= nistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 MOD attr=3Ddescripti= on Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> test_filter Dec 3 22:17:01 master slapd[947]: PRESENT Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr objectClass Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: search access= granted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access gran= ted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: <=3D test_filter 6 Dec 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fscope = 1 rc 6 Dec 3 22:17:01 master slapd[947]: hdb_modify: uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: slap_queue_csn: queing 0x7fa90f0fe110 2= 0121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: 0x0000000b: uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (description) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: delete access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "description" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr description Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "description"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] applying write(=3Dwr= scxd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] mask: write(=3Dwrscx= d) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: delete access= granted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: delete access gran= ted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (description) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: add access to "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "description" req= uested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr description Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "description"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to value by "uid=3Dadmin= istrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] applying write(=3Dwr= scxd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] mask: write(=3Dwrscx= d) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: add access gr= anted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: add access granted= by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: acl: internal mod entryCSN: modify acce= ss granted Dec 3 22:17:01 master slapd[947]: acl: internal mod modifiersName: modify= access granted Dec 3 22:17:01 master slapd[947]: acl: internal mod modifyTimestamp: modi= fy access granted Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace descriptio= n Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace entryCSN Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace modifiersN= ame Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace modifyTime= stamp Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "inetOrgPerso= n" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "posixAccount= " Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "shadowAccoun= t" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbPrincipal= Aux" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbTicketPol= icyAux" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "objectClass" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "cn" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "sn" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "uidNumber" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "gidNumber" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "userPassword" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "homeDirectory" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "structuralObject= Class" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "uid" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "entryUUID" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "creatorsName" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "createTimestamp" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbPrincipalName= " Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbPrincipalKey" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastPwdChange= " Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastFailedAut= h" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLoginFailedCo= unt" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastSuccessfu= lAuth" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbExtraData" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "description" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "entryCSN" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "modifiersName" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "modifyTimestamp" Dec 3 22:17:01 master slapd[947]: =3D> key_change(DELETE=2Cb) Dec 3 22:17:01 master slapd[947]: bdb_idl_delete_key: b=20 Dec 3 22:17:01 master slapd[947]: <=3D key_change 0 Dec 3 22:17:01 master slapd[947]: =3D> key_change(ADD=2Cb) Dec 3 22:17:01 master slapd[947]: bdb_idl_insert_key: b=20 Dec 3 22:17:01 master slapd[947]: <=3D key_change 0 Dec 3 22:17:01 master slapd[947]: =3D> entry_encode(0x0000000b):=20 Dec 3 22:17:01 master slapd[947]: <=3D entry_encode(0x0000000b):=20 Dec 3 22:17:01 master slapd[947]: hdb_modify: updated id=3D0000000b dn=3D"= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: send_ldap_result: conn=3D1054 op=3D3 p= =3D3 Dec 3 22:17:01 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" = text=3D"" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> test_filter Dec 3 22:17:01 master slapd[947]: PRESENT Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr objectClass Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: search access= granted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access gran= ted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: <=3D test_filter 6 Dec 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fscope = 1 rc 6 Dec 3 22:17:01 master slapd[947]: syncprov_sendresp: cookie=3Drid=3D123= =2Ccsn=3D20121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Everything looks good on the master. I see uid=3Dadministrator gets sent = over from the the proxy on replica and the update proceeds as expected. No= w if I restart slapd on replica=2C things change. performing the same modi= fucation=2C we again see sasl/gssapi authentication occuring on replica jus= t as before Dec 3 22:20:38 replica slapd[1412]: [rw] authid: "uid=3Dadministrator=2C= cn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -> "uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: slap_parseURI: parsing uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <=3D=3Dslap_sasl2dn: Converted SASL n= ame to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: slap_sasl_getdn: dn:id converted to u= id=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: SASL Canonicalize [conn=3D1000]: slap= AuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: SASL proxy authorize [conn=3D1000]: a= uthcid=3D"administrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND authcid=3D"ad= ministrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:20:38 replica slapd[1412]: SASL Authorize [conn=3D1000]: proxy = authorization allowed authzDN=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_sasl: err=3D0 len=3D-1 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND dn=3D"uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ss= f=3D56 ssf=3D56 Dec 3 22:20:38 replica slapd[1412]: do_bind: SASL/GSSAPI bind: dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 Dec 3 22:20:38 replica slapd[1412]: send_ldap_response: msgid=3D3 tag=3D9= 7 err=3D0 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 RESULT tag=3D97 er= r=3D0 text=3D Dec 3 22:20:38 replica slapd[1412]: <=3D=3D slap_sasl_bind: rc=3D0 Again=2C we head into the modification: Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 do_modify Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:20:38 replica slapd[1412]: >>> dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 modifications: Dec 3 22:20:38 replica slapd[1412]: #011replace: description Dec 3 22:20:38 replica slapd[1412]: #011#011one value=2C length 21 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 MOD dn=3D"uid=3Dad= ministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 MOD attr=3Ddescrip= tion Dec 3 22:20:38 replica slapd[1412]: bdb_dn2entry("uid=3Dadministrator=2Co= u=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: =3D> hdb_dn2id("ou=3Dpeople=2Cdc=3Dex= ample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: <=3D hdb_dn2id: got id=3D0x3 Dec 3 22:20:38 replica slapd[1412]: daemon: activity on 1 descriptor Dec 3 22:20:38 replica slapd[1412]: daemon: activity on: Dec 3 22:20:38 replica slapd[1412]: =20 So far=2C so good (I think)=2C replica sees the need to refer the action a= nd tries to chase it on behalf of the clent: Dec 3 22:20:38 replica slapd[1412]: =3D> hdb_dn2id("uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: <=3D hdb_dn2id: got id=3D0xb Dec 3 22:20:38 replica slapd[1412]: entry_decode: "" Dec 3 22:20:38 replica slapd[1412]: <=3D entry_decode() Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D10 matched=3D= "" text=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: referral=3D"ldap://= master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet" Dec 3 22:20:38 replica slapd[1412]: >>> dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" -> "ldap://master.example.net:389" Dec 3 22:20:38 replica slapd[1412]: ldap_back_db_open: URI=3Dldap://maste= r.example.net:389 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" temporary Dec 3 22:20:38 replica slapd[1412]: =3D>ldap_back_getconn: conn=3D1000 op= =3D3: lc=3D0x7f213015a7d0 inserted refcnt=3D1 rc=3D0 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 =20 At this point=2C I "assume" the modification has been passed off to master.= However=2C I notice that I never see the replica checking authzTo like be= fore the restart. I think this is where it's falling apart for me and the e= rr=3D8 back is returned from master. =20 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matched=3D"= " text=3D"modifications require authentication" Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matched=3D"= " text=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_response: msgid=3D4 tag=3D1= 03 err=3D8 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 RESULT tag=3D103 e= rr=3D8 text=3D Dec 3 22:20:38 replica slapd[1412]: daemon: activity on 1 descriptor Dec 3 22:20:38 replica slapd[1412]: daemon: activity on: Dec 3 22:20:38 replica slapd[1412]: 18r =20 Over on the master we see the proxy connection occurs=2C but the client cr= edentials never apper to arrive. I say that because=2C it looks to me like= the proxy connection from replica appears to bind anonymously. Dec 3 22:20:38 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]:=20 Dec 3 22:20:38 master slapd[947]: slap_listener_activate(8):=20 Dec 3 22:20:38 master slapd[947]: >>> slap_listener(ldap:///) Dec 3 22:20:38 master slapd[947]: daemon: listen=3D8=2C new connection on= 51 Dec 3 22:20:38 master slapd[947]: daemon: added 51r (active) listener=3D(= nil) Dec 3 22:20:38 master slapd[947]: conn=3D1056 fd=3D51 ACCEPT from IP=3D19= 2.168.1.2:34759 (IP=3D0.0.0.0:389) Dec 3 22:20:38 master slapd[947]: daemon: activity on 2 descriptors Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]: 51r Dec 3 22:20:38 master slapd[947]:=20 Dec 3 22:20:38 master slapd[947]: daemon: read active on 51 Dec 3 22:20:38 master slapd[947]: connection_get(51) Dec 3 22:20:38 master slapd[947]: connection_get(51): got connid=3D1056 Dec 3 22:20:38 master slapd[947]: connection_read(51): checking for input= on id=3D1056 Dec 3 22:20:38 master slapd[947]: op tag 0x60=2C time 1354591238 Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 do_bind Dec 3 22:20:38 master slapd[947]: >>> dnPrettyNormal: <> Dec 3 22:20:38 master slapd[947]: <<< dnPrettyNormal: <>=2C <> Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 BIND dn=3D"" method= =3D128 Dec 3 22:20:38 master slapd[947]: do_bind: version=3D3 dn=3D"" method=3D1= 28 Dec 3 22:20:38 master slapd[947]: send_ldap_result: conn=3D1056 op=3D0 p= =3D3 Dec 3 22:20:38 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" = text=3D"" Dec 3 22:20:38 master slapd[947]: send_ldap_response: msgid=3D1 tag=3D97 = err=3D0 Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 RESULT tag=3D97 err= =3D0 text=3D Dec 3 22:20:38 master slapd[947]: do_bind: v3 anonymous bind Dec 3 22:20:38 master slapd[947]: daemon: activity on 2 descriptors Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]: 51r Dec 3 22:20:38 master slapd[947]:=20 After=2C the (anonymous) bind=2C the master never attempts to if the proxya= uth request is allowed via authzTo or anything else (perhaps obviously). T= he modification just proceeds anonymously and eventually fails. =20 Not sure if I'm saying this in a way that makes any sense to you. Hopeful= ly=2C it does. It appears=2C that the proxy on replica after restarting=2C= never tries to determine if the olcDbIDAssertBind binddn is permitted to i= mpersonate the client via the authzTo attribute and proceeds with the refer= al chase anonymously. =20 I'll copy paste configs below. Sorry this is so long=2C but I figure the= more information=2C the better when trying to solve any problem. =20 Thanks =20 Barry =20 vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv master configuration vvvvvvvvvvvvvvvvv= vvvvvvvvvvv dn: cn=3Dconfig objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: ea6bf008-d108-1031-912d-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/master_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/master_slapd_key.pem olcAuthzPolicy: to olcSaslHost: master.example.net olcSaslRealm: EXAMPLE.NET olcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet olcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet olcLogLevel: -1 entryCSN: 20121204013949.466434Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204013949Z dn: cn=3Dmodule{0}=2Ccn=3Dconfig objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: ea6dda08-d108-1031-9135-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121203054749.860918Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z dn: cn=3Dschema=2Ccn=3Dconfig objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: ea6c3a0e-d108-1031-9130-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.672699Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z <snip schemas > dn: olcBackend=3D{0}hdb=2Ccn=3Dconfig objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: ea6f949c-d108-1031-9136-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.694663Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break olcAccess: {1}to dn.exact=3D"" by * read olcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: ea6c0bf6-d108-1031-912e-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.671512Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{0}config=2Ccn=3Dconfig objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal=2Ccn=3Dauth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: ea6c325c-d108-1031-912f-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.672495Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=3Dexample=2Cdc=3Dnet olcLastMod: TRUE olcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet olcRootPW:: e1NTSEF9cGhKNWtqME9rOGJnVXp0dy9hYzZEaWFmU1U1Z0FTZk0=3D olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: krbPrincipalName eq=2Cpres=2Csub olcDbIndex: krbPwdPolicyReference eq structuralObjectClass: olcHdbConfig entryUUID: ea6fa3ce-d108-1031-9137-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z olcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange by group.exact=3D= "cn=3Dreplic ators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by self write by anon= ymous auth olcAccess: {1}to attrs=3DauthzTo=2CauthzFrom=2Ccn=2CuidNumber=2CgidNumber= =2Cuid by users r ead by anonymous none olcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFai= ledAuth=2Ckr bLoginFailedCount by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc= =3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" wr= ite by dn=3D"cn=3Dadm-sr v=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by self read by * none olcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by= group.exact=3D"cn =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by dn=3D"cn= =3Dkdc-srv=2Cou=3Dkerberos=2C dc=3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc= =3Dexample=2Cdc=3Dnet" writ e by * none olcAccess: {4}to dn.base=3D"" by * read olcAccess: {5}to * by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C= dc=3Dnet" write by s elf write by users read entryCSN: 20121203054749.804561Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z dn: olcOverlay=3D{0}syncprov=2ColcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 structuralObjectClass: olcSyncProvConfig entryUUID: b77dc36a-d158-1031-9917-2f12ddec6588 creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121203054749Z entryCSN: 20121203054749.962179Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv dc=3D= example=2Cdc=3Dnet vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv dn: dc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: dcObject objectClass: organization o: example.net dc: example structuralObjectClass: organization entryUUID: eac01854-d108-1031-95b6-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.222029Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z contextCSN: 20121204035116.890381Z#000000#000#000000 dn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: eac2e160-d108-1031-95b7-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.240572Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z dn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: people description: user account objects structuralObjectClass: organizationalUnit entryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.299880Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: groups description: group objects structuralObjectClass: organizationalUnit entryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.394485Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: hosts description: host/computer objects structuralObjectClass: organizationalUnit entryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.400935Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: kerberos description: kerberos realm container structuralObjectClass: organizationalUnit entryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.409140Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: replica objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica structuralObjectClass: organizationalRole entryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/replica.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRU= RAxZ oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6= Mn3k f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu= 6lb/ QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065600Z krbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D userPassword:: <secret> entryCSN: 20121203233422.105322Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203233422Z dn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: master objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica userPassword:: e0NSWVBUfSo=3D structuralObjectClass: organizationalRole entryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/master.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW= +aWr 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5= 522A i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH1= 5xNZ VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060855Z krbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203060855.932134Z#000000#000#000000 modifiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203060855Z dn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: posixGroup cn: administrator gidNumber: 50000 structuralObjectClass: posixGroup entryUUID: 1d079216-d12b-1031-978d-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.465616Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: groupOfNames cn: replicators member: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet member: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet structuralObjectClass: groupOfNames entryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.477792Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: administrator sn: administrator uidNumber: 50000 gidNumber: 50000 userPassword:: <secret> homeDirectory: /home/administrator structuralObjectClass: inetOrgPerson uid: administrator entryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: administrator(a)EXAMPLE.NET krbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ecqcdxa= iluD o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/= Ot7l cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADm= Ozq8 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8o= AcwB aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6= yoME 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo= 8yyO mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgED= oSgE JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLR= VhBT VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXG= a5U+ g=3D krbLastPwdChange: 20121203054848Z krbLastFailedAuth: 20121204013714Z krbLoginFailedCount: 0 description: Network Administrator krbLastSuccessfulAuth: 20121204035116Z krbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204035116.890381Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204035116Z dn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: kdc-srv description: Kerberos KDC userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.563692Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: adm-srv description: Kerberos Admin Server userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.575773Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet cn: EXAMPLE.NET objectClass: top objectClass: krbRealmContainer objectClass: krbTicketPolicyAux krbSubTrees: dc=3Dexample=2Cdc=3Dnet krbSearchScope: 2 krbMaxRenewableAge: 604800 krbMaxTicketLife: 36000 structuralObjectClass: krbRealmContainer entryUUID: c03d58b8-d134-1031-83e7-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.757228Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 192 krbPrincipalName: K/M(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/= c4Ks HI=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAkBAAEArgC8UA=3D=3D krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c04d9282-d134-1031-83e8-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.863568Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: krbtgt/EXAMPLE.NET(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNn= fmRR GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7= UKy1 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9= KwFT B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8= oR krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0518180-d134-1031-83e9-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.889347Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3D= kerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/admin(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtC= kdsY 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M2= 8Ix6 SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZ= M5wu tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3a= Qz krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c05346be-d134-1031-83ea-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.900950Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 300 krbMaxRenewableAge: 604800 krbTicketFlags: 8196 krbPrincipalName: kadmin/changepw(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceW= qIB2 ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0w= wSqU ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd= 423Z epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9z= Pl krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c054d88a-d134-1031-83eb-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.911237Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/history(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: kadmin/history(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd= /N+Z 2g=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0562d3e-d134-1031-83ec-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.919957Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/master.example.net(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABhOeGOuo9UBDjK7hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4= Ta3z Y4ZaEYItXr2awBW6QXSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtG= g1qY oev8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj= 0sgn ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf4UwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qYDwpK0Hycj+cwyCjFsVKTsjzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAxTSMEh/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZA= Bm krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAANAD4gA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0581144-d134-1031-83ed-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.932349Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/master.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203060105Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPU= S2wz qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14TYWZyLZem= 5kvD yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAb= Nr3p vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060153Z krbLastSuccessfulAuth: 20121203061721Z krbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203061721.358939Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203061721Z dn: krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE= .NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/replica.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203065511Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUX= FMNw 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKb= ipUj AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOv= mT4x MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065628Z krbLastSuccessfulAuth: 20121204032538Z krbExtraData:: AAIcTbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204032538.048010Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204032538Z =20 =20 =20 vvvvvvvvvvvvvvvvvvvv replica config vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv =20 dn: cn=3Dconfig objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: af9b0068-d108-1031-9417-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/replica_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/replica_slapd_key.pem olcLogLevel: stats olcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet olcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet olcSaslHost: replica.example.net olcSaslRealm: EXAMPLE.NET entryCSN: 20121204023449.956406Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204023449Z dn: cn=3Dmodule{0}=2Ccn=3Dconfig objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}back_ldap structuralObjectClass: olcModuleList entryUUID: af9d1e34-d108-1031-941f-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z entryCSN: 20121204041212.292184Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: cn=3Dschema=2Ccn=3Dconfig objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: af9b564e-d108-1031-941a-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.995860Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z < snip schemas > dn: olcBackend=3D{0}hdb= =2Ccn=3Dconfig objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: af9e498a-d108-1031-9420-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z entryCSN: 20121202201457.015189Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201457Z dn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break olcAccess: {1}to dn.exact=3D"" by * read olcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: af9b211a-d108-1031-9418-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.994497Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z dn: olcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE structuralObjectClass: olcChainConfig entryUUID: 8605cc76-d214-1031-93d2-613cc62fd42f creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121204041212Z entryCSN: 20121204041212.352767Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: olcDatabase=3D{0}ldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}fron= tend=2Ccn=3Dconfig objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://master.example.net:389/" olcDbIDAssertBind: bindmethod=3Dsimple binddn=3D"cn=3Dreplica=2Cou=3Dhosts= =2Cdc=3Dexample=2Cdc =3Dnet" credentials=3D<secret> mode=3Dself flags=3Doverride starttls=3Dcr= itical tls_req cert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem olcDbRebindAsUser: TRUE structuralObjectClass: olcLDAPConfig entryUUID: 8609b6f6-d214-1031-93d3-613cc62fd42f creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121204041212Z entryCSN: 20121204041212.378432Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: olcDatabase=3D{0}config=2Ccn=3Dconfig objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: af9b4528-d108-1031-9419-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.995421Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=3Dexample=2Cdc=3Dnet olcLastMod: TRUE olcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet olcRootPW:: e1NTSEF9eW1nS3JTR0VkMW5LQ0VaQ0Y4UjJBTDlPTlEveENDbzY=3D olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: krbPrincipalName eq=2Cpres=2Csub olcDbIndex: krbPwdPolicyReference eq structuralObjectClass: olcHdbConfig entryUUID: af9e5d12-d108-1031-9421-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z olcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange by group.exact=3D= "cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by self wri= te by anonymous auth olcAccess: {1}to attrs=3DauthzTo=2CauthzFrom by group.exact=3D"cn=3Dreplic= ators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by users read by anonym= ous none olcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFai= ledAuth=2CkrbLoginFailedCount by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3D= example=2Cdc=3Dnet" read by dn =3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by self = read by * none olcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by= dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by dn= =3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C dc=3Dnet" read by * none olcAccess: {4}to dn.base=3D"" by * read olcAccess: {5}to * by self write by users read olcSyncrepl: {0}rid=3D123 provider=3D"ldap://master.example.net:389/" type= =3DrefreshAndPersist retry=3D"60 30 300 +" searchbase=3D"dc=3Dexample=2Cdc= =3Dnet" bindmethod=3Dsasl saslmech=3Dgssapi starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D= /etc/ssl/certs/cacert.pem olcUpdateRef: "ldap://master.example.net:389/" entryCSN: 20121204041212.283590Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z =20 =20 =20 dn: dc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: dcObject objectClass: organization o: example.net dc: example structuralObjectClass: organization entryUUID: eac01854-d108-1031-95b6-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.222029Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z contextCSN: 20121204035116.890381Z#000000#000#000000 dn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: eac2e160-d108-1031-95b7-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.240572Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z dn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: people description: user account objects structuralObjectClass: organizationalUnit entryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.299880Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: groups description: group objects structuralObjectClass: organizationalUnit entryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.394485Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: hosts description: host/computer objects structuralObjectClass: organizationalUnit entryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.400935Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: kerberos description: kerberos realm container structuralObjectClass: organizationalUnit entryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.409140Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: replica objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica structuralObjectClass: organizationalRole entryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/replica.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRU= RAxZ oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6= Mn3k f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu= 6lb/ QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065600Z krbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D userPassword:: <secret> entryCSN: 20121203233422.105322Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203233422Z dn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: master objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/master.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW= +aWr 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5= 522A i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH1= 5xNZ VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060855Z krbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203060855.932134Z#000000#000#000000 modifiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203060855Z dn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: posixGroup cn: administrator gidNumber: 50000 structuralObjectClass: posixGroup entryUUID: 1d079216-d12b-1031-978d-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.465616Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: groupOfNames cn: replicators member: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet member: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet structuralObjectClass: groupOfNames entryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.477792Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: administrator sn: administrator uidNumber: 50000 gidNumber: 50000 userPassword:: <secret> homeDirectory: /home/administrator structuralObjectClass: inetOrgPerson uid: administrator entryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: administrator(a)EXAMPLE.NET krbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ecqcdxa= iluD o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/= Ot7l cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADm= Ozq8 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8o= AcwB aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6= yoME 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo= 8yyO mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgED= oSgE JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLR= VhBT VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXG= a5U+ g=3D krbLastPwdChange: 20121203054848Z krbLastFailedAuth: 20121204013714Z krbLoginFailedCount: 0 description: Network Administrator krbLastSuccessfulAuth: 20121204035116Z krbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204035116.890381Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204035116Z dn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: kdc-srv description: Kerberos KDC userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.563692Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: adm-srv description: Kerberos Admin Server userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.575773Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet cn: EXAMPLE.NET objectClass: top objectClass: krbRealmContainer objectClass: krbTicketPolicyAux krbSubTrees: dc=3Dexample=2Cdc=3Dnet krbSearchScope: 2 krbMaxRenewableAge: 604800 krbMaxTicketLife: 36000 structuralObjectClass: krbRealmContainer entryUUID: c03d58b8-d134-1031-83e7-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.757228Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3D net krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 192 krbPrincipalName: K/M(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/= c4Ks HI=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAkBAAEArgC8UA=3D=3D krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c04d9282-d134-1031-83e8-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.863568Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos =2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: krbtgt/EXAMPLE.NET(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNn= fmRR GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7= UKy1 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9= KwFT B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8= oR krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0518180-d134-1031-83e9-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.889347Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3D= kerberos=2Cdc=3Dex ample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/admin(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtC= kdsY 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M2= 8Ix6 SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZ= M5wu tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3a= Qz krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c05346be-d134-1031-83ea-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.900950Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc =3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 300 krbMaxRenewableAge: 604800 krbTicketFlags: 8196 krbPrincipalName: kadmin/changepw(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceW= qIB2 ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0w= wSqU ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd= 423Z epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9z= Pl krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c054d88a-d134-1031-83eb-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.911237Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/history(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3D example=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: kadmin/history(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd= /N+Z 2g=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0562d3e-d134-1031-83ec-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.919957Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dk erberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/master.example.net(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABhOeGOuo9UBDjK7hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4= Ta3z Y4ZaEYItXr2awBW6QXSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtG= g1qY oev8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj= 0sgn ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf4UwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qYDwpK0Hycj+cwyCjFsVKTsjzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAxTSMEh/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZA= Bm krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAANAD4gA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0581144-d134-1031-83ed-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.932349Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dker beros=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/master.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203060105Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPU= S2wz qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14TYWZyLZem= 5kvD yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAb= Nr3p vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060153Z krbLastSuccessfulAuth: 20121203061721Z krbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203061721.358939Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203061721Z dn: krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE= .NET=2Cou=3Dke rberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/replica.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203065511Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUX= FMNw 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKb= ipUj AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOv= mT4x MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065628Z krbExtraData:: AAIcTbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D krbLastSuccessfulAuth: 20121204032538Z entryCSN: 20121204032538.048010Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204032538Z > Date: Fri=2C 9 Nov 2012 01:55:32 +0000 > From: openldap-its(a)OpenLDAP.org > To: blance3459(a)hotmail.com > Subject: Re: (ITS#7434) idassert-bind fails after restarting slapd >=20 >=20 > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** >=20 > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7434. >=20 > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. >=20 > If you need to provide additional information in regards to your > issue report=2C you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7434) > in the subject will automatically be attached to the issue report. >=20 > mailto:openldap-its@openldap.org?subject=3D(ITS#7434) >=20 > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=3D7434 >=20 > Please remember to retain your issue tracking number (ITS#7434) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. >=20 > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. >=20 > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ >=20 > -------------- > Copyright 1998-2007 The OpenLDAP Foundation=2C All Rights Reserved. >=20 = --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style></style></head> <body class=3D'hmmessage'><div dir=3D'ltr'>Quanah=2C &nbsp=3B I fina= lly got back around to working on this over the last couple of days.&nbsp= =3B Where I'm at with my project is: &nbsp=3BI have two servers (virtual machines)=2C named master an= d replica=2C&nbsp=3B with slapd configured with my directory information an= d single-master replication between them.&nbsp=3B &nbsp=3BI created a K= erberos realm and various principals in open ldap.&nbsp=3B &nbsp=3BRepl= ication access is authenticated using sasl/gssapi with the slapd principal= =2C ldap/replica.example.net.&nbsp=3B &nbsp=3Bk5start has been added to= system startup to buid the credential cache for slapd. &nbsp=3B &nb= sp=3BThat brings me to configuring referrals and proxyAuth on replica.&nbsp= =3B What appears to be happening is that at the initial configuration (= before restarting the daemon) is the client binds to the replica and authen= ticates with its kerberos ticket.&nbsp=3B The "magic" is performed on the s= asl user and the ldap directory entry is returned.&nbsp=3B It then proce= eds into the modification and notices the update referral.&nbsp=3B It then = checks to determine if the binddn used in&nbsp=3B in the olcDbIDAssertBind<= br>statems can authzTo the bound user.&nbsp=3B It can and the proxy of the = modification proceeds.&nbsp=3B On the master=2C the proxy request is receiv= ed=2C more "magic" is done on the user id to make sure it is in the cor= rect form=2C the authzTo attribute is again checked and allowed.&nbsp=3B Th= e update is performed as the user=2C and success is returned back through t= he chain to the user.&nbsp=3B This is how I would expect the process to= proceed.&nbsp=3B However=2C if I restart the server (or slapd daemon)=2C t= his behavior changes.&nbsp=3B After restarting=2C the bind occurs at th= e replica=2C does "magic"=2C and then sees the referral and attempts the pr= oxy.&nbsp=3B What's notable here is that the check of authzTo is NOT perfor= med. The refereal is then chased=2C but the authzTo check was never made= .&nbsp=3B Since there is no user to "authzTo"=2C does the referral get chas= ed with perhaps a "null" or anonymous user? Whatever the case=2C it appe= ars the the original binding user is never sent over the proxy.&nbsp=3B Ove= r at the master=2C I see the bind request come on from the replica which is= treated as an anonymous bind request. No magic=2C no authzTo check=2C n= o nothing.&nbsp=3B It then goes straight into the modification and tries to= perform=2C but is blocked due to the bound user being anonymous and the st= ronger authentication error (8) is returned.&nbsp=3B Given that the bin= d occured anonymously=2C I feel that error is expected and wanted. &nbsp= =3B I had been trying to use sasl binding here=2C but was not having the= same sucess that I had with syncrepl.&nbsp=3B In order to only fight one b= attle at a time=2C I changed by proxy config to use a simple bind instead o= f sasl/gssapi.&nbsp=3B &nbsp=3B Referrals and proxy authentication a= re configured on replica with the following ldif.&nbsp=3B I tried setting t= he override flag because the man page makes it sound like it forces the aut= hzTo check at bind time. By doing that I was hoping I could force the ch= eck and see the authzTo process in my logs.&nbsp=3B Is this what the ITS yo= u mentions is referring to? &nbsp=3B dn: olcDatabase=3D{1}hdb=2Ccn=3D= config &nbsp=3Bchangetype: modify &nbsp=3Badd: olcUpdateref &nbsp= =3BolcUpdateref: "<a href=3D"ldap://master.example.net:389/">ldap://master.= example.net:389/</a>" &nbsp=3B &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dcon= fig &nbsp=3Bchangetype: modify &nbsp=3Badd: olcModuleLoad &nbsp=3B= olcModuleLoad: {1}back_ldap &nbsp=3B &nbsp=3Bdn: olcOverlay=3Dchain= =2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bchangetype: add &= nbsp=3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcChainConfig= &nbsp=3BolcOverlay: {0}chain &nbsp=3BolcChainReturnError: TRUE &n= bsp=3B &nbsp=3Bdn: olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcData= base=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bchangetype: add &nbsp=3Bobj= ectClass: olcLDAPConfig &nbsp=3BobjectClass: olcChainDatabase &nbsp= =3BolcDatabase: {0}ldap &nbsp=3BolcDbURI: "<a href=3D"ldap://master.exam= ple.net:389/">ldap://master.example.net:389/</a>" &nbsp=3BolcDbRebindAsU= ser: TRUE &nbsp=3BolcDbIDAssertBind: bindmethod=3Dsimple &nbsp=3B&nbs= p=3B binddn=3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" &nbs= p=3B&nbsp=3B credentials=3Dshhh-secret &nbsp=3B&nbsp=3B mode=3Dself &= nbsp=3B&nbsp=3B flags=3Doverride &nbsp=3B&nbsp=3B starttls=3Dcritical<br= >&nbsp=3B&nbsp=3B tls_reqcert=3Ddemand &nbsp=3B&nbsp=3B tls_cacert=3D/et= c/ssl/certs/cacert.pem &nbsp=3B &nbsp=3B After adding that infor= mation via ldapmodify=2C I attempt to perform an update on the replica.&nbs= p=3B For testing=2C i simply change the description attribute for uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet.&nbsp=3B I'm using this = simple ldif to test with: &nbsp=3B dn: uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bchangetype: modify &nbsp=3Brep= lace: description &nbsp=3Bdescription: Network Administrator Init= ially after configuring the proxy and obtainng a kerberos ticket for the ac= count (administrator=2C self write)=2C this update succeeds.&nbsp=3B Lookin= g at syslog on replica=2C I see happiness.&nbsp=3B The ldap modify binds us= ing gssapi=2C I see SASL name being correctly converted to uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. &nbsp=3B Dec&nbsp=3B 3 = 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: authcid=3D"ad= ministrator" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: slap_sas= l_getdn: conn 1005 id=3Dadministrator [len=3D13] &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 replica slapd[994]: slap_sasl_getdn: u:id converted to uid=3Dadmini= strator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth &nbsp=3BDec&nbsp=3B= 3 22:17:01 replica slapd[994]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid= =3Dadministrator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth&gt=3B &nbs= p=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &lt=3B&lt=3B&lt=3B dnNormali= ze: &lt=3Buid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth&= gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D=3D&gt=3Bsla= p_sasl2dn: converting SASL name uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn= =3Dgssapi=2Ccn=3Dauth to a DN &nbsp=3BDec&nbsp=3B 3 22:17:01 replica sla= pd[994]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] string=3D'uid=3Dadm= inistrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' &nbsp=3BDec&nbs= p=3B 3 22:17:01 replica slapd[994]: =3D=3D&gt=3B rewrite_rule_apply rule=3D= 'uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Da= uth' string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3D= auth' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = =3D=3D&gt=3B rewrite_rule_apply rule=3D'uid=3D([^=2C]+)=2Ccn=3Dexample.net= =2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3Dadministrator=2Ccn=3Dexample.ne= t=2Ccn=3Dgssapi=2Ccn=3Dauth' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] res=3D{= 0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'} &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: [rw] authid: "uid=3Dadministr= ator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -&gt=3B "uid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 replica slapd[994]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 replica = slapd[994]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 = 22:17:01 replica slapd[994]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL name = to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BD= ec&nbsp=3B 3 22:17:01 replica slapd[994]: slap_sasl_getdn: dn:id converted = to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BD= ec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: = slapAuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL proxy authorize= [conn=3D1005]: authcid=3D"<a href=3D"mailto:administrator@EXAMPLE.NET">adm= inistrator(a)EXAMPLE.NET</a>" authzid=3D"<a href=3D"mailto:administrator@EXAM= PLE.NET">administrator(a)EXAMPLE.NET</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 r= eplica slapd[994]: conn=3D1005 op=3D2 BIND authcid=3D"<a href=3D"mailto:adm= inistrator(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"<a href= =3D"mailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" &nb= sp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL Authorize [conn=3D1005= ]:&nbsp=3B proxy authorization allowed authzDN=3D"" &nbsp=3BDec&nbsp=3B = 3 22:17:01 replica slapd[994]: send_ldap_sasl: err=3D0 len=3D-1 &nbsp=3B= Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: activity on:= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: Dec&nbsp=3B 3 22= :17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND dn=3D"uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ssf=3D56 ssf= =3D56 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: do_bind: SASL/G= SSAPI bind: dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dn= et" sasl_ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: sen= d_ldap_response: msgid=3D3 tag=3D97 err=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:= 01 replica slapd[994]: conn=3D1005 op=3D2 RESULT tag=3D97 err=3D0 text=3D<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &lt=3B=3D=3D slap_sasl= _bind: rc=3D0 &nbsp=3BAll good=2C so far on replica.&nbsp=3B I belie= ve the sasl/gssapi authntication process is completed.&nbsp=3B Now to perfo= rm the modify. Dec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D100= 5 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: co= nn=3D1005 op=3D3 do_modify: dn (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dex= ample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &gt= =3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slap= d[994]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: conn=3D1005 op=3D3 modifications: &nbsp=3BDec&nbsp= =3B 3 22:17:01 replica slapd[994]: #011replace: description &nbsp=3BDec&= nbsp=3B 3 22:17:01 replica slapd[994]: #011#011one value=2C length 21 &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD dn= =3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD attr= =3Ddescription &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: bdb_dn= 2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1= 005 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send= _ldap_result: err=3D10 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 replica slapd[994]: send_ldap_result: referral=3D"<a href=3D"ldap://ma= ster.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd= [994]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 re= plica slapd[994]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3= 22:17:01 replica slapd[994]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3= 22:17:01 replica slapd[994]: Dec&nbsp=3B 3 22:17:01 replica slapd[994]= : &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica= slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap://mas= ter.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet</a>" -&gt=3B "<a href=3D"ldap://master.example.net:3= 89">ldap://master.example.net:389</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 re= plica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap:= //master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet</a>": URI=3D"<a href=3D"ldap://master.example.n= et:389">ldap://master.example.net:389</a>" found in cache &nbsp=3B <= br>&nbsp=3BOkay=2C now it seems that the referral is returned and chased on= behalf of the client.&nbsp=3B Finally=2C from the perspective of replica= =2C success!&nbsp=3B Modified data comes back to replica via syncrepl. &= nbsp=3B Dec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&gt=3Bldap_back_g= etconn: conn 0x7fe0b0147c30 fetched refcnt=3D1. &nbsp=3BDec&nbsp=3B 3 22= :17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p=3D3 &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D0 = matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]= : send_ldap_response: msgid=3D4 tag=3D103 err=3D0 &nbsp=3BDec&nbsp=3B 3 = 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 RESULT tag=3D103 err=3D0 te= xt=3D &nbsp=3B Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon:= activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]:&nbsp=3B 15r &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: read active on 15 &nb= sp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: connection_get(15) &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: connection_get(15): got conni= d=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&gt=3Bdo_syn= crepl rid=3D123 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&g= t=3Bdo_syncrep2 rid=3D123 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]: do_syncrep2: rid=3D123 cookie=3Drid=3D123=2Ccsn=3D20121204031701.56069= 7Z#000000#000#000000 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica = slapd[994]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:= 01 replica slapd[994]: &gt=3B&gt=3B&gt=3B dnPretty: &lt=3Bcn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd= [994]: &lt=3B&lt=3B&lt=3B dnPretty: &lt=3Bcn=3Dadmin=2Cdc=3Dexample=2Cdc=3D= net&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &gt=3B&gt= =3B&gt=3B dnNormalize: &lt=3Bcn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B = &nbsp=3BDec&nbsp=3B 3 22:17:01 replica rsyslogd-2177: imuxsock begins to dr= op messages from pid 994 due to rate-limiting &nbsp=3BSo everything = looks good (correct?) on replica.&nbsp=3B Meanwhile=2C back at the master..= .. &nbsp=3B Dec&nbsp=3B 3 22:17:01 master slapd[947]: daemon: activi= ty on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: dae= mon: activity on: &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:&nbsp= =3B 51r &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: Dec&nbsp= =3B 3 22:17:01 master slapd[947]: daemon: read active on 51 &nbsp=3BDec&= nbsp=3B 3 22:17:01 master slapd[947]: connection_get(51) &nbsp=3BDec&nbs= p=3B 3 22:17:01 master slapd[947]: connection_get(51): got connid=3D1054<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: connection_read(51): che= cking for input on id=3D1054 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: op tag 0x66=2C time 1354591021 &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: Dec&nbsp=3B 3 22:17:01 master slapd[947]: con= n=3D1054 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[94= 7]: conn=3D1054 op=3D3 do_modify: dn (uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B get_ctrls &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D&gt=3B get_ctrls: oid=3D"2.16.840.1.113730.3.4.18" (noncritical) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: parseProxyAuthz: conn 1054 au= thzid=3D"dn:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_sasl_getdn: conn 10= 54 id=3Ddn:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet [len= =3D48] &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &gt=3B&gt=3B&gt= =3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B&l= t=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexam= ple=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D=3D&gt=3Bslap_sasl2dn: converting SASL name uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet to a DN &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] string=3D'= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: =3D=3D&gt=3B rewrite_rule_apply rule= =3D'uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth' string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3D= net' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= =3D&gt=3B rewrite_rule_apply rule=3D'uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] res=3D{0=2C'uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'} &nbsp=3BDec&n= bsp=3B 3 22:17:01 master slapd[947]: [rw] authid: "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" -&gt=3B "uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master sl= apd[947]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3De= xample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &gt= =3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master= slapd[947]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL name to uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:= 17:01 master slapd[947]: slap_sasl_getdn: dn:id converted to uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 master slapd[947]: parseProxyAuthz: conn=3D1054 "uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01= master slapd[947]: =3D=3D&gt=3Bslap_sasl_authorized: can cn=3Dreplica=2Cou= =3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet become uid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet? &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: =3D=3D&gt=3Bslap_sasl_check_authz: does uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet match authzTo rule in cn=3Dreplica=2Cou=3Dho= sts=2Cdc=3Dexample=2Cdc=3Dnet? &nbsp=3BDec&nbsp=3B 3 22:17:01 master sla= pd[947]: =3D&gt=3B bdb_entry_get: ndn: "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dex= ample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&= gt=3B bdb_entry_get: oc: "(null)"=2C at: "authzTo" &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: bdb_dn2entry("cn=3Dreplica=2Cou=3Dhosts=2Cdc= =3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B bdb_entry_get: found entry: "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3De= xample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb= _entry_get: rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B access_allowed: result not in cache (authzTo) &nbsp=3BDec&nbsp=3B= 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: auth access to "cn= =3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" "authzTo" requested &= nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [2] att= r authzTo &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B ac= l_mask: access to entry "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dne= t"=2C attr "authzTo" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 master sla= pd[947]: =3D&gt=3B acl_mask: to all values by "cn=3Dreplica=2Cou=3Dhosts=2C= dc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 master slapd[= 947]: &lt=3B=3D check a_dn_pat: users &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D acl_mask: [1] applying read(=3Drscxd) (stop) &= nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [1] ma= sk: read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B slap_access_allowed: auth access granted by read(=3Drscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: auth= access granted by read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master = slapd[947]: =3D&gt=3B access_allowed: result was in cache (authzTo) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D=3D=3D&gt=3Bslap_sasl_matc= h: comparing DN uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet= to rule dn:* &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_par= seURI: parsing dn:* &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &l= t=3B=3D=3D=3Dslap_sasl_match: comparison returned 0 &nbsp=3BDec&nbsp=3B = 3 22:17:01 master slapd[947]: &lt=3B=3D=3Dslap_sasl_check_authz: authzTo ch= eck returning 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B= =3D=3D slap_sasl_authorized: return 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: conn=3D1054 op=3D3 PROXYAUTHZ dn=3D"uid=3Dadministrator=2Co= u=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D get_ctrls: n=3D1 rc=3D0 err=3D"" &nbsp=3BDec&n= bsp=3B 3 22:17:01 master slapd[947]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt= =3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nb= sp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B&lt=3B&lt=3B dnPrettyN= ormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt= =3B=2C &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt= =3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3= modifications: &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: #011re= place: description &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: #01= 1#011one value=2C length 21 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: conn=3D1054 op=3D3 MOD dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:= conn=3D1054 op=3D3 MOD attr=3Ddescription &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B bdb_entry_get: ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3De= xample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B bdb_entry_get: oc: "(null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slap= d[947]: =3D&gt=3B bdb_entry_get: found entry: "uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: bdb_entry_get: rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D&gt=3B test_filter &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]:&nbsp=3B&nbsp=3B&nbsp=3B&nbsp=3B PRESENT &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: search access to "ui= d=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" re= quested &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: = [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: =3D&gt=3B dn: [5] Dec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D&gt=3B acl_get: [6] attr objectClass &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: =3D&gt=3B acl_mask: access to entry "uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass" r= equested &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl= _mask: to all values by "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dne= t"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check = a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: self= &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_= pat: users &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D a= cl_mask: [3] applying read(=3Drscxd) (stop) &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: &lt=3B=3D acl_mask: [3] mask: read(=3Drscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B slap_access_allowed:= search access granted by read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 = master slapd[947]: =3D&gt=3B access_allowed: search access granted by read(= =3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D te= st_filter 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_m= atchops: sid ffffffff fscope 1 rc 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 maste= r slapd[947]: hdb_modify: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_queue= _csn: queing 0x7fa90f0fe110 20121204031701.560697Z#000000#000#000000 &nb= sp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: bdb_modify_internal: 0x0000000b: uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: =3D&gt=3B access_allowed: result not in cache (descri= ption) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acces= s_allowed: delete access to "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexamp= le=2Cdc=3Dnet" "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 ma= ster slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [5] = Dec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [6] attr descr= iption &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_m= ask: access to entry "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet"=2C attr "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D&gt=3B acl_mask: to all values by "uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17= :01 master slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerber= os=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D acl_mask: [2] applying write(=3Dwrscxd) (stop)<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [2] = mask: write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:= =3D&gt=3B slap_access_allowed: delete access granted by write(=3Dwrscxd)<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowe= d: delete access granted by write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: =3D&gt=3B access_allowed: result not in cache (descr= iption) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acce= ss_allowed: add access to "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 mast= er slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [5] De= c&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [6] attr descrip= tion &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_mas= k: access to entry "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet"=2C attr "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D&gt=3B acl_mask: to value by "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 m= aster slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: &lt=3B=3D acl_mask: [2] applying write(=3Dwrscxd) (stop) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [2] mask:= write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&= gt=3B slap_access_allowed: add access granted by write(=3Dwrscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: add = access granted by write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master= slapd[947]: acl: internal mod entryCSN: modify access granted &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: acl: internal mod modifiersName: m= odify access granted &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: a= cl: internal mod modifyTimestamp: modify access granted &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: bdb_modify_internal: replace description<= br>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_modify_internal: r= eplace entryCSN &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_mo= dify_internal: replace modifiersName &nbsp=3BDec&nbsp=3B 3 22:17:01 mast= er slapd[947]: bdb_modify_internal: replace modifyTimestamp &nbsp=3BDec&= nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "inetOrgPer= son" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required= entry (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C obj= ectClass "posixAccount" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : oc_check_required entry (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet)=2C objectClass "shadowAccount" &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: oc_check_required entry (uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbPrincipalAux" &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required entry (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "k= rbTicketPolicyAux" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_= check_allowed type "objectClass" &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: oc_check_allowed type "cn" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: oc_check_allowed type "sn" &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: oc_check_allowed type "uidNumber" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "gidNumber" &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "userPa= ssword" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allow= ed type "homeDirectory" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : oc_check_allowed type "structuralObjectClass" &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: oc_check_allowed type "uid" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "entryUUID" &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "creato= rsName" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allow= ed type "createTimestamp" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[94= 7]: oc_check_allowed type "krbPrincipalName" &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: oc_check_allowed type "krbPrincipalKey" &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastPwdC= hange" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowe= d type "krbLastFailedAuth" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[9= 47]: oc_check_allowed type "krbLoginFailedCount" &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 master slapd[947]: oc_check_allowed type "krbLastSuccessfulAuth"<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "k= rbExtraData" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_= allowed type "description" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[9= 47]: oc_check_allowed type "entryCSN" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: oc_check_allowed type "modifiersName" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "modifyTimestamp"<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B key_change(DE= LETE=2Cb) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_idl_dele= te_key: b Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D key_chang= e 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B key_chan= ge(ADD=2Cb) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_idl_in= sert_key: b Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D key_cha= nge 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B entry_= encode(0x0000000b): Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D= entry_encode(0x0000000b): Dec&nbsp=3B 3 22:17:01 master slapd[947]: hd= b_modify: updated id=3D0000000b dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : send_ldap_result: conn=3D1054 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" text=3D"" = &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: = ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: oc: "= (null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet= ") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry= _get: found entry: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_entry_get:= rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B test= _filter &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:&nbsp=3B&nbsp= =3B&nbsp=3B&nbsp=3B PRESENT &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: =3D&gt=3B access_allowed: search access to "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" requested &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D&gt=3B dn: [5] Dec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B a= cl_get: [6] attr objectClass &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: =3D&gt=3B acl_mask: access to entry "uid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass" requested &nbsp=3BDe= c&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_mask: to all values b= y "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&n= bsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B = 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: users &nbsp=3BDe= c&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [3] applying re= ad(=3Drscxd) (stop) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &l= t=3B=3D acl_mask: [3] mask: read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: =3D&gt=3B slap_access_allowed: search access granted b= y read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&g= t=3B access_allowed: search access granted by read(=3Drscxd) &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D test_filter 6 &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fs= cope 1 rc 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_s= endresp: cookie=3Drid=3D123=2Ccsn=3D20121204031701.560697Z#000000#000#00000= 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_= get: ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" = &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: = oc: "(null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb= _entry_get: found entry: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" &nbsp=3BEverything looks good on the master.&nbsp=3B I = see uid=3Dadministrator gets sent over from the the proxy on replica and th= e update proceeds as expected.&nbsp=3B Now if I restart slapd on replica=2C= things change.&nbsp=3B performing the same modifucation=2C we again see sa= sl/gssapi authentication occuring on replica just as before &nbsp=3B <BR= >Dec&nbsp=3B 3 22:20:38 replica slapd[1412]: [rw] authid: "uid=3Dadministra= tor=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -&gt=3B "uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20= :38 replica slapd[1412]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:20:38 replica = slapd[1412]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:38= replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL nam= e to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: slap_sasl_getdn: dn:id conve= rted to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL Canonicalize [conn=3D1= 000]: slapAuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL proxy a= uthorize [conn=3D1000]: authcid=3D"<a href=3D"mailto:administrator@EXAMPLE.= NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"<a href=3D"mailto:administra= tor(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" &nbsp=3BDec&nbsp=3B 3 22= :20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND authcid=3D"<a href=3D"m= ailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"= <a href=3D"mailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>"= &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL Authorize [con= n=3D1000]:&nbsp=3B proxy authorization allowed authzDN=3D"" &nbsp=3BDec&= nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_sasl: err=3D0 len=3D-1<br= >&nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIN= D dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech= =3DGSSAPI sasl_ssf=3D56 ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica = slapd[1412]: do_bind: SASL/GSSAPI bind: dn=3D"uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:2= 0:38 replica slapd[1412]: send_ldap_response: msgid=3D3 tag=3D97 err=3D0<br= >&nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 RES= ULT tag=3D97 err=3D0 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]: &lt=3B=3D=3D slap_sasl_bind: rc=3D0 &nbsp=3BAgain=2C we hea= d into the modification: &nbsp=3B Dec&nbsp=3B 3 22:20:38 replica sla= pd[1412]: conn=3D1000 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:20:38 re= plica slapd[1412]: conn=3D1000 op=3D3 do_modify: dn (uid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:20:38 re= plica slapd[1412]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BD= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 modifications= : &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: #011replace: descr= iption &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: #011#011one v= alue=2C length 21 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: co= nn=3D1000 op=3D3 MOD dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D= 1000 op=3D3 MOD attr=3Ddescription &nbsp=3BDec&nbsp=3B 3 22:20:38 replic= a slapd[1412]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexamp= le=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: =3D&= gt=3B hdb_dn2id("ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbs= p=3B 3 22:20:38 replica slapd[1412]: &lt=3B=3D hdb_dn2id: got id=3D0x3 &= nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemon: activity on 1 de= scriptor &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemon: act= ivity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: &nbsp= =3B &nbsp=3BSo far=2C so good (I think)=2C replica sees the need to refe= r the action and tries to chase it on behalf of the clent: &nbsp=3BD= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: =3D&gt=3B hdb_dn2id("uid=3Dadmin= istrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B=3D hdb_dn2id: got id=3D0xb &nbsp= =3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: entry_decode: "" &nbsp=3B= Dec&nbsp=3B 3 22:20:38 replica slapd[1412]: &lt=3B=3D entry_decode() &nb= sp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1= 000 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: sen= d_ldap_result: err=3D10 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:= 20:38 replica slapd[1412]: send_ldap_result: referral=3D"<a href=3D"ldap://= master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2C= dc=3Dexample=2Cdc=3Dnet</a>" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:38= replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp= =3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"<a href=3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeo= ple=2Cdc=3Dexample=2Cdc=3Dnet">ldap://master.example.net:389/uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet</a>" -&gt=3B "<a href=3D"ldap= ://master.example.net:389">ldap://master.example.net:389</a>" &nbsp=3BDe= c&nbsp=3B 3 22:20:38 replica slapd[1412]: ldap_back_db_open: URI=3Dldap://m= aster.example.net:389 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]= : conn=3D1000 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap://master.example= .net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet">ldap:= //master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet</a>" temporary &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[= 1412]: =3D&gt=3Bldap_back_getconn: conn=3D1000 op=3D3: lc=3D0x7f213015a7d0 = inserted refcnt=3D1 rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[= 1412]: send_ldap_result: conn=3D1000 op=3D3 p=3D3 &nbsp=3B &nbsp=3B<= br>At this point=2C I "assume" the modification has been passed off to mast= er.&nbsp=3B However=2C I notice that I never see the replica checking authz= To like before the restart. I think this is where it's falling apart for me= and the err=3D8 back is returned from master. &nbsp=3B &nbsp=3B D= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matche= d=3D"" text=3D"modifications require authentication" &nbsp=3BDec&nbsp=3B= 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 p=3D3= &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: e= rr=3D8 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica sla= pd[1412]: send_ldap_response: msgid=3D4 tag=3D103 err=3D8 &nbsp=3BDec&nb= sp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 RESULT tag=3D103 e= rr=3D8 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemo= n: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd= [1412]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]:&nbsp=3B 18r &nbsp=3B &nbsp=3BOver on the master we see the = proxy connection occurs=2C but the client credentials never apper to arrive= .&nbsp=3B I say that because=2C it looks to me like the proxy connection fr= om replica appears to bind anonymously. &nbsp=3B Dec&nbsp=3B 3 22:20= :38 master slapd[947]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: Dec&nbsp=3B 3 22:20:38 master slapd[9= 47]: slap_listener_activate(8): Dec&nbsp=3B 3 22:20:38 master slapd[947= ]: &gt=3B&gt=3B&gt=3B slap_listener(<a href=3D"ldap:///">ldap:///</a>) &= nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemon: listen=3D8=2C new = connection on 51 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemo= n: added 51r (active) listener=3D(nil) &nbsp=3BDec&nbsp=3B 3 22:20:38 ma= ster slapd[947]: conn=3D1056 fd=3D51 ACCEPT from IP=3D192.168.1.2:34759 (IP= =3D0.0.0.0:389) &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemon= : activity on 2 descriptors &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[= 947]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[9= 47]:&nbsp=3B 51r &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: D= ec&nbsp=3B 3 22:20:38 master slapd[947]: daemon: read active on 51 &nbsp= =3BDec&nbsp=3B 3 22:20:38 master slapd[947]: connection_get(51) &nbsp=3B= Dec&nbsp=3B 3 22:20:38 master slapd[947]: connection_get(51): got connid=3D= 1056 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: connection_read(5= 1): checking for input on id=3D1056 &nbsp=3BDec&nbsp=3B 3 22:20:38 maste= r slapd[947]: op tag 0x60=2C time 1354591238 &nbsp=3BDec&nbsp=3B 3 22:20= :38 master slapd[947]: conn=3D1056 op=3D0 do_bind &nbsp=3BDec&nbsp=3B 3 = 22:20:38 master slapd[947]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3B&gt=3B= &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: &lt=3B&lt=3B&lt=3B dn= PrettyNormal: &lt=3B&gt=3B=2C &lt=3B&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:3= 8 master slapd[947]: conn=3D1056 op=3D0 BIND dn=3D"" method=3D128 &nbsp= =3BDec&nbsp=3B 3 22:20:38 master slapd[947]: do_bind: version=3D3 dn=3D"" m= ethod=3D128 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: send_ldap_= result: conn=3D1056 op=3D0 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:20:38 master s= lapd[947]: send_ldap_result: err=3D0 matched=3D"" text=3D"" &nbsp=3BDec&= nbsp=3B 3 22:20:38 master slapd[947]: send_ldap_response: msgid=3D1 tag=3D9= 7 err=3D0 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: conn=3D1056 = op=3D0 RESULT tag=3D97 err=3D0 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 ma= ster slapd[947]: do_bind: v3 anonymous bind &nbsp=3BDec&nbsp=3B 3 22:20:= 38 master slapd[947]: daemon: activity on 2 descriptors &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]:&nbsp=3B 51r &nbsp=3BDec&nbsp=3B 3 22:2= 0:38 master slapd[947]: After=2C the (anonymous) bind=2C the master= never attempts to if the proxyauth request is allowed via authzTo or anyth= ing else (perhaps obviously).&nbsp=3B The modification just proceeds anonym= ously and eventually fails. &nbsp=3B &nbsp=3BNot sure if I'm saying = this in a way that makes any sense to you.&nbsp=3B Hopefully=2C it does.&nb= sp=3B It appears=2C that the proxy on replica after restarting=2C never tri= es to determine if the olcDbIDAssertBind binddn is permitted to impersonate= the client via the authzTo attribute and proceeds with the referal chase a= nonymously. &nbsp=3B &nbsp=3BI'll copy paste configs below.&nbsp=3B&= nbsp=3B Sorry this is so long=2C but I figure the more information=2C the b= etter when trying to solve any problem. &nbsp=3B &nbsp=3BThanks &= nbsp=3B &nbsp=3BBarry &nbsp=3B &nbsp=3Bvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvvvv master configuration vvvvvvvvvvvvvvvvvvvvvvvvvvvv &nbsp=3Bdn:= cn=3Dconfig &nbsp=3BobjectClass: olcGlobal &nbsp=3Bcn: config &nb= sp=3BolcArgsFile: /var/run/slapd/slapd.args &nbsp=3BolcPidFile: /var/run= /slapd/slapd.pid &nbsp=3BolcToolThreads: 1 &nbsp=3BstructuralObjectCl= ass: olcGlobal &nbsp=3BentryUUID: ea6bf008-d108-1031-912d-8fbb37ee6dd9<b= r>&nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201= 635Z &nbsp=3BolcTLSCACertificateFile: /etc/ssl/certs/cacert.pem &nbsp= =3BolcTLSCertificateFile: /etc/ssl/certs/master_slapd_cert.pem &nbsp=3Bo= lcTLSCertificateKeyFile: /etc/ldap/master_slapd_key.pem &nbsp=3BolcAuthz= Policy: to &nbsp=3BolcSaslHost: master.example.net &nbsp=3BolcSaslRea= lm: EXAMPLE.NET &nbsp=3BolcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.= net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BolcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3D= example.net=2Ccn=3Dgssapi=2Ccn=3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BolcLogLevel: -1 &nbsp=3BentryCSN: 20121204013949.= 466434Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber= =3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp= : 20121204013949Z &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dconfig &nbsp=3Bob= jectClass: olcModuleList &nbsp=3Bcn: module{0} &nbsp=3BolcModulePath:= /usr/lib/ldap &nbsp=3BolcModuleLoad: {0}back_hdb &nbsp=3BolcModuleLo= ad: {1}syncprov &nbsp=3BstructuralObjectClass: olcModuleList &nbsp=3B= entryUUID: ea6dda08-d108-1031-9135-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn= =3Dconfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: = 20121203054749.860918Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumbe= r=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3B= modifyTimestamp: 20121203054749Z &nbsp=3Bdn: cn=3Dschema=2Ccn=3Dconfig<b= r>&nbsp=3BobjectClass: olcSchemaConfig &nbsp=3Bcn: schema &nbsp=3Bstr= ucturalObjectClass: olcSchemaConfig &nbsp=3BentryUUID: ea6c3a0e-d108-103= 1-9130-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateT= imestamp: 20121202201635Z &nbsp=3BentryCSN: 20121202201635.672699Z#00000= 0#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig &nbsp=3BmodifyTimesta= mp: 20121202201635Z &nbsp=3B&lt=3Bsnip schemas &gt=3B &nbsp=3Bdn: olc= Backend=3D{0}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olcBackendConfig = &nbsp=3BolcBackend: {0}hdb &nbsp=3BstructuralObjectClass: olcBackendConf= ig &nbsp=3BentryUUID: ea6f949c-d108-1031-9136-8fbb37ee6dd9 &nbsp=3Bcr= eatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbs= p=3BentryCSN: 20121202201635.694663Z#000000#000#000000 &nbsp=3Bmodifiers= Name: cn=3Dconfig &nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn= : olcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatab= aseConfig &nbsp=3BobjectClass: olcFrontendConfig &nbsp=3BolcDatabase:= {-1}frontend &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uid= Number=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2Ccn=3Dauth manage = by * break &nbsp=3BolcAccess: {1}to dn.exact=3D"" by * read &nbsp=3Bo= lcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read &nbsp=3BolcSizeLimi= t: 500 &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp=3Bentry= UUID: ea6c0bf6-d108-1031-912e-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dco= nfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: 20121= 202201635.671512Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig<b= r>&nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn: olcDatabase=3D{0}= config=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3Bo= lcDatabase: {0}config &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber= =3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth manage by * = break &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp=3BentryU= UID: ea6c325c-d108-1031-912f-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dcon= fig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: 201212= 02201635.672495Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig<br= >&nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn: olcDatabase=3D{1}h= db=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3Bobjec= tClass: olcHdbConfig &nbsp=3BolcDatabase: {1}hdb &nbsp=3BolcDbDirecto= ry: /var/lib/ldap &nbsp=3BolcSuffix: dc=3Dexample=2Cdc=3Dnet &nbsp=3B= olcLastMod: TRUE &nbsp=3BolcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BolcRootPW:: e1NTSEF9cGhKNWtqME9rOGJnVXp0dy9hYzZEaWFmU1U1Z0FTZk0= =3D &nbsp=3BolcDbCheckpoint: 512 30 &nbsp=3BolcDbConfig: {0}set_cache= size 0 2097152 0 &nbsp=3BolcDbConfig: {1}set_lk_max_objects 1500 &nbs= p=3BolcDbConfig: {2}set_lk_max_locks 1500 &nbsp=3BolcDbConfig: {3}set_lk= _max_lockers 1500 &nbsp=3BolcDbIndex: objectClass eq &nbsp=3BolcDbInd= ex: uid eq &nbsp=3BolcDbIndex: cn eq &nbsp=3BolcDbIndex: ou eq &nb= sp=3BolcDbIndex: dc eq &nbsp=3BolcDbIndex: uidNumber eq &nbsp=3BolcDb= Index: gidNumber eq &nbsp=3BolcDbIndex: memberUid eq &nbsp=3BolcDbInd= ex: uniqueMember eq &nbsp=3BolcDbIndex: entryUUID eq &nbsp=3BolcDbInd= ex: entryCSN eq &nbsp=3BolcDbIndex: krbPrincipalName eq=2Cpres=2Csub = &nbsp=3BolcDbIndex: krbPwdPolicyReference eq &nbsp=3BstructuralObjectCla= ss: olcHdbConfig &nbsp=3BentryUUID: ea6fa3ce-d108-1031-9137-8fbb37ee6dd9= &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 201212022= 01635Z &nbsp=3BolcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange = by group.exact=3D"cn=3Dreplic &nbsp=3B ators=2Cou=3Dgroups=2Cdc=3Dexampl= e=2Cdc=3Dnet" read by self write by anonymous auth &nbsp=3BolcAccess: {1= }to attrs=3DauthzTo=2CauthzFrom=2Ccn=2CuidNumber=2CgidNumber=2Cuid by users= r &nbsp=3B ead by anonymous none &nbsp=3BolcAccess: {2}to attrs=3Dkr= bLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFailedAuth=2Ckr &nbsp=3B bLo= ginFailedCount by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet" &nbsp=3B&nbsp=3B read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerbe= ros=2Cdc=3Dexample=2Cdc=3Dnet" write by dn=3D"cn=3Dadm-sr &nbsp=3B v=2Co= u=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by self read by * none &nb= sp=3BolcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet= " by group.exact=3D"cn &nbsp=3B =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet" read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2C &nbsp=3B d= c=3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3De= xample=2Cdc=3Dnet" writ &nbsp=3B e by * none &nbsp=3BolcAccess: {4}to= dn.base=3D"" by * read &nbsp=3BolcAccess: {5}to * by dn=3D"cn=3Dadm-srv= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by s &nbsp=3B elf writ= e by users read &nbsp=3BentryCSN: 20121203054749.804561Z#000000#000#0000= 00 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2C= cn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp: 20121203054749Z &n= bsp=3Bdn: olcOverlay=3D{0}syncprov=2ColcDatabase=3D{1}hdb=2Ccn=3Dconfig = &nbsp=3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcSyncProvCo= nfig &nbsp=3BolcOverlay: {0}syncprov &nbsp=3BolcSpCheckpoint: 100 10<= br>&nbsp=3BolcSpSessionlog: 100 &nbsp=3BstructuralObjectClass: olcSyncPr= ovConfig &nbsp=3BentryUUID: b77dc36a-d158-1031-9917-2f12ddec6588 &nbs= p=3BcreatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dextern= al=2Ccn=3Dauth &nbsp=3BcreateTimestamp: 20121203054749Z &nbsp=3Bentry= CSN: 20121203054749.962179Z#000000#000#000000 &nbsp=3BmodifiersName: gid= Number=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nb= sp=3BmodifyTimestamp: 20121203054749Z &nbsp=3Bvvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvv&nbsp=3B dc=3Dexample=2Cdc=3Dnet&nbsp=3B vvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvvvvvvvvvvvvvvv &nbsp=3Bdn: dc=3Dexample=2Cdc=3Dnet &nbsp=3Bobj= ectClass: top &nbsp=3BobjectClass: dcObject &nbsp=3BobjectClass: orga= nization &nbsp=3Bo: example.net &nbsp=3Bdc: example &nbsp=3Bstruct= uralObjectClass: organization &nbsp=3BentryUUID: eac01854-d108-1031-95b6= -31806daa9e45 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BcreateTimestamp: 20121202201636Z &nbsp=3BentryCSN: 201212022= 01636.222029Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121202201636Z &nbsp= =3BcontextCSN: 20121204035116.890381Z#000000#000#000000 &nbsp=3Bdn: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecurityOb= ject &nbsp=3BobjectClass: organizationalRole &nbsp=3Bcn: admin &nb= sp=3Bdescription: LDAP administrator &nbsp=3BuserPassword:: &lt=3Bsecret= &gt=3B &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3Bentr= yUUID: eac2e160-d108-1031-95b7-31806daa9e45 &nbsp=3BcreatorsName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121202201636Z<= br>&nbsp=3BentryCSN: 20121202201636.240572Z#000000#000#000000 &nbsp=3Bmo= difiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestam= p: 20121202201636Z &nbsp=3Bdn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet = &nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: people &nbsp=3Bde= scription: user account objects &nbsp=3BstructuralObjectClass: organizat= ionalUnit &nbsp=3BentryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.299880Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: ou=3Dgroups=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organizationalUnit &nbsp= =3Bou: groups &nbsp=3Bdescription: group objects &nbsp=3BstructuralOb= jectClass: organizationalUnit &nbsp=3BentryUUID: 1cfcb788-d12b-1031-9788= -4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 201212030= 02123.394485Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp= =3Bdn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organiz= ationalUnit &nbsp=3Bou: hosts &nbsp=3Bdescription: host/computer obje= cts &nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUU= ID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmi= n=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z = &nbsp=3BentryCSN: 20121203002123.400935Z#000000#000#000000 &nbsp=3Bmodif= iersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: = 20121203002123Z &nbsp=3Bdn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &= nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: kerberos &nbsp=3Bd= escription: kerberos realm container &nbsp=3BstructuralObjectClass: orga= nizationalUnit &nbsp=3BentryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93<b= r>&nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcre= ateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.409140Z#0= 00000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn=3Drepl= ica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: replica &nbsp= =3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: organizational= Role &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTic= ketPolicyAux &nbsp=3BauthzTo: dn:* &nbsp=3Bdescription: LDAP server= =2C replica &nbsp=3BstructuralObjectClass: organizationalRole &nbsp= =3BentryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 &nbsp=3BcreatorsName:= cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212030= 02123Z &nbsp=3BkrbPrincipalName: <a href=3D"mailto:host/replica.example.= net(a)EXAMPLE.NET">host/replica.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbLog= inFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDA= gEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gADgZgDa20URzdHW= Q1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRURAxZ &nbsp=3B oJVqBI/zPGh/FDf9= m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6Mn3k &nbsp=3B f= 62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu6lb= / &nbsp=3B QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNS= kxswPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB6= 38xMCex7sQ1zfzZkLiViiKpw=3D=3D &nbsp=3BkrbPasswordExpiration: 1970010100= 0000Z &nbsp=3BkrbLastPwdChange: 20121203065600Z &nbsp=3BkrbExtraData:= : AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: = AAgBAA=3D=3D &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BentryC= SN: 20121203233422.105322Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212032334= 22Z &nbsp=3Bdn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &n= bsp=3Bcn: master &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3Bob= jectClass: organizationalRole &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BauthzTo: dn:* &nbsp=3Bd= escription: LDAP server=2C replica &nbsp=3BuserPassword:: e0NSWVBUfSo=3D= &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3BentryUUID:= 1d0514dc-d12b-1031-978c-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin= =2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &= nbsp=3BkrbPrincipalName: <a href=3D"mailto:host/master.example.net@EXAMPLE.= NET">host/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbLoginFailedCount= : 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCAS= gwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMd= eygNYlf/SiWtzll+A7x/QBVoz7zFW+aWr &nbsp=3B 8/FMEBj49p4Bn0Goa371TBEoAcwBa= ADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5522A &nbsp=3B i/CCoCVDIVBZHO= I48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH15xNZ &nbsp=3B= VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWgA= wIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3= DaIILvcKv0w=3D=3D &nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbs= p=3BkrbLastPwdChange: 20121203060855Z &nbsp=3BkrbExtraData:: AAL3QbxQYWR= taW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D<= br>&nbsp=3BentryCSN: 20121203060855.932134Z#000000#000#000000 &nbsp=3Bmo= difiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3BmodifyTimestamp: 20121203060855Z &nbsp=3Bdn: cn=3Dadministrator=2Cou= =3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: posixGroup &= nbsp=3Bcn: administrator &nbsp=3BgidNumber: 50000 &nbsp=3BstructuralO= bjectClass: posixGroup &nbsp=3BentryUUID: 1d079216-d12b-1031-978d-4f8d9a= bcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.4= 65616Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexampl= e=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn= =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectCla= ss: top &nbsp=3BobjectClass: groupOfNames &nbsp=3Bcn: replicators = &nbsp=3Bmember: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3Bmember: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bs= tructuralObjectClass: groupOfNames &nbsp=3BentryUUID: 1d096db6-d12b-1031= -978e-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 201= 21203002123.477792Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin= =2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &= nbsp=3Bdn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &= nbsp=3BobjectClass: top &nbsp=3BobjectClass: inetOrgPerson &nbsp=3Bob= jectClass: posixAccount &nbsp=3BobjectClass: shadowAccount &nbsp=3Bob= jectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &n= bsp=3Bcn: administrator &nbsp=3Bsn: administrator &nbsp=3BuidNumber: = 50000 &nbsp=3BgidNumber: 50000 &nbsp=3BuserPassword:: &lt=3Bsecret&gt= =3B &nbsp=3BhomeDirectory: /home/administrator &nbsp=3BstructuralObje= ctClass: inetOrgPerson &nbsp=3Buid: administrator &nbsp=3BentryUUID: = 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbs= p=3BkrbPrincipalName: <a href=3D"mailto:administrator@EXAMPLE.NET">administ= rator(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIB= AaMDAgEBpIICUzCCAk8wVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gALWKtjcuVI= PL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+EcqcdxailuD &nbsp=3B o3oHvU0K11Y= iAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/Ot7l &nbsp= =3B cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYA= DmOzq8 &nbsp=3B 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/L= Nz2jwAqIwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQI= Cvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8oAcwB &nbsp=3B aADAgEBoTEwL6ADAgEDoSgEJgg= A0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6yoME &nbsp=3B 2gGDAWoAMCA= QKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo8yyO &nbsp= =3B mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAg= EDoSgE &nbsp=3B JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEug= FjAUoAMCAQWhDQQLRVhBT &nbsp=3B VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEE= YGOMA8CDwINmmJXgnKPQr8jRDsxGToXGa5U+ &nbsp=3B g=3D &nbsp=3BkrbLastPwd= Change: 20121203054848Z &nbsp=3BkrbLastFailedAuth: 20121204013714Z &n= bsp=3BkrbLoginFailedCount: 0 &nbsp=3Bdescription: Network Administrator<= br>&nbsp=3BkrbLastSuccessfulAuth: 20121204035116Z &nbsp=3BkrbExtraData::= AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBA= A=3D=3D &nbsp=3BentryCSN: 20121204035116.890381Z#000000#000#000000 &n= bsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BmodifyTimestamp: 20121204035116Z &nbsp=3Bdn: cn=3Dkdc-srv=2C= ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecur= ityObject &nbsp=3BobjectClass: organizationalRole &nbsp=3Bcn: kdc-srv= &nbsp=3Bdescription: Kerberos KDC &nbsp=3BuserPassword:: &lt=3Bsecre= t&gt=3B &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3Bent= ryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3D= admin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z= &nbsp=3BentryCSN: 20121203002123.563692Z#000000#000#000000 &nbsp=3Bm= odifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimesta= mp: 20121203002123Z &nbsp=3Bdn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexam= ple=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3Bobje= ctClass: organizationalRole &nbsp=3Bcn: adm-srv &nbsp=3Bdescription: = Kerberos Admin Server &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp= =3BstructuralObjectClass: organizationalRole &nbsp=3BentryUUID: 1d18610e= -d12b-1031-9791-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexa= mple=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3Bentr= yCSN: 20121203002123.575773Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212030021= 23Z &nbsp=3Bdn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3Bcn: EXAMPLE.NET &nbsp=3BobjectClass: top &nbsp=3Bobject= Class: krbRealmContainer &nbsp=3BobjectClass: krbTicketPolicyAux &nbs= p=3BkrbSubTrees: dc=3Dexample=2Cdc=3Dnet &nbsp=3BkrbSearchScope: 2 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbMaxTicketLife: 36000 &nbs= p=3BstructuralObjectClass: krbRealmContainer &nbsp=3BentryUUID: c03d58b8= -d134-1031-83e7-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexa= mple=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3Bentr= yCSN: 20121203013022.757228Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212030130= 22Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3DK/M@EXAMPLE.NET=2Cc= n=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName= =3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc= =3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 3= 6000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 192<b= r>&nbsp=3BkrbPrincipalName: <a href=3D"mailto:K/M@EXAMPLE.NET">K/M(a)EXAMPLE.= NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPr= incipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+gAwIB<b= r>&nbsp=3B EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxT= uO7OIrbK/c4Ks &nbsp=3B HI=3D &nbsp=3BkrbLastPwdChange: 19700101000000= Z &nbsp=3BkrbExtraData:: AAkBAAEArgC8UA=3D=3D &nbsp=3BkrbExtraData:: = AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIA= AgAAAAAAAAA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectClass:= krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3Bstru= cturalObjectClass: krbPrincipal &nbsp=3BentryUUID: c04d9282-d134-1031-83= e8-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN: 2012120= 3013022.863568Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp= =3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkrbtgt/EXAMPLE.NET@EXAMPLE.NET= =2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipal= Name=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3Bkr= bMaxTicketLife: 36000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbT= icketFlags: 0 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:krbtgt/EXAMPLE= .NET(a)EXAMPLE.NET">krbtgt/EXAMPLE.NET(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipa= lExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCA= QGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAOy= PPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNnfmRR &nbsp=3B GQI5= lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7UKy1<b= r>&nbsp=3B 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEK= E4BDYYAM9KwFT &nbsp=3B B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQV= R0PWLB2OM5q1llQwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NE= ctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgED= oSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8oR &nbsp=3BkrbLast= PwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb2= 5ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAAAAAAA=3D &nbs= p=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krb= Principal &nbsp=3BentryUUID: c0518180-d134-1031-83e9-0707760cf534 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.889347Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailt= o:krbPrincipalName=3Dkadmin/admin@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dker= beros=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NE= T=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp= =3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &nbsp=3Bkrb= MaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3BkrbPrincipa= lName: <a href=3D"mailto:kadmin/admin@EXAMPLE.NET">kadmin/admin(a)EXAMPLE.NET= </a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPrinc= ipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &= nbsp=3B MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7= CF2xtCkdsY &nbsp=3B 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAEL= hAAwMe5Vpq5Hd2Zy1E8M28Ix6 &nbsp=3B SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfA= wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZM5wu &nbsp=3B tIcsdKbsYTDZgUzqIADtNt= 4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWgAwIB &nbsp=3B AKExMC+= gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8oAcwB &= nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM= +9bG3aQz &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtraDa= ta:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAc= BAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectC= lass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp= =3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c05346be-d134-= 1031-83ea-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN= : 20121203013022.900950Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z<= br>&nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/changepw@EXAMPLE= .NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrinc= ipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbMaxTicketLife: 300 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3Bk= rbTicketFlags: 8196 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/c= hangepw(a)EXAMPLE.NET">kadmin/changepw(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipa= lExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCA= QGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAHN= xSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceWqIB2 &nbsp=3B ic80= wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0wwSqU<b= r>&nbsp=3B ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEK= E4BDYYACd423Z &nbsp=3B epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbp= L0kTawz9zdg60IgwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAs= CALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgED= oSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9zPl &nbsp=3BkrbLast= PwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb2= 5ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbs= p=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krb= Principal &nbsp=3BentryUUID: c054d88a-d134-1031-83eb-0707760cf534 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.911237Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailt= o:krbPrincipalName=3Dkadmin/history@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dk= erberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/history@EXAMPL= E.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &= nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp= =3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 0 &nbsp=3BkrbPr= incipalName: <a href=3D"mailto:kadmin/history@EXAMPLE.NET">kadmin/history@E= XAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp= =3BkrbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD= +gAwIB &nbsp=3B EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHp= jECIfASUXjBoB+Pkd/N+Z &nbsp=3B 2g=3D &nbsp=3BkrbLastPwdChange: 197001= 01000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQ= A &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: = krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass= : krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal &nbs= p=3BentryUUID: c0562d3e-d134-1031-83ec-0707760cf534 &nbsp=3BcreatorsName= : cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203= 013022Z &nbsp=3BentryCSN: 20121203013022.919957Z#000000#000#000000 &n= bsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodify= Timestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalNam= e=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerbero= s=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/master.example.net@E= XAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a>= &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3Bkr= bPrincipalName: <a href=3D"mailto:kadmin/master.example.net@EXAMPLE.NET">ka= dmin/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: = 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAg= EApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABhOeGOuo9UBDjK7= hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4Ta3z &nbsp=3B Y4ZaEYItXr2awBW6Q= XSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtGg1qY &nbsp=3B oe= v8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj0sgn= &nbsp=3B ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf= 4UwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qY= DwpK0Hycj+cwyCjFsVKTsjzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAxTSME= h/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZABm &nbsp=3BkrbLastPwdChange: 19= 700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5= ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAANAD4gA=3D &nbsp=3BobjectCla= ss: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectC= lass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal = &nbsp=3BentryUUID: c0581144-d134-1031-83ed-0707760cf534 &nbsp=3Bcreators= Name: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012= 1203013022Z &nbsp=3BentryCSN: 20121203013022.932349Z#000000#000#000000<b= r>&nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmo= difyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipa= lName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerbe= ros=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dldap/master.example.net@E= XAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a>= &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ldap/master.example.net@EXA= MPLE.NET">ldap/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: k= rbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass:= krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp= =3BentryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 &nbsp=3BcreatorsName:= cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203060105Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPr= incipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ<b= r>&nbsp=3B MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pK= gmUyVdsPUS2wz &nbsp=3B qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoT= AELhAAkzwNhAF14TYWZyLZem5kvD &nbsp=3B yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf= 09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAbNr3p &nbsp=3B vkmNXkIZNgUtw2FJ3Vt= GEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWgAwIB &nbsp=3B AKEx= MC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D=3D<br= >&nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange= : 20121203060153Z &nbsp=3BkrbLastSuccessfulAuth: 20121203061721Z &nbs= p=3BkrbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp= =3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203061721.358939Z#= 000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203061721Z &nbs= p=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dldap/replica.example.net@EXAMP= LE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPri= ncipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbPrincipalName: <a h= ref=3D"mailto:ldap/replica.example.net@EXAMPLE.NET">ldap/replica.example.ne= t(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectCla= ss: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3Bs= tructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: 205686f2-d162-1031= -9537-2fa18b539eb9 &nbsp=3BcreatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203065511Z &nbs= p=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQG= iAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABVJB= bD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUXFMNw &nbsp=3B 2R8oC1= rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKbipUj = &nbsp=3B AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4= BDYYAOvmT4x &nbsp=3B MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaB= sgthQCj3BCDmkwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2m= xhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D=3D &nbsp=3BkrbPasswordExpiration: = 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203065628Z &nbsp=3Bkrb= LastSuccessfulAuth: 20121204032538Z &nbsp=3BkrbExtraData:: AAIcTbxQYWRta= W5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D<br= >&nbsp=3BentryCSN: 20121204032538.048010Z#000000#000#000000 &nbsp=3Bmodi= fiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BmodifyTimestamp: 20121204032538Z &nbsp=3B &nbsp=3B &nbsp=3B <= br>&nbsp=3Bvvvvvvvvvvvvvvvvvvvv replica config vvvvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvv &nbsp=3B &nbsp=3Bdn: cn=3Dconfig &nbsp=3BobjectClass: ol= cGlobal &nbsp=3Bcn: config &nbsp=3BolcArgsFile: /var/run/slapd/slapd.= args &nbsp=3BolcPidFile: /var/run/slapd/slapd.pid &nbsp=3BolcToolThre= ads: 1 &nbsp=3BstructuralObjectClass: olcGlobal &nbsp=3BentryUUID: af= 9b0068-d108-1031-9417-cd3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig = &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BolcTLSCACertificateFile= : /etc/ssl/certs/cacert.pem &nbsp=3BolcTLSCertificateFile: /etc/ssl/cert= s/replica_slapd_cert.pem &nbsp=3BolcTLSCertificateKeyFile: /etc/ldap/rep= lica_slapd_key.pem &nbsp=3BolcLogLevel: stats &nbsp=3BolcAuthzRegexp:= {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BolcAuthzR= egexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth uid= =3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BolcSaslHost: repli= ca.example.net &nbsp=3BolcSaslRealm: EXAMPLE.NET &nbsp=3BentryCSN: 20= 121204023449.956406Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber= =3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3Bm= odifyTimestamp: 20121204023449Z &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dconfig= &nbsp=3BobjectClass: olcModuleList &nbsp=3Bcn: module{0} &nbsp=3B= olcModulePath: /usr/lib/ldap &nbsp=3BolcModuleLoad: {0}back_hdb &nbsp= =3BolcModuleLoad: {1}back_ldap &nbsp=3BstructuralObjectClass: olcModuleL= ist &nbsp=3BentryUUID: af9d1e34-d108-1031-941f-cd3569532aaf &nbsp=3Bc= reatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201457Z &nb= sp=3BentryCSN: 20121204041212.292184Z#000000#000#000000 &nbsp=3Bmodifier= sName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Da= uth &nbsp=3BmodifyTimestamp: 20121204041212Z &nbsp=3Bdn: cn=3Dschema= =2Ccn=3Dconfig &nbsp=3BobjectClass: olcSchemaConfig &nbsp=3Bcn: schem= a &nbsp=3BstructuralObjectClass: olcSchemaConfig &nbsp=3BentryUUID: a= f9b564e-d108-1031-941a-cd3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig<br= >&nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BentryCSN: 201212022014= 56.995860Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig &nbsp= =3BmodifyTimestamp: 20121202201456Z &nbsp=3B&lt=3B snip schemas &gt=3B<B= R>&nbsp=3Bdn: olcBackend=3D{0}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olc= BackendConfig &nbsp=3BolcBackend: {0}hdb &nbsp=3BstructuralObjectClas= s: olcBackendConfig &nbsp=3BentryUUID: af9e498a-d108-1031-9420-cd3569532= aaf &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 201212= 02201457Z &nbsp=3BentryCSN: 20121202201457.015189Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dconfig &nbsp=3BmodifyTimestamp: 201212022014= 57Z &nbsp=3Bdn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bobje= ctClass: olcDatabaseConfig &nbsp=3BobjectClass: olcFrontendConfig &nb= sp=3BolcDatabase: {-1}frontend &nbsp=3BolcAccess: {0}to * by dn.exact=3D= gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2C= cn=3Dauth manage by * break &nbsp=3BolcAccess: {1}to dn.exact=3D"" by * = read &nbsp=3BolcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read &n= bsp=3BolcSizeLimit: 500 &nbsp=3BstructuralObjectClass: olcDatabaseConfig= &nbsp=3BentryUUID: af9b211a-d108-1031-9418-cd3569532aaf &nbsp=3Bcrea= torsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp= =3BentryCSN: 20121202201456.994497Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dconfig &nbsp=3BmodifyTimestamp: 20121202201456Z &nbsp=3Bdn:= olcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp= =3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcChainConfig = &nbsp=3BolcOverlay: {0}chain &nbsp=3BolcChainReturnError: TRUE &nbsp= =3BstructuralObjectClass: olcChainConfig &nbsp=3BentryUUID: 8605cc76-d21= 4-1031-93d2-613cc62fd42f &nbsp=3BcreatorsName: gidNumber=3D0+uidNumber= =3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BcreateTimestamp= : 20121204041212Z &nbsp=3BentryCSN: 20121204041212.352767Z#000000#000#00= 0000 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred= =2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp: 20121204041212Z<br= >&nbsp=3Bdn: olcDatabase=3D{0}ldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D= {-1}frontend=2Ccn=3Dconfig &nbsp=3BobjectClass: olcLDAPConfig &nbsp= =3BobjectClass: olcChainDatabase &nbsp=3BolcDatabase: {0}ldap &nbsp= =3BolcDbURI: "<a href=3D"ldap://master.example.net:389/">ldap://master.exam= ple.net:389/</a>" &nbsp=3BolcDbIDAssertBind: bindmethod=3Dsimple binddn= =3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc &nbsp=3B =3Dnet" crede= ntials=3D&lt=3Bsecret&gt=3B mode=3Dself flags=3Doverride starttls=3Dcritica= l tls_req &nbsp=3B cert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem<= br>&nbsp=3BolcDbRebindAsUser: TRUE &nbsp=3BstructuralObjectClass: olcLDA= PConfig &nbsp=3BentryUUID: 8609b6f6-d214-1031-93d3-613cc62fd42f &nbsp= =3BcreatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexterna= l=2Ccn=3Dauth &nbsp=3BcreateTimestamp: 20121204041212Z &nbsp=3BentryC= SN: 20121204041212.378432Z#000000#000#000000 &nbsp=3BmodifiersName: gidN= umber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbs= p=3BmodifyTimestamp: 20121204041212Z &nbsp=3Bdn: olcDatabase=3D{0}config= =2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3BolcData= base: {0}config &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber=3D0+u= idNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2Ccn=3Dauth manag= e by * break &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp= =3BentryUUID: af9b4528-d108-1031-9419-cd3569532aaf &nbsp=3BcreatorsName:= cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BentryCS= N: 20121202201456.995421Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3D= config &nbsp=3BmodifyTimestamp: 20121202201456Z &nbsp=3Bdn: olcDataba= se=3D{1}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbs= p=3BobjectClass: olcHdbConfig &nbsp=3BolcDatabase: {1}hdb &nbsp=3Bolc= DbDirectory: /var/lib/ldap &nbsp=3BolcSuffix: dc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BolcLastMod: TRUE &nbsp=3BolcRootDN: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BolcRootPW:: e1NTSEF9eW1nS3JTR0VkMW5LQ0VaQ0Y4UjJBTDlP= TlEveENDbzY=3D &nbsp=3BolcDbCheckpoint: 512 30 &nbsp=3BolcDbConfig: {= 0}set_cachesize 0 2097152 0 &nbsp=3BolcDbConfig: {1}set_lk_max_objects 1= 500 &nbsp=3BolcDbConfig: {2}set_lk_max_locks 1500 &nbsp=3BolcDbConfig= : {3}set_lk_max_lockers 1500 &nbsp=3BolcDbIndex: objectClass eq &nbsp= =3BolcDbIndex: uid eq &nbsp=3BolcDbIndex: cn eq &nbsp=3BolcDbIndex: o= u eq &nbsp=3BolcDbIndex: dc eq &nbsp=3BolcDbIndex: uidNumber eq &n= bsp=3BolcDbIndex: gidNumber eq &nbsp=3BolcDbIndex: memberUid eq &nbsp= =3BolcDbIndex: uniqueMember eq &nbsp=3BolcDbIndex: entryUUID eq &nbsp= =3BolcDbIndex: entryCSN eq &nbsp=3BolcDbIndex: krbPrincipalName eq=2Cpre= s=2Csub &nbsp=3BolcDbIndex: krbPwdPolicyReference eq &nbsp=3Bstructur= alObjectClass: olcHdbConfig &nbsp=3BentryUUID: af9e5d12-d108-1031-9421-c= d3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp= : 20121202201457Z &nbsp=3BolcAccess: {0}to attrs=3DuserPassword=2Cshadow= LastChange by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample= =2Cdc=3Dnet" read by self write by anonymous auth &nbsp=3BolcAccess: {1}= to attrs=3DauthzTo=2CauthzFrom by group.exact=3D"cn=3Dreplicators=2Cou=3Dgr= oups=2Cdc=3Dexample=2Cdc=3Dnet" read by users read by anonymous none &nb= sp=3BolcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLas= tFailedAuth=2CkrbLoginFailedCount by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cd= c=3Dexample=2Cdc=3Dnet" read by dn &nbsp=3B =3D"cn=3Dadm-srv=2Cou=3Dkerb= eros=2Cdc=3Dexample=2Cdc=3Dnet" read by self read by * none &nbsp=3BolcA= ccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by dn= =3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by dn=3D"c= n=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C &nbsp=3B dc=3Dnet" read by= * none &nbsp=3BolcAccess: {4}to dn.base=3D"" by * read &nbsp=3BolcAc= cess: {5}to * by self write by users read &nbsp=3BolcSyncrepl: {0}rid=3D= 123 provider=3D"<a href=3D"ldap://master.example.net:389/">ldap://master.ex= ample.net:389/</a>" type=3DrefreshAndPersist retry=3D"60 30 300 +" searchba= se=3D"dc=3Dexample=2Cdc=3Dnet" bindmethod=3Dsasl &nbsp=3B&nbsp=3B saslme= ch=3Dgssapi starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D/etc/ssl/= certs/cacert.pem &nbsp=3BolcUpdateRef: "<a href=3D"ldap://master.example= .net:389/">ldap://master.example.net:389/</a>" &nbsp=3BentryCSN: 2012120= 4041212.283590Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber=3D0+u= idNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyT= imestamp: 20121204041212Z &nbsp=3B &nbsp=3B &nbsp=3B &nbsp= =3Bdn: dc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3Bobjec= tClass: dcObject &nbsp=3BobjectClass: organization &nbsp=3Bo: example= .net &nbsp=3Bdc: example &nbsp=3BstructuralObjectClass: organization<= br>&nbsp=3BentryUUID: eac01854-d108-1031-95b6-31806daa9e45 &nbsp=3Bcreat= orsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2= 0121202201636Z &nbsp=3BentryCSN: 20121202201636.222029Z#000000#000#00000= 0 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BmodifyTimestamp: 20121202201636Z &nbsp=3BcontextCSN: 20121204035116.8= 90381Z#000000#000#000000 &nbsp=3Bdn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: orga= nizationalRole &nbsp=3Bcn: admin &nbsp=3Bdescription: LDAP administra= tor &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjec= tClass: organizationalRole &nbsp=3BentryUUID: eac2e160-d108-1031-95b7-31= 806daa9e45 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BcreateTimestamp: 20121202201636Z &nbsp=3BentryCSN: 201212022016= 36.240572Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dex= ample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121202201636Z &nbsp=3Bdn:= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organization= alUnit &nbsp=3Bou: people &nbsp=3Bdescription: user account objects<b= r>&nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUUID: 1= cee4810-d12b-1031-9787-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cd= c=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp= =3BentryCSN: 20121203002123.299880Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121= 203002123Z &nbsp=3Bdn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3B= objectClass: organizationalUnit &nbsp=3Bou: groups &nbsp=3Bdescriptio= n: group objects &nbsp=3BstructuralObjectClass: organizationalUnit &n= bsp=3BentryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 &nbsp=3BcreatorsNa= me: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212= 03002123Z &nbsp=3BentryCSN: 20121203002123.394485Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodi= fyTimestamp: 20121203002123Z &nbsp=3Bdn: ou=3Dhosts=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: hosts &= nbsp=3Bdescription: host/computer objects &nbsp=3BstructuralObjectClass:= organizationalUnit &nbsp=3BentryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abce= a93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.400= 935Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: ou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organizationa= lUnit &nbsp=3Bou: kerberos &nbsp=3Bdescription: kerberos realm contai= ner &nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUU= ID: 1cfef412-d12b-1031-978a-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmi= n=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z = &nbsp=3BentryCSN: 20121203002123.409140Z#000000#000#000000 &nbsp=3Bmodif= iersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: = 20121203002123Z &nbsp=3Bdn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cd= c=3Dnet &nbsp=3Bcn: replica &nbsp=3BobjectClass: simpleSecurityObject= &nbsp=3BobjectClass: organizationalRole &nbsp=3BobjectClass: krbPrin= cipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BauthzTo: dn:= * &nbsp=3Bdescription: LDAP server=2C replica &nbsp=3BstructuralObjec= tClass: organizationalRole &nbsp=3BentryUUID: 1d02dae6-d12b-1031-978b-4f= 8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a h= ref=3D"mailto:host/replica.example.net@EXAMPLE.NET">host/replica.example.ne= t(a)EXAMPLE.NET</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipal= Key:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp= =3B MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhb= RURAxZ &nbsp=3B oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz= 54uBWIC4AFa66jXa6Mn3k &nbsp=3B f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKA= HMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu6lb/ &nbsp=3B QQQHgCnrL6XaSAYoh3A5GHF0xa= 2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWgAwIB &nbsp=3B AKExMC+gAwI= BAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D=3D &nbsp= =3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 2012= 1203065600Z &nbsp=3BkrbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFL= k5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BuserPassword:: = &lt=3Bsecret&gt=3B &nbsp=3BentryCSN: 20121203233422.105322Z#000000#000#0= 00000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BmodifyTimestamp: 20121203233422Z &nbsp=3Bdn: cn=3Dmaster=2Cou=3Dhos= ts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: master &nbsp=3BobjectClass: = simpleSecurityObject &nbsp=3BobjectClass: organizationalRole &nbsp=3B= objectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux = &nbsp=3BauthzTo: dn:* &nbsp=3Bdescription: LDAP server=2C replica &nb= sp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectClass: or= ganizationalRole &nbsp=3BentryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93= &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bc= reateTimestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a href=3D"mai= lto:host/master.example.net@EXAMPLE.NET">host/master.example.net(a)EXAMPLE.NE= T</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRK= ADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIB= EqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW+aWr &n= bsp=3B 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86Xg= WwWj5522A &nbsp=3B i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKF= BMD+gAwIBEKE4BDYYAH15xNZ &nbsp=3B VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsS= WdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGu= LUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D=3D &nbsp=3BkrbPasswor= dExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203060855Z<b= r>&nbsp=3BkrbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D = &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203060855.932= 134Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadm-srv=2Cou=3Dkerber= os=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203060855Z<br= >&nbsp=3Bdn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet = &nbsp=3BobjectClass: posixGroup &nbsp=3Bcn: administrator &nbsp=3Bgid= Number: 50000 &nbsp=3BstructuralObjectClass: posixGroup &nbsp=3Bentry= UUID: 1d079216-d12b-1031-978d-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dad= min=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z<b= r>&nbsp=3BentryCSN: 20121203002123.465616Z#000000#000#000000 &nbsp=3Bmod= ifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp= : 20121203002123Z &nbsp=3Bdn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3BobjectClass: groupOfN= ames &nbsp=3Bcn: replicators &nbsp=3Bmember: cn=3Dreplica=2Cou=3Dhost= s=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmember: cn=3Dmaster=2Cou=3Dhosts=2Cd= c=3Dexample=2Cdc=3Dnet &nbsp=3BstructuralObjectClass: groupOfNames &n= bsp=3BentryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 &nbsp=3BcreatorsNa= me: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212= 03002123Z &nbsp=3BentryCSN: 20121203002123.477792Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodi= fyTimestamp: 20121203002123Z &nbsp=3Bdn: uid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3BobjectC= lass: inetOrgPerson &nbsp=3BobjectClass: posixAccount &nbsp=3BobjectC= lass: shadowAccount &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3Bobje= ctClass: krbTicketPolicyAux &nbsp=3Bcn: administrator &nbsp=3Bsn: adm= inistrator &nbsp=3BuidNumber: 50000 &nbsp=3BgidNumber: 50000 &nbsp= =3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BhomeDirectory: /home/admini= strator &nbsp=3BstructuralObjectClass: inetOrgPerson &nbsp=3Buid: adm= inistrator &nbsp=3BentryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 &n= bsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateT= imestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ad= ministrator(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a> &nbsp=3BkrbPrinci= palKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIBAKFJ &n= bsp=3B MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ec= qcdxailuD &nbsp=3B o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELh= AAQRTIM4QI0IPjmA1xg/Ot7l &nbsp=3B cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkw= TKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADmOzq8 &nbsp=3B 96TliwJM9J3X0Dxb/Y+bcTz= 3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWgAwIB &nbsp=3B AKExMC+g= AwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8oAcwB &n= bsp=3B aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4= HaK+6yoME &nbsp=3B 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCY= IAHKR4PzhneCY8c8tLpo8yyO &nbsp=3B mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADA= gEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgEDoSgE &nbsp=3B JggA4e6VizsvWUEKEqAt58P= rPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLRVhBT &nbsp=3B VBMRS5OR= VShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXGa5U+ &n= bsp=3B g=3D &nbsp=3BkrbLastPwdChange: 20121203054848Z &nbsp=3BkrbLast= FailedAuth: 20121204013714Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3Bde= scription: Network Administrator &nbsp=3BkrbLastSuccessfulAuth: 20121204= 035116Z &nbsp=3BkrbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA= =3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121204035= 116.890381Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212040= 35116Z &nbsp=3Bdn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: orga= nizationalRole &nbsp=3Bcn: kdc-srv &nbsp=3Bdescription: Kerberos KDC<= br>&nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectCla= ss: organizationalRole &nbsp=3BentryUUID: 1d168924-d12b-1031-9790-4f8d9a= bcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.5= 63692Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexampl= e=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn= =3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass= : simpleSecurityObject &nbsp=3BobjectClass: organizationalRole &nbsp= =3Bcn: adm-srv &nbsp=3Bdescription: Kerberos Admin Server &nbsp=3Buse= rPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectClass: organizati= onalRole &nbsp=3BentryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 &nbs= p=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTim= estamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.575773Z#000000#= 000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<b= r>&nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: EXAMPLE.NET &n= bsp=3BobjectClass: top &nbsp=3BobjectClass: krbRealmContainer &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BkrbSubTrees: dc=3Dexample=2Cd= c=3Dnet &nbsp=3BkrbSearchScope: 2 &nbsp=3BkrbMaxRenewableAge: 604800<= br>&nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3BstructuralObjectClass: krbRea= lmContainer &nbsp=3BentryUUID: c03d58b8-d134-1031-83e7-0707760cf534 &= nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcreate= Timestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.757228Z#0000= 00#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mai= lto:krbPrincipalName=3DK/M@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc">krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc</a>=3D &nbsp=3B net &nbsp=3BkrbL= oginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3BkrbMaxRene= wableAge: 604800 &nbsp=3BkrbTicketFlags: 192 &nbsp=3BkrbPrincipalName= : <a href=3D"mailto:K/M@EXAMPLE.NET">K/M(a)EXAMPLE.NET</a> &nbsp=3BkrbPrin= cipalExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MGagAwIBAaEDA= gEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+gAwIB &nbsp=3B EKE4BDYYALvAYAT= OnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/c4Ks &nbsp=3B = HI=3D &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtraData:= : AAkBAAEArgC8UA=3D=3D &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARV= hBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAAAAAAA=3D &nbsp=3B= objectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPri= ncipal &nbsp=3BentryUUID: c04d9282-d134-1031-83e8-0707760cf534 &nbsp= =3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTime= stamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.863568Z#000000#0= 00#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:= krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos">krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMP= LE.NET=2Cou=3Dkerberos</a> &nbsp=3B =2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3Bkrb= MaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 0 &nbsp=3BkrbPrincipa= lName: <a href=3D"mailto:krbtgt/EXAMPLE.NET@EXAMPLE.NET">krbtgt/EXAMPLE.NET= @EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbs= p=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgA= wIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwF= c2CqS9kNvgpTNujaNnfmRR &nbsp=3B GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN= 6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7UKy1 &nbsp=3B 93EQx3jtSTiD0aa2tNK9Fbkom= kYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9KwFT &nbsp=3B B9MqvfMfba= 37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWgAwIB &nbs= p=3B AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTT= A8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9= HckLfrcVL5goKRVOV8oR &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp= =3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbEx= traData:: AAcBAAIAAgAAAAAAAAA=3D &nbsp=3BobjectClass: krbPrincipal &n= bsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyA= ux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c05= 18180-d134-1031-83e9-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp= =3BentryCSN: 20121203013022.889347Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121= 203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/admin= @EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dex">krbPrincipalName= =3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dex</a= > &nbsp=3B ample=2Cdc=3Dnet &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbMaxTicketLife: 10800 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp= =3BkrbTicketFlags: 4 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/= admin(a)EXAMPLE.NET">kadmin/admin(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpi= ration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAw= IBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAMjLoWHT= DPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtCkdsY &nbsp=3B 5WwobkGKF= vGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M28Ix6 &nb= sp=3B SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDY= YAGZM5wu &nbsp=3B tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFiv= BmdH1kEy8cwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84= Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJ= ggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3aQz &nbsp=3BkrbLastPwdCh= ange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVh= BTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbsp=3Bo= bjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPri= ncipal &nbsp=3BentryUUID: c05346be-d134-1031-83ea-0707760cf534 &nbsp= =3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTime= stamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.900950Z#000000#0= 00#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:= krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dke= rberos=2Cdc">krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dkerberos=2Cdc</a> &nbsp=3B =3Dexample=2Cdc=3Dnet &nbsp=3Bk= rbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 300 &nbsp=3BkrbMaxRen= ewableAge: 604800 &nbsp=3BkrbTicketFlags: 8196 &nbsp=3BkrbPrincipalNa= me: <a href=3D"mailto:kadmin/changepw@EXAMPLE.NET">kadmin/changepw(a)EXAMPLE.= NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPr= incipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ<b= r>&nbsp=3B MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaB= p9l1hsceWqIB2 &nbsp=3B ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoT= AELhAAt+ZrWZKAjKkUhSJt0wwSqU &nbsp=3B ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2= M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd423Z &nbsp=3B epUHmGMVf2I5sRQZRuo= ypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWgAwIB &nbsp=3B AKEx= MC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8oAcwB<b= r>&nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/= w7dmvqU9zPl &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtr= aData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: = AAcBAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3Bobje= ctClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbs= p=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c054d88a-d134= -1031-83eb-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN= : 20121203013022.911237Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z<= br>&nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/history@EXAMPLE.= NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc">krbPrincipalName=3Dkadmin/hist= ory(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc</a>=3D &nbsp=3B = example=2Cdc=3Dnet &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicke= tLife: 36000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlag= s: 0 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/history@EXAMPLE.= NET">kadmin/history(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 1970= 0101000000Z &nbsp=3BkrbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME= 4wTKAHMAWgAwIBAKFBMD+gAwIB &nbsp=3B EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKb= f2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd/N+Z &nbsp=3B 2g=3D &nbsp=3BkrbL= astPwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXR= pb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &= nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux<br= >&nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: = krbPrincipal &nbsp=3BentryUUID: c0562d3e-d134-1031-83ec-0707760cf534 = &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcreat= eTimestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.919957Z#000= 000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"ma= ilto:krbPrincipalName=3Dkadmin/master.example.net@EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dk">krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2C= cn=3DEXAMPLE.NET=2Cou=3Dk</a> &nbsp=3B erberos=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3Bkr= bPrincipalName: <a href=3D"mailto:kadmin/master.example.net@EXAMPLE.NET">ka= dmin/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: = 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAg= EApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABhOeGOuo9UBDjK7= hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4Ta3z &nbsp=3B Y4ZaEYItXr2awBW6Q= XSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtGg1qY &nbsp=3B oe= v8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj0sgn= &nbsp=3B ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf= 4UwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qY= DwpK0Hycj+cwyCjFsVKTsjzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAxTSME= h/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZABm &nbsp=3BkrbLastPwdChange: 19= 700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5= ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAANAD4gA=3D &nbsp=3BobjectCla= ss: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectC= lass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal = &nbsp=3BentryUUID: c0581144-d134-1031-83ed-0707760cf534 &nbsp=3Bcreators= Name: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012= 1203013022Z &nbsp=3BentryCSN: 20121203013022.932349Z#000000#000#000000<b= r>&nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmo= difyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipa= lName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dker">= krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dker</a> &nbsp=3B beros=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BkrbP= rincipalName: <a href=3D"mailto:ldap/master.example.net@EXAMPLE.NET">ldap/m= aster.example.net(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: krbPrincipal &= nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicy= Aux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: 91= a6199c-d15a-1031-9919-2f12ddec6588 &nbsp=3BcreatorsName: cn=3Dadm-srv=2C= ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012120= 3060105Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MII= BRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegA= wIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPUS2wz<br= >&nbsp=3B qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14T= YWZyLZem5kvD &nbsp=3B yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIB= AKFBMD+gAwIBEKE4BDYYAAbNr3p &nbsp=3B vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4= kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYI= APc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D=3D &nbsp=3BkrbPass= wordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203060153= Z &nbsp=3BkrbLastSuccessfulAuth: 20121203061721Z &nbsp=3BkrbExtraData= :: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData::= AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203061721.358939Z#000000#000#000000= &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BmodifyTimestamp: 20121203061721Z &nbsp=3Bdn: <a href= =3D"mailto:krbPrincipalName=3Dldap/replica.example.net@EXAMPLE.NET=2Ccn=3DE= XAMPLE.NET=2Cou=3Dke">krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.N= ET=2Ccn=3DEXAMPLE.NET=2Cou=3Dke</a> &nbsp=3B rberos=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ldap/replica.example.= net(a)EXAMPLE.NET">ldap/replica.example.net(a)EXAMPLE.NET</a> &nbsp=3Bobject= Class: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3Bobje= ctClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal<= br>&nbsp=3BentryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 &nbsp=3Bcreat= orsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3B= createTimestamp: 20121203065511Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAw= IBAKFJ &nbsp=3B MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3= wddcUmq3o092v7mUXFMNw &nbsp=3B 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6= ADAgEXoTAELhAApsEJiySukR8L5M3DKbipUj &nbsp=3B AITSVQQL2YSqY7xr/BY7Hm3huN= /juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOvmT4x &nbsp=3B MDAmgH2qTgq= XTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWgAwIB &nbsp= =3B AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA= =3D=3D &nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLast= PwdChange: 20121203065628Z &nbsp=3BkrbExtraData:: AAIcTbxQYWRtaW5pc3RyYX= RvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3B= krbLastSuccessfulAuth: 20121204032538Z &nbsp=3BentryCSN: 20121204032538.= 048010Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dker= beros=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121204032538Z= &nbsp=3B <div><div id=3D"SkyDrivePlaceholder"></div>&gt=3B Date: Fri= =2C 9 Nov 2012 01:55:32 +0000 &gt=3B From: openldap-its(a)OpenLDAP.org = &gt=3B To: blance3459(a)hotmail.com &gt=3B Subject: Re: (ITS#7434) idasser= t-bind fails after restarting slapd &gt=3B &gt=3B &gt=3B *** THI= S IS AN AUTOMATICALLY GENERATED REPLY *** &gt=3B &gt=3B Thanks for y= our report to the OpenLDAP Issue Tracking System. Your &gt=3B report ha= s been assigned the tracking number ITS#7434. &gt=3B &gt=3B One of o= ur support engineers will look at your report in due course. &gt=3B Note= that this may take some time because our support engineers &gt=3B are v= olunteers. They only work on OpenLDAP when they have spare &gt=3B time.= &gt=3B &gt=3B If you need to provide additional information in rega= rds to your &gt=3B issue report=2C you may do so by replying to this mes= sage. Note that &gt=3B any mail sent to openldap-its(a)openldap.org with = (ITS#7434) &gt=3B in the subject will automatically be attached to the i= ssue report. &gt=3B &gt=3B mailto:openldap-its@openldap.org?subject= =3D(ITS#7434) &gt=3B &gt=3B You may follow the progress of this repo= rt by loading the following &gt=3B URL in a web browser: &gt=3B h= ttp://www.OpenLDAP.org/its/index.cgi?findid=3D7434 &gt=3B &gt=3B Ple= ase remember to retain your issue tracking number (ITS#7434) &gt=3B on a= ny further messages you send to us regarding this report. If &gt=3B you= don't then you'll just waste our time and yours because we &gt=3B won't= be able to properly track the report. &gt=3B &gt=3B Please note tha= t the Issue Tracking System is not intended to &gt=3B be used to seek he= lp in the proper use of OpenLDAP Software. &gt=3B Such requests will be = closed. &gt=3B &gt=3B OpenLDAP Software is user supported. &gt=3B= http://www.OpenLDAP.org/support/ &gt=3B &gt=3B -------------- &= gt=3B Copyright 1998-2007 The OpenLDAP Foundation=2C All Rights Reserved.<b= r>&gt=3B </div> </div></body> </html>= --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_--

1 0

(ITS#7462) olcPcache cannot be modified
by tioteath＠gmail.com 04 Dec '12

04 Dec '12

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.172.239.4) I'm getting 'LDAP: error code 80 - cannot delete olcPcache' while I'm trying to perform olcPcache modification: dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config changetype: modify replace: olcPcache olcPcache: hdb 10000 4 500 100 - I have to perform this action in case, I need to extend the number of pcacheAttrset directives.

1 0

(ITS#7461) slapo-pcache not used for ACL which contains DN pointing to the remote LDAP server
by tioteath＠gmail.com 04 Dec '12

04 Dec '12

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.172.239.4) I'm trying to set up group ACL, which contains DN located on the remote LDAP server. I have working ldap-proxy (olcSuffix: dc=remote) with slapo-pcache up and running. I can do the following search request, and get proper result, stored in the pcache database: ldapsearch -bcn=test2,ou=group,dc=remote "(objectClass=groupOfNames)" objectClass member But whenever I trying to get access to the RDN, the ACL of which contains following group entry: 'to dn.base="ou=people,dc=local" by group.exact="cn=test2,ou=group,dc=remote" write' I can't see any activity in the log (using pcache loglevel). Looks like, for some unknown reason, pcache are totally ignored while ACLs are processed. This decreases performance dramatically, as search statements are produced for each ACL containing remote DN.

1 0

Re: (ITS#7458) No matching rules for attribute mailPreferenceOption
by jonas.d.lindstrom＠ericsson.com 04 Dec '12

04 Dec '12

Yes, you are right of course. And thanks for the tip about forcing a matching rule, it works fine. /JL On 2012-12-04 02:29, Quanah Gibson-Mount wrote: > --On Monday, December 03, 2012 9:06 AM +0000 > jonas.d.lindstrom(a)ericsson.com wrote: > >> Full_Name: Jonas Lindstr?m >> Version: 2.4.33 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (194.237.142.6) >> >> >> The attribute mailPreferenceOption in the cosine schema is defined >> without any matching rules, so filters such as (mailPreferenceOption=0) >> fail. > > Core schema are defined by RFCs. If the RFC defines no matching rule, > then there isn't one in the schema. If you want to see this changed, > I advise filing an RFC to update the schema definition. For this > particular attribute, see <https://www.ietf.org/rfc/rfc1274.txt> > > You can, of course, force matching rules for your search. See the > slapcat manpage for examples of how to force matching rules. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7458) No matching rules for attribute mailPreferenceOption
by quanah＠zimbra.com 03 Dec '12

03 Dec '12

--On Monday, December 03, 2012 9:06 AM +0000 jonas.d.lindstrom(a)ericsson.com wrote: > Full_Name: Jonas Lindstr?m > Version: 2.4.33 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (194.237.142.6) > > > The attribute mailPreferenceOption in the cosine schema is defined > without any matching rules, so filters such as (mailPreferenceOption=0) > fail. Core schema are defined by RFCs. If the RFC defines no matching rule, then there isn't one in the schema. If you want to see this changed, I advise filing an RFC to update the schema definition. For this particular attribute, see <https://www.ietf.org/rfc/rfc1274.txt> You can, of course, force matching rules for your search. See the slapcat manpage for examples of how to force matching rules. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by quanah＠zimbra.com 03 Dec '12

03 Dec '12

--On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: > fumiyas(a)osstech.jp wrote: >> At Wed, 28 Nov 2012 20:04:41 GMT, >> michael(a)stroeder.com wrote: >>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>> to ease building it without installed OpenLDAP client libs: >> >> This ITS is a dup of #7309. >> http://www.openldap.org/its/index.cgi?findid=7309 >> >> And see also: >> http://www.openldap.org/its/index.cgi?findid=7308 >> >> This problem is fixed in master, but not in 2.4 branch... > > Ah, thanks for the hint. The Makefile in master looks much better than my > suggestion. > > @Quanah: Could you please port this to RE24 branch? My recollection is we've been waiting on someone to go through and test the changes. Are you willing to do that? it sounds like you've started... --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7460) command-line option to ldapsearch to ignore server SSL certificate
by hyc＠symas.com 03 Dec '12

03 Dec '12

hauser(a)acm.org wrote: > Full_Name: Ralf Hauser > Version: 2.4.23 > OS: debian stable > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.25.16.113) > > > to test, it would be great to have a ldapsearch command-line option to ignore > the server cert. > > a) is that already existing ? No. > b) how would this be done otherwise? Use ldaprc. Read the ldap.conf(5) manpage. Closing this ITS. > > Many thanks in advance! > > Ralf > > P.S.: Perhaps, this could be added to a FAQ > http://www.openldap.org/faq/data/cache/2.html > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7459) It is impossible to modify attributes olcPcacheTemplate, olcPcacheAttrset
by hyc＠symas.com 03 Dec '12

03 Dec '12

tioteath(a)gmail.com wrote: > Full_Name: Tio Teath > Version: 2.4.33 > OS: Debian GNU Linux Wheezy > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (178.172.239.4) > > > It is impossible to modify attributes olcPcacheTemplate, olcPcacheAttrset: > modify/add: olcPcacheTemplate: no equality matching rule > > Fixed now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7460) command-line option to ldapsearch to ignore server SSL certificate
by hauser＠acm.org 03 Dec '12

03 Dec '12

Full_Name: Ralf Hauser Version: 2.4.23 OS: debian stable URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.25.16.113) to test, it would be great to have a ldapsearch command-line option to ignore the server cert. a) is that already existing ? b) how would this be done otherwise? Many thanks in advance! Ralf P.S.: Perhaps, this could be added to a FAQ http://www.openldap.org/faq/data/cache/2.html

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs