- openldap-bugs - openldap.org

(ITS#7484) sssvlv-maxpercon(n) configuration option
by liam.gretton＠leicester.ac.uk 04 Jan '13

04 Jan '13

Full_Name: Liam Gretton Version: 2.4.33 OS: SLES 11 SP 2 URL: Submission from: (NULL) (143.210.13.77) There's a mismatch between the documentation for the sssvlv-maxpercon option and the actual configuration option name. The man page documentation for slapo-sssvlv states that the maximum number of concurrent paged search requests per connection option is 'sssvlv-maxperconn'. For an LDAP-based configuration the option is 'olcSssVlvMaxPerConn' but for a slapd.conf based configuration the option is 'sssvlv-maxpercon' (note only one 'n', not two).

1 0

(ITS#7483) back-mdb slapcat missing entries behavior
by ebackes＠symas.com 28 Dec '12

28 Dec '12

Full_Name: Emily Backes Version: RE24/HEAD OS: URL: Submission from: (NULL) (98.155.30.248) When given a database with missing entries, e.g. from slapadd of bad or incomplete data, slapcat on back-bdb returned even the orphaned children. Slapcat on back-mdb had inconsistent behavior, sometimes resulting in many more missing entries and sometimes resulting in segv. This is a problem only in slapcat, and should be fixed in commit e4ec2be93d675b120f1bffbff497d9ed8628c2a6 Better handling of missing entries (Thanks Howard!)

1 0

Re: (ITS#7481) nssov-pam-session ignored while db creation
by hyc＠symas.com 23 Dec '12

23 Dec '12

molostoff(a)gmail.com wrote: > Full_Name: Vasiliy molostov > Version: 2.4.28-1.1ubuntu4.2 > OS: ubuntu 12.04.1 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (95.31.14.8) > > > Being placed into slapd.conf nssov-pam-session directive is ignored while db > creation that can be observed in olcOverlay=nssov,olcDatabase=hdb,cn=config - > attribute olcNssPamSession is not added and has no requested values, and as a > result loginStatus doesnt work. Thanks for the report, fixed now in git master. PS: the version you're reporting against is already over a year old. You would have needed to update anyway. > > Manual addition of olcNssPamSession into > olcOverlay=nssov,olcDatabase=hdb,cn=config does this thing to work - loginStatus > works fine. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7481) nssov-pam-session ignored while db creation
by molostoff＠gmail.com 21 Dec '12

21 Dec '12

Full_Name: Vasiliy molostov Version: 2.4.28-1.1ubuntu4.2 OS: ubuntu 12.04.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (95.31.14.8) Being placed into slapd.conf nssov-pam-session directive is ignored while db creation that can be observed in olcOverlay=nssov,olcDatabase=hdb,cn=config - attribute olcNssPamSession is not added and has no requested values, and as a result loginStatus doesnt work. Manual addition of olcNssPamSession into olcOverlay=nssov,olcDatabase=hdb,cn=config does this thing to work - loginStatus works fine.

1 0

Re: (ITS#7477) ldapmodify core dumps
by hyc＠symas.com 19 Dec '12

19 Dec '12

marco.pizzoli(a)gmail.com wrote: > Full_Name: Marco Pizzoli > Version: RE24 as of 2012/12/12 > OS: Linux x86_64 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (194.11.209.11) > > > I composed an erroneous ldif file to modify an entry, I executed the ldapmodify > operation and the ldapmodify tool core dumped. > > I can't provide the core dump, I'm sorry. Thanks for the report, fixed now in master. > > > These are both the ldif and the cmdline I used: > > ------------------------ > dn: cn=my name,ou=my_ou,dc=mydc > changetype: add > add: objectClass > objectClass: posixAccount > - > add: userPassword > userPassword: {SASL}user(a)domain.dc > - > ------------------------ > > ldapmodify -vvvv -x cn=my_admin -wpassword -h 127.0.0.1 -p 389 -f file.ldif > ldap_initialize( ldap://127.0.0.1:389 ) > Segmentation fault (core dumped) > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7477) ldapmodify core dumps
by marco.pizzoli＠gmail.com 19 Dec '12

19 Dec '12

Full_Name: Marco Pizzoli Version: RE24 as of 2012/12/12 OS: Linux x86_64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.11.209.11) I composed an erroneous ldif file to modify an entry, I executed the ldapmodify operation and the ldapmodify tool core dumped. I can't provide the core dump, I'm sorry. These are both the ldif and the cmdline I used: ------------------------ dn: cn=my name,ou=my_ou,dc=mydc changetype: add add: objectClass objectClass: posixAccount - add: userPassword userPassword: {SASL}user(a)domain.dc - ------------------------ ldapmodify -vvvv -x cn=my_admin -wpassword -h 127.0.0.1 -p 389 -f file.ldif ldap_initialize( ldap://127.0.0.1:389 ) Segmentation fault (core dumped)

1 0

(ITS#7476) patch for ldap_pvt_connect
by codehero＠gmail.com 19 Dec '12

19 Dec '12

Full_Name: David Bender Version: 2.4.32 OS: Linux URL: Submission from: (NULL) (96.236.148.85) ldap_pvt_connect() in libldap/os-ip.c fails intermittently when the calling program also runs child processes. The connect() call fails with EINTR, but no effort is made to retry the connect(). The following patches add support for retrying in this case, as well as toggling the behaviour with LDAP_OPT_RESTART. Patches are available and should be applied in this order (applied to current HEAD): https://github.com/benegon/openldap/commit/8e4fee39bfccaa3dd15179fb6451d397… https://github.com/benegon/openldap/commit/991941e3b51fea44d5f123f24a0f3206…

1 0

(ITS#7475) documenting that dynamic lists/groups overlays are mutually exclusive with the memberof overlay
by tedcheng＠symas.com 17 Dec '12

17 Dec '12

Full_Name: Ted C. Cheng Version: trunk OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (76.174.253.197) Document enhancement request: Dynamic lists/groups do not involve group entry modification. As a result, they cannot be used with the memberof overlay. It would be great to document explicitly, man pages and admin guide, that dynamic lists/groups overlays and memberof overlay are mutually exclusive.

1 0

Re: (ITS#7309) [PATCH] contrib/slapd-modules: Unify the structure and usage of Makefile
by quanah＠zimbra.com 15 Dec '12

15 Dec '12

--On Saturday, December 15, 2012 7:06 PM +0000 michael(a)stroeder.com wrote: > This is a cryptographically signed message in MIME format. > > --------------ms020502020407040509060800 > Content-Type: text/plain; charset=ISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > I've tested RE24 4aed59cafd4815ea9d849b0031ebab54a0d74536 with this build= > > patch applied and everything seems to work for me. > > (Actually the patch was applied to RE24 in > 979d48625035d7ccd85f0021295fc8ee0f45e31d.) Thanks Michael! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7309) [PATCH] contrib/slapd-modules: Unify the structure and usage of Makefile
by michael＠stroeder.com 15 Dec '12

15 Dec '12

This is a cryptographically signed message in MIME format. --------------ms020502020407040509060800 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable I've tested RE24 4aed59cafd4815ea9d849b0031ebab54a0d74536 with this build= patch applied and everything seems to work for me. (Actually the patch was applied to RE24 in 979d48625035d7ccd85f0021295fc8ee0f45e31d.) --------------ms020502020407040509060800 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMjE1MTkwNjAzWjAjBgkq hkiG9w0BCQQxFgQUwqmjaQ9Jg1BWK2ZKa2aTGL6/5bcwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAngeFWLhvwxUst1NtrVtbFYvx237qewz713dGdZq6wwye/Q5sGh5FZF680d+g5mGeqVUn BZD6gA5yU8a/bpCdTB9s16fQKJpRKLuz+xHpYDWmV/AUpB+QpQijnrJpJZFWDCTX6RnTwL2L vxOhhb21DMuIIZ1Kuu1dx0S4L6MVZjJGfQgx+8kYnObMqcKyUr6pOUElQnWy1deRVpwgpgF+ MpwLt2FFdMHIOMfkjDIhtxHOBvfrBlKt9a8BFfymyTBwEm1gPxv8gdSF4TOnfmJbcntGPG/a E50j9iak/qoK3/cS05KkFtqb1Zx7hyjAUIX/l5vQb/O7Rp9b4Xegv80AMAAAAAAAAA== --------------ms020502020407040509060800--

1 0

(ITS#7474) memberOf and full syncreplication
by marco.pizzoli＠gmail.com 14 Dec '12

14 Dec '12

Full_Name: Marco Pizzoli Version: 2.4.33 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.11.209.11) Hi, I think this could be considered an RFE. During a full syncreplication I can't populate the memberOf attribute of some entries because they are not (yet) present in the replicated tree. The error is quite clear by looking at the logs during the full syncreplication., "conn=-1 op=0: memberof_value_modify DN=<my_user_DN> add memberOf=<my_group_DN> failed err=32 The problem doesn't occur on all user entries, because some of them are replicated before the group which include them (as member, of course). I would like to be assured that a full sync-replication can go smooth by populating the memberOf attribute on all entries. Thanks in advance Marco

1 0

(ITS#7473) back-mdb is 50x slower than back-hdb on datasets with numerous subtrees
by quanah＠OpenLDAP.org 13 Dec '12

13 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/11/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) When testing on a database with over 40,000 subtrees, I discovered that search results when using subtrees as a base for the search are at least 50x slower with back-mdb than they are with back-hdb. Details have been provided to Howard, including the example dataset

1 0

Re: (ITS#7472) syncrepl conflicting write resolution trouble
by hyc＠symas.com 11 Dec '12

11 Dec '12

ebackes(a)symas.com wrote: > Full_Name: Emily Backes > Version: 2.4.33+ITS#7427 > OS: > URL: > Submission from: (NULL) (98.155.30.248) > > > We are seeing a condition under heavy conflicting-write load-- i.e. changes to > the same DN from multiple nodes in a syncrepl MMR cluster at the same time-- > where the content of the entry is desynchronized between servers. > > There is a non-reproduced case with incomplete logs where servers traded entry > versions, even with one CSN significantly (by one second) later than the other. > I'll supply more info if that reappears. > > Additionally, we have a -d logged case of a conflicting write resulting in > different changes applied on different servers while the same CSN gets applied > to both, which seems truly bizarre. > > The expected case is that one server "wins" the conflict and its state is sent > to all of the others, eventually. Analyzing the logs shows this is an unresolvable conflict in plain syncrepl/MMR. Please note that the Admin Guide already documents the fact that consistency is not guaranteed in this mode. (Section 18.2.2.3.) The solution, as documented, is to use mirrormode. > All of these results are using back-hdb. More details soon, hopefully. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7472) syncrepl conflicting write resolution trouble
by ebackes＠symas.com 11 Dec '12

11 Dec '12

Full_Name: Emily Backes Version: 2.4.33+ITS#7427 OS: URL: Submission from: (NULL) (98.155.30.248) We are seeing a condition under heavy conflicting-write load-- i.e. changes to the same DN from multiple nodes in a syncrepl MMR cluster at the same time-- where the content of the entry is desynchronized between servers. There is a non-reproduced case with incomplete logs where servers traded entry versions, even with one CSN significantly (by one second) later than the other. I'll supply more info if that reappears. Additionally, we have a -d logged case of a conflicting write resulting in different changes applied on different servers while the same CSN gets applied to both, which seems truly bizarre. The expected case is that one server "wins" the conflict and its state is sent to all of the others, eventually. While most likely unrelated, we're also still seeing massive desynchronization from conflicting writes involving modifies and deletes, where the deletes are sent under heavy load such that the commits occur out of order and result in a cookie-less syncrepl event-- these (Despite #7427) can still resurrect entries later. All of these results are using back-hdb. More details soon, hopefully.

1 0

(ITS#7471) MDB resize on the fly is broken in RE24
by quanah＠OpenLDAP.org 11 Dec '12

11 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/11/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) In the 2.4.33 release of OpenLDAP, it was possibly to resize an MDB database by modifying olcDbMaxsize while slapd was running. This functionality no longer works in current RE24. This is highly desirable behavior, as one may wish to reduce the maximum DB size after determining how large the actual MDB is. With current RE24, changing olcDbMaxsize to a smaller value leaves the data.mdb file the same size as it was before. 2.4.33 behavior: 80GB initial maxsize: zimbra@zre-ldap002:~$ ls -l data/ldap/mdb/db total 692 -rw------- 1 zimbra zimbra 85899345920 Dec 11 10:46 data.mdb After modifying cn=config with a 10MB maxsize: zimbra@zre-ldap002:~$ ls -l data/ldap/mdb/db total 692 -rw------- 1 zimbra zimbra 10485760 Dec 11 10:51 data.mdb

1 0

Re: (ITS#7470) RE24 MDB corrupts over time
by quanah＠zimbra.com 11 Dec '12

11 Dec '12

--On Tuesday, December 11, 2012 6:31 PM +0000 openldap-its(a)OpenLDAP.org wrote: Never mind, old build before latest patches. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7470) RE24 MDB corrupts over time
by quanah＠OpenLDAP.org 11 Dec '12

11 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/11/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) Over time, the MDB database corrupts with write traffic. Dec 10 23:54:39 zqa-384 slapd[28213]: slap_queue_csn: queing 0x7f81a6d8d1a0 20121211075439.646157Z#000000#000#000000 Dec 10 23:54:39 zqa-384 slapd[28213]: slap_graduate_commit_csn: removing 0x64c6e70 20121211075439.646157Z#000000#000#000000 Dec 10 23:54:39 zqa-384 slapd[28213]: slap_queue_csn: queing 0x7f81a5d8b1a0 20121211075439.660500Z#000000#000#000000 Dec 10 23:54:40 zqa-384 postfix/smtpd[17272]: connect from zqa-384.eng.vmware.com[10.137.245.129] Dec 10 23:54:40 zqa-384 postfix/proxymap[17273]: error: dict_ldap_connect: Unable to set STARTTLS: -1: Can't contact LDAP server Dec 10 23:54:40 zqa-384 postfix/trivial-rewrite[17274]: warning: proxy:ldap:/opt/zimbra/conf/ldap-vad.cf: table lookup problem Dec 10 23:54:40 zqa-384 postfix/trivial-rewrite[17274]: warning: virtual_alias_domains lookup failure Dec 10 23:54:40 zqa-384 postfix/proxymap[17273]: error: dict_ldap_connect: Unable to set STARTTLS: -1: Can't contact LDAP server Dec 10 23:54:40 zqa-384 postfix/trivial-rewrite[17274]: warning: proxy:ldap:/opt/zimbra/conf/ldap-vad.cf: table lookup problem Dec 10 23:54:40 zqa-384 postfix/trivial-rewrite[17274]: warning: virtual_alias_domains lookup failure Dec 10 23:54:40 zqa-384 postfix/smtpd[17272]: NOQUEUE: reject: RCPT from zqa-384.eng.vmware.com[10.137.245.129]: 451 4.3.0 <admin(a)zqa-384.eng.vmware.com>: Temporary lookup failure; from=<admin(a)zqa-384.eng.vmware.com> to=<test1355212480752.21277(a)zqa-384.eng.vmware.com> proto=ESMTP helo=<zqa-384.eng.vmware.com> zimbra@zqa-384:~$ mdb_stat -eaf data/ldap/mdb/db mdb_env_open failed, error -30793 MDB_INVALID: File is not an MDB file

1 0

Re: (ITS#7469) MDB double free when slapcatting a subtree
by quanah＠zimbra.com 10 Dec '12

10 Dec '12

--On Tuesday, December 11, 2012 1:07 AM +0000 openldap-its(a)OpenLDAP.org wrote: zimbra@zre-ldap001:~$ valgrind /opt/zimbra/openldap/sbin/slapcat -F /opt/zimbra/data/ldap/config -b "" -s dc=com -l /tmp/blah.ldif ==3554== Memcheck, a memory error detector ==3554== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al. ==3554== Using Valgrind-3.6.0.SVN and LibVEX; rerun with -h for copyright info ==3554== Command: /opt/zimbra/openldap/sbin/slapcat -F /opt/zimbra/data/ldap/config -b -s dc=com -l /tmp/blah.ldif ==3554== ==3554== Invalid read of size 8 ==3554== at 0x66A63C4: __strspn_sse42 (smmintrin.h:510) ==3554== by 0x4E681F8: ldap_pvt_strtok (string.c:92) ==3554== by 0x499C4E: str2anlist (ad.c:936) ==3554== by 0x47388B: parse_acl (aclparse.c:473) ==3554== by 0x41A454: config_generic (bconfig.c:1825) ==3554== by 0x42E1DB: config_set_vals (config.c:345) ==3554== by 0x42E73A: config_add_vals (config.c:418) ==3554== by 0x42F45B: config_parse_add (config.c:689) ==3554== by 0x425A1B: config_add_internal (bconfig.c:5182) ==3554== by 0x421E40: config_ldif_resp (bconfig.c:3990) ==3554== by 0x453E2B: slap_response_play (result.c:507) ==3554== by 0x455A44: slap_send_search_entry (result.c:1011) ==3554== Address 0x6afc0f8 is 8 bytes inside a block of size 13 alloc'd ==3554== at 0x4C275D8: malloc (vg_replace_malloc.c:236) ==3554== by 0x509AFD5: ber_memalloc_x (memory.c:228) ==3554== by 0x509B910: ber_strdup_x (memory.c:638) ==3554== by 0x463B0E: ch_strdup (ch_malloc.c:121) ==3554== by 0x499BA2: str2anlist (ad.c:924) ==3554== by 0x47388B: parse_acl (aclparse.c:473) ==3554== by 0x41A454: config_generic (bconfig.c:1825) ==3554== by 0x42E1DB: config_set_vals (config.c:345) ==3554== by 0x42E73A: config_add_vals (config.c:418) ==3554== by 0x42F45B: config_parse_add (config.c:689) ==3554== by 0x425A1B: config_add_internal (bconfig.c:5182) ==3554== by 0x421E40: config_ldif_resp (bconfig.c:3990) ==3554== ==3554== Invalid read of size 8 ==3554== at 0x66A63AD: __strspn_sse42 (emmintrin.h:679) ==3554== by 0x4E681F8: ldap_pvt_strtok (string.c:92) ==3554== by 0x499E1F: str2anlist (ad.c:938) ==3554== by 0x47388B: parse_acl (aclparse.c:473) ==3554== by 0x41A454: config_generic (bconfig.c:1825) ==3554== by 0x42E1DB: config_set_vals (config.c:345) ==3554== by 0x42E73A: config_add_vals (config.c:418) ==3554== by 0x42F45B: config_parse_add (config.c:689) ==3554== by 0x425A1B: config_add_internal (bconfig.c:5182) ==3554== by 0x421E40: config_ldif_resp (bconfig.c:3990) ==3554== by 0x453E2B: slap_response_play (result.c:507) ==3554== by 0x455A44: slap_send_search_entry (result.c:1011) ==3554== Address 0xa57bbc8 is 40 bytes inside a block of size 46 alloc'd ==3554== at 0x4C275D8: malloc (vg_replace_malloc.c:236) ==3554== by 0x509AFD5: ber_memalloc_x (memory.c:228) ==3554== by 0x509B910: ber_strdup_x (memory.c:638) ==3554== by 0x463B0E: ch_strdup (ch_malloc.c:121) ==3554== by 0x499BA2: str2anlist (ad.c:924) ==3554== by 0x47388B: parse_acl (aclparse.c:473) ==3554== by 0x41A454: config_generic (bconfig.c:1825) ==3554== by 0x42E1DB: config_set_vals (config.c:345) ==3554== by 0x42E73A: config_add_vals (config.c:418) ==3554== by 0x42F45B: config_parse_add (config.c:689) ==3554== by 0x425A1B: config_add_internal (bconfig.c:5182) ==3554== by 0x421E40: config_ldif_resp (bconfig.c:3990) ==3554== 50c689a0 mdb_db_open: database "" cannot be opened, err 22. Restore from backup! 50c689a0 backend_startup_one (type=mdb, suffix=""): bi_db_open failed! (22) slap_startup failed ==3554== ==3554== HEAP SUMMARY: ==3554== in use at exit: 3,904,527 bytes in 46,449 blocks ==3554== total heap usage: 89,842 allocs, 43,393 frees, 31,218,836 bytes allocated ==3554== ==3554== LEAK SUMMARY: ==3554== definitely lost: 0 bytes in 0 blocks ==3554== indirectly lost: 0 bytes in 0 blocks ==3554== possibly lost: 0 bytes in 0 blocks ==3554== still reachable: 3,904,527 bytes in 46,449 blocks ==3554== suppressed: 0 bytes in 0 blocks ==3554== Rerun with --leak-check=full to see details of leaked memory ==3554== ==3554== For counts of detected and suppressed errors, rerun with: -v ==3554== ERROR SUMMARY: 8 errors from 2 contexts (suppressed: 59 from 5) --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7469) MDB double free when slapcatting a subtree
by quanah＠zimbra.com 10 Dec '12

10 Dec '12

--On Tuesday, December 11, 2012 1:07 AM +0000 openldap-its(a)OpenLDAP.org wrote: #0 0x00007ffff633fa75 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 pid = <value optimized out> selftid = <value optimized out> #1 0x00007ffff63435c0 in *__GI_abort () at abort.c:92 act = {__sigaction_handler = {sa_handler = 0x7fffffffd850, sa_sigaction = 0x7fffffffd850}, sa_mask = {__val = {140737488345360, 140737488350338, 43, 140737325127087, 3, 140737488345370, 6, 140737325127091, 2, 140737488345358, 2, 140737325118168, 1, 140737325127087, 3, 140737488345364}}, sa_flags = 12, sa_restorer = 0x7ffff64555b3} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007ffff637974b in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189 ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fffffffe290, reg_save_area = 0x7fffffffe1a0}} ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffe290, reg_save_area = 0x7fffffffe1a0}} fd = 8 on_2 = <value optimized out> list = <value optimized out> nlist = 1024 cp = <value optimized out> written = false #3 0x00007ffff6383806 in malloc_printerr (action=3, str=0x7ffff64572f0 "double free or corruption (fasttop)", ptr=<value optimized out>) at malloc.c:6266 buf = "0000000000d1d310" cp = 0x7ffff644d300 "0123456789abcdefghijklmnopqrstuvwxyz" #4 0x00007ffff638a0d3 in *__GI___libc_free (mem=<value optimized out>) at malloc.c:3738 ar_ptr = 0x7ffff668ae40 p = 0x7ffff644d300 #5 0x00007ffff7972e91 in ber_memfree_x (p=0xd1d310, ctx=0x0) at memory.c:152 __PRETTY_FUNCTION__ = "ber_memfree_x" #6 0x0000000000463bef in ch_free (ptr=0xd1d310) at ch_malloc.c:139 ctx = 0x0 #7 0x00007ffff380287a in mdb_entry_return (op=0x7fffffffe6b0, e=0xd1d330) at id2entry.c:243 No locals. #8 0x00007ffff38028ec in mdb_entry_release (op=0x7fffffffe6b0, e=0xd1d330, rw=0) at id2entry.c:265 mdb = 0x8c0600 moi = 0x0 rc = 0 #9 0x00000000004d421e in overlay_entry_release_ov (op=0x7fffffffe6b0, e=0xd1d330, rw=0, on=0x0) at backover.c:434 oi = 0x8b9850 be = 0x8b3490 db = {bd_info = 0x0, bd_self = 0x0, be_ctrls = '\000' <repeats 32 times>, be_flags = 140737347270259, be_restrictops = 0, be_requires = 0, be_ssf_set = {sss_ssf = 4294960368, sss_transport = 32767, sss_tls = 0, sss_sasl = 0, sss_update_ssf = 0, sss_update_transport = 0, sss_update_tls = 8121104, sss_update_sasl = 0, sss_simple_bind = 0}, be_suffix = 0x7fffffffe4f0, be_nsuffix = 0x7fffffffe4d0, be_schemadn = {bv_len = 140737347270493, bv_val = 0x7fffffffe4f0 "\017"}, be_schemandn = {bv_len = 0, bv_val = 0x0}, be_rootdn = {bv_len = 8121104, bv_val = 0x0}, be_rootndn = {bv_len = 76, bv_val = 0x7fffffffe520 "\300\345\377\377\377\177"}, be_rootpw = {bv_len = 140737349714310, bv_val = 0x7972616e69623b <Address 0x7972616e69623b out of bounds>}, be_max_deref_depth = 8121104, be_def_limit = {lms_t_soft = 0, lms_t_hard = 15, lms_s_soft = 0, lms_s_hard = 8121104, lms_s_unchecked = 0, lms_s_pr = -6720, lms_s_pr_hide = 32767, lms_s_pr_total = 4280592}, be_limits = 0x7fffffffea30, be_acl = 0x4c, be_dfltaccess = -6720, be_extra_anlist = 0x7ffff7bc86ec, be_update_ndn = {bv_len = 76, bv_val = 0xf <Address 0xf out of bounds>}, be_update_refs = 0x7febf29d2fec, be_pending_csn_list = 0x7beb10, be_pcl_mutex = {__data = {__lock = 0, __count = 1, __owner = 7733832, __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x4, __next = 0x20}}, __size = "\000\000\000\000\001\000\000\000H\002v", '\000' <repeats 13 times>, "\004\000\000\000\000\000\000\000 \000\000\000\000\000\000", __align = 4294967296}, be_syncinfo = 0x10, be_pb = 0xd3c897, be_cf_ocs = 0x0, be_private = 0x7febf29d2ffb, be_next = {stqe_next = 0x7febf29d2ffb}} bi = 0x8b9850 rc = 32768 #10 0x00000000004d430d in over_entry_release_rw (op=0x7fffffffe6b0, e=0xd1d330, rw=0) at backover.c:463 oi = 0x8b9850 on = 0x8bee10 __PRETTY_FUNCTION__ = "over_entry_release_rw" #11 0x00000000004507ca in be_entry_release_rw (op=0x7fffffffe6b0, e=0xd1d330, rw=0) at backend.c:886 No locals. #12 0x00000000004d9815 in slapcat (argc=9, argv=0x7fffffffea38) at slapcat.c:152 data = 0xd3c730 "dn:: AAAAAAAA\nobjectClass: organization\nobjectClass: dcObject\no: com domain\ndc: com\nstructuralObjectClass: organization\nentryUUID: acf761e8-d5d2-1031-88ffda6f3a93b\ncreatorsName: uid=zimbra,cn=admi"... len = 376 e = 0xd1d330 id = 33 rc = 0 op = {o_hdr = 0x0, o_tag = 0, o_time = 0, o_tincr = 0, o_bd = 0x8b3490, o_req_dn = {bv_len = 0, bv_val = 0x0}, o_req_ndn = {bv_len = 0, bv_val = 0x0}, o_request = {oq_add = { rs_modlist = 0x0, rs_e = 0x0}, oq_bind = {rb_method = 0, rb_cred = {bv_len = 0, bv_val = 0x0}, rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = 0, rb_mech = {bv_len = 0, bv_val = 0x0}}, oq_compare = {rs_ava = 0x0}, oq_modify = {rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_increment = 0}, oq_modrdn = {rs_mods = { rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_deleteoldrdn = 0, rs_newrdn = {bv_len = 0, bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, bv_val = 0x0}, rs_newSup = 0x0, rs_nnewSup = 0x0}, oq_search = {rs_scope = 0, rs_deref = 0, rs_slimit = 0, rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs = 0x0, rs_filter = 0x0, rs_filterstr = { bv_len = 0, bv_val = 0x0}}, oq_abandon = {rs_msgid = 0}, oq_cancel = {rs_msgid = 0}, oq_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val = 0x0}, rs_new = { bv_len = 0, bv_val = 0x0}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check = 0 '\000', o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 times>, o_controls = 0x0, o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = { bv_len = 0, bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x0, o_ctrls = 0x0, o_csn = { bv_len = 0, bv_val = 0x0}, o_private = 0x0, o_extra = {slh_first = 0x0}, o_next = {stqe_next = 0x0}} progname = 0x51a858 "slapcat" requestBSF = 1 doBSF = 0 __PRETTY_FUNCTION__ = "slapcat" #13 0x00000000004158f0 in main (argc=9, argv=0x7fffffffea38) at main.c:410 i = 1 no_detach = 0 rc = 1 urls = 0x0 username = 0x0 groupname = 0x0 sandbox = 0x0 syslogUser = 160 pid = 0 waitfds = {-154148864, 32767} g_argc = 9 g_argv = 0x7fffffffea38 configfile = 0x0 configdir = 0x0 serverName = 0x7fffffffeca6 "slapcat" serverMode = 1 scp = 0x0 scp_entry = 0x0 debug_unknowns = 0x0 syslog_unknowns = 0x0 serverNamePrefix = 0x4f9aa8 "" l = 140737323823448 slapd_pid_file_unlink = 0 slapd_args_file_unlink = 0 firstopt = 1 __PRETTY_FUNCTION__ = "main" -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7469) MDB double free when slapcatting a subtree
by quanah＠OpenLDAP.org 10 Dec '12

10 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/10/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) zimbra@zre-ldap001:~$ /opt/zimbra/openldap/sbin/slapcat -F /opt/zimbra/data/ldap/config -b "" -s "cn=zimbra" -l /tmp/z.ldif *** glibc detected *** /opt/zimbra/openldap/sbin/slapcat: double free or corruption (fasttop): 0x00000000025a8310 *** ======= Backtrace: ========= /lib/libc.so.6(+0x77806)[0x7fbe15574806] /lib/libc.so.6(cfree+0x73)[0x7fbe1557b0d3] /opt/zimbra/openldap-2.4.33.3z/lib/liblber-2.4.so.2(ber_memfree_x+0x39)[0x7fbe16b63e91] /opt/zimbra/openldap/sbin/slapcat(ch_free+0x49)[0x463bef] /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/back_mdb-2.4.so.2(mdb_entry_return+0xb9)[0x7fbe129f387a] /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/back_mdb-2.4.so.2(mdb_entry_release+0x41)[0x7fbe129f38ec] /opt/zimbra/openldap/sbin/slapcat(overlay_entry_release_ov+0x201)[0x4d421e] /opt/zimbra/openldap/sbin/slapcat[0x4d430d] /opt/zimbra/openldap/sbin/slapcat(be_entry_release_rw+0x50)[0x4507ca] /opt/zimbra/openldap/sbin/slapcat(slapcat+0x536)[0x4d9815] /opt/zimbra/openldap/sbin/slapcat(main+0x161)[0x4158f0] /lib/libc.so.6(__libc_start_main+0xfd)[0x7fbe1551bc4d] /opt/zimbra/openldap/sbin/slapcat[0x415139] ======= Memory map: ======== 00400000-00555000 r-xp 00000000 fb:00 7352232 /opt/zimbra/openldap-2.4.33.3z/sbin/slapd 00755000-00756000 r--p 00155000 fb:00 7352232 /opt/zimbra/openldap-2.4.33.3z/sbin/slapd 00756000-0075f000 rw-p 00156000 fb:00 7352232 /opt/zimbra/openldap-2.4.33.3z/sbin/slapd 0075f000-007b2000 rw-p 00000000 00:00 0 0203d000-025e8000 rw-p 00000000 00:00 0 [heap] 7faa0c000000-7faa0c021000 rw-p 00000000 00:00 0 7faa0c021000-7faa10000000 ---p 00000000 00:00 0 7faa11959000-7faa1196f000 r-xp 00000000 fb:00 262196 /lib/libgcc_s.so.1 7faa1196f000-7faa11b6e000 ---p 00016000 fb:00 262196 /lib/libgcc_s.so.1 7faa11b6e000-7faa11b6f000 r--p 00015000 fb:00 262196 /lib/libgcc_s.so.1 7faa11b6f000-7faa11b70000 rw-p 00016000 fb:00 262196 /lib/libgcc_s.so.1 7faa11b75000-7fbe11b75000 r--s 00000000 fb:00 7351893 /opt/zimbra/data/ldap/mdb/db/data.mdb 7fbe11b75000-7fbe11d76000 rw-p 00000000 00:00 0 7fbe11d76000-7fbe11d78000 r-xp 00000000 fb:00 7352301 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/noopsrch.so.0.0.0 7fbe11d78000-7fbe11f77000 ---p 00002000 fb:00 7352301 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/noopsrch.so.0.0.0 7fbe11f77000-7fbe11f78000 r--p 00001000 fb:00 7352301 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/noopsrch.so.0.0.0 7fbe11f78000-7fbe11f79000 rw-p 00002000 fb:00 7352301 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/noopsrch.so.0.0.0 7fbe11f79000-7fbe11f80000 r-xp 00000000 fb:00 7352321 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/unique-2.4.so.2.8.5 7fbe11f80000-7fbe12180000 ---p 00007000 fb:00 7352321 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/unique-2.4.so.2.8.5 7fbe12180000-7fbe12181000 r--p 00007000 fb:00 7352321 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/unique-2.4.so.2.8.5 7fbe12181000-7fbe12182000 rw-p 00008000 fb:00 7352321 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/unique-2.4.so.2.8.5 7fbe12182000-7fbe1218a000 r-xp 00000000 fb:00 7352272 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/dynlist-2.4.so.2.8.5 7fbe1218a000-7fbe12389000 ---p 00008000 fb:00 7352272 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/dynlist-2.4.so.2.8.5 7fbe12389000-7fbe1238a000 r--p 00007000 fb:00 7352272 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/dynlist-2.4.so.2.8.5 7fbe1238a000-7fbe1238b000 rw-p 00008000 fb:00 7352272 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/dynlist-2.4.so.2.8.5 7fbe1238b000-7fbe12398000 r-xp 00000000 fb:00 7352348 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/accesslog-2.4.so.2.8.5 7fbe12398000-7fbe12597000 ---p 0000d000 fb:00 7352348 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/accesslog-2.4.so.2.8.5 7fbe12597000-7fbe12598000 r--p 0000c000 fb:00 7352348 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/accesslog-2.4.so.2.8.5 7fbe12598000-7fbe12599000 rw-p 0000d000 fb:00 7352348 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/accesslog-2.4.so.2.8.5 7fbe12599000-7fbe125a9000 r-xp 00000000 fb:00 7352294 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/syncprov-2.4.so.2.8.5 7fbe125a9000-7fbe127a8000 ---p 00010000 fb:00 7352294 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/syncprov-2.4.so.2.8.5 7fbe127a8000-7fbe127a9000 r--p 0000f000 fb:00 7352294 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/syncprov-2.4.so.2.8.5 7fbe127a9000-7fbe127aa000 rw-p 00010000 fb:00 7352294 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/syncprov-2.4.so.2.8.5 7fbe127aa000-7fbe127c8000 r-xp 00000000 fb:00 7352252 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/back_monitor-2.4.so.2.8.5 7fbe127c8000-7fbe129c7000 ---p 0001e000 fb:00 7352252 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/back_monitor-2.4.so.2.8.5 7fbe129c7000-7fbe129c8000 r--p 0001d000 fb:00 7352252 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/back_monitor-2.4.so.2.8.5 7fbe129c8000-7fbe129ca000 rw-p 0001e000 fb:00 7352252 /opt/zimbra/openldap-2.4.33.3z/sbin/openldap/back_monitor-2.4.so.2.8.5Aborted

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by quanah＠zimbra.com 10 Dec '12

10 Dec '12

--On Tuesday, December 04, 2012 6:47 PM +0000 michael(a)stroeder.com wrote: > This is a cryptographically signed message in MIME format. > > --------------ms080001080509060504090401 > Content-Type: text/plain; charset=UTF-8 > Content-Transfer-Encoding: quoted-printable > > Quanah Gibson-Mount wrote: >> I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talk= > ing >> about the commits for ITS7308 and ITS7309, which touched a significant = > number >> of files. Generally we need someone to go through contrib and verify t= > hings >> build ok. > > Yeah, no problem. > > My build script currently contains the lines below for overlays I'm always= > s > using. Please apply the patches to RE24 and I will test as many overlays = > as > possible. Now in RE24, please test. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7466) syncreplication causes massive explosion in database size
by hyc＠symas.com 09 Dec '12

09 Dec '12

andrew.findlay(a)skills-1st.co.uk wrote: > On Fri, Dec 07, 2012 at 08:29:59PM +0000, quanah(a)zimbra.com wrote: > >> Subject: Re: (ITS#7466) syncreplication causes massive explosion in >> database size > >> Closing. Issue was actually triggered by the core dump in ITS#7465, which >> left a read txn lock on the primary database, causing the freelist to not >> be able to compact. Rebuilding the database cleared the lock and things >> went back to normal. > > Would it be possible for slapd to recover from such a case > automatically on startup? If so, then I think it should. > If not, then I think it is worth mentioning this in the > documentation or an FAQ. The library is designed to clean up automatically. The outstanding bugs (#7465) prevent that from working at the moment in RE24. This is not going to be an issue in the released code. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7466) syncreplication causes massive explosion in database size
by andrew.findlay＠skills-1st.co.uk 09 Dec '12

09 Dec '12

On Fri, Dec 07, 2012 at 08:29:59PM +0000, quanah(a)zimbra.com wrote: > Subject: Re: (ITS#7466) syncreplication causes massive explosion in > database size > Closing. Issue was actually triggered by the core dump in ITS#7465, which > left a read txn lock on the primary database, causing the freelist to not > be able to compact. Rebuilding the database cleared the lock and things > went back to normal. Would it be possible for slapd to recover from such a case automatically on startup? If so, then I think it should. If not, then I think it is worth mentioning this in the documentation or an FAQ. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

(ITS#7468) ppolicy and rwm/relay segfaulting
by tim.j.watts＠kcl.ac.uk 08 Dec '12

08 Dec '12

Full_Name: Tim Watts Version: 2.4.23 OS: Debian 6/amd64 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (81.2.78.46) Hi, We load slapd up with actual entries for the dc=new,dc=example,dc=com domain. slapd is configured to map all records with rwm/relay to dc=old,dc=example,dc=com so clients with the old config still work. ie we load a real record: 1) dn: uid=testuser,ou=people,dc=new,dc=example,dc=com and we want clients asking about 2) dn: uid=testuser,ou=people,dc=old,dc=example,dc=com will be served from (1) ======== OK here's an example ================ === Server ==== Running debian 6 server with debian slapd 2.4.23-7.2 /usr/sbin/slapd -d 4 -h "ldap:/// ldaps:/// ldapi:///" -g openldap -u openldap -f /etc/ldap/slapd.conf === Test client === Running test against the "old" realm: ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com # Enter the wrong password and it fails correctly and server runs OK. # Enter the right password and the client says: ldap_result: Can't contact LDAP server (-1) Server says (last few lines from slapd): [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=old,dc=example,dc=com" [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=new,dc=example,dc=com" => ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com,0) <= ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" => bdb_entry_get: ndn: "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" ==> hdb_bind: dn: uid=testuser,ou=people,dc=new,dc=example,dc=com send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" Segmentation fault However, queries against the "new" domain work: ldapwhoami -x -W -D uid=testuser,ou=people,dc=new,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com If I disable ppolicy in slapd.conf, queries agains the "old" domain work: root@ldaptest1:/etc# ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com (the rewrite is not perfect - but that may not matter for my clients). Almost certainly I have done something stupid - and it seems clear that ppolicy is being upset by the relay mappings. Any ideas how to fix would be *very* welcome - I have been all over Google and the man pages. All the best! Tim OK - boring stuff: slapd.conf ########################################### ####################################################################### # Global Directives: # Features to permit allow bind_anon_cred bind_anon_dn update_anon # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel sync stats sizelimit 5000 tool-threads 1 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm moduleload ppolicy overlay rwm rwm-rewriteEngine on backend hdb ####################################################################### # Global ACLs # # Ensure read access to the base for things like # supportedSASLMechanisms. access to dn.base="" by * read # The userPassword by default can be changed # by the entry owning it if they are authenticated. # This ACL must be first or password leakage will happen!!! access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by self write by * auth # The admin dn has full write access, everyone else # can read everything. Local unix domain socket (root only) # Can do everything access to * by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by * read ####################################################################### # Main new.example.com authoritative database # database hdb suffix dc=new,dc=example,dc=com rootdn "cn=admin,dc=new,dc=example,dc=com" rootpw "{SSHA}NoNoNooo..." directory "/var/lib/ldap" dbconfig set_cachesize 0 134217728 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # # Password Policy # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext ####################################################################### # Virtual maps - compatibility with old.example.com only # # map dc=old to dc=new # database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ########################################### Initial database loaded with slapadd from this ldif: ########################################### dn: dc=new,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: new.example.com dc: new dn: cn=admin,dc=new,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: NoNoNoooo... dn: ou=people,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: ou=pwpolicies,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: pwpolicies # # # Standard policy for normal people # dn: cn=default,ou=pwpolicies,dc=new,dc=example,dc=com objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15811200 pwdExpireWarning: 1814400 pwdGraceAuthnLimit: 3 pwdInHistory: 6 pwdCheckQuality: 2 pwdMaxFailure: 5 pwdMinLength: 8 pwdLockout: TRUE pwdLockoutDuration: 300 pwdFailureCountInterval: 300 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE dn: uid=testuser,ou=people,dc=new,dc=example,dc=com objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Test User employeeType: Staff gecos: Test User gidNumber: 1000 givenName: Test homeDirectory: /homes/testuser loginShell: /bin/bash mail: testuser(a)new.example.com sn: User uid: testuser uidNumber: 1000 userPassword: {SSHA}NoNoNoooo... dn: cn=ddh-staff,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: ddh-staff description: Test Group gidNumber: 1000 memberUid: testuser dn: cn=sysadmin,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: sysadmin description: Staff: System Admin Group gidNumber: 1001 memberUid: testuser ###########################################

1 0

(ITS#7467) mdb_stat improvements
by quanah＠OpenLDAP.org 07 Dec '12

07 Dec '12

Full_Name: Quanah Gibson-Mount Version: master OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) It would be helpful to expand the functionality of mdb_stat: a) Merge in mfree b) Show the reader table c) Add option to zero out dead locker entries without interrupting anything

1 0

Re: (ITS#7466) syncreplication causes massive explosion in database size
by quanah＠zimbra.com 07 Dec '12

07 Dec '12

--On Friday, December 07, 2012 7:56 PM +0000 quanah(a)OpenLDAP.org wrote: > Full_Name: Quanah Gibson-Mount > Version: RE24 12/7/2012 > OS: Linux 2.6 > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (74.196.25.250) Closing. Issue was actually triggered by the core dump in ITS#7465, which left a read txn lock on the primary database, causing the freelist to not be able to compact. Rebuilding the database cleared the lock and things went back to normal. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

(ITS#7466) syncreplication causes massive explosion in database size
by quanah＠OpenLDAP.org 07 Dec '12

07 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/7/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) In a master/replica environment, sync replication causes a massive explosion in database size on the replica. For example, with a 25MB database, the size on disk grew from 25MB to 50MB in the space of an hour (and it shows no signs of slowing down). Entries in the freelist grows without reducing: [zimbra@ldap02-zcs ~]$ mdb_stat -f data/ldap/mdb/db Freelist Status Tree depth: 2 Branch pages: 1 Leaf pages: 43 Overflow pages: 0 Entries: 987 Free pages: 7441 In monitoring, it appears every change adds about 6 entries and 40+ free pages. id2e database looks the same as on the master.

1 0

(ITS#7465) mdb_stat core dumps when used with -a -s
by quanah＠OpenLDAP.org 07 Dec '12

07 Dec '12

Full_Name: Quanah Gibson-Mount Version: RE24 12/7/2012 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (74.196.25.250) I believe the mdb_stat options "-a" and "-s <db>" are supposed to be mutually exclusive. However, if they are used in conjunction with one another, mdb_stat core dumps: [zimbra@ldap02-zcs ~]$ mdb_stat -a -e data/ldap/mdb/db -s id2e Environment Info Map address: (nil) Map size: 85899345920 Page size: 4096 Max pages: 20971520 Number of pages used: 6309 Last transaction ID: 434 Max readers: 126 Number of readers used: 7 Status of id2e Tree depth: 3 Branch pages: 6 Leaf pages: 678 Overflow pages: 1957 Entries: 2963 mdb_stat: mdb.c:4297: mdb_cursor_set: Assertion `key->mv_size > 0' failed. Aborted (core dumped)

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 07 Dec '12

07 Dec '12

--20cf307811d03117ef04d043e582 Content-Type: text/plain; charset=ISO-8859-1 Setting the timeout to 4294967294 should to the trick for now... but this is really a sort of bug to me as back-ldap should not behave this way when he have no credentials to use... Surely, closing the connexion with the client may be the best solution... 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > --20cf307811d0eb756704d0342092 > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Actualy I had this before and that did not change anything. I don't think > > this directive is used for this kind of "timeouts"... > > > > I also tried : > > > > *chase-referrals yes (this is default)* > > *rebind-as-user yes (as suggested here)** > > * > > *single-conn yes (default to NO)** > > * > > * > > * > > I also tried some combinings of idassert-bind options with no luck (as > the > > backend does not support identity assertion). > > By backend do you mean the remote server you're trying to proxy? > > I see your problem. Indeed, when a connection is pruned (in your case > because it timed out), information about client's credentials is lost. > Back-ldap is working incorrectly, since it falls back to trying to rebind > anonymously. However, the only other reasonable option could only be to > return a meaningful error (or dropping the connection with the client). > > Things work fine with identity assertion, because in that case the > client's credentials are no longer needed, what counts is that the > client's connection is alive and authenticated, so the client's identity > can be asserted. > > You'd need to do something like > > idassert-bind bindmethod=simple > binddn="<authorizing dn>" > credentials="<authorizing credentials>" > mode=self > flags=override > > (tested, works fine). However, I understood from what you wrote above > that this is not an option. > > I see one quick solution: bail out when the connection is lost and > idassert is not going to take place. This requires a minimal patch. > > An alternative could be to find a decent manner to store the client's > credentials in the frontend's connection with the client (as much as we do > for the client's identity in c_authz). This will live as long as the > client's connection stays alive (something like what we do for paged > results). > > [disclaimer: I'll look into this time permitting; I can't commit to fixing > it any soon] > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d03117ef04d043e582 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Setting the timeout to=A04294967294 should to the trick for now... but = this is really a sort of bug to me as back-ldap should not behave this way = when he have no credentials to use...<div> Surely, closing the connexion =A0with the client may be the best soluti= on...</div><div class=3D"gmail_extra"> <div class=3D"gmail_qu= ote"> 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masar= ati(a)aero.polimi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>></span= > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-le= ft:1px #ccc solid;padding-left:1ex"> > --20cf307811d0eb756704d0342092 > Content-Type: text/plain; charset=3DISO-8859-1 <div class=3D"im">> > Actualy I had this before and that did not change anything. I don'= t think > this directive is used for this kind of "timeouts"... > > I also tried : > </div>> *chase-referrals yes (this is default)* > *rebind-as-user yes (as suggested here)** > * > *single-conn yes (default to NO)** > * > * <div class=3D"im">> * > I also tried some combinings of idassert-bind options with no luck (as= the > backend does not support identity assertion). </div>By backend do you mean the remote server you're trying to proxy?<= br> I see your problem. =A0Indeed, when a connection is pruned (in your case<br= > because it timed out), information about client's credentials is lost.<= br> Back-ldap is working incorrectly, since it falls back to trying to rebind<b= r> anonymously. =A0However, the only other reasonable option could only be to<= br> return a meaningful error (or dropping the connection with the client). Things work fine with identity assertion, because in that case the client's credentials are no longer needed, what counts is that the client's connection is alive and authenticated, so the client's ide= ntity can be asserted. You'd need to do something like idassert-bind bindmethod=3Dsimple =A0 =A0 =A0 =A0 =A0 =A0 =A0 binddn=3D"<authorizing dn>" =A0 =A0 =A0 =A0 =A0 =A0 =A0 credentials=3D"<authorizing credentials= >" =A0 =A0 =A0 =A0 =A0 =A0 =A0 mode=3Dself =A0 =A0 =A0 =A0 =A0 =A0 =A0 flags=3Doverride (tested, works fine). =A0However, I understood from what you wrote above<br= > that this is not an option. I see one quick solution: bail out when the connection is lost and idassert is not going to take place. =A0This requires a minimal patch. An alternative could be to find a decent manner to store the client's<b= r> credentials in the frontend's connection with the client (as much as we= do for the client's identity in c_authz). =A0This will live as long as the= client's connection stays alive (something like what we do for paged<br= > results). [disclaimer: I'll look into this time permitting; I can't commit to= fixing it any soon] <div class=3D"HOEnZb"><div class=3D"h5"> p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> --20cf307811d03117ef04d043e582--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> --20cf307811d0eb756704d0342092 > Content-Type: text/plain; charset=ISO-8859-1 > > Actualy I had this before and that did not change anything. I don't think > this directive is used for this kind of "timeouts"... > > I also tried : > > *chase-referrals yes (this is default)* > *rebind-as-user yes (as suggested here)** > * > *single-conn yes (default to NO)** > * > * > * > I also tried some combinings of idassert-bind options with no luck (as the > backend does not support identity assertion). By backend do you mean the remote server you're trying to proxy? I see your problem. Indeed, when a connection is pruned (in your case because it timed out), information about client's credentials is lost. Back-ldap is working incorrectly, since it falls back to trying to rebind anonymously. However, the only other reasonable option could only be to return a meaningful error (or dropping the connection with the client). Things work fine with identity assertion, because in that case the client's credentials are no longer needed, what counts is that the client's connection is alive and authenticated, so the client's identity can be asserted. You'd need to do something like idassert-bind bindmethod=simple binddn="<authorizing dn>" credentials="<authorizing credentials>" mode=self flags=override (tested, works fine). However, I understood from what you wrote above that this is not an option. I see one quick solution: bail out when the connection is lost and idassert is not going to take place. This requires a minimal patch. An alternative could be to find a decent manner to store the client's credentials in the frontend's connection with the client (as much as we do for the client's identity in c_authz). This will live as long as the client's connection stays alive (something like what we do for paged results). [disclaimer: I'll look into this time permitting; I can't commit to fixing it any soon] p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307d04d2686d3904d0343c02 Content-Type: text/plain; charset=ISO-8859-1 Here is a quick python script that can be used to query a LDAP proxy. Running it while the proxy is configured with conn-ttl = 5 will trigget the error after 5 seconds: import ldap, sys, pprint, time ldap_server = "localhost" dn="cn=ldapintbind,o=corp" pw="your password here" con = ldap.initialize('ldap://' + ldap_server) try: #l.start_tls_s() con.simple_bind_s(dn, pw) con.set_option(ldap.OPT_DEREF,3) scope = ldap.SCOPE_SUBTREE base = "o=corp" filter ="(&(objectClass=*)(uid=dln))" retrieve_attributes = ["uid"] result_data = [] result_set = [] timeout = 0 essai=0 while 1: print(str(essai) + ".") essai+=1 result_id = con.search_s(base, scope, filter, retrieve_attributes) #pprint.pprint(result_id) time.sleep(1) except ldap.LDAPError, e: print e.message['info'] if type(e.message) == dict and e.message.has_key('desc'): print e.message['desc'] else: print e sys.exit() 2012/12/6 Sebastien Thomas <prune(a)lecentre.net> > Actualy I had this before and that did not change anything. I don't think > this directive is used for this kind of "timeouts"... > > I also tried : > > *chase-referrals yes (this is default)* > *rebind-as-user yes (as suggested here)** > * > *single-conn yes (default to NO)** > * > * > * > I also tried some combinings of idassert-bind options with no luck (as > the backend does not support identity assertion). > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > >> >> > --20cf307811d0d379c404d032d6ee >> > Content-Type: text/plain; charset=ISO-8859-1 >> > >> > Config is basic (with special timeout tests commented out) : >> > >> > database ldap >> > suffix "o=corp" >> > uri ldaps://10.100.120.153 >> > >> > # close connection after a timeout >> > #idletimeout 100 >> > # causes a cached connection to be dropped an recreated after a given >> ttl >> > #conn-ttl 4294967294 >> > # close connection after a timeout for ldap backend >> > #idle-timeout 4294967294 >> > # Discards current cached connection when the client rebinds - default >> to >> > No >> > #single-conn no >> >> >> Try adding a "rebind-as-user" here. This forces back-ldap to store >> client's credentials in order to rebind when needed (e.g. because a >> persistent connection timed out). >> >> p. >> >> > overlay rwm >> > rwm-suffixmassage "o=corp" "o=int" >> > >> > >> > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> >> > >> >> >> >> > Full_Name: Sebastien Prune THOMAS >> >> > Version: slapd 2.4.31 >> >> > OS: Linux CentOS >> >> > URL: ftp://ftp.openldap.org/incoming/ >> >> > Submission from: (NULL) (206.167.157.64) >> >> > >> >> > >> >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> >> LDAP >> >> > server. >> >> > Every once and a while I have long lasting connections re-binding as >> >> > anonymous, >> >> > breaking the actual bind. >> >> > This usualy happen after hitting either the idle-timeout or the >> >> conn-ttl >> >> > limit. >> >> > I wasn't able to find out what these values are when not set... but >> >> > setting them >> >> > low can help reproduce the problem : >> >> >> >> What is the configuration of back-ldap? Can you post it (after >> >> sanitizing >> >> sensitive info)? >> >> >> >> p. >> >> >> >> -- >> >> Pierangelo Masarati >> >> Associate Professor >> >> Dipartimento di Ingegneria Aerospaziale >> >> Politecnico di Milano >> >> >> >> >> > >> > --20cf307811d0d379c404d032d6ee >> > Content-Type: text/html; charset=ISO-8859-1 >> > Content-Transfer-Encoding: quoted-printable >> > >> > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with >> > spec= >> > ial timeout tests commented out) :</div><div >> > style=3D"font-family:Tahoma;fo= >> > nt-size:13px">=A0</div><div >> > style=3D"font-family:Tahoma;font-size:13px">dat= >> > abase =A0 =A0 =A0ldap >> > suffix =A0 =A0 =A0 =A0 =A0 >> > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= >> > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div >> > style= >> > =3D"font-family:Tahoma;font-size:13px">=A0</div><div >> > style=3D"font-family:T= >> > ahoma;font-size:13px"># close connection after a timeout >> > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be >> dropped >> > = >> > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 >> > 4294967294= >> > # close connection after a timeout for ldap >> > backend #idle-timeout=A0= >> > =A0=A0 4294967294 # Discards current cached connection when the >> client >> > r= >> > ebinds - default to No >> > #single-conn=A0=A0=A0=A0 no</div><div >> > style=3D"font-family:Tahoma;font-size= >> > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage >> > "o= >> > =3Dcorp" "o=3Dint"</div><div >> > class=3D"gmail_extra"> <= >> > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati > > dir=3D"ltr">&= >> > lt;<a href=3D"mailto:masarati@aero.polimi.it" >> > target=3D"_blank">masarati@ae= >> > ro.polimi.it</a>> >> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 >> > .8ex;border-left:1p= >> > x #ccc solid;padding-left:1ex"> >> > > Full_Name: Sebastien Prune THOMAS >> > > Version: slapd 2.4.31 >> > > OS: Linux CentOS >> > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" >> > target=3D"_blank">ft= >> > p://ftp.openldap.org/incoming/</a> >> > > Submission from: (NULL) (206.167.157.64) >> > > >> > > >> > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> > LD= >> > AP >> > > server. >> > > Every once and a while I have long lasting connections re-binding >> > as<b= >> > r> >> > > anonymous, >> > > breaking the actual bind. >> > > This usualy happen after hitting either the idle-timeout or the >> > conn-t= >> > tl >> > > limit. >> > > I wasn't able to find out what these values are when not set... >> > bu= >> > t >> > > setting them >> > > low can help reproduce the problem : >> > >> > What is the configuration of back-ldap? =A0Can you post it (after >> > sanitizin= >> > g >> > sensitive info)? >> > >> > p. >> > >> > -- >> > Pierangelo Masarati >> > Associate Professor >> > Dipartimento di Ingegneria Aerospaziale >> > Politecnico di Milano >> > >> > </blockquote></div> </div> >> > >> > --20cf307811d0d379c404d032d6ee-- >> > >> > >> > >> > >> > >> >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > --20cf307d04d2686d3904d0343c02 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Here is a quick python script that can be used to query a LDAP proxy. Runni= ng it while the proxy is configured with conn-ttl =3D 5 will trigget the er= ror after 5 seconds:<div> </div><div> </div><div> </div><div><div = style=3D"font-family:Tahoma;font-size:13px"> import ldap, sys, pprint, time</div><div style=3D"font-family:Tahoma;font-s= ize:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px">ldap_se= rver =3D "localhost" dn=3D"cn=3Dldapintbind,o=3Dcorp&quot= ; pw=3D"your password here"</div> <div style=3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"fon= t-family:Tahoma;font-size:13px">con =3D ldap.initialize('ldap://' += ldap_server) try: =A0=A0=A0 #l.start_tls_s() =A0=A0=A0 con.simple= _bind_s(dn, pw) =A0=A0=A0 con.set_option(ldap.OPT_DEREF,3) =A0 =A0=A0</div><div style=3D= "font-family:Tahoma;font-size:13px">=A0=A0=A0 scope =3D ldap.SCOPE_SUBTREE<= br>=A0=A0=A0 base =3D "o=3Dcorp" =A0=A0=A0 filter =3D"(&a= mp;(objectClass=3D*)(uid=3Ddln))" =A0=A0=A0 retrieve_attributes =3D ["uid"] =A0=A0=A0 result_dat= a =3D [] =A0=A0=A0 result_set =3D [] =A0=A0=A0 timeout =3D 0</div><di= v style=3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"font-f= amily:Tahoma;font-size:13px">=A0=A0=A0 essai=3D0 =A0=A0=A0 while 1: =A0=A0=A0=A0=A0=A0=A0 print(str(essai) + ".&quot= ;) =A0=A0=A0=A0=A0=A0=A0 essai+=3D1</div><div style=3D"font-family:Tahom= a;font-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px"= >=A0=A0=A0=A0=A0=A0=A0 result_id =3D con.search_s(base, scope, filter, retr= ieve_attributes) =A0=A0=A0=A0=A0=A0=A0 #pprint.pprint(result_id)</div><div style=3D"font-fam= ily:Tahoma;font-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-s= ize:13px">=A0 =A0 =A0 =A0 time.sleep(1) </div><div style=3D"font-family:= Tahoma;font-size:13px">=A0</div> <div style=3D"font-family:Tahoma;font-size:13px"> except ldap.LDAPError,= e: =A0=A0=A0 print e.message['info'] =A0=A0=A0 if type(e.mes= sage) =3D=3D dict and e.message.has_key('desc'): =A0=A0=A0=A0=A0= =A0=A0 print e.message['desc'] =A0=A0=A0 else: =A0=A0=A0=A0=A0=A0=A0 print e =A0=A0=A0 sys.exit()</d= iv></div><div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012= /12/6 Sebastien Thomas <<a href=3D"mailto:prune@lecent= re.net" target=3D"_blank">prune(a)lecentre.net</a>> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex">Actualy I had this before and that did not change anything.= I don't think this directive is used for this kind of "timeouts&q= uot;... <div> </div><div>I also tried :</div><div> </div><div>chase-referrals yes (this is default) </div><div>= rebind-as-user yes (as suggested here) </div><div> single-conn yes (d= efault to NO)<= br></div><div>= </div><div>= I also tried some combinings of=A0idassert-bind options with no luck (as the backen= d does not support identity assertion).</div> <div class=3D"HOEnZb"><div class=3D"h5"> <div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012/12/6 Pie= rangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> <blockqu= ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s= olid;padding-left:1ex"> > --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=3DISO-8859-1 <div>> > Config is basic (with special timeout tests commented out) : > > database =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" > uri =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ldaps://<a href=3D"http://10.100.1= 20.153" target=3D"_blank">10.100.120.153</a> > > # close connection after a timeout > #idletimeout =A0 =A0 100 > # causes a cached connection to be dropped an recreated after a given = ttl > #conn-ttl =A0 =A0 =A0 =A04294967294 > # close connection after a timeout for ldap backend > #idle-timeout =A0 =A04294967294 > # Discards current cached connection when the client rebinds - default= to > No > #single-conn =A0 =A0 no </div>Try adding a "rebind-as-user" here. =A0This forces back-lda= p to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. <div><div> > overlay =A0 =A0 =A0 =A0 rwm > rwm-suffixmassage "o=3Dcorp" "o=3Dint" > > > 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_= blank">ftp://ftp.openldap.org/incoming/</a> >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-bin= ding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or t= he >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not = set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? =A0Can you post it (after<= br> >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > </div></div>> --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=3DISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D3D"font-family:Tahoma;font-size:13px">Con= fig is basic (with > spec=3D > ial timeout tests commented out) :</div><div > style=3D3D"font-family:Tahoma;fo=3D > nt-size:13px">=3DA0</div><div > style=3D3D"font-family:Tahoma;font-size:13px">dat=3D > abase =3DA0 =3DA0 =3DA0ldap > suffix =3DA0 =3DA0 =3DA0 =3DA0 =3DA0 > =3DA0&quot;o=3D3Dcorp&quot; uri=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3D > =3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0 =3DA0 =3DA0<a>ldaps://<a hre= f=3D"http://10.100.120.153" target=3D"_blank">10.100.120.153</a></a>&= lt;/div><div > style=3D > =3D3D"font-family:Tahoma;font-size:13px">=3DA0</div&gt= ;<div > style=3D3D"font-family:T=3D > ahoma;font-size:13px"># close connection after a timeout<br= > > #idletimeout=3DA0=3DA0=3DA0=3DA0 100 # causes a cached connec= tion to be dropped > =3D > an recreated after a given ttl #conn-ttl=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3DA0 > 4294967294=3D > # close connection after a timeout for ldap > backend #idle-timeout=3DA0=3D > =3DA0=3DA0 4294967294 # Discards current cached connection wh= en the client > r=3D > ebinds - default to No > #single-conn=3DA0=3DA0=3DA0=3DA0 no</div><div > style=3D3D"font-family:Tahoma;font-size=3D > :13px"> overlay=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3D= A0 rwm rwm-suffixmassage > &quot;o=3D > =3D3Dcorp&quot; &quot;o=3D3Dint&quot;</div><div<b= r> > class=3D3D"gmail_extra"> <=3D > div class=3D3D"gmail_quote">2012/12/6 Pierangelo Masarati= <span > dir=3D3D"ltr">&=3D > lt;<a href=3D3D"mailto:<a href=3D"mailto:masarati@aero.polimi.= it" target=3D"_blank">masarati(a)aero.polimi.it</a>" > target=3D3D"_blank">masarati@ae=3D > <a href=3D"http://ro.polimi.it" target=3D"_blank">ro.polimi.it</a><= /a>&gt; > <blockquote class=3D3D"gmail_quote" style=3D3D"margi= n:0 0 0 > .8ex;border-left:1p=3D > x #ccc solid;padding-left:1ex"> > &gt; Full_Name: Sebastien Prune THOMAS > &gt; Version: slapd 2.4.31 > &gt; OS: Linux CentOS > &gt; URL: <a href=3D3D"<a href=3D"ftp://ftp.openldap.org/i= ncoming/" target=3D"_blank">ftp://ftp.openldap.org/incoming/</a>" > target=3D3D"_blank">ft=3D > p://<a href=3D"http://ftp.openldap.org/incoming/" target=3D"_blank">ft= p.openldap.org/incoming/</a></a> > &gt; Submission from: (NULL) (206.167.157.64) > &gt; > &gt; > &gt; I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory > LD=3D > AP > &gt; server. > &gt; Every once and a while I have long lasting connections re-bin= ding > as<b=3D > r> > &gt; anonymous, > &gt; breaking the actual bind. > &gt; This usualy happen after hitting either the idle-timeout or t= he > conn-t=3D > tl > &gt; limit. > &gt; I wasn&#39;t able to find out what these values are when = not set... > bu=3D > t > &gt; setting them > &gt; low can help reproduce the problem : > > What is the configuration of back-ldap? =3DA0Can you post it (after<br= > > sanitizin=3D > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> &lt= ;/div> > > --20cf307811d0d379c404d032d6ee-- <div><div>> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> </div></div></blockquote></div> </div> --20cf307d04d2686d3904d0343c02--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307811d0eb756704d0342092 Content-Type: text/plain; charset=ISO-8859-1 Actualy I had this before and that did not change anything. I don't think this directive is used for this kind of "timeouts"... I also tried : *chase-referrals yes (this is default)* *rebind-as-user yes (as suggested here)** * *single-conn yes (default to NO)** * * * I also tried some combinings of idassert-bind options with no luck (as the backend does not support identity assertion). 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > --20cf307811d0d379c404d032d6ee > > Content-Type: text/plain; charset=ISO-8859-1 > > > > Config is basic (with special timeout tests commented out) : > > > > database ldap > > suffix "o=corp" > > uri ldaps://10.100.120.153 > > > > # close connection after a timeout > > #idletimeout 100 > > # causes a cached connection to be dropped an recreated after a given ttl > > #conn-ttl 4294967294 > > # close connection after a timeout for ldap backend > > #idle-timeout 4294967294 > > # Discards current cached connection when the client rebinds - default to > > No > > #single-conn no > > > Try adding a "rebind-as-user" here. This forces back-ldap to store > client's credentials in order to rebind when needed (e.g. because a > persistent connection timed out). > > p. > > > overlay rwm > > rwm-suffixmassage "o=corp" "o=int" > > > > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > >> > >> > Full_Name: Sebastien Prune THOMAS > >> > Version: slapd 2.4.31 > >> > OS: Linux CentOS > >> > URL: ftp://ftp.openldap.org/incoming/ > >> > Submission from: (NULL) (206.167.157.64) > >> > > >> > > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > >> LDAP > >> > server. > >> > Every once and a while I have long lasting connections re-binding as > >> > anonymous, > >> > breaking the actual bind. > >> > This usualy happen after hitting either the idle-timeout or the > >> conn-ttl > >> > limit. > >> > I wasn't able to find out what these values are when not set... but > >> > setting them > >> > low can help reproduce the problem : > >> > >> What is the configuration of back-ldap? Can you post it (after > >> sanitizing > >> sensitive info)? > >> > >> p. > >> > >> -- > >> Pierangelo Masarati > >> Associate Professor > >> Dipartimento di Ingegneria Aerospaziale > >> Politecnico di Milano > >> > >> > > > > --20cf307811d0d379c404d032d6ee > > Content-Type: text/html; charset=ISO-8859-1 > > Content-Transfer-Encoding: quoted-printable > > > > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with > > spec= > > ial timeout tests commented out) :</div><div > > style=3D"font-family:Tahoma;fo= > > nt-size:13px">=A0</div><div > > style=3D"font-family:Tahoma;font-size:13px">dat= > > abase =A0 =A0 =A0ldap > > suffix =A0 =A0 =A0 =A0 =A0 > > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= > > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div > > style= > > =3D"font-family:Tahoma;font-size:13px">=A0</div><div > > style=3D"font-family:T= > > ahoma;font-size:13px"># close connection after a timeout > > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be > dropped > > = > > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 > > 4294967294= > > # close connection after a timeout for ldap > > backend #idle-timeout=A0= > > =A0=A0 4294967294 # Discards current cached connection when the client > > r= > > ebinds - default to No > > #single-conn=A0=A0=A0=A0 no</div><div > > style=3D"font-family:Tahoma;font-size= > > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage > > "o= > > =3Dcorp" "o=3Dint"</div><div > > class=3D"gmail_extra"> <= > > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati > dir=3D"ltr">&= > > lt;<a href=3D"mailto:masarati@aero.polimi.it" > > target=3D"_blank">masarati@ae= > > ro.polimi.it</a>> > > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > > .8ex;border-left:1p= > > x #ccc solid;padding-left:1ex"> > > > Full_Name: Sebastien Prune THOMAS > > > Version: slapd 2.4.31 > > > OS: Linux CentOS > > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" > > target=3D"_blank">ft= > > p://ftp.openldap.org/incoming/</a> > > > Submission from: (NULL) (206.167.157.64) > > > > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > > LD= > > AP > > > server. > > > Every once and a while I have long lasting connections re-binding > > as<b= > > r> > > > anonymous, > > > breaking the actual bind. > > > This usualy happen after hitting either the idle-timeout or the > > conn-t= > > tl > > > limit. > > > I wasn't able to find out what these values are when not set... > > bu= > > t > > > setting them > > > low can help reproduce the problem : > > > > What is the configuration of back-ldap? =A0Can you post it (after > > sanitizin= > > g > > sensitive info)? > > > > p. > > > > -- > > Pierangelo Masarati > > Associate Professor > > Dipartimento di Ingegneria Aerospaziale > > Politecnico di Milano > > > > </blockquote></div> </div> > > > > --20cf307811d0d379c404d032d6ee-- > > > > > > > > > > > > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d0eb756704d0342092 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Actualy I had t= his before and that did not change anything. I don't think this directi= ve is used for this kind of "timeouts"... <div> </div><div>I also tried :</div><div> </div><div>chase-referrals yes (this is defau= lt) </div><div>rebind-as-user yes (as suggested here) </div><di= v> s= ingle-conn yes (default to NO) </div><div> </div><div>I also tried some combinings of=A0idassert-bind o= ptions with no luck (as the backend does not support identity assertion).</= span></div> <div class=3D"gmail_extra"> <div class=3D"gmail_quote">2012/12/6 Pie= rangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it" target=3D"_blank">masarati(a)aero.polimi.it</a>> <blockqu= ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s= olid;padding-left:1ex"> > --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=3DISO-8859-1 <div class=3D"im">> > Config is basic (with special timeout tests commented out) : > > database =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" > uri =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ldaps://<a href=3D"http://10.100.1= 20.153" target=3D"_blank">10.100.120.153</a> > > # close connection after a timeout > #idletimeout =A0 =A0 100 > # causes a cached connection to be dropped an recreated after a given = ttl > #conn-ttl =A0 =A0 =A0 =A04294967294 > # close connection after a timeout for ldap backend > #idle-timeout =A0 =A04294967294 > # Discards current cached connection when the client rebinds - default= to > No > #single-conn =A0 =A0 no </div>Try adding a "rebind-as-user" here. =A0This forces back-lda= p to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. <div><div class=3D"h5"> > overlay =A0 =A0 =A0 =A0 rwm > rwm-suffixmassage "o=3Dcorp" "o=3Dint" > > > 2012/12/6 Pierangelo Masarati <<a href=3D"mailto:masarati@aero.poli= mi.it">masarati(a)aero.polimi.it</a>> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_= blank">ftp://ftp.openldap.org/incoming/</a> >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-bin= ding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or t= he >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not = set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? =A0Can you post it (after<= br> >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > </div></div>> --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=3DISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D3D"font-family:Tahoma;font-size:13px">Con= fig is basic (with > spec=3D > ial timeout tests commented out) :</div><div > style=3D3D"font-family:Tahoma;fo=3D > nt-size:13px">=3DA0</div><div > style=3D3D"font-family:Tahoma;font-size:13px">dat=3D > abase =3DA0 =3DA0 =3DA0ldap > suffix =3DA0 =3DA0 =3DA0 =3DA0 =3DA0 > =3DA0&quot;o=3D3Dcorp&quot; uri=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3D > =3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0 =3DA0 =3DA0<a>ldaps://<a hre= f=3D"http://10.100.120.153" target=3D"_blank">10.100.120.153</a></a>&= lt;/div><div > style=3D > =3D3D"font-family:Tahoma;font-size:13px">=3DA0</div&gt= ;<div > style=3D3D"font-family:T=3D > ahoma;font-size:13px"># close connection after a timeout<br= > > #idletimeout=3DA0=3DA0=3DA0=3DA0 100 # causes a cached connec= tion to be dropped > =3D > an recreated after a given ttl #conn-ttl=3DA0=3DA0=3DA0=3DA0= =3DA0=3DA0=3DA0 > 4294967294=3D > # close connection after a timeout for ldap > backend #idle-timeout=3DA0=3D > =3DA0=3DA0 4294967294 # Discards current cached connection wh= en the client > r=3D > ebinds - default to No > #single-conn=3DA0=3DA0=3DA0=3DA0 no</div><div > style=3D3D"font-family:Tahoma;font-size=3D > :13px"> overlay=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3DA0=3D= A0 rwm rwm-suffixmassage > &quot;o=3D > =3D3Dcorp&quot; &quot;o=3D3Dint&quot;</div><div<b= r> > class=3D3D"gmail_extra"> <=3D > div class=3D3D"gmail_quote">2012/12/6 Pierangelo Masarati= <span > dir=3D3D"ltr">&=3D > lt;<a href=3D3D"mailto:<a href=3D"mailto:masarati@aero.polimi.= it">masarati(a)aero.polimi.it</a>" > target=3D3D"_blank">masarati@ae=3D > <a href=3D"http://ro.polimi.it" target=3D"_blank">ro.polimi.it</a><= /a>&gt; > <blockquote class=3D3D"gmail_quote" style=3D3D"margi= n:0 0 0 > .8ex;border-left:1p=3D > x #ccc solid;padding-left:1ex"> > &gt; Full_Name: Sebastien Prune THOMAS > &gt; Version: slapd 2.4.31 > &gt; OS: Linux CentOS > &gt; URL: <a href=3D3D"<a href=3D"ftp://ftp.openldap.org/i= ncoming/" target=3D"_blank">ftp://ftp.openldap.org/incoming/</a>" > target=3D3D"_blank">ft=3D > p://<a href=3D"http://ftp.openldap.org/incoming/" target=3D"_blank">ft= p.openldap.org/incoming/</a></a> > &gt; Submission from: (NULL) (206.167.157.64) > &gt; > &gt; > &gt; I use OpenLdap to proxy (with the module back-ldap) to a eDir= ectory > LD=3D > AP > &gt; server. > &gt; Every once and a while I have long lasting connections re-bin= ding > as<b=3D > r> > &gt; anonymous, > &gt; breaking the actual bind. > &gt; This usualy happen after hitting either the idle-timeout or t= he > conn-t=3D > tl > &gt; limit. > &gt; I wasn&#39;t able to find out what these values are when = not set... > bu=3D > t > &gt; setting them > &gt; low can help reproduce the problem : > > What is the configuration of back-ldap? =3DA0Can you post it (after<br= > > sanitizin=3D > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> &lt= ;/div> > > --20cf307811d0d379c404d032d6ee-- <div class=3D"HOEnZb"><div class=3D"h5">> > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </div></div></blockquote></div> </div> --20cf307811d0eb756704d0342092--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> --20cf307811d0d379c404d032d6ee > Content-Type: text/plain; charset=ISO-8859-1 > > Config is basic (with special timeout tests commented out) : > > database ldap > suffix "o=corp" > uri ldaps://10.100.120.153 > > # close connection after a timeout > #idletimeout 100 > # causes a cached connection to be dropped an recreated after a given ttl > #conn-ttl 4294967294 > # close connection after a timeout for ldap backend > #idle-timeout 4294967294 > # Discards current cached connection when the client rebinds - default to > No > #single-conn no Try adding a "rebind-as-user" here. This forces back-ldap to store client's credentials in order to rebind when needed (e.g. because a persistent connection timed out). p. > overlay rwm > rwm-suffixmassage "o=corp" "o=int" > > > 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > >> >> > Full_Name: Sebastien Prune THOMAS >> > Version: slapd 2.4.31 >> > OS: Linux CentOS >> > URL: ftp://ftp.openldap.org/incoming/ >> > Submission from: (NULL) (206.167.157.64) >> > >> > >> > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory >> LDAP >> > server. >> > Every once and a while I have long lasting connections re-binding as >> > anonymous, >> > breaking the actual bind. >> > This usualy happen after hitting either the idle-timeout or the >> conn-ttl >> > limit. >> > I wasn't able to find out what these values are when not set... but >> > setting them >> > low can help reproduce the problem : >> >> What is the configuration of back-ldap? Can you post it (after >> sanitizing >> sensitive info)? >> >> p. >> >> -- >> Pierangelo Masarati >> Associate Professor >> Dipartimento di Ingegneria Aerospaziale >> Politecnico di Milano >> >> > > --20cf307811d0d379c404d032d6ee > Content-Type: text/html; charset=ISO-8859-1 > Content-Transfer-Encoding: quoted-printable > > <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with > spec= > ial timeout tests commented out) :</div><div > style=3D"font-family:Tahoma;fo= > nt-size:13px">=A0</div><div > style=3D"font-family:Tahoma;font-size:13px">dat= > abase =A0 =A0 =A0ldap > suffix =A0 =A0 =A0 =A0 =A0 > =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= > =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div > style= > =3D"font-family:Tahoma;font-size:13px">=A0</div><div > style=3D"font-family:T= > ahoma;font-size:13px"># close connection after a timeout > #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be dropped > = > an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 > 4294967294= > # close connection after a timeout for ldap > backend #idle-timeout=A0= > =A0=A0 4294967294 # Discards current cached connection when the client > r= > ebinds - default to No > #single-conn=A0=A0=A0=A0 no</div><div > style=3D"font-family:Tahoma;font-size= > :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage > "o= > =3Dcorp" "o=3Dint"</div><div > class=3D"gmail_extra"> <= > div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati dir=3D"ltr">&= > lt;<a href=3D"mailto:masarati@aero.polimi.it" > target=3D"_blank">masarati@ae= > ro.polimi.it</a>> > <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 > .8ex;border-left:1p= > x #ccc solid;padding-left:1ex"> > > Full_Name: Sebastien Prune THOMAS > > Version: slapd 2.4.31 > > OS: Linux CentOS > > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" > target=3D"_blank">ft= > p://ftp.openldap.org/incoming/</a> > > Submission from: (NULL) (206.167.157.64) > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory > LD= > AP > > server. > > Every once and a while I have long lasting connections re-binding > as<b= > r> > > anonymous, > > breaking the actual bind. > > This usualy happen after hitting either the idle-timeout or the > conn-t= > tl > > limit. > > I wasn't able to find out what these values are when not set... > bu= > t > > setting them > > low can help reproduce the problem : > > What is the configuration of back-ldap? =A0Can you post it (after > sanitizin= > g > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > </blockquote></div> </div> > > --20cf307811d0d379c404d032d6ee-- > > > > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

--20cf307811d0d379c404d032d6ee Content-Type: text/plain; charset=ISO-8859-1 Config is basic (with special timeout tests commented out) : database ldap suffix "o=corp" uri ldaps://10.100.120.153 # close connection after a timeout #idletimeout 100 # causes a cached connection to be dropped an recreated after a given ttl #conn-ttl 4294967294 # close connection after a timeout for ldap backend #idle-timeout 4294967294 # Discards current cached connection when the client rebinds - default to No #single-conn no overlay rwm rwm-suffixmassage "o=corp" "o=int" 2012/12/6 Pierangelo Masarati <masarati(a)aero.polimi.it> > > > Full_Name: Sebastien Prune THOMAS > > Version: slapd 2.4.31 > > OS: Linux CentOS > > URL: ftp://ftp.openldap.org/incoming/ > > Submission from: (NULL) (206.167.157.64) > > > > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP > > server. > > Every once and a while I have long lasting connections re-binding as > > anonymous, > > breaking the actual bind. > > This usualy happen after hitting either the idle-timeout or the conn-ttl > > limit. > > I wasn't able to find out what these values are when not set... but > > setting them > > low can help reproduce the problem : > > What is the configuration of back-ldap? Can you post it (after sanitizing > sensitive info)? > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > > --20cf307811d0d379c404d032d6ee Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable <div style=3D"font-family:Tahoma;font-size:13px">Config is basic (with spec= ial timeout tests commented out) :</div><div style=3D"font-family:Tahoma;fo= nt-size:13px">=A0</div><div style=3D"font-family:Tahoma;font-size:13px">dat= abase =A0 =A0 =A0ldap suffix =A0 =A0 =A0 =A0 =A0 =A0"o=3Dcorp" uri=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0 =A0 =A0<a>ldaps://10.100.120.153</a></div><div style= =3D"font-family:Tahoma;font-size:13px">=A0</div><div style=3D"font-family:T= ahoma;font-size:13px"># close connection after a timeout #idletimeout=A0=A0=A0=A0 100 # causes a cached connection to be dropped = an recreated after a given ttl #conn-ttl=A0=A0=A0=A0=A0=A0=A0 4294967294= # close connection after a timeout for ldap backend #idle-timeout=A0= =A0=A0 4294967294 # Discards current cached connection when the client r= ebinds - default to No #single-conn=A0=A0=A0=A0 no</div><div style=3D"font-family:Tahoma;font-size= :13px"> overlay=A0=A0=A0=A0=A0=A0=A0=A0 rwm rwm-suffixmassage "o= =3Dcorp" "o=3Dint"</div><div class=3D"gmail_extra"> <= div class=3D"gmail_quote">2012/12/6 Pierangelo Masarati &= lt;<a href=3D"mailto:masarati@aero.polimi.it" target=3D"_blank">masarati@ae= ro.polimi.it</a>> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> > Full_Name: Sebastien Prune THOMAS > Version: slapd 2.4.31 > OS: Linux CentOS > URL: <a href=3D"ftp://ftp.openldap.org/incoming/" target=3D"_blank">ft= p://ftp.openldap.org/incoming/</a> > Submission from: (NULL) (206.167.157.64) > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LD= AP > server. > Every once and a while I have long lasting connections re-binding as<b= r> > anonymous, > breaking the actual bind. > This usualy happen after hitting either the idle-timeout or the conn-t= tl > limit. > I wasn't able to find out what these values are when not set... bu= t > setting them > low can help reproduce the problem : What is the configuration of back-ldap? =A0Can you post it (after sanitizin= g sensitive info)? p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano </blockquote></div> </div> --20cf307811d0d379c404d032d6ee--

1 0

Re: (ITS#7464) ldap_back_dobind_int breaking binded user
by masarati＠aero.polimi.it 06 Dec '12

06 Dec '12

> Full_Name: Sebastien Prune THOMAS > Version: slapd 2.4.31 > OS: Linux CentOS > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (206.167.157.64) > > > I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP > server. > Every once and a while I have long lasting connections re-binding as > anonymous, > breaking the actual bind. > This usualy happen after hitting either the idle-timeout or the conn-ttl > limit. > I wasn't able to find out what these values are when not set... but > setting them > low can help reproduce the problem : What is the configuration of back-ldap? Can you post it (after sanitizing sensitive info)? p. -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

1 0

(ITS#7464) ldap_back_dobind_int breaking binded user
by prune＠lecentre.net 06 Dec '12

06 Dec '12

Full_Name: Sebastien Prune THOMAS Version: slapd 2.4.31 OS: Linux CentOS URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (206.167.157.64) I use OpenLdap to proxy (with the module back-ldap) to a eDirectory LDAP server. Every once and a while I have long lasting connections re-binding as anonymous, breaking the actual bind. This usualy happen after hitting either the idle-timeout or the conn-ttl limit. I wasn't able to find out what these values are when not set... but setting them low can help reproduce the problem : Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 fd=39 ACCEPT from IP=10.100.64.68:33906 (IP=0.0.0.0:389) Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 BIND dn="cn=ldapintbind,o=corp" method=128 Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 BIND dn="cn=ldapintbind,o=shq" mech=SIMPLE ssf=0 Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=0 RESULT tag=97 err=0 text= Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SRCH base="o=corp" scope=2 deref=3 filter="(&(objectClass=*)(uid=pry))" Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SRCH attr=uid Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=2 CMP dn="cn=00-BASICAUTH,o=corp" attr="member" Dec 5 12:50:19 qxpldp01 slapd[40707]: conn=1095 op=2 RESULT tag=111 err=6 text= Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SRCH base="o=corp" scope=2 deref=3 filter="(&(objectClass=*)(uid=dln))" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SRCH attr=uid Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 ldap_back_retry: retrying URI="ldaps://10.100.120.153" DN="cn=ldapintbindo=corp" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 ldap_back_dobind_int: DN="cn=ldapintbind,o=corp" without creds, binding anonymously Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=4 CMP dn="cn=00-BASICAUTH,o=corp" attr="member" Dec 6 09:22:51 qxpldp01 slapd[40707]: conn=1095 op=4 RESULT tag=111 err=5 text= Dec 6 09:23:28 qxpldp01 slapd[40707]: conn=1095 fd=39 closed (slapd shutdown) There, the connection is opened on december the 5... then idle... then another search is done on december the 6... and leads to a re-bind... Either, I don't understand why : - openldap don't re-use the credential of the first bind OR - openldap simply end the TCP connection when the timeout is reached instead of re-using it like if it was a new connection --- > the client is not aware of that and still thinks the last bind is valid. I tried every option I could without success... For now, I set the conn-ttl and idle-timeout to the max an unsigned long could support : 4294967294 Any other solution apreciated...

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by michael＠stroeder.com 04 Dec '12

04 Dec '12

This is a cryptographically signed message in MIME format. --------------ms080001080509060504090401 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Quanah Gibson-Mount wrote: > I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talk= ing > about the commits for ITS7308 and ITS7309, which touched a significant = number > of files. Generally we need someone to go through contrib and verify t= hings > build ok. Yeah, no problem. My build script currently contains the lines below for overlays I'm alway= s using. Please apply the patches to RE24 and I will test as many overlays = as possible. Ciao, Michael. ------------------------------- snip ------------------------------- # Build selected contrib overlays # slapo-allowed cd ${OPENLDAP_CONTRIB_MOD}/allowed make clean ; make PREFIX=3D${OPENLDAP_PREFIX} # slapo-lastbind cd ${OPENLDAP_CONTRIB_MOD}/lastbind make clean ; make prefix=3D${OPENLDAP_PREFIX} # slapo-noopsrch cd ${OPENLDAP_CONTRIB_MOD}/noopsrch make clean ; make prefix=3D${OPENLDAP_PREFIX} # slapo-smbk5pwd cd ${OPENLDAP_CONTRIB_MOD}/smbk5pwd make clean ; make prefix=3D${OPENLDAP_PREFIX} DEFS=3D"-DDO_SAMBA -DDO_SHA= DOW" --------------ms080001080509060504090401 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIILHzCC BT8wggQnoAMCAQICDwCmSwABAAIAivjZQ8SBvzANBgkqhkiG9w0BAQUFADB8MQswCQYDVQQG EwJERTEcMBoGA1UEChMTVEMgVHJ1c3RDZW50ZXIgR21iSDElMCMGA1UECxMcVEMgVHJ1c3RD ZW50ZXIgQ2xhc3MgMSBMMSBDQTEoMCYGA1UEAxMfVEMgVHJ1c3RDZW50ZXIgQ2xhc3MgMSBM MSBDQSBJWDAeFw0xMjA2MDYxOTAyMTZaFw0xMzA2MDcxOTAyMTZaMCgxCzAJBgNVBAYTAkRF MRkwFwYDVQQDDBBNaWNoYWVsIFN0csO2ZGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAxXZGav40rnGNLxEggBW94MILWHlfC8a23Jew5U1gPlfRTXOjjzmoaZ1uCyGdgF6M VvuO9T1aTQNGH+OdeGe3P7Tfc/NsLJFJ2wtd8blvhmodUgse2eypiWjNOd4gZuhalBhgsQ0K b5D6/1foghII4E264iZlJ7AJ+UYcO+GxvFWT0YMTbLckgDkZk7c3qwTozdhYvXarvqx+8Ou/ kuxpQQhac/ebzxpu0N+RHSf2KIUS0g0tEGnPtGv6iL+9QNHc4JKo9Y9KKVw3tQy+Re+FQLxB 1fPE5F+qxuD3AUENpOwkMsqWLM94ohtx3CFqLpxfUPrnKFLAHOhHEbByYGvFPwIDAQABo4IC EDCCAgwwgaUGCCsGAQUFBwEBBIGYMIGVMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnRydXN0 Y2VudGVyLmRlL2NlcnRzZXJ2aWNlcy9jYWNlcnRzL3RjX2NsYXNzMV9MMV9DQV9JWC5jcnQw QAYIKwYBBQUHMAGGNGh0dHA6Ly9vY3NwLml4LnRjY2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1 c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAU6bgoHUbP/M34TpvF7ktg69g7P9EwDAYDVR0TAQH/ BAIwADBKBgNVHSAEQzBBMD8GCSqCFAAsAQEBATAyMDAGCCsGAQUFBwIBFiRodHRwOi8vd3d3 LnRydXN0Y2VudGVyLmRlL2d1aWRlbGluZXMwDgYDVR0PAQH/BAQDAgTwMB0GA1UdDgQWBBS2 KAWfTfgJ/JQ63qLGwTXYLnI+LzBiBgNVHR8EWzBZMFegVaBThlFodHRwOi8vY3JsLml4LnRj Y2xhc3MxLnRjdW5pdmVyc2FsLWkudHJ1c3RjZW50ZXIuZGUvY3JsL3YyL3RjX0NsYXNzMV9M MV9DQV9JWC5jcmwwMwYDVR0lBCwwKgYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDBwYK KwYBBAGCNxQCAjAfBgNVHREEGDAWgRRtaWNoYWVsQHN0cm9lZGVyLmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAQ3bvVUpEq+cQrLpcogyt5BJNk/WvUvOHqhzyj28M9pg9hcDl1+MYl5qqj6tR GSTLPQZyf287pcmbMwbcTGZO/gbW9v7RYcut6RauWdwKMCUmKC3J4fVfDq9ZETA2WOV68ef4 B3Gzdhghsbp3Rhp5dDmrCVKAHlafm6ZwJrEQ9P76fxnQZzRLgeKpZep5ePH5YHUB3+YaOQvJ FG0bOXvfHhRiRG7/HW2G+yDgjHSxDz8AFzMWL/RFePqZ4pn6T/SM/qU6WEpW39MWyJNoH/Kx QDYK8gGYuesn1ciMCTnjrvZQj0fonGTO4SfWekJRkuGrJ7dYSZRjYbDcWBBkdFLWzzCCBdgw ggTAoAMCAQICDgboAAEAAkqWLSQM/sXJMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNVBAYTAkRF MRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQwIgYDVQQLExtUQyBUcnVzdENlbnRl ciBVbml2ZXJzYWwgQ0ExJjAkBgNVBAMTHVRDIFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJ MB4XDTA5MTEwMzE0MDgxOVoXDTI1MTIzMTIxNTk1OVowfDELMAkGA1UEBhMCREUxHDAaBgNV BAoTE1RDIFRydXN0Q2VudGVyIEdtYkgxJTAjBgNVBAsTHFRDIFRydXN0Q2VudGVyIENsYXNz IDEgTDEgQ0ExKDAmBgNVBAMTH1RDIFRydXN0Q2VudGVyIENsYXNzIDEgTDEgQ0EgSVgwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC75pBuz2Lp6QuqthDVR+V8XSsncZpozVVt 5KLv5P7yemMRwleKyH3PjmYfZUVL64Biab1GjovFblqVGCrep/EfdRonq20yU+P7TVhiLP8Z 5cegDZotIYhZhM0d8cPIij6w5d4IJM/8QCy6QSOUu4ASiTVItoYE4AFPjLqpmPwcie0fiqHH hpgmHnJla/7PZdkMZEsaCfVDEWBmJuMzVprJPT40anjG5VBLyM2I5DlsUCaeQCy2O3w3sqf1 3dyzUcv03IICuNc63towXA31Qt0TaVNU6YAmQjMepdfMbspmCZ+G8D2+xophEPPR/1vkstst smUMqX0XrLonTUJczglPAgMBAAGjggJZMIICVTCBmgYIKwYBBQUHAQEEgY0wgYowUgYIKwYB BQUHMAKGRmh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvY2VydHNlcnZpY2VzL2NhY2VydHMv dGNfdW5pdmVyc2FsX3Jvb3RfSS5jcnQwNAYIKwYBBQUHMAGGKGh0dHA6Ly9vY3NwLnRjdW5p dmVyc2FsLUkudHJ1c3RjZW50ZXIuZGUwHwYDVR0jBBgwFoAUkqR1LKSevoFE63n8isWVpesQ dXMwEgYDVR0TAQH/BAgwBgEB/wIBADBSBgNVHSAESzBJMAYGBFUdIAAwPwYJKoIUACwBAQEB MDIwMAYIKwYBBQUHAgEWJGh0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lczAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFOm4KB1Gz/zN+E6bxe5LYOvYOz/RMIH9BgNVHR8E gfUwgfIwge+ggeyggemGRmh0dHA6Ly9jcmwudGN1bml2ZXJzYWwtSS50cnVzdGNlbnRlci5k ZS9jcmwvdjIvdGNfdW5pdmVyc2FsX3Jvb3RfSS5jcmyGgZ5sZGFwOi8vd3d3LnRydXN0Y2Vu dGVyLmRlL0NOPVRDJTIwVHJ1c3RDZW50ZXIlMjBVbml2ZXJzYWwlMjBDQSUyMEksTz1UQyUy MFRydXN0Q2VudGVyJTIwR21iSCxPVT1yb290Y2VydHMsREM9dHJ1c3RjZW50ZXIsREM9ZGU/ Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlPzANBgkqhkiG9w0BAQUFAAOCAQEAOcjE m+6+mO5Icm+N53G2DpCM07LBFSGoRpBoX0oE8TrJaIQh2KXmBHVdn9LU8kt3QzLclctgvwJV 0KwcsMUUl5tlCsMPpR3s2Ek5lbWpvvr0HqtW56blAQiINV9nBd1EJFASIkRjefGbV2nOq9Yz UU+N8HA7jq1ROhd/NZZraGhjthwKyfjfHV7PKxGlY+3M0MbTIG+q/GhIfm0euDpFqhKG88e9 ALXr/uoSn3MzeOcoOWjTpW3adtFO4VWVgKbgG7jNrFbvRVlHmFLbOm4msjE5aXWxLiTwpJ2X iF4zKca1vAdAOgw9us90jEtOeiH6GzjNxEMvb7TfeO6Zkuc6HDGCA84wggPKAgEBMIGPMHwx CzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQLExxU QyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRlciBD bGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wCQYFKw4DAhoFAKCCAhMwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIxMjA0MTg0NzI4WjAjBgkq hkiG9w0BCQQxFgQU0i74cGCINoBUMa+SopgnSm/SyfgwbAYJKoZIhvcNAQkPMV8wXTALBglg hkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBoAYJKwYBBAGCNxAEMYGSMIGP MHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYDVQQL ExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENlbnRl ciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wgaIGCyqGSIb3DQEJEAILMYGS oIGPMHwxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSUwIwYD VQQLExxUQyBUcnVzdENlbnRlciBDbGFzcyAxIEwxIENBMSgwJgYDVQQDEx9UQyBUcnVzdENl bnRlciBDbGFzcyAxIEwxIENBIElYAg8ApksAAQACAIr42UPEgb8wDQYJKoZIhvcNAQEBBQAE ggEAj+hC4vk+9YseHBkFV80S/vi18exEl55i068Bjjr7P/A5gt0BpJP2jIIKnPEzxikfnIhv OogXkVWpOD1VL+dHZouNKWHx2rLu8IYgU+sZKFtqRShfevc25HniCGKs0g50HRsjrI1BcrK2 bOp+dDxmt+9z9kaQXkVqCMgMDSqvLY90JPNSssW2RXwezIpoo0Sk06bxwsnXploF0qZYYPTO alGNv3uCckWCVd6gna63jMz51aV7c/7+sJYG/hZz/ps5C0IFeZ07mhANeAMKjC793/U+MEwu A9CQgrkBMKKHOjmQOvQyNKQ4YHQ8BzU5/Ql0xkTMBY2/4CDdtw+D6874MwAAAAAAAA== --------------ms080001080509060504090401--

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by quanah＠zimbra.com 04 Dec '12

04 Dec '12

--On Tuesday, December 04, 2012 7:36 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > quanah(a)zimbra.com wrote: >> --On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: >> >>> fumiyas(a)osstech.jp wrote: >>>> At Wed, 28 Nov 2012 20:04:41 GMT, >>>> michael(a)stroeder.com wrote: >>>>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>>>> to ease building it without installed OpenLDAP client libs: >>>> >>>> This ITS is a dup of #7309. >>>> http://www.openldap.org/its/index.cgi?findid=7309 >>>> >>>> And see also: >>>> http://www.openldap.org/its/index.cgi?findid=7308 >>>> >>>> This problem is fixed in master, but not in 2.4 branch... >>> >>> Ah, thanks for the hint. The Makefile in master looks much better than >>> my suggestion. >>> >>> @Quanah: Could you please port this to RE24 branch? >> >> My recollection is we've been waiting on someone to go through and test >> the changes. Are you willing to do that? it sounds like you've >> started... > > Which tests do you expect? > > I usually build without the KRB5 support. If you want this to be also > tested I have to reactivate my rusty heimdal knowledge a bit. I'm not talking specifically about slapo-smbk5pwd testing. ;) I'm talking about the commits for ITS7308 and ITS7309, which touched a significant number of files. Generally we need someone to go through contrib and verify things build ok. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by michael＠stroeder.com 04 Dec '12

04 Dec '12

quanah(a)zimbra.com wrote: > --On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: > >> fumiyas(a)osstech.jp wrote: >>> At Wed, 28 Nov 2012 20:04:41 GMT, >>> michael(a)stroeder.com wrote: >>>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>>> to ease building it without installed OpenLDAP client libs: >>> >>> This ITS is a dup of #7309. >>> http://www.openldap.org/its/index.cgi?findid=7309 >>> >>> And see also: >>> http://www.openldap.org/its/index.cgi?findid=7308 >>> >>> This problem is fixed in master, but not in 2.4 branch... >> >> Ah, thanks for the hint. The Makefile in master looks much better than my >> suggestion. >> >> @Quanah: Could you please port this to RE24 branch? > > My recollection is we've been waiting on someone to go through and test the > changes. Are you willing to do that? it sounds like you've started... Which tests do you expect? I usually build without the KRB5 support. If you want this to be also tested I have to reactivate my rusty heimdal knowledge a bit. Ciao, Michael.

1 0

RE: (ITS#7434) idassert-bind fails after restarting slapd
by blance3459＠hotmail.com 04 Dec '12

04 Dec '12

--_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Quanah=2C=20 =20 I finally got back around to working on this over the last couple of days. = Where I'm at with my project is: I have two servers (virtual machines)=2C = named master and replica=2C with slapd configured with my directory inform= ation and single-master replication between them. =20 I created a Kerberos realm and various principals in open ldap. =20 Replication access is authenticated using sasl/gssapi with the slapd princ= ipal=2C ldap/replica.example.net. =20 k5start has been added to system startup to buid the credential cache for = slapd. =20 That brings me to configuring referrals and proxyAuth on replica. What ap= pears to be happening is that at the initial configuration (before restarti= ng the daemon) is the client binds to the replica and authenticates with it= s kerberos ticket. The "magic" is performed on the sasl user and the ldap directory entry is returned. It then proceeds into the modifi= cation and notices the update referral. It then checks to determine if the= binddn used in in the olcDbIDAssertBind statems can authzTo the bound user. It can and the proxy of the modificati= on proceeds. On the master=2C the proxy request is received=2C more "magic= " is done on the user id to make sure it is in=20 the correct form=2C the authzTo attribute is again checked and allowed. Th= e update is performed as the user=2C and success is returned back through t= he chain to the user. This is how I would expect=20 the process to proceed. However=2C if I restart the server (or slapd daemo= n)=2C this behavior changes. After restarting=2C the bind occurs at the re= plica=2C does "magic"=2C and then sees the referral and attempts the proxy.= What's notable here is that the check of authzTo is NOT performed. The refereal is then chased=2C but the authzTo check was never made. Since= there is no user to "authzTo"=2C does the referral get chased with perhaps= a "null" or anonymous user? Whatever the case=2C it appears the the original binding user is never sent= over the proxy. Over at the master=2C I see the bind request come on from= the replica which is treated as an anonymous bind request. No magic=2C no authzTo check=2C no nothing. It then goes straight into the= modification and tries to perform=2C but is blocked due to the bound user = being anonymous and the stronger authentication error (8) is returned. =20 Given that the bind occured anonymously=2C I feel that error is expected an= d wanted. =20 I had been trying to use sasl binding here=2C but was not having the same s= ucess that I had with syncrepl. In order to only fight one battle at a tim= e=2C I changed by proxy config to use a simple bind instead of sasl/gssapi.= =20 =20 Referrals and proxy authentication are configured on replica with the follo= wing ldif. I tried setting the override flag because the man page makes it= sound like it forces the authzTo check at bind time. By doing that I was hoping I could force the check and see the authzTo proc= ess in my logs. Is this what the ITS you mentions is referring to?=20 dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig changetype: modify add: olcUpdateref olcUpdateref: "ldap://master.example.net:389/" =20 dn: cn=3Dmodule{0}=2Ccn=3Dconfig changetype: modify add: olcModuleLoad olcModuleLoad: {1}back_ldap =20 dn: olcOverlay=3Dchain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE =20 dn: olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}fronten= d=2Ccn=3Dconfig changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://master.example.net:389/" olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=3Dsimple binddn=3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" credentials=3Dshhh-secret mode=3Dself flags=3Doverride starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem =20 =20 After adding that information via ldapmodify=2C I attempt to perform an upd= ate on the replica. For testing=2C i simply change the description attribu= te for uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. I'm us= ing this simple ldif to test with: dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet changetype: modify replace: description description: Network Administrator Initially after configuring the proxy and obtainng a kerberos ticket for th= e account (administrator=2C self write)=2C this update succeeds. Looking a= t syslog on replica=2C I see happiness. The ldap modify binds using gssapi= =2C I see SASL name being correctly converted to uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. Dec 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: auth= cid=3D"administrator" Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: conn 1005 id=3Dadmini= strator [len=3D13] Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: u:id converted to uid= =3Dadministrator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <uid=3Dadministrator= =2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth> Dec 3 22:17:01 replica slapd[994]: <<< dnNormalize: <uid=3Dadministrator= =2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth> Dec 3 22:17:01 replica slapd[994]: =3D=3D>slap_sasl2dn: converting SASL n= ame uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth to a D= N Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_context_apply [depth= =3D1] string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth' Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth'= string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth= ' [1 pass(es)] Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3D= administrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' [1 pass(es)] Dec 3 22:17:01 replica slapd[994]: =3D=3D> rewrite_context_apply [depth= =3D1] res=3D{0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dn= et'} Dec 3 22:17:01 replica slapd[994]: [rw] authid: "uid=3Dadministrator=2Ccn= =3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -> "uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: slap_parseURI: parsing uid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <=3D=3Dslap_sasl2dn: Converted SASL na= me to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: slap_sasl_getdn: dn:id converted to ui= d=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: slapA= uthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: SASL proxy authorize [conn=3D1005]: au= thcid=3D"administrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND authcid=3D"adm= inistrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:17:01 replica slapd[994]: SASL Authorize [conn=3D1005]: proxy a= uthorization allowed authzDN=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_sasl: err=3D0 len=3D-1 Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND dn=3D"uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ssf= =3D56 ssf=3D56 Dec 3 22:17:01 replica slapd[994]: do_bind: SASL/GSSAPI bind: dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 Dec 3 22:17:01 replica slapd[994]: send_ldap_response: msgid=3D3 tag=3D97= err=3D0 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D2 RESULT tag=3D97 err= =3D0 text=3D Dec 3 22:17:01 replica slapd[994]: <=3D=3D slap_sasl_bind: rc=3D0 All good=2C so far on replica. I believe the sasl/gssapi authntication pr= ocess is completed. Now to perform the modify. Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 do_modify Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 modifications: Dec 3 22:17:01 replica slapd[994]: #011replace: description Dec 3 22:17:01 replica slapd[994]: #011#011one value=2C length 21 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD dn=3D"uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD attr=3Ddescript= ion Dec 3 22:17:01 replica slapd[994]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p= =3D3 Dec 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D10 matched=3D"= " text=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_result: referral=3D"ldap://m= aster.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" -> "ldap://master.example.net:389" Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet": URI=3D"ldap://master.example.net:389" found in cache =20 Okay=2C now it seems that the referral is returned and chased on behalf of= the client. Finally=2C from the perspective of replica=2C success! Modif= ied data comes back to replica via syncrepl. Dec 3 22:17:01 replica slapd[994]: =3D>ldap_back_getconn: conn 0x7fe0b01= 47c30 fetched refcnt=3D1. Dec 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p= =3D3 Dec 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D0 matched=3D""= text=3D"" Dec 3 22:17:01 replica slapd[994]: send_ldap_response: msgid=3D4 tag=3D10= 3 err=3D0 Dec 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 RESULT tag=3D103 er= r=3D0 text=3D =20 Dec 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor Dec 3 22:17:01 replica slapd[994]: daemon: activity on: Dec 3 22:17:01 replica slapd[994]: 15r Dec 3 22:17:01 replica slapd[994]:=20 Dec 3 22:17:01 replica slapd[994]: daemon: read active on 15 Dec 3 22:17:01 replica slapd[994]: connection_get(15) Dec 3 22:17:01 replica slapd[994]: connection_get(15): got connid=3D0 Dec 3 22:17:01 replica slapd[994]: =3D>do_syncrepl rid=3D123 Dec 3 22:17:01 replica slapd[994]: =3D>do_syncrep2 rid=3D123 Dec 3 22:17:01 replica slapd[994]: do_syncrep2: rid=3D123 cookie=3Drid=3D= 123=2Ccsn=3D20121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 replica slapd[994]: >>> dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPrettyNormal: <uid=3Dadministrat= or=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: >>> dnPretty: <cn=3Dadmin=2Cdc=3Dexamp= le=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: <<< dnPretty: <cn=3Dadmin=2Cdc=3Dexamp= le=2Cdc=3Dnet> Dec 3 22:17:01 replica slapd[994]: >>> dnNormalize: <cn=3Dadmin=2Cdc=3Dex= ample=2Cdc=3Dnet> Dec 3 22:17:01 replica rsyslogd-2177: imuxsock begins to drop messages fr= om pid 994 due to rate-limiting So everything looks good (correct?) on replica. Meanwhile=2C back at the = master....=20 Dec 3 22:17:01 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:17:01 master slapd[947]: daemon: activity on: Dec 3 22:17:01 master slapd[947]: 51r Dec 3 22:17:01 master slapd[947]:=20 Dec 3 22:17:01 master slapd[947]: daemon: read active on 51 Dec 3 22:17:01 master slapd[947]: connection_get(51) Dec 3 22:17:01 master slapd[947]: connection_get(51): got connid=3D1054 Dec 3 22:17:01 master slapd[947]: connection_read(51): checking for input= on id=3D1054 Dec 3 22:17:01 master slapd[947]: op tag 0x66=2C time 1354591021 Dec 3 22:17:01 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:17:01 master slapd[947]: daemon: activity on: Dec 3 22:17:01 master slapd[947]:=20 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 do_modify Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:17:01 master slapd[947]: =3D> get_ctrls Dec 3 22:17:01 master slapd[947]: =3D> get_ctrls: oid=3D"2.16.840.1.11373= 0.3.4.18" (noncritical) Dec 3 22:17:01 master slapd[947]: parseProxyAuthz: conn 1054 authzid=3D"d= n:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: slap_sasl_getdn: conn 1054 id=3Ddn:uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet [len=3D48] Dec 3 22:17:01 master slapd[947]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl2dn: converting SASL na= me uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet to a DN Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_context_apply [depth=3D= 1] string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth'= string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' [1 = pass(es)] Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_rule_apply rule=3D'uid= =3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' [1 pass(es)] Dec 3 22:17:01 master slapd[947]: =3D=3D> rewrite_context_apply [depth=3D= 1] res=3D{0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'= } Dec 3 22:17:01 master slapd[947]: [rw] authid: "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" -> "uid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: slap_parseURI: parsing uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <=3D=3Dslap_sasl2dn: Converted SASL nam= e to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: slap_sasl_getdn: dn:id converted to uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: parseProxyAuthz: conn=3D1054 "uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl_authorized: can cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet become uid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet? Dec 3 22:17:01 master slapd[947]: =3D=3D>slap_sasl_check_authz: does uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet match authzTo rule= in cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet? Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "cn=3Dreplica= =2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "authzTo" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("cn=3Dreplica=2Cou=3Dhosts= =2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "cn=3D= replica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (authzTo) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: auth access to "cn= =3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" "authzTo" requested Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [2] attr authzTo Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "cn=3Dre= plica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "authzTo" requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [1] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [1] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: auth access g= ranted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: auth access grante= d by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result was in cach= e (authzTo) Dec 3 22:17:01 master slapd[947]: =3D=3D=3D>slap_sasl_match: comparing DN= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet to rule dn:* Dec 3 22:17:01 master slapd[947]: slap_parseURI: parsing dn:* Dec 3 22:17:01 master slapd[947]: <=3D=3D=3Dslap_sasl_match: comparison r= eturned 0 Dec 3 22:17:01 master slapd[947]: <=3D=3Dslap_sasl_check_authz: authzTo c= heck returning 0 Dec 3 22:17:01 master slapd[947]: <=3D=3D slap_sasl_authorized: return 0 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 PROXYAUTHZ dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: <=3D get_ctrls: n=3D1 rc=3D0 err=3D"" Dec 3 22:17:01 master slapd[947]: >>> dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: <<< dnPrettyNormal: <uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 modifications: Dec 3 22:17:01 master slapd[947]: #011replace: description Dec 3 22:17:01 master slapd[947]: #011#011one value=2C length 21 Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 MOD dn=3D"uid=3Dadmi= nistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3 MOD attr=3Ddescripti= on Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> test_filter Dec 3 22:17:01 master slapd[947]: PRESENT Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr objectClass Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: search access= granted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access gran= ted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: <=3D test_filter 6 Dec 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fscope = 1 rc 6 Dec 3 22:17:01 master slapd[947]: hdb_modify: uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: slap_queue_csn: queing 0x7fa90f0fe110 2= 0121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: 0x0000000b: uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (description) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: delete access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "description" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr description Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "description"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "uid=3D= administrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] applying write(=3Dwr= scxd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] mask: write(=3Dwrscx= d) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: delete access= granted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: delete access gran= ted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: result not in cach= e (description) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: add access to "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "description" req= uested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr description Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "description"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to value by "uid=3Dadmin= istrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] applying write(=3Dwr= scxd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [2] mask: write(=3Dwrscx= d) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: add access gr= anted by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: add access granted= by write(=3Dwrscxd) Dec 3 22:17:01 master slapd[947]: acl: internal mod entryCSN: modify acce= ss granted Dec 3 22:17:01 master slapd[947]: acl: internal mod modifiersName: modify= access granted Dec 3 22:17:01 master slapd[947]: acl: internal mod modifyTimestamp: modi= fy access granted Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace descriptio= n Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace entryCSN Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace modifiersN= ame Dec 3 22:17:01 master slapd[947]: bdb_modify_internal: replace modifyTime= stamp Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "inetOrgPerso= n" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "posixAccount= " Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "shadowAccoun= t" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbPrincipal= Aux" Dec 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbTicketPol= icyAux" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "objectClass" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "cn" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "sn" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "uidNumber" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "gidNumber" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "userPassword" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "homeDirectory" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "structuralObject= Class" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "uid" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "entryUUID" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "creatorsName" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "createTimestamp" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbPrincipalName= " Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbPrincipalKey" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastPwdChange= " Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastFailedAut= h" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLoginFailedCo= unt" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastSuccessfu= lAuth" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "krbExtraData" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "description" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "entryCSN" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "modifiersName" Dec 3 22:17:01 master slapd[947]: oc_check_allowed type "modifyTimestamp" Dec 3 22:17:01 master slapd[947]: =3D> key_change(DELETE=2Cb) Dec 3 22:17:01 master slapd[947]: bdb_idl_delete_key: b=20 Dec 3 22:17:01 master slapd[947]: <=3D key_change 0 Dec 3 22:17:01 master slapd[947]: =3D> key_change(ADD=2Cb) Dec 3 22:17:01 master slapd[947]: bdb_idl_insert_key: b=20 Dec 3 22:17:01 master slapd[947]: <=3D key_change 0 Dec 3 22:17:01 master slapd[947]: =3D> entry_encode(0x0000000b):=20 Dec 3 22:17:01 master slapd[947]: <=3D entry_encode(0x0000000b):=20 Dec 3 22:17:01 master slapd[947]: hdb_modify: updated id=3D0000000b dn=3D"= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: send_ldap_result: conn=3D1054 op=3D3 p= =3D3 Dec 3 22:17:01 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" = text=3D"" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: bdb_entry_get: rc=3D0 Dec 3 22:17:01 master slapd[947]: =3D> test_filter Dec 3 22:17:01 master slapd[947]: PRESENT Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access to "= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" = requested Dec 3 22:17:01 master slapd[947]: =3D> dn: [4] ou=3Dkerberos=2Cdc=3Dexamp= le=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: =3D> dn: [5]=20 Dec 3 22:17:01 master slapd[947]: =3D> acl_get: [6] attr objectClass Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: access to entry "uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass"= requested Dec 3 22:17:01 master slapd[947]: =3D> acl_mask: to all values by "cn=3Dr= eplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0)=20 Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: cn=3Dadm-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: self Dec 3 22:17:01 master slapd[947]: <=3D check a_dn_pat: users Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] applying read(=3Drsc= xd) (stop) Dec 3 22:17:01 master slapd[947]: <=3D acl_mask: [3] mask: read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> slap_access_allowed: search access= granted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: =3D> access_allowed: search access gran= ted by read(=3Drscxd) Dec 3 22:17:01 master slapd[947]: <=3D test_filter 6 Dec 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fscope = 1 rc 6 Dec 3 22:17:01 master slapd[947]: syncprov_sendresp: cookie=3Drid=3D123= =2Ccsn=3D20121204031701.560697Z#000000#000#000000 Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: ndn: "uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: oc: "(null)"=2C at:= "(null)" Dec 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:17:01 master slapd[947]: =3D> bdb_entry_get: found entry: "uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Everything looks good on the master. I see uid=3Dadministrator gets sent = over from the the proxy on replica and the update proceeds as expected. No= w if I restart slapd on replica=2C things change. performing the same modi= fucation=2C we again see sasl/gssapi authentication occuring on replica jus= t as before Dec 3 22:20:38 replica slapd[1412]: [rw] authid: "uid=3Dadministrator=2C= cn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -> "uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: slap_parseURI: parsing uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: >>> dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnNormalize: <uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <=3D=3Dslap_sasl2dn: Converted SASL n= ame to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: slap_sasl_getdn: dn:id converted to u= id=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet Dec 3 22:20:38 replica slapd[1412]: SASL Canonicalize [conn=3D1000]: slap= AuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: SASL proxy authorize [conn=3D1000]: a= uthcid=3D"administrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND authcid=3D"ad= ministrator(a)EXAMPLE.NET" authzid=3D"administrator(a)EXAMPLE.NET" Dec 3 22:20:38 replica slapd[1412]: SASL Authorize [conn=3D1000]: proxy = authorization allowed authzDN=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_sasl: err=3D0 len=3D-1 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND dn=3D"uid=3Da= dministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ss= f=3D56 ssf=3D56 Dec 3 22:20:38 replica slapd[1412]: do_bind: SASL/GSSAPI bind: dn=3D"uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 Dec 3 22:20:38 replica slapd[1412]: send_ldap_response: msgid=3D3 tag=3D9= 7 err=3D0 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 RESULT tag=3D97 er= r=3D0 text=3D Dec 3 22:20:38 replica slapd[1412]: <=3D=3D slap_sasl_bind: rc=3D0 Again=2C we head into the modification: Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 do_modify Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 do_modify: dn (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) Dec 3 22:20:38 replica slapd[1412]: >>> dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 modifications: Dec 3 22:20:38 replica slapd[1412]: #011replace: description Dec 3 22:20:38 replica slapd[1412]: #011#011one value=2C length 21 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 MOD dn=3D"uid=3Dad= ministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 MOD attr=3Ddescrip= tion Dec 3 22:20:38 replica slapd[1412]: bdb_dn2entry("uid=3Dadministrator=2Co= u=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: =3D> hdb_dn2id("ou=3Dpeople=2Cdc=3Dex= ample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: <=3D hdb_dn2id: got id=3D0x3 Dec 3 22:20:38 replica slapd[1412]: daemon: activity on 1 descriptor Dec 3 22:20:38 replica slapd[1412]: daemon: activity on: Dec 3 22:20:38 replica slapd[1412]: =20 So far=2C so good (I think)=2C replica sees the need to refer the action a= nd tries to chase it on behalf of the clent: Dec 3 22:20:38 replica slapd[1412]: =3D> hdb_dn2id("uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") Dec 3 22:20:38 replica slapd[1412]: <=3D hdb_dn2id: got id=3D0xb Dec 3 22:20:38 replica slapd[1412]: entry_decode: "" Dec 3 22:20:38 replica slapd[1412]: <=3D entry_decode() Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D10 matched=3D= "" text=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: referral=3D"ldap://= master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet" Dec 3 22:20:38 replica slapd[1412]: >>> dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: <<< dnPrettyNormal: <uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet>=2C <uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet> Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" -> "ldap://master.example.net:389" Dec 3 22:20:38 replica slapd[1412]: ldap_back_db_open: URI=3Dldap://maste= r.example.net:389 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet" temporary Dec 3 22:20:38 replica slapd[1412]: =3D>ldap_back_getconn: conn=3D1000 op= =3D3: lc=3D0x7f213015a7d0 inserted refcnt=3D1 rc=3D0 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 =20 At this point=2C I "assume" the modification has been passed off to master.= However=2C I notice that I never see the replica checking authzTo like be= fore the restart. I think this is where it's falling apart for me and the e= rr=3D8 back is returned from master. =20 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matched=3D"= " text=3D"modifications require authentication" Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 = p=3D3 Dec 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matched=3D"= " text=3D"" Dec 3 22:20:38 replica slapd[1412]: send_ldap_response: msgid=3D4 tag=3D1= 03 err=3D8 Dec 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 RESULT tag=3D103 e= rr=3D8 text=3D Dec 3 22:20:38 replica slapd[1412]: daemon: activity on 1 descriptor Dec 3 22:20:38 replica slapd[1412]: daemon: activity on: Dec 3 22:20:38 replica slapd[1412]: 18r =20 Over on the master we see the proxy connection occurs=2C but the client cr= edentials never apper to arrive. I say that because=2C it looks to me like= the proxy connection from replica appears to bind anonymously. Dec 3 22:20:38 master slapd[947]: daemon: activity on 1 descriptor Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]:=20 Dec 3 22:20:38 master slapd[947]: slap_listener_activate(8):=20 Dec 3 22:20:38 master slapd[947]: >>> slap_listener(ldap:///) Dec 3 22:20:38 master slapd[947]: daemon: listen=3D8=2C new connection on= 51 Dec 3 22:20:38 master slapd[947]: daemon: added 51r (active) listener=3D(= nil) Dec 3 22:20:38 master slapd[947]: conn=3D1056 fd=3D51 ACCEPT from IP=3D19= 2.168.1.2:34759 (IP=3D0.0.0.0:389) Dec 3 22:20:38 master slapd[947]: daemon: activity on 2 descriptors Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]: 51r Dec 3 22:20:38 master slapd[947]:=20 Dec 3 22:20:38 master slapd[947]: daemon: read active on 51 Dec 3 22:20:38 master slapd[947]: connection_get(51) Dec 3 22:20:38 master slapd[947]: connection_get(51): got connid=3D1056 Dec 3 22:20:38 master slapd[947]: connection_read(51): checking for input= on id=3D1056 Dec 3 22:20:38 master slapd[947]: op tag 0x60=2C time 1354591238 Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 do_bind Dec 3 22:20:38 master slapd[947]: >>> dnPrettyNormal: <> Dec 3 22:20:38 master slapd[947]: <<< dnPrettyNormal: <>=2C <> Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 BIND dn=3D"" method= =3D128 Dec 3 22:20:38 master slapd[947]: do_bind: version=3D3 dn=3D"" method=3D1= 28 Dec 3 22:20:38 master slapd[947]: send_ldap_result: conn=3D1056 op=3D0 p= =3D3 Dec 3 22:20:38 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" = text=3D"" Dec 3 22:20:38 master slapd[947]: send_ldap_response: msgid=3D1 tag=3D97 = err=3D0 Dec 3 22:20:38 master slapd[947]: conn=3D1056 op=3D0 RESULT tag=3D97 err= =3D0 text=3D Dec 3 22:20:38 master slapd[947]: do_bind: v3 anonymous bind Dec 3 22:20:38 master slapd[947]: daemon: activity on 2 descriptors Dec 3 22:20:38 master slapd[947]: daemon: activity on: Dec 3 22:20:38 master slapd[947]: 51r Dec 3 22:20:38 master slapd[947]:=20 After=2C the (anonymous) bind=2C the master never attempts to if the proxya= uth request is allowed via authzTo or anything else (perhaps obviously). T= he modification just proceeds anonymously and eventually fails. =20 Not sure if I'm saying this in a way that makes any sense to you. Hopeful= ly=2C it does. It appears=2C that the proxy on replica after restarting=2C= never tries to determine if the olcDbIDAssertBind binddn is permitted to i= mpersonate the client via the authzTo attribute and proceeds with the refer= al chase anonymously. =20 I'll copy paste configs below. Sorry this is so long=2C but I figure the= more information=2C the better when trying to solve any problem. =20 Thanks =20 Barry =20 vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv master configuration vvvvvvvvvvvvvvvvv= vvvvvvvvvvv dn: cn=3Dconfig objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: ea6bf008-d108-1031-912d-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/master_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/master_slapd_key.pem olcAuthzPolicy: to olcSaslHost: master.example.net olcSaslRealm: EXAMPLE.NET olcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet olcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet olcLogLevel: -1 entryCSN: 20121204013949.466434Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204013949Z dn: cn=3Dmodule{0}=2Ccn=3Dconfig objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov structuralObjectClass: olcModuleList entryUUID: ea6dda08-d108-1031-9135-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121203054749.860918Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z dn: cn=3Dschema=2Ccn=3Dconfig objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: ea6c3a0e-d108-1031-9130-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.672699Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z <snip schemas > dn: olcBackend=3D{0}hdb=2Ccn=3Dconfig objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: ea6f949c-d108-1031-9136-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.694663Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break olcAccess: {1}to dn.exact=3D"" by * read olcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: ea6c0bf6-d108-1031-912e-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.671512Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{0}config=2Ccn=3Dconfig objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal=2Ccn=3Dauth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: ea6c325c-d108-1031-912f-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z entryCSN: 20121202201635.672495Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201635Z dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=3Dexample=2Cdc=3Dnet olcLastMod: TRUE olcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet olcRootPW:: e1NTSEF9cGhKNWtqME9rOGJnVXp0dy9hYzZEaWFmU1U1Z0FTZk0=3D olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: krbPrincipalName eq=2Cpres=2Csub olcDbIndex: krbPwdPolicyReference eq structuralObjectClass: olcHdbConfig entryUUID: ea6fa3ce-d108-1031-9137-8fbb37ee6dd9 creatorsName: cn=3Dconfig createTimestamp: 20121202201635Z olcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange by group.exact=3D= "cn=3Dreplic ators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by self write by anon= ymous auth olcAccess: {1}to attrs=3DauthzTo=2CauthzFrom=2Ccn=2CuidNumber=2CgidNumber= =2Cuid by users r ead by anonymous none olcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFai= ledAuth=2Ckr bLoginFailedCount by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc= =3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" wr= ite by dn=3D"cn=3Dadm-sr v=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by self read by * none olcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by= group.exact=3D"cn =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by dn=3D"cn= =3Dkdc-srv=2Cou=3Dkerberos=2C dc=3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc= =3Dexample=2Cdc=3Dnet" writ e by * none olcAccess: {4}to dn.base=3D"" by * read olcAccess: {5}to * by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C= dc=3Dnet" write by s elf write by users read entryCSN: 20121203054749.804561Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z dn: olcOverlay=3D{0}syncprov=2ColcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 structuralObjectClass: olcSyncProvConfig entryUUID: b77dc36a-d158-1031-9917-2f12ddec6588 creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121203054749Z entryCSN: 20121203054749.962179Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121203054749Z vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv dc=3D= example=2Cdc=3Dnet vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv dn: dc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: dcObject objectClass: organization o: example.net dc: example structuralObjectClass: organization entryUUID: eac01854-d108-1031-95b6-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.222029Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z contextCSN: 20121204035116.890381Z#000000#000#000000 dn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: eac2e160-d108-1031-95b7-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.240572Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z dn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: people description: user account objects structuralObjectClass: organizationalUnit entryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.299880Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: groups description: group objects structuralObjectClass: organizationalUnit entryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.394485Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: hosts description: host/computer objects structuralObjectClass: organizationalUnit entryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.400935Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: kerberos description: kerberos realm container structuralObjectClass: organizationalUnit entryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.409140Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: replica objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica structuralObjectClass: organizationalRole entryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/replica.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRU= RAxZ oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6= Mn3k f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu= 6lb/ QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065600Z krbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D userPassword:: <secret> entryCSN: 20121203233422.105322Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203233422Z dn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: master objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica userPassword:: e0NSWVBUfSo=3D structuralObjectClass: organizationalRole entryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/master.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW= +aWr 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5= 522A i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH1= 5xNZ VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060855Z krbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203060855.932134Z#000000#000#000000 modifiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203060855Z dn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: posixGroup cn: administrator gidNumber: 50000 structuralObjectClass: posixGroup entryUUID: 1d079216-d12b-1031-978d-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.465616Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: groupOfNames cn: replicators member: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet member: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet structuralObjectClass: groupOfNames entryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.477792Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: administrator sn: administrator uidNumber: 50000 gidNumber: 50000 userPassword:: <secret> homeDirectory: /home/administrator structuralObjectClass: inetOrgPerson uid: administrator entryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: administrator(a)EXAMPLE.NET krbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ecqcdxa= iluD o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/= Ot7l cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADm= Ozq8 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8o= AcwB aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6= yoME 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo= 8yyO mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgED= oSgE JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLR= VhBT VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXG= a5U+ g=3D krbLastPwdChange: 20121203054848Z krbLastFailedAuth: 20121204013714Z krbLoginFailedCount: 0 description: Network Administrator krbLastSuccessfulAuth: 20121204035116Z krbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204035116.890381Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204035116Z dn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: kdc-srv description: Kerberos KDC userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.563692Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: adm-srv description: Kerberos Admin Server userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.575773Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet cn: EXAMPLE.NET objectClass: top objectClass: krbRealmContainer objectClass: krbTicketPolicyAux krbSubTrees: dc=3Dexample=2Cdc=3Dnet krbSearchScope: 2 krbMaxRenewableAge: 604800 krbMaxTicketLife: 36000 structuralObjectClass: krbRealmContainer entryUUID: c03d58b8-d134-1031-83e7-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.757228Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 192 krbPrincipalName: K/M(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/= c4Ks HI=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAkBAAEArgC8UA=3D=3D krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c04d9282-d134-1031-83e8-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.863568Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: krbtgt/EXAMPLE.NET(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNn= fmRR GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7= UKy1 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9= KwFT B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8= oR krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0518180-d134-1031-83e9-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.889347Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3D= kerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/admin(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtC= kdsY 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M2= 8Ix6 SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZ= M5wu tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3a= Qz krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c05346be-d134-1031-83ea-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.900950Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 300 krbMaxRenewableAge: 604800 krbTicketFlags: 8196 krbPrincipalName: kadmin/changepw(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceW= qIB2 ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0w= wSqU ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd= 423Z epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9z= Pl krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c054d88a-d134-1031-83eb-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.911237Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/history(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: kadmin/history(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd= /N+Z 2g=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0562d3e-d134-1031-83ec-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.919957Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/master.example.net(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABhOeGOuo9UBDjK7hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4= Ta3z Y4ZaEYItXr2awBW6QXSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtG= g1qY oev8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj= 0sgn ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf4UwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qYDwpK0Hycj+cwyCjFsVKTsjzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAxTSMEh/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZA= Bm krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAANAD4gA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0581144-d134-1031-83ed-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.932349Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/master.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203060105Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPU= S2wz qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14TYWZyLZem= 5kvD yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAb= Nr3p vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060153Z krbLastSuccessfulAuth: 20121203061721Z krbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203061721.358939Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203061721Z dn: krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE= .NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/replica.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203065511Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUX= FMNw 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKb= ipUj AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOv= mT4x MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065628Z krbLastSuccessfulAuth: 20121204032538Z krbExtraData:: AAIcTbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204032538.048010Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204032538Z =20 =20 =20 vvvvvvvvvvvvvvvvvvvv replica config vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv =20 dn: cn=3Dconfig objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: af9b0068-d108-1031-9417-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/replica_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/replica_slapd_key.pem olcLogLevel: stats olcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet olcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet olcSaslHost: replica.example.net olcSaslRealm: EXAMPLE.NET entryCSN: 20121204023449.956406Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204023449Z dn: cn=3Dmodule{0}=2Ccn=3Dconfig objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}back_ldap structuralObjectClass: olcModuleList entryUUID: af9d1e34-d108-1031-941f-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z entryCSN: 20121204041212.292184Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: cn=3Dschema=2Ccn=3Dconfig objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: af9b564e-d108-1031-941a-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.995860Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z < snip schemas > dn: olcBackend=3D{0}hdb= =2Ccn=3Dconfig objectClass: olcBackendConfig olcBackend: {0}hdb structuralObjectClass: olcBackendConfig entryUUID: af9e498a-d108-1031-9420-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z entryCSN: 20121202201457.015189Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201457Z dn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break olcAccess: {1}to dn.exact=3D"" by * read olcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: af9b211a-d108-1031-9418-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.994497Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z dn: olcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE structuralObjectClass: olcChainConfig entryUUID: 8605cc76-d214-1031-93d2-613cc62fd42f creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121204041212Z entryCSN: 20121204041212.352767Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: olcDatabase=3D{0}ldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D{-1}fron= tend=2Ccn=3Dconfig objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://master.example.net:389/" olcDbIDAssertBind: bindmethod=3Dsimple binddn=3D"cn=3Dreplica=2Cou=3Dhosts= =2Cdc=3Dexample=2Cdc =3Dnet" credentials=3D<secret> mode=3Dself flags=3Doverride starttls=3Dcr= itical tls_req cert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem olcDbRebindAsUser: TRUE structuralObjectClass: olcLDAPConfig entryUUID: 8609b6f6-d214-1031-93d3-613cc62fd42f creatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth createTimestamp: 20121204041212Z entryCSN: 20121204041212.378432Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z dn: olcDatabase=3D{0}config=2Ccn=3Dconfig objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercr= ed=2Ccn=3Dexternal =2Ccn=3Dauth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: af9b4528-d108-1031-9419-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201456Z entryCSN: 20121202201456.995421Z#000000#000#000000 modifiersName: cn=3Dconfig modifyTimestamp: 20121202201456Z dn: olcDatabase=3D{1}hdb=2Ccn=3Dconfig objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=3Dexample=2Cdc=3Dnet olcLastMod: TRUE olcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet olcRootPW:: e1NTSEF9eW1nS3JTR0VkMW5LQ0VaQ0Y4UjJBTDlPTlEveENDbzY=3D olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: krbPrincipalName eq=2Cpres=2Csub olcDbIndex: krbPwdPolicyReference eq structuralObjectClass: olcHdbConfig entryUUID: af9e5d12-d108-1031-9421-cd3569532aaf creatorsName: cn=3Dconfig createTimestamp: 20121202201457Z olcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange by group.exact=3D= "cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by self wri= te by anonymous auth olcAccess: {1}to attrs=3DauthzTo=2CauthzFrom by group.exact=3D"cn=3Dreplic= ators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet" read by users read by anonym= ous none olcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFai= ledAuth=2CkrbLoginFailedCount by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3D= example=2Cdc=3Dnet" read by dn =3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by self = read by * none olcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by= dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by dn= =3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C dc=3Dnet" read by * none olcAccess: {4}to dn.base=3D"" by * read olcAccess: {5}to * by self write by users read olcSyncrepl: {0}rid=3D123 provider=3D"ldap://master.example.net:389/" type= =3DrefreshAndPersist retry=3D"60 30 300 +" searchbase=3D"dc=3Dexample=2Cdc= =3Dnet" bindmethod=3Dsasl saslmech=3Dgssapi starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D= /etc/ssl/certs/cacert.pem olcUpdateRef: "ldap://master.example.net:389/" entryCSN: 20121204041212.283590Z#000000#000#000000 modifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal= =2Ccn=3Dauth modifyTimestamp: 20121204041212Z =20 =20 =20 dn: dc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: dcObject objectClass: organization o: example.net dc: example structuralObjectClass: organization entryUUID: eac01854-d108-1031-95b6-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.222029Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z contextCSN: 20121204035116.890381Z#000000#000#000000 dn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: eac2e160-d108-1031-95b7-31806daa9e45 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121202201636Z entryCSN: 20121202201636.240572Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121202201636Z dn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: people description: user account objects structuralObjectClass: organizationalUnit entryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.299880Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: groups description: group objects structuralObjectClass: organizationalUnit entryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.394485Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: hosts description: host/computer objects structuralObjectClass: organizationalUnit entryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.400935Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: organizationalUnit ou: kerberos description: kerberos realm container structuralObjectClass: organizationalUnit entryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.409140Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: replica objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica structuralObjectClass: organizationalRole entryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/replica.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRU= RAxZ oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6= Mn3k f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu= 6lb/ QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065600Z krbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D userPassword:: <secret> entryCSN: 20121203233422.105322Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203233422Z dn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet cn: master objectClass: simpleSecurityObject objectClass: organizationalRole objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux authzTo: dn:* description: LDAP server=2C replica userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: host/master.example.net(a)EXAMPLE.NET krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW= +aWr 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5= 522A i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH1= 5xNZ VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060855Z krbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203060855.932134Z#000000#000#000000 modifiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203060855Z dn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: posixGroup cn: administrator gidNumber: 50000 structuralObjectClass: posixGroup entryUUID: 1d079216-d12b-1031-978d-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.465616Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: groupOfNames cn: replicators member: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet member: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet structuralObjectClass: groupOfNames entryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.477792Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: administrator sn: administrator uidNumber: 50000 gidNumber: 50000 userPassword:: <secret> homeDirectory: /home/administrator structuralObjectClass: inetOrgPerson uid: administrator entryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z krbPrincipalName: administrator(a)EXAMPLE.NET krbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ecqcdxa= iluD o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/= Ot7l cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADm= Ozq8 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8o= AcwB aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6= yoME 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo= 8yyO mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgED= oSgE JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLR= VhBT VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXG= a5U+ g=3D krbLastPwdChange: 20121203054848Z krbLastFailedAuth: 20121204013714Z krbLoginFailedCount: 0 description: Network Administrator krbLastSuccessfulAuth: 20121204035116Z krbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121204035116.890381Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204035116Z dn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: kdc-srv description: Kerberos KDC userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.563692Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet objectClass: simpleSecurityObject objectClass: organizationalRole cn: adm-srv description: Kerberos Admin Server userPassword:: <secret> structuralObjectClass: organizationalRole entryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203002123Z entryCSN: 20121203002123.575773Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203002123Z dn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet cn: EXAMPLE.NET objectClass: top objectClass: krbRealmContainer objectClass: krbTicketPolicyAux krbSubTrees: dc=3Dexample=2Cdc=3Dnet krbSearchScope: 2 krbMaxRenewableAge: 604800 krbMaxTicketLife: 36000 structuralObjectClass: krbRealmContainer entryUUID: c03d58b8-d134-1031-83e7-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.757228Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3D net krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 192 krbPrincipalName: K/M(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/= c4Ks HI=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAkBAAEArgC8UA=3D=3D krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c04d9282-d134-1031-83e8-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.863568Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos =2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: krbtgt/EXAMPLE.NET(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNn= fmRR GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7= UKy1 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9= KwFT B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8= oR krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAAAAAAA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0518180-d134-1031-83e9-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.889347Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3D= kerberos=2Cdc=3Dex ample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/admin(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtC= kdsY 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M2= 8Ix6 SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZ= M5wu tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3a= Qz krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c05346be-d134-1031-83ea-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.900950Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc =3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 300 krbMaxRenewableAge: 604800 krbTicketFlags: 8196 krbPrincipalName: kadmin/changepw(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceW= qIB2 ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0w= wSqU ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd= 423Z epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9z= Pl krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c054d88a-d134-1031-83eb-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.911237Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/history(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3D example=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 36000 krbMaxRenewableAge: 604800 krbTicketFlags: 0 krbPrincipalName: kadmin/history(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+g= AwIB EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd= /N+Z 2g=3D krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAAGlvbkA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0562d3e-d134-1031-83ec-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.919957Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dk erberos=2Cdc=3Dexample=2Cdc=3Dnet krbLoginFailedCount: 0 krbMaxTicketLife: 10800 krbMaxRenewableAge: 604800 krbTicketFlags: 4 krbPrincipalName: kadmin/master.example.net(a)EXAMPLE.NET krbPrincipalExpiration: 19700101000000Z krbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABhOeGOuo9UBDjK7hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4= Ta3z Y4ZaEYItXr2awBW6QXSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtG= g1qY oev8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj= 0sgn ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf4UwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qYDwpK0Hycj+cwyCjFsVKTsjzA8o= AcwB aADAgEAoTEwL6ADAgEDoSgEJggAxTSMEh/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZA= Bm krbLastPwdChange: 19700101000000Z krbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA krbExtraData:: AAcBAAIAAgAAANAD4gA=3D objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: c0581144-d134-1031-83ed-0707760cf534 creatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203013022Z entryCSN: 20121203013022.932349Z#000000#000#000000 modifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203013022Z dn: krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dker beros=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/master.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203060105Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPU= S2wz qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14TYWZyLZem= 5kvD yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAb= Nr3p vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203060153Z krbLastSuccessfulAuth: 20121203061721Z krbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D entryCSN: 20121203061721.358939Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121203061721Z dn: krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE= .NET=2Cou=3Dke rberos=2Cdc=3Dexample=2Cdc=3Dnet krbPrincipalName: ldap/replica.example.net(a)EXAMPLE.NET objectClass: krbPrincipal objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux structuralObjectClass: krbPrincipal entryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 creatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet createTimestamp: 20121203065511Z krbLoginFailedCount: 0 krbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIB= AKFJ MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUX= FMNw 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKb= ipUj AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOv= mT4x MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWg= AwIB AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D= =3D krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20121203065628Z krbExtraData:: AAIcTbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D krbExtraData:: AAgBAA=3D=3D krbLastSuccessfulAuth: 20121204032538Z entryCSN: 20121204032538.048010Z#000000#000#000000 modifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet modifyTimestamp: 20121204032538Z > Date: Fri=2C 9 Nov 2012 01:55:32 +0000 > From: openldap-its(a)OpenLDAP.org > To: blance3459(a)hotmail.com > Subject: Re: (ITS#7434) idassert-bind fails after restarting slapd >=20 >=20 > *** THIS IS AN AUTOMATICALLY GENERATED REPLY *** >=20 > Thanks for your report to the OpenLDAP Issue Tracking System. Your > report has been assigned the tracking number ITS#7434. >=20 > One of our support engineers will look at your report in due course. > Note that this may take some time because our support engineers > are volunteers. They only work on OpenLDAP when they have spare > time. >=20 > If you need to provide additional information in regards to your > issue report=2C you may do so by replying to this message. Note that > any mail sent to openldap-its(a)openldap.org with (ITS#7434) > in the subject will automatically be attached to the issue report. >=20 > mailto:openldap-its@openldap.org?subject=3D(ITS#7434) >=20 > You may follow the progress of this report by loading the following > URL in a web browser: > http://www.OpenLDAP.org/its/index.cgi?findid=3D7434 >=20 > Please remember to retain your issue tracking number (ITS#7434) > on any further messages you send to us regarding this report. If > you don't then you'll just waste our time and yours because we > won't be able to properly track the report. >=20 > Please note that the Issue Tracking System is not intended to > be used to seek help in the proper use of OpenLDAP Software. > Such requests will be closed. >=20 > OpenLDAP Software is user supported. > http://www.OpenLDAP.org/support/ >=20 > -------------- > Copyright 1998-2007 The OpenLDAP Foundation=2C All Rights Reserved. >=20 = --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <style></style></head> <body class=3D'hmmessage'><div dir=3D'ltr'>Quanah=2C &nbsp=3B I fina= lly got back around to working on this over the last couple of days.&nbsp= =3B Where I'm at with my project is: &nbsp=3BI have two servers (virtual machines)=2C named master an= d replica=2C&nbsp=3B with slapd configured with my directory information an= d single-master replication between them.&nbsp=3B &nbsp=3BI created a K= erberos realm and various principals in open ldap.&nbsp=3B &nbsp=3BRepl= ication access is authenticated using sasl/gssapi with the slapd principal= =2C ldap/replica.example.net.&nbsp=3B &nbsp=3Bk5start has been added to= system startup to buid the credential cache for slapd. &nbsp=3B &nb= sp=3BThat brings me to configuring referrals and proxyAuth on replica.&nbsp= =3B What appears to be happening is that at the initial configuration (= before restarting the daemon) is the client binds to the replica and authen= ticates with its kerberos ticket.&nbsp=3B The "magic" is performed on the s= asl user and the ldap directory entry is returned.&nbsp=3B It then proce= eds into the modification and notices the update referral.&nbsp=3B It then = checks to determine if the binddn used in&nbsp=3B in the olcDbIDAssertBind<= br>statems can authzTo the bound user.&nbsp=3B It can and the proxy of the = modification proceeds.&nbsp=3B On the master=2C the proxy request is receiv= ed=2C more "magic" is done on the user id to make sure it is in the cor= rect form=2C the authzTo attribute is again checked and allowed.&nbsp=3B Th= e update is performed as the user=2C and success is returned back through t= he chain to the user.&nbsp=3B This is how I would expect the process to= proceed.&nbsp=3B However=2C if I restart the server (or slapd daemon)=2C t= his behavior changes.&nbsp=3B After restarting=2C the bind occurs at th= e replica=2C does "magic"=2C and then sees the referral and attempts the pr= oxy.&nbsp=3B What's notable here is that the check of authzTo is NOT perfor= med. The refereal is then chased=2C but the authzTo check was never made= .&nbsp=3B Since there is no user to "authzTo"=2C does the referral get chas= ed with perhaps a "null" or anonymous user? Whatever the case=2C it appe= ars the the original binding user is never sent over the proxy.&nbsp=3B Ove= r at the master=2C I see the bind request come on from the replica which is= treated as an anonymous bind request. No magic=2C no authzTo check=2C n= o nothing.&nbsp=3B It then goes straight into the modification and tries to= perform=2C but is blocked due to the bound user being anonymous and the st= ronger authentication error (8) is returned.&nbsp=3B Given that the bin= d occured anonymously=2C I feel that error is expected and wanted. &nbsp= =3B I had been trying to use sasl binding here=2C but was not having the= same sucess that I had with syncrepl.&nbsp=3B In order to only fight one b= attle at a time=2C I changed by proxy config to use a simple bind instead o= f sasl/gssapi.&nbsp=3B &nbsp=3B Referrals and proxy authentication a= re configured on replica with the following ldif.&nbsp=3B I tried setting t= he override flag because the man page makes it sound like it forces the aut= hzTo check at bind time. By doing that I was hoping I could force the ch= eck and see the authzTo process in my logs.&nbsp=3B Is this what the ITS yo= u mentions is referring to? &nbsp=3B dn: olcDatabase=3D{1}hdb=2Ccn=3D= config &nbsp=3Bchangetype: modify &nbsp=3Badd: olcUpdateref &nbsp= =3BolcUpdateref: "<a href=3D"ldap://master.example.net:389/">ldap://master.= example.net:389/</a>" &nbsp=3B &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dcon= fig &nbsp=3Bchangetype: modify &nbsp=3Badd: olcModuleLoad &nbsp=3B= olcModuleLoad: {1}back_ldap &nbsp=3B &nbsp=3Bdn: olcOverlay=3Dchain= =2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bchangetype: add &= nbsp=3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcChainConfig= &nbsp=3BolcOverlay: {0}chain &nbsp=3BolcChainReturnError: TRUE &n= bsp=3B &nbsp=3Bdn: olcDatabase=3Dldap=2ColcOverlay=3D{0}chain=2ColcData= base=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bchangetype: add &nbsp=3Bobj= ectClass: olcLDAPConfig &nbsp=3BobjectClass: olcChainDatabase &nbsp= =3BolcDatabase: {0}ldap &nbsp=3BolcDbURI: "<a href=3D"ldap://master.exam= ple.net:389/">ldap://master.example.net:389/</a>" &nbsp=3BolcDbRebindAsU= ser: TRUE &nbsp=3BolcDbIDAssertBind: bindmethod=3Dsimple &nbsp=3B&nbs= p=3B binddn=3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" &nbs= p=3B&nbsp=3B credentials=3Dshhh-secret &nbsp=3B&nbsp=3B mode=3Dself &= nbsp=3B&nbsp=3B flags=3Doverride &nbsp=3B&nbsp=3B starttls=3Dcritical<br= >&nbsp=3B&nbsp=3B tls_reqcert=3Ddemand &nbsp=3B&nbsp=3B tls_cacert=3D/et= c/ssl/certs/cacert.pem &nbsp=3B &nbsp=3B After adding that infor= mation via ldapmodify=2C I attempt to perform an update on the replica.&nbs= p=3B For testing=2C i simply change the description attribute for uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet.&nbsp=3B I'm using this = simple ldif to test with: &nbsp=3B dn: uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bchangetype: modify &nbsp=3Brep= lace: description &nbsp=3Bdescription: Network Administrator Init= ially after configuring the proxy and obtainng a kerberos ticket for the ac= count (administrator=2C self write)=2C this update succeeds.&nbsp=3B Lookin= g at syslog on replica=2C I see happiness.&nbsp=3B The ldap modify binds us= ing gssapi=2C I see SASL name being correctly converted to uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet. &nbsp=3B Dec&nbsp=3B 3 = 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: authcid=3D"ad= ministrator" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: slap_sas= l_getdn: conn 1005 id=3Dadministrator [len=3D13] &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 replica slapd[994]: slap_sasl_getdn: u:id converted to uid=3Dadmini= strator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth &nbsp=3BDec&nbsp=3B= 3 22:17:01 replica slapd[994]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid= =3Dadministrator=2Ccn=3DEXAMPLE.NET=2Ccn=3DGSSAPI=2Ccn=3Dauth&gt=3B &nbs= p=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &lt=3B&lt=3B&lt=3B dnNormali= ze: &lt=3Buid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth&= gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D=3D&gt=3Bsla= p_sasl2dn: converting SASL name uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn= =3Dgssapi=2Ccn=3Dauth to a DN &nbsp=3BDec&nbsp=3B 3 22:17:01 replica sla= pd[994]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] string=3D'uid=3Dadm= inistrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth' &nbsp=3BDec&nbs= p=3B 3 22:17:01 replica slapd[994]: =3D=3D&gt=3B rewrite_rule_apply rule=3D= 'uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Da= uth' string=3D'uid=3Dadministrator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3D= auth' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = =3D=3D&gt=3B rewrite_rule_apply rule=3D'uid=3D([^=2C]+)=2Ccn=3Dexample.net= =2Ccn=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3Dadministrator=2Ccn=3Dexample.ne= t=2Ccn=3Dgssapi=2Ccn=3Dauth' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] res=3D{= 0=2C'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'} &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: [rw] authid: "uid=3Dadministr= ator=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -&gt=3B "uid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 replica slapd[994]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 replica = slapd[994]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 = 22:17:01 replica slapd[994]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL name = to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BD= ec&nbsp=3B 3 22:17:01 replica slapd[994]: slap_sasl_getdn: dn:id converted = to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BD= ec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL Canonicalize [conn=3D1005]: = slapAuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL proxy authorize= [conn=3D1005]: authcid=3D"<a href=3D"mailto:administrator@EXAMPLE.NET">adm= inistrator(a)EXAMPLE.NET</a>" authzid=3D"<a href=3D"mailto:administrator@EXAM= PLE.NET">administrator(a)EXAMPLE.NET</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 r= eplica slapd[994]: conn=3D1005 op=3D2 BIND authcid=3D"<a href=3D"mailto:adm= inistrator(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"<a href= =3D"mailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" &nb= sp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: SASL Authorize [conn=3D1005= ]:&nbsp=3B proxy authorization allowed authzDN=3D"" &nbsp=3BDec&nbsp=3B = 3 22:17:01 replica slapd[994]: send_ldap_sasl: err=3D0 len=3D-1 &nbsp=3B= Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: activity on 1 descriptor= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: activity on:= &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: Dec&nbsp=3B 3 22= :17:01 replica slapd[994]: conn=3D1005 op=3D2 BIND dn=3D"uid=3Dadministrato= r=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech=3DGSSAPI sasl_ssf=3D56 ssf= =3D56 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: do_bind: SASL/G= SSAPI bind: dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dn= et" sasl_ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: sen= d_ldap_response: msgid=3D3 tag=3D97 err=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:= 01 replica slapd[994]: conn=3D1005 op=3D2 RESULT tag=3D97 err=3D0 text=3D<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &lt=3B=3D=3D slap_sasl= _bind: rc=3D0 &nbsp=3BAll good=2C so far on replica.&nbsp=3B I belie= ve the sasl/gssapi authntication process is completed.&nbsp=3B Now to perfo= rm the modify. Dec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D100= 5 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: co= nn=3D1005 op=3D3 do_modify: dn (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dex= ample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &gt= =3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slap= d[994]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01= replica slapd[994]: conn=3D1005 op=3D3 modifications: &nbsp=3BDec&nbsp= =3B 3 22:17:01 replica slapd[994]: #011replace: description &nbsp=3BDec&= nbsp=3B 3 22:17:01 replica slapd[994]: #011#011one value=2C length 21 &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD dn= =3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 MOD attr= =3Ddescription &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: bdb_dn= 2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send_ldap_result: conn=3D1= 005 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send= _ldap_result: err=3D10 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 replica slapd[994]: send_ldap_result: referral=3D"<a href=3D"ldap://ma= ster.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd= [994]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 re= plica slapd[994]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3= 22:17:01 replica slapd[994]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3= 22:17:01 replica slapd[994]: Dec&nbsp=3B 3 22:17:01 replica slapd[994]= : &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica= slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap://mas= ter.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet</a>" -&gt=3B "<a href=3D"ldap://master.example.net:3= 89">ldap://master.example.net:389</a>" &nbsp=3BDec&nbsp=3B 3 22:17:01 re= plica slapd[994]: conn=3D1005 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap:= //master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet</a>": URI=3D"<a href=3D"ldap://master.example.n= et:389">ldap://master.example.net:389</a>" found in cache &nbsp=3B <= br>&nbsp=3BOkay=2C now it seems that the referral is returned and chased on= behalf of the client.&nbsp=3B Finally=2C from the perspective of replica= =2C success!&nbsp=3B Modified data comes back to replica via syncrepl. &= nbsp=3B Dec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&gt=3Bldap_back_g= etconn: conn 0x7fe0b0147c30 fetched refcnt=3D1. &nbsp=3BDec&nbsp=3B 3 22= :17:01 replica slapd[994]: send_ldap_result: conn=3D1005 op=3D3 p=3D3 &n= bsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: send_ldap_result: err=3D0 = matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]= : send_ldap_response: msgid=3D4 tag=3D103 err=3D0 &nbsp=3BDec&nbsp=3B 3 = 22:17:01 replica slapd[994]: conn=3D1005 op=3D3 RESULT tag=3D103 err=3D0 te= xt=3D &nbsp=3B Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon:= activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]:&nbsp=3B 15r &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = Dec&nbsp=3B 3 22:17:01 replica slapd[994]: daemon: read active on 15 &nb= sp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: connection_get(15) &nbsp= =3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: connection_get(15): got conni= d=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&gt=3Bdo_syn= crepl rid=3D123 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: =3D&g= t=3Bdo_syncrep2 rid=3D123 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[9= 94]: do_syncrep2: rid=3D123 cookie=3Drid=3D123=2Ccsn=3D20121204031701.56069= 7Z#000000#000#000000 &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: = &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica = slapd[994]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:= 01 replica slapd[994]: &gt=3B&gt=3B&gt=3B dnPretty: &lt=3Bcn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd= [994]: &lt=3B&lt=3B&lt=3B dnPretty: &lt=3Bcn=3Dadmin=2Cdc=3Dexample=2Cdc=3D= net&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 replica slapd[994]: &gt=3B&gt= =3B&gt=3B dnNormalize: &lt=3Bcn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B = &nbsp=3BDec&nbsp=3B 3 22:17:01 replica rsyslogd-2177: imuxsock begins to dr= op messages from pid 994 due to rate-limiting &nbsp=3BSo everything = looks good (correct?) on replica.&nbsp=3B Meanwhile=2C back at the master..= .. &nbsp=3B Dec&nbsp=3B 3 22:17:01 master slapd[947]: daemon: activi= ty on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: dae= mon: activity on: &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:&nbsp= =3B 51r &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: Dec&nbsp= =3B 3 22:17:01 master slapd[947]: daemon: read active on 51 &nbsp=3BDec&= nbsp=3B 3 22:17:01 master slapd[947]: connection_get(51) &nbsp=3BDec&nbs= p=3B 3 22:17:01 master slapd[947]: connection_get(51): got connid=3D1054<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: connection_read(51): che= cking for input on id=3D1054 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: op tag 0x66=2C time 1354591021 &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: Dec&nbsp=3B 3 22:17:01 master slapd[947]: con= n=3D1054 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[94= 7]: conn=3D1054 op=3D3 do_modify: dn (uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B get_ctrls &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D&gt=3B get_ctrls: oid=3D"2.16.840.1.113730.3.4.18" (noncritical) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: parseProxyAuthz: conn 1054 au= thzid=3D"dn:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_sasl_getdn: conn 10= 54 id=3Ddn:uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet [len= =3D48] &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &gt=3B&gt=3B&gt= =3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B&l= t=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexam= ple=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D=3D&gt=3Bslap_sasl2dn: converting SASL name uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet to a DN &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] string=3D'= uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet' &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: =3D=3D&gt=3B rewrite_rule_apply rule= =3D'uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth' string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3D= net' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= =3D&gt=3B rewrite_rule_apply rule=3D'uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Cc= n=3Dgssapi=2Ccn=3Dauth' string=3D'uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3D= example=2Cdc=3Dnet' [1 pass(es)] &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D=3D&gt=3B rewrite_context_apply [depth=3D1] res=3D{0=2C'uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet'} &nbsp=3BDec&n= bsp=3B 3 22:17:01 master slapd[947]: [rw] authid: "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" -&gt=3B "uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master sl= apd[947]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3De= xample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &gt= =3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master= slapd[947]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL name to uid=3Dadminis= trator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:= 17:01 master slapd[947]: slap_sasl_getdn: dn:id converted to uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:1= 7:01 master slapd[947]: parseProxyAuthz: conn=3D1054 "uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01= master slapd[947]: =3D=3D&gt=3Bslap_sasl_authorized: can cn=3Dreplica=2Cou= =3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet become uid=3Dadministrator=2Cou=3Dpeople= =2Cdc=3Dexample=2Cdc=3Dnet? &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: =3D=3D&gt=3Bslap_sasl_check_authz: does uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet match authzTo rule in cn=3Dreplica=2Cou=3Dho= sts=2Cdc=3Dexample=2Cdc=3Dnet? &nbsp=3BDec&nbsp=3B 3 22:17:01 master sla= pd[947]: =3D&gt=3B bdb_entry_get: ndn: "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dex= ample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&= gt=3B bdb_entry_get: oc: "(null)"=2C at: "authzTo" &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: bdb_dn2entry("cn=3Dreplica=2Cou=3Dhosts=2Cdc= =3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B bdb_entry_get: found entry: "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3De= xample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb= _entry_get: rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B access_allowed: result not in cache (authzTo) &nbsp=3BDec&nbsp=3B= 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: auth access to "cn= =3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet" "authzTo" requested &= nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [2] att= r authzTo &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B ac= l_mask: access to entry "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dne= t"=2C attr "authzTo" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 master sla= pd[947]: =3D&gt=3B acl_mask: to all values by "cn=3Dreplica=2Cou=3Dhosts=2C= dc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 master slapd[= 947]: &lt=3B=3D check a_dn_pat: users &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D acl_mask: [1] applying read(=3Drscxd) (stop) &= nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [1] ma= sk: read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B slap_access_allowed: auth access granted by read(=3Drscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: auth= access granted by read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master = slapd[947]: =3D&gt=3B access_allowed: result was in cache (authzTo) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D=3D=3D&gt=3Bslap_sasl_matc= h: comparing DN uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet= to rule dn:* &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_par= seURI: parsing dn:* &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &l= t=3B=3D=3D=3Dslap_sasl_match: comparison returned 0 &nbsp=3BDec&nbsp=3B = 3 22:17:01 master slapd[947]: &lt=3B=3D=3Dslap_sasl_check_authz: authzTo ch= eck returning 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B= =3D=3D slap_sasl_authorized: return 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: conn=3D1054 op=3D3 PROXYAUTHZ dn=3D"uid=3Dadministrator=2Co= u=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D get_ctrls: n=3D1 rc=3D0 err=3D"" &nbsp=3BDec&n= bsp=3B 3 22:17:01 master slapd[947]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt= =3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nb= sp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B&lt=3B&lt=3B dnPrettyN= ormal: &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt= =3B=2C &lt=3Buid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt= =3B &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: conn=3D1054 op=3D3= modifications: &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: #011re= place: description &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: #01= 1#011one value=2C length 21 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: conn=3D1054 op=3D3 MOD dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:= conn=3D1054 op=3D3 MOD attr=3Ddescription &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc= =3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : =3D&gt=3B bdb_entry_get: ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3De= xample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D= &gt=3B bdb_entry_get: oc: "(null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeopl= e=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slap= d[947]: =3D&gt=3B bdb_entry_get: found entry: "uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: bdb_entry_get: rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D&gt=3B test_filter &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]:&nbsp=3B&nbsp=3B&nbsp=3B&nbsp=3B PRESENT &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: search access to "ui= d=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" re= quested &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: = [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: =3D&gt=3B dn: [5] Dec&nbsp=3B 3 22:17:01 master s= lapd[947]: =3D&gt=3B acl_get: [6] attr objectClass &nbsp=3BDec&nbsp=3B 3= 22:17:01 master slapd[947]: =3D&gt=3B acl_mask: access to entry "uid=3Dadm= inistrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass" r= equested &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl= _mask: to all values by "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dne= t"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check = a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: self= &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_= pat: users &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D a= cl_mask: [3] applying read(=3Drscxd) (stop) &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: &lt=3B=3D acl_mask: [3] mask: read(=3Drscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B slap_access_allowed:= search access granted by read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 = master slapd[947]: =3D&gt=3B access_allowed: search access granted by read(= =3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D te= st_filter 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_m= atchops: sid ffffffff fscope 1 rc 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 maste= r slapd[947]: hdb_modify: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: slap_queue= _csn: queing 0x7fa90f0fe110 20121204031701.560697Z#000000#000#000000 &nb= sp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_dn2entry("uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: bdb_modify_internal: 0x0000000b: uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: =3D&gt=3B access_allowed: result not in cache (descri= ption) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acces= s_allowed: delete access to "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexamp= le=2Cdc=3Dnet" "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 ma= ster slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [5] = Dec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [6] attr descr= iption &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_m= ask: access to entry "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet"=2C attr "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D&gt=3B acl_mask: to all values by "uid=3Dadministrator= =2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17= :01 master slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerber= os=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: &lt=3B=3D acl_mask: [2] applying write(=3Dwrscxd) (stop)<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [2] = mask: write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:= =3D&gt=3B slap_access_allowed: delete access granted by write(=3Dwrscxd)<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowe= d: delete access granted by write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: =3D&gt=3B access_allowed: result not in cache (descr= iption) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acce= ss_allowed: add access to "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 mast= er slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [5] De= c&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_get: [6] attr descrip= tion &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_mas= k: access to entry "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet"=2C attr "description" requested &nbsp=3BDec&nbsp=3B 3 22:17:01 m= aster slapd[947]: =3D&gt=3B acl_mask: to value by "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&nbsp=3B 3 22:17:01 m= aster slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: &lt=3B=3D acl_mask: [2] applying write(=3Dwrscxd) (stop) &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [2] mask:= write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&= gt=3B slap_access_allowed: add access granted by write(=3Dwrscxd) &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B access_allowed: add = access granted by write(=3Dwrscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master= slapd[947]: acl: internal mod entryCSN: modify access granted &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: acl: internal mod modifiersName: m= odify access granted &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: a= cl: internal mod modifyTimestamp: modify access granted &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: bdb_modify_internal: replace description<= br>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_modify_internal: r= eplace entryCSN &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_mo= dify_internal: replace modifiersName &nbsp=3BDec&nbsp=3B 3 22:17:01 mast= er slapd[947]: bdb_modify_internal: replace modifyTimestamp &nbsp=3BDec&= nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required entry (uid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "inetOrgPer= son" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required= entry (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C obj= ectClass "posixAccount" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : oc_check_required entry (uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet)=2C objectClass "shadowAccount" &nbsp=3BDec&nbsp=3B 3 22:17:= 01 master slapd[947]: oc_check_required entry (uid=3Dadministrator=2Cou=3Dp= eople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "krbPrincipalAux" &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_required entry (uid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet)=2C objectClass "k= rbTicketPolicyAux" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_= check_allowed type "objectClass" &nbsp=3BDec&nbsp=3B 3 22:17:01 master s= lapd[947]: oc_check_allowed type "cn" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: oc_check_allowed type "sn" &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: oc_check_allowed type "uidNumber" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "gidNumber" &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "userPa= ssword" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allow= ed type "homeDirectory" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : oc_check_allowed type "structuralObjectClass" &nbsp=3BDec&nbsp=3B 3 22= :17:01 master slapd[947]: oc_check_allowed type "uid" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "entryUUID" &nbs= p=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "creato= rsName" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allow= ed type "createTimestamp" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[94= 7]: oc_check_allowed type "krbPrincipalName" &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: oc_check_allowed type "krbPrincipalKey" &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "krbLastPwdC= hange" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowe= d type "krbLastFailedAuth" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[9= 47]: oc_check_allowed type "krbLoginFailedCount" &nbsp=3BDec&nbsp=3B 3 2= 2:17:01 master slapd[947]: oc_check_allowed type "krbLastSuccessfulAuth"<br= >&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_allowed type "k= rbExtraData" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: oc_check_= allowed type "description" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[9= 47]: oc_check_allowed type "entryCSN" &nbsp=3BDec&nbsp=3B 3 22:17:01 mas= ter slapd[947]: oc_check_allowed type "modifiersName" &nbsp=3BDec&nbsp= =3B 3 22:17:01 master slapd[947]: oc_check_allowed type "modifyTimestamp"<b= r>&nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B key_change(DE= LETE=2Cb) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_idl_dele= te_key: b Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D key_chang= e 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B key_chan= ge(ADD=2Cb) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_idl_in= sert_key: b Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D key_cha= nge 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B entry_= encode(0x0000000b): Dec&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D= entry_encode(0x0000000b): Dec&nbsp=3B 3 22:17:01 master slapd[947]: hd= b_modify: updated id=3D0000000b dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cd= c=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : send_ldap_result: conn=3D1054 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:17= :01 master slapd[947]: send_ldap_result: err=3D0 matched=3D"" text=3D"" = &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: = ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp= =3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: oc: "= (null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]= : bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet= ") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry= _get: found entry: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: bdb_entry_get:= rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B test= _filter &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]:&nbsp=3B&nbsp= =3B&nbsp=3B&nbsp=3B PRESENT &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[= 947]: =3D&gt=3B access_allowed: search access to "uid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" "objectClass" requested &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B dn: [4] ou=3Dkerberos=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: = =3D&gt=3B dn: [5] Dec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B a= cl_get: [6] attr objectClass &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: =3D&gt=3B acl_mask: access to entry "uid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet"=2C attr "objectClass" requested &nbsp=3BDe= c&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B acl_mask: to all values b= y "cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet"=2C (=3D0) Dec&n= bsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: cn=3Dadm-srv= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: &lt=3B=3D check a_dn_pat: self &nbsp=3BDec&nbsp=3B = 3 22:17:01 master slapd[947]: &lt=3B=3D check a_dn_pat: users &nbsp=3BDe= c&nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D acl_mask: [3] applying re= ad(=3Drscxd) (stop) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: &l= t=3B=3D acl_mask: [3] mask: read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:0= 1 master slapd[947]: =3D&gt=3B slap_access_allowed: search access granted b= y read(=3Drscxd) &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&g= t=3B access_allowed: search access granted by read(=3Drscxd) &nbsp=3BDec= &nbsp=3B 3 22:17:01 master slapd[947]: &lt=3B=3D test_filter 6 &nbsp=3BD= ec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_matchops: sid ffffffff fs= cope 1 rc 6 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: syncprov_s= endresp: cookie=3Drid=3D123=2Ccsn=3D20121204031701.560697Z#000000#000#00000= 0 &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_= get: ndn: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" = &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb_entry_get: = oc: "(null)"=2C at: "(null)" &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd= [947]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet") &nbsp=3BDec&nbsp=3B 3 22:17:01 master slapd[947]: =3D&gt=3B bdb= _entry_get: found entry: "uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" &nbsp=3BEverything looks good on the master.&nbsp=3B I = see uid=3Dadministrator gets sent over from the the proxy on replica and th= e update proceeds as expected.&nbsp=3B Now if I restart slapd on replica=2C= things change.&nbsp=3B performing the same modifucation=2C we again see sa= sl/gssapi authentication occuring on replica just as before &nbsp=3B <BR= >Dec&nbsp=3B 3 22:20:38 replica slapd[1412]: [rw] authid: "uid=3Dadministra= tor=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth" -&gt=3B "uid=3Dadministra= tor=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20= :38 replica slapd[1412]: slap_parseURI: parsing uid=3Dadministrator=2Cou=3D= people=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BDec&nbsp=3B 3 22:20:38 replica = slapd[1412]: &gt=3B&gt=3B&gt=3B dnNormalize: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:38= replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnNormalize: &lt=3Buid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B=3D=3Dslap_sasl2dn: Converted SASL nam= e to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: slap_sasl_getdn: dn:id conve= rted to uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL Canonicalize [conn=3D1= 000]: slapAuthcDN=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc= =3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL proxy a= uthorize [conn=3D1000]: authcid=3D"<a href=3D"mailto:administrator@EXAMPLE.= NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"<a href=3D"mailto:administra= tor(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" &nbsp=3BDec&nbsp=3B 3 22= :20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIND authcid=3D"<a href=3D"m= ailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>" authzid=3D"= <a href=3D"mailto:administrator@EXAMPLE.NET">administrator(a)EXAMPLE.NET</a>"= &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: SASL Authorize [con= n=3D1000]:&nbsp=3B proxy authorization allowed authzDN=3D"" &nbsp=3BDec&= nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_sasl: err=3D0 len=3D-1<br= >&nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 BIN= D dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet" mech= =3DGSSAPI sasl_ssf=3D56 ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica = slapd[1412]: do_bind: SASL/GSSAPI bind: dn=3D"uid=3Dadministrator=2Cou=3Dpe= ople=2Cdc=3Dexample=2Cdc=3Dnet" sasl_ssf=3D56 &nbsp=3BDec&nbsp=3B 3 22:2= 0:38 replica slapd[1412]: send_ldap_response: msgid=3D3 tag=3D97 err=3D0<br= >&nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D2 RES= ULT tag=3D97 err=3D0 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]: &lt=3B=3D=3D slap_sasl_bind: rc=3D0 &nbsp=3BAgain=2C we hea= d into the modification: &nbsp=3B Dec&nbsp=3B 3 22:20:38 replica sla= pd[1412]: conn=3D1000 op=3D3 do_modify &nbsp=3BDec&nbsp=3B 3 22:20:38 re= plica slapd[1412]: conn=3D1000 op=3D3 do_modify: dn (uid=3Dadministrator=2C= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet) &nbsp=3BDec&nbsp=3B 3 22:20:38 re= plica slapd[1412]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministr= ator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid= =3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BD= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 modifications= : &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: #011replace: descr= iption &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: #011#011one v= alue=2C length 21 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: co= nn=3D1000 op=3D3 MOD dn=3D"uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: conn=3D= 1000 op=3D3 MOD attr=3Ddescription &nbsp=3BDec&nbsp=3B 3 22:20:38 replic= a slapd[1412]: bdb_dn2entry("uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexamp= le=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: =3D&= gt=3B hdb_dn2id("ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbs= p=3B 3 22:20:38 replica slapd[1412]: &lt=3B=3D hdb_dn2id: got id=3D0x3 &= nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemon: activity on 1 de= scriptor &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemon: act= ivity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: &nbsp= =3B &nbsp=3BSo far=2C so good (I think)=2C replica sees the need to refe= r the action and tries to chase it on behalf of the clent: &nbsp=3BD= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: =3D&gt=3B hdb_dn2id("uid=3Dadmin= istrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet") &nbsp=3BDec&nbsp=3B 3= 22:20:38 replica slapd[1412]: &lt=3B=3D hdb_dn2id: got id=3D0xb &nbsp= =3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: entry_decode: "" &nbsp=3B= Dec&nbsp=3B 3 22:20:38 replica slapd[1412]: &lt=3B=3D entry_decode() &nb= sp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1= 000 op=3D3 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: sen= d_ldap_result: err=3D10 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:= 20:38 replica slapd[1412]: send_ldap_result: referral=3D"<a href=3D"ldap://= master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cd= c=3Dnet">ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2C= dc=3Dexample=2Cdc=3Dnet</a>" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3Buid=3Dadministrator=2Cou= =3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:38= replica slapd[1412]: &lt=3B&lt=3B&lt=3B dnPrettyNormal: &lt=3Buid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B=2C &lt=3Buid=3Dadmini= strator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet&gt=3B &nbsp=3BDec&nbsp= =3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 ldap_chain_op: ref= =3D"<a href=3D"ldap://master.example.net:389/uid=3Dadministrator=2Cou=3Dpeo= ple=2Cdc=3Dexample=2Cdc=3Dnet">ldap://master.example.net:389/uid=3Dadminist= rator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet</a>" -&gt=3B "<a href=3D"ldap= ://master.example.net:389">ldap://master.example.net:389</a>" &nbsp=3BDe= c&nbsp=3B 3 22:20:38 replica slapd[1412]: ldap_back_db_open: URI=3Dldap://m= aster.example.net:389 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]= : conn=3D1000 op=3D3 ldap_chain_op: ref=3D"<a href=3D"ldap://master.example= .net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet">ldap:= //master.example.net:389/uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet</a>" temporary &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[= 1412]: =3D&gt=3Bldap_back_getconn: conn=3D1000 op=3D3: lc=3D0x7f213015a7d0 = inserted refcnt=3D1 rc=3D0 &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[= 1412]: send_ldap_result: conn=3D1000 op=3D3 p=3D3 &nbsp=3B &nbsp=3B<= br>At this point=2C I "assume" the modification has been passed off to mast= er.&nbsp=3B However=2C I notice that I never see the replica checking authz= To like before the restart. I think this is where it's falling apart for me= and the err=3D8 back is returned from master. &nbsp=3B &nbsp=3B D= ec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: err=3D8 matche= d=3D"" text=3D"modifications require authentication" &nbsp=3BDec&nbsp=3B= 3 22:20:38 replica slapd[1412]: send_ldap_result: conn=3D1000 op=3D3 p=3D3= &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: send_ldap_result: e= rr=3D8 matched=3D"" text=3D"" &nbsp=3BDec&nbsp=3B 3 22:20:38 replica sla= pd[1412]: send_ldap_response: msgid=3D4 tag=3D103 err=3D8 &nbsp=3BDec&nb= sp=3B 3 22:20:38 replica slapd[1412]: conn=3D1000 op=3D3 RESULT tag=3D103 e= rr=3D8 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd[1412]: daemo= n: activity on 1 descriptor &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slapd= [1412]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 replica slap= d[1412]:&nbsp=3B 18r &nbsp=3B &nbsp=3BOver on the master we see the = proxy connection occurs=2C but the client credentials never apper to arrive= .&nbsp=3B I say that because=2C it looks to me like the proxy connection fr= om replica appears to bind anonymously. &nbsp=3B Dec&nbsp=3B 3 22:20= :38 master slapd[947]: daemon: activity on 1 descriptor &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: Dec&nbsp=3B 3 22:20:38 master slapd[9= 47]: slap_listener_activate(8): Dec&nbsp=3B 3 22:20:38 master slapd[947= ]: &gt=3B&gt=3B&gt=3B slap_listener(<a href=3D"ldap:///">ldap:///</a>) &= nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemon: listen=3D8=2C new = connection on 51 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemo= n: added 51r (active) listener=3D(nil) &nbsp=3BDec&nbsp=3B 3 22:20:38 ma= ster slapd[947]: conn=3D1056 fd=3D51 ACCEPT from IP=3D192.168.1.2:34759 (IP= =3D0.0.0.0:389) &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: daemon= : activity on 2 descriptors &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[= 947]: daemon: activity on: &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[9= 47]:&nbsp=3B 51r &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: D= ec&nbsp=3B 3 22:20:38 master slapd[947]: daemon: read active on 51 &nbsp= =3BDec&nbsp=3B 3 22:20:38 master slapd[947]: connection_get(51) &nbsp=3B= Dec&nbsp=3B 3 22:20:38 master slapd[947]: connection_get(51): got connid=3D= 1056 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: connection_read(5= 1): checking for input on id=3D1056 &nbsp=3BDec&nbsp=3B 3 22:20:38 maste= r slapd[947]: op tag 0x60=2C time 1354591238 &nbsp=3BDec&nbsp=3B 3 22:20= :38 master slapd[947]: conn=3D1056 op=3D0 do_bind &nbsp=3BDec&nbsp=3B 3 = 22:20:38 master slapd[947]: &gt=3B&gt=3B&gt=3B dnPrettyNormal: &lt=3B&gt=3B= &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: &lt=3B&lt=3B&lt=3B dn= PrettyNormal: &lt=3B&gt=3B=2C &lt=3B&gt=3B &nbsp=3BDec&nbsp=3B 3 22:20:3= 8 master slapd[947]: conn=3D1056 op=3D0 BIND dn=3D"" method=3D128 &nbsp= =3BDec&nbsp=3B 3 22:20:38 master slapd[947]: do_bind: version=3D3 dn=3D"" m= ethod=3D128 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: send_ldap_= result: conn=3D1056 op=3D0 p=3D3 &nbsp=3BDec&nbsp=3B 3 22:20:38 master s= lapd[947]: send_ldap_result: err=3D0 matched=3D"" text=3D"" &nbsp=3BDec&= nbsp=3B 3 22:20:38 master slapd[947]: send_ldap_response: msgid=3D1 tag=3D9= 7 err=3D0 &nbsp=3BDec&nbsp=3B 3 22:20:38 master slapd[947]: conn=3D1056 = op=3D0 RESULT tag=3D97 err=3D0 text=3D &nbsp=3BDec&nbsp=3B 3 22:20:38 ma= ster slapd[947]: do_bind: v3 anonymous bind &nbsp=3BDec&nbsp=3B 3 22:20:= 38 master slapd[947]: daemon: activity on 2 descriptors &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]: daemon: activity on: &nbsp=3BDec&nbsp= =3B 3 22:20:38 master slapd[947]:&nbsp=3B 51r &nbsp=3BDec&nbsp=3B 3 22:2= 0:38 master slapd[947]: After=2C the (anonymous) bind=2C the master= never attempts to if the proxyauth request is allowed via authzTo or anyth= ing else (perhaps obviously).&nbsp=3B The modification just proceeds anonym= ously and eventually fails. &nbsp=3B &nbsp=3BNot sure if I'm saying = this in a way that makes any sense to you.&nbsp=3B Hopefully=2C it does.&nb= sp=3B It appears=2C that the proxy on replica after restarting=2C never tri= es to determine if the olcDbIDAssertBind binddn is permitted to impersonate= the client via the authzTo attribute and proceeds with the referal chase a= nonymously. &nbsp=3B &nbsp=3BI'll copy paste configs below.&nbsp=3B&= nbsp=3B Sorry this is so long=2C but I figure the more information=2C the b= etter when trying to solve any problem. &nbsp=3B &nbsp=3BThanks &= nbsp=3B &nbsp=3BBarry &nbsp=3B &nbsp=3Bvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvvvv master configuration vvvvvvvvvvvvvvvvvvvvvvvvvvvv &nbsp=3Bdn:= cn=3Dconfig &nbsp=3BobjectClass: olcGlobal &nbsp=3Bcn: config &nb= sp=3BolcArgsFile: /var/run/slapd/slapd.args &nbsp=3BolcPidFile: /var/run= /slapd/slapd.pid &nbsp=3BolcToolThreads: 1 &nbsp=3BstructuralObjectCl= ass: olcGlobal &nbsp=3BentryUUID: ea6bf008-d108-1031-912d-8fbb37ee6dd9<b= r>&nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201= 635Z &nbsp=3BolcTLSCACertificateFile: /etc/ssl/certs/cacert.pem &nbsp= =3BolcTLSCertificateFile: /etc/ssl/certs/master_slapd_cert.pem &nbsp=3Bo= lcTLSCertificateKeyFile: /etc/ldap/master_slapd_key.pem &nbsp=3BolcAuthz= Policy: to &nbsp=3BolcSaslHost: master.example.net &nbsp=3BolcSaslRea= lm: EXAMPLE.NET &nbsp=3BolcAuthzRegexp: {0}uid=3Dldap/([^/\.]+).example.= net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BolcAuthzRegexp: {1}uid=3D([^=2C]+)=2Ccn=3D= example.net=2Ccn=3Dgssapi=2Ccn=3Dauth uid=3D$1=2Cou=3Dpeople=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BolcLogLevel: -1 &nbsp=3BentryCSN: 20121204013949.= 466434Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber= =3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp= : 20121204013949Z &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dconfig &nbsp=3Bob= jectClass: olcModuleList &nbsp=3Bcn: module{0} &nbsp=3BolcModulePath:= /usr/lib/ldap &nbsp=3BolcModuleLoad: {0}back_hdb &nbsp=3BolcModuleLo= ad: {1}syncprov &nbsp=3BstructuralObjectClass: olcModuleList &nbsp=3B= entryUUID: ea6dda08-d108-1031-9135-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn= =3Dconfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: = 20121203054749.860918Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumbe= r=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3B= modifyTimestamp: 20121203054749Z &nbsp=3Bdn: cn=3Dschema=2Ccn=3Dconfig<b= r>&nbsp=3BobjectClass: olcSchemaConfig &nbsp=3Bcn: schema &nbsp=3Bstr= ucturalObjectClass: olcSchemaConfig &nbsp=3BentryUUID: ea6c3a0e-d108-103= 1-9130-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateT= imestamp: 20121202201635Z &nbsp=3BentryCSN: 20121202201635.672699Z#00000= 0#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig &nbsp=3BmodifyTimesta= mp: 20121202201635Z &nbsp=3B&lt=3Bsnip schemas &gt=3B &nbsp=3Bdn: olc= Backend=3D{0}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olcBackendConfig = &nbsp=3BolcBackend: {0}hdb &nbsp=3BstructuralObjectClass: olcBackendConf= ig &nbsp=3BentryUUID: ea6f949c-d108-1031-9136-8fbb37ee6dd9 &nbsp=3Bcr= eatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbs= p=3BentryCSN: 20121202201635.694663Z#000000#000#000000 &nbsp=3Bmodifiers= Name: cn=3Dconfig &nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn= : olcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatab= aseConfig &nbsp=3BobjectClass: olcFrontendConfig &nbsp=3BolcDatabase:= {-1}frontend &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber=3D0+uid= Number=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2Ccn=3Dauth manage = by * break &nbsp=3BolcAccess: {1}to dn.exact=3D"" by * read &nbsp=3Bo= lcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read &nbsp=3BolcSizeLimi= t: 500 &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp=3Bentry= UUID: ea6c0bf6-d108-1031-912e-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dco= nfig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: 20121= 202201635.671512Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig<b= r>&nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn: olcDatabase=3D{0}= config=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3Bo= lcDatabase: {0}config &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber= =3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth manage by * = break &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp=3BentryU= UID: ea6c325c-d108-1031-912f-8fbb37ee6dd9 &nbsp=3BcreatorsName: cn=3Dcon= fig &nbsp=3BcreateTimestamp: 20121202201635Z &nbsp=3BentryCSN: 201212= 02201635.672495Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig<br= >&nbsp=3BmodifyTimestamp: 20121202201635Z &nbsp=3Bdn: olcDatabase=3D{1}h= db=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3Bobjec= tClass: olcHdbConfig &nbsp=3BolcDatabase: {1}hdb &nbsp=3BolcDbDirecto= ry: /var/lib/ldap &nbsp=3BolcSuffix: dc=3Dexample=2Cdc=3Dnet &nbsp=3B= olcLastMod: TRUE &nbsp=3BolcRootDN: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BolcRootPW:: e1NTSEF9cGhKNWtqME9rOGJnVXp0dy9hYzZEaWFmU1U1Z0FTZk0= =3D &nbsp=3BolcDbCheckpoint: 512 30 &nbsp=3BolcDbConfig: {0}set_cache= size 0 2097152 0 &nbsp=3BolcDbConfig: {1}set_lk_max_objects 1500 &nbs= p=3BolcDbConfig: {2}set_lk_max_locks 1500 &nbsp=3BolcDbConfig: {3}set_lk= _max_lockers 1500 &nbsp=3BolcDbIndex: objectClass eq &nbsp=3BolcDbInd= ex: uid eq &nbsp=3BolcDbIndex: cn eq &nbsp=3BolcDbIndex: ou eq &nb= sp=3BolcDbIndex: dc eq &nbsp=3BolcDbIndex: uidNumber eq &nbsp=3BolcDb= Index: gidNumber eq &nbsp=3BolcDbIndex: memberUid eq &nbsp=3BolcDbInd= ex: uniqueMember eq &nbsp=3BolcDbIndex: entryUUID eq &nbsp=3BolcDbInd= ex: entryCSN eq &nbsp=3BolcDbIndex: krbPrincipalName eq=2Cpres=2Csub = &nbsp=3BolcDbIndex: krbPwdPolicyReference eq &nbsp=3BstructuralObjectCla= ss: olcHdbConfig &nbsp=3BentryUUID: ea6fa3ce-d108-1031-9137-8fbb37ee6dd9= &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 201212022= 01635Z &nbsp=3BolcAccess: {0}to attrs=3DuserPassword=2CshadowLastChange = by group.exact=3D"cn=3Dreplic &nbsp=3B ators=2Cou=3Dgroups=2Cdc=3Dexampl= e=2Cdc=3Dnet" read by self write by anonymous auth &nbsp=3BolcAccess: {1= }to attrs=3DauthzTo=2CauthzFrom=2Ccn=2CuidNumber=2CgidNumber=2Cuid by users= r &nbsp=3B ead by anonymous none &nbsp=3BolcAccess: {2}to attrs=3Dkr= bLastSuccessfulAuth=2CkrbExtraData=2CkrbLastFailedAuth=2Ckr &nbsp=3B bLo= ginFailedCount by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet" &nbsp=3B&nbsp=3B read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerbe= ros=2Cdc=3Dexample=2Cdc=3Dnet" write by dn=3D"cn=3Dadm-sr &nbsp=3B v=2Co= u=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by self read by * none &nb= sp=3BolcAccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet= " by group.exact=3D"cn &nbsp=3B =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet" read by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2C &nbsp=3B d= c=3Dexample=2Cdc=3Dnet" read by dn=3D"cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3De= xample=2Cdc=3Dnet" writ &nbsp=3B e by * none &nbsp=3BolcAccess: {4}to= dn.base=3D"" by * read &nbsp=3BolcAccess: {5}to * by dn=3D"cn=3Dadm-srv= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" write by s &nbsp=3B elf writ= e by users read &nbsp=3BentryCSN: 20121203054749.804561Z#000000#000#0000= 00 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2C= cn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp: 20121203054749Z &n= bsp=3Bdn: olcOverlay=3D{0}syncprov=2ColcDatabase=3D{1}hdb=2Ccn=3Dconfig = &nbsp=3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcSyncProvCo= nfig &nbsp=3BolcOverlay: {0}syncprov &nbsp=3BolcSpCheckpoint: 100 10<= br>&nbsp=3BolcSpSessionlog: 100 &nbsp=3BstructuralObjectClass: olcSyncPr= ovConfig &nbsp=3BentryUUID: b77dc36a-d158-1031-9917-2f12ddec6588 &nbs= p=3BcreatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dextern= al=2Ccn=3Dauth &nbsp=3BcreateTimestamp: 20121203054749Z &nbsp=3Bentry= CSN: 20121203054749.962179Z#000000#000#000000 &nbsp=3BmodifiersName: gid= Number=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nb= sp=3BmodifyTimestamp: 20121203054749Z &nbsp=3Bvvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvv&nbsp=3B dc=3Dexample=2Cdc=3Dnet&nbsp=3B vvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvvvvvvvvvvvvvvv &nbsp=3Bdn: dc=3Dexample=2Cdc=3Dnet &nbsp=3Bobj= ectClass: top &nbsp=3BobjectClass: dcObject &nbsp=3BobjectClass: orga= nization &nbsp=3Bo: example.net &nbsp=3Bdc: example &nbsp=3Bstruct= uralObjectClass: organization &nbsp=3BentryUUID: eac01854-d108-1031-95b6= -31806daa9e45 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BcreateTimestamp: 20121202201636Z &nbsp=3BentryCSN: 201212022= 01636.222029Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121202201636Z &nbsp= =3BcontextCSN: 20121204035116.890381Z#000000#000#000000 &nbsp=3Bdn: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecurityOb= ject &nbsp=3BobjectClass: organizationalRole &nbsp=3Bcn: admin &nb= sp=3Bdescription: LDAP administrator &nbsp=3BuserPassword:: &lt=3Bsecret= &gt=3B &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3Bentr= yUUID: eac2e160-d108-1031-95b7-31806daa9e45 &nbsp=3BcreatorsName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121202201636Z<= br>&nbsp=3BentryCSN: 20121202201636.240572Z#000000#000#000000 &nbsp=3Bmo= difiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestam= p: 20121202201636Z &nbsp=3Bdn: ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet = &nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: people &nbsp=3Bde= scription: user account objects &nbsp=3BstructuralObjectClass: organizat= ionalUnit &nbsp=3BentryUUID: 1cee4810-d12b-1031-9787-4f8d9abcea93 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.299880Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: ou=3Dgroups=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organizationalUnit &nbsp= =3Bou: groups &nbsp=3Bdescription: group objects &nbsp=3BstructuralOb= jectClass: organizationalUnit &nbsp=3BentryUUID: 1cfcb788-d12b-1031-9788= -4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 201212030= 02123.394485Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp= =3Bdn: ou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organiz= ationalUnit &nbsp=3Bou: hosts &nbsp=3Bdescription: host/computer obje= cts &nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUU= ID: 1cfdb37c-d12b-1031-9789-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmi= n=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z = &nbsp=3BentryCSN: 20121203002123.400935Z#000000#000#000000 &nbsp=3Bmodif= iersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: = 20121203002123Z &nbsp=3Bdn: ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &= nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: kerberos &nbsp=3Bd= escription: kerberos realm container &nbsp=3BstructuralObjectClass: orga= nizationalUnit &nbsp=3BentryUUID: 1cfef412-d12b-1031-978a-4f8d9abcea93<b= r>&nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcre= ateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.409140Z#0= 00000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn=3Drepl= ica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: replica &nbsp= =3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: organizational= Role &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTic= ketPolicyAux &nbsp=3BauthzTo: dn:* &nbsp=3Bdescription: LDAP server= =2C replica &nbsp=3BstructuralObjectClass: organizationalRole &nbsp= =3BentryUUID: 1d02dae6-d12b-1031-978b-4f8d9abcea93 &nbsp=3BcreatorsName:= cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212030= 02123Z &nbsp=3BkrbPrincipalName: <a href=3D"mailto:host/replica.example.= net(a)EXAMPLE.NET">host/replica.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbLog= inFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDA= gEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gADgZgDa20URzdHW= Q1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhbRURAxZ &nbsp=3B oJVqBI/zPGh/FDf9= m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz54uBWIC4AFa66jXa6Mn3k &nbsp=3B f= 62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu6lb= / &nbsp=3B QQQHgCnrL6XaSAYoh3A5GHF0xa2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNS= kxswPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB6= 38xMCex7sQ1zfzZkLiViiKpw=3D=3D &nbsp=3BkrbPasswordExpiration: 1970010100= 0000Z &nbsp=3BkrbLastPwdChange: 20121203065600Z &nbsp=3BkrbExtraData:= : AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: = AAgBAA=3D=3D &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BentryC= SN: 20121203233422.105322Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212032334= 22Z &nbsp=3Bdn: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &n= bsp=3Bcn: master &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3Bob= jectClass: organizationalRole &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BauthzTo: dn:* &nbsp=3Bd= escription: LDAP server=2C replica &nbsp=3BuserPassword:: e0NSWVBUfSo=3D= &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3BentryUUID:= 1d0514dc-d12b-1031-978c-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin= =2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &= nbsp=3BkrbPrincipalName: <a href=3D"mailto:host/master.example.net@EXAMPLE.= NET">host/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbLoginFailedCount= : 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCAS= gwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMd= eygNYlf/SiWtzll+A7x/QBVoz7zFW+aWr &nbsp=3B 8/FMEBj49p4Bn0Goa371TBEoAcwBa= ADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86XgWwWj5522A &nbsp=3B i/CCoCVDIVBZHO= I48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAH15xNZ &nbsp=3B= VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsSWdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWgA= wIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGuLUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3= DaIILvcKv0w=3D=3D &nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbs= p=3BkrbLastPwdChange: 20121203060855Z &nbsp=3BkrbExtraData:: AAL3QbxQYWR= taW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D<= br>&nbsp=3BentryCSN: 20121203060855.932134Z#000000#000#000000 &nbsp=3Bmo= difiersName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3BmodifyTimestamp: 20121203060855Z &nbsp=3Bdn: cn=3Dadministrator=2Cou= =3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: posixGroup &= nbsp=3Bcn: administrator &nbsp=3BgidNumber: 50000 &nbsp=3BstructuralO= bjectClass: posixGroup &nbsp=3BentryUUID: 1d079216-d12b-1031-978d-4f8d9a= bcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.4= 65616Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexampl= e=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn= =3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectCla= ss: top &nbsp=3BobjectClass: groupOfNames &nbsp=3Bcn: replicators = &nbsp=3Bmember: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbs= p=3Bmember: cn=3Dmaster=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bs= tructuralObjectClass: groupOfNames &nbsp=3BentryUUID: 1d096db6-d12b-1031= -978e-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 201= 21203002123.477792Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin= =2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &= nbsp=3Bdn: uid=3Dadministrator=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &= nbsp=3BobjectClass: top &nbsp=3BobjectClass: inetOrgPerson &nbsp=3Bob= jectClass: posixAccount &nbsp=3BobjectClass: shadowAccount &nbsp=3Bob= jectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &n= bsp=3Bcn: administrator &nbsp=3Bsn: administrator &nbsp=3BuidNumber: = 50000 &nbsp=3BgidNumber: 50000 &nbsp=3BuserPassword:: &lt=3Bsecret&gt= =3B &nbsp=3BhomeDirectory: /home/administrator &nbsp=3BstructuralObje= ctClass: inetOrgPerson &nbsp=3Buid: administrator &nbsp=3BentryUUID: = 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbs= p=3BkrbPrincipalName: <a href=3D"mailto:administrator@EXAMPLE.NET">administ= rator(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalKey:: MIICa6ADAgEBoQMCAQGiAwIB= AaMDAgEBpIICUzCCAk8wVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gALWKtjcuVI= PL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+EcqcdxailuD &nbsp=3B o3oHvU0K11Y= iAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAQRTIM4QI0IPjmA1xg/Ot7l &nbsp= =3B cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYA= DmOzq8 &nbsp=3B 96TliwJM9J3X0Dxb/Y+bcTz3e4/FarTIvzEMrMneaW57VGLWX1y162/L= Nz2jwAqIwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQI= Cvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8oAcwB &nbsp=3B aADAgEBoTEwL6ADAgEDoSgEJgg= A0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4HaK+6yoME &nbsp=3B 2gGDAWoAMCA= QKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCYIAHKR4PzhneCY8c8tLpo8yyO &nbsp= =3B mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADAgEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAg= EDoSgE &nbsp=3B JggA4e6VizsvWUEKEqAt58PrPViScqavK7u2VuYDpNNuVwTv3zGmMEug= FjAUoAMCAQWhDQQLRVhBT &nbsp=3B VBMRS5ORVShMTAvoAMCAQOhKAQmCACA4sM1SoUcEE= YGOMA8CDwINmmJXgnKPQr8jRDsxGToXGa5U+ &nbsp=3B g=3D &nbsp=3BkrbLastPwd= Change: 20121203054848Z &nbsp=3BkrbLastFailedAuth: 20121204013714Z &n= bsp=3BkrbLoginFailedCount: 0 &nbsp=3Bdescription: Network Administrator<= br>&nbsp=3BkrbLastSuccessfulAuth: 20121204035116Z &nbsp=3BkrbExtraData::= AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBA= A=3D=3D &nbsp=3BentryCSN: 20121204035116.890381Z#000000#000#000000 &n= bsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BmodifyTimestamp: 20121204035116Z &nbsp=3Bdn: cn=3Dkdc-srv=2C= ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecur= ityObject &nbsp=3BobjectClass: organizationalRole &nbsp=3Bcn: kdc-srv= &nbsp=3Bdescription: Kerberos KDC &nbsp=3BuserPassword:: &lt=3Bsecre= t&gt=3B &nbsp=3BstructuralObjectClass: organizationalRole &nbsp=3Bent= ryUUID: 1d168924-d12b-1031-9790-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3D= admin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z= &nbsp=3BentryCSN: 20121203002123.563692Z#000000#000#000000 &nbsp=3Bm= odifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimesta= mp: 20121203002123Z &nbsp=3Bdn: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexam= ple=2Cdc=3Dnet &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3Bobje= ctClass: organizationalRole &nbsp=3Bcn: adm-srv &nbsp=3Bdescription: = Kerberos Admin Server &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp= =3BstructuralObjectClass: organizationalRole &nbsp=3BentryUUID: 1d18610e= -d12b-1031-9791-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexa= mple=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3Bentr= yCSN: 20121203002123.575773Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212030021= 23Z &nbsp=3Bdn: cn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3Bcn: EXAMPLE.NET &nbsp=3BobjectClass: top &nbsp=3Bobject= Class: krbRealmContainer &nbsp=3BobjectClass: krbTicketPolicyAux &nbs= p=3BkrbSubTrees: dc=3Dexample=2Cdc=3Dnet &nbsp=3BkrbSearchScope: 2 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbMaxTicketLife: 36000 &nbs= p=3BstructuralObjectClass: krbRealmContainer &nbsp=3BentryUUID: c03d58b8= -d134-1031-83e7-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexa= mple=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3Bentr= yCSN: 20121203013022.757228Z#000000#000#000000 &nbsp=3BmodifiersName: cn= =3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212030130= 22Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3DK/M@EXAMPLE.NET=2Cc= n=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName= =3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc= =3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 3= 6000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 192<b= r>&nbsp=3BkrbPrincipalName: <a href=3D"mailto:K/M@EXAMPLE.NET">K/M(a)EXAMPLE.= NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPr= incipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+gAwIB<b= r>&nbsp=3B EKE4BDYYALvAYATOnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxT= uO7OIrbK/c4Ks &nbsp=3B HI=3D &nbsp=3BkrbLastPwdChange: 19700101000000= Z &nbsp=3BkrbExtraData:: AAkBAAEArgC8UA=3D=3D &nbsp=3BkrbExtraData:: = AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIA= AgAAAAAAAAA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectClass:= krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3Bstru= cturalObjectClass: krbPrincipal &nbsp=3BentryUUID: c04d9282-d134-1031-83= e8-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN: 2012120= 3013022.863568Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp= =3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkrbtgt/EXAMPLE.NET@EXAMPLE.NET= =2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipal= Name=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3Bkr= bMaxTicketLife: 36000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbT= icketFlags: 0 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:krbtgt/EXAMPLE= .NET(a)EXAMPLE.NET">krbtgt/EXAMPLE.NET(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipa= lExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCA= QGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAOy= PPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwFc2CqS9kNvgpTNujaNnfmRR &nbsp=3B GQI5= lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7UKy1<b= r>&nbsp=3B 93EQx3jtSTiD0aa2tNK9FbkomkYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEK= E4BDYYAM9KwFT &nbsp=3B B9MqvfMfba37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQV= R0PWLB2OM5q1llQwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NE= ctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTTA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgED= oSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9HckLfrcVL5goKRVOV8oR &nbsp=3BkrbLast= PwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb2= 5ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAAAAAAA=3D &nbs= p=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krb= Principal &nbsp=3BentryUUID: c0518180-d134-1031-83e9-0707760cf534 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.889347Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailt= o:krbPrincipalName=3Dkadmin/admin@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dker= beros=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/admin(a)EXAMPLE.NE= T=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp= =3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &nbsp=3Bkrb= MaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3BkrbPrincipa= lName: <a href=3D"mailto:kadmin/admin@EXAMPLE.NET">kadmin/admin(a)EXAMPLE.NET= </a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPrinc= ipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &= nbsp=3B MEegAwIBEqFABD4gAMjLoWHTDPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7= CF2xtCkdsY &nbsp=3B 5WwobkGKFvGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAEL= hAAwMe5Vpq5Hd2Zy1E8M28Ix6 &nbsp=3B SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfA= wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAGZM5wu &nbsp=3B tIcsdKbsYTDZgUzqIADtNt= 4GYjBIJx13JO40Bto78eCybAvE4uqFivBmdH1kEy8cwPKAHMAWgAwIB &nbsp=3B AKExMC+= gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8oAcwB &= nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM= +9bG3aQz &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtraDa= ta:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAc= BAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectC= lass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp= =3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c05346be-d134-= 1031-83ea-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN= : 20121203013022.900950Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z<= br>&nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/changepw@EXAMPLE= .NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrinc= ipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbMaxTicketLife: 300 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3Bk= rbTicketFlags: 8196 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/c= hangepw(a)EXAMPLE.NET">kadmin/changepw(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipa= lExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCA= QGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAHN= xSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaBp9l1hsceWqIB2 &nbsp=3B ic80= wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAt+ZrWZKAjKkUhSJt0wwSqU<b= r>&nbsp=3B ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2M0MwTKAHMAWgAwIBAKFBMD+gAwIBEK= E4BDYYACd423Z &nbsp=3B epUHmGMVf2I5sRQZRuoypVddoREy1pTtTMIiGvqai7Z+PRHbp= L0kTawz9zdg60IgwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGGbQu5FJ0ewAs= CALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgED= oSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/w7dmvqU9zPl &nbsp=3BkrbLast= PwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb2= 5ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbs= p=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &n= bsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krb= Principal &nbsp=3BentryUUID: c054d88a-d134-1031-83eb-0707760cf534 &nb= sp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.911237Z#000000= #000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<= br>&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailt= o:krbPrincipalName=3Dkadmin/history@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dk= erberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/history@EXAMPL= E.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &= nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp= =3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 0 &nbsp=3BkrbPr= incipalName: <a href=3D"mailto:kadmin/history@EXAMPLE.NET">kadmin/history@E= XAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp= =3BkrbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD= +gAwIB &nbsp=3B EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKbf2qwLJbJ0nPXoUdjtbHp= jECIfASUXjBoB+Pkd/N+Z &nbsp=3B 2g=3D &nbsp=3BkrbLastPwdChange: 197001= 01000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQ= A &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: = krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass= : krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal &nbs= p=3BentryUUID: c0562d3e-d134-1031-83ec-0707760cf534 &nbsp=3BcreatorsName= : cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203= 013022Z &nbsp=3BentryCSN: 20121203013022.919957Z#000000#000#000000 &n= bsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodify= Timestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalNam= e=3Dkadmin/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerbero= s=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dkadmin/master.example.net@E= XAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a>= &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3Bkr= bPrincipalName: <a href=3D"mailto:kadmin/master.example.net@EXAMPLE.NET">ka= dmin/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: = 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAg= EApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABhOeGOuo9UBDjK7= hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4Ta3z &nbsp=3B Y4ZaEYItXr2awBW6Q= XSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtGg1qY &nbsp=3B oe= v8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj0sgn= &nbsp=3B ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf= 4UwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qY= DwpK0Hycj+cwyCjFsVKTsjzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAxTSME= h/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZABm &nbsp=3BkrbLastPwdChange: 19= 700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5= ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAANAD4gA=3D &nbsp=3BobjectCla= ss: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectC= lass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal = &nbsp=3BentryUUID: c0581144-d134-1031-83ed-0707760cf534 &nbsp=3Bcreators= Name: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012= 1203013022Z &nbsp=3BentryCSN: 20121203013022.932349Z#000000#000#000000<b= r>&nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmo= difyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipa= lName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerbe= ros=2Cdc=3Dexample=2Cdc=3Dnet">krbPrincipalName=3Dldap/master.example.net@E= XAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a>= &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ldap/master.example.net@EXA= MPLE.NET">ldap/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: k= rbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass:= krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp= =3BentryUUID: 91a6199c-d15a-1031-9919-2f12ddec6588 &nbsp=3BcreatorsName:= cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTi= mestamp: 20121203060105Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPr= incipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ<b= r>&nbsp=3B MEegAwIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pK= gmUyVdsPUS2wz &nbsp=3B qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoT= AELhAAkzwNhAF14TYWZyLZem5kvD &nbsp=3B yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf= 09cwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAAbNr3p &nbsp=3B vkmNXkIZNgUtw2FJ3Vt= GEU9MmDmNHCFKSk4kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWgAwIB &nbsp=3B AKEx= MC+gAwIBAaEoBCYIAPc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D=3D<br= >&nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange= : 20121203060153Z &nbsp=3BkrbLastSuccessfulAuth: 20121203061721Z &nbs= p=3BkrbExtraData:: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp= =3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203061721.358939Z#= 000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203061721Z &nbs= p=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dldap/replica.example.net@EXAMP= LE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet">krbPri= ncipalName=3Dldap/replica.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet</a> &nbsp=3BkrbPrincipalName: <a h= ref=3D"mailto:ldap/replica.example.net@EXAMPLE.NET">ldap/replica.example.ne= t(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectCla= ss: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3Bs= tructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: 205686f2-d162-1031= -9537-2fa18b539eb9 &nbsp=3BcreatorsName: cn=3Dadm-srv=2Cou=3Dkerberos=2C= dc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203065511Z &nbs= p=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQG= iAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABVJB= bD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3wddcUmq3o092v7mUXFMNw &nbsp=3B 2R8oC1= rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAApsEJiySukR8L5M3DKbipUj = &nbsp=3B AITSVQQL2YSqY7xr/BY7Hm3huN/juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4= BDYYAOvmT4x &nbsp=3B MDAmgH2qTgqXTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaB= sgthQCj3BCDmkwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2m= xhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA=3D=3D &nbsp=3BkrbPasswordExpiration: = 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203065628Z &nbsp=3Bkrb= LastSuccessfulAuth: 20121204032538Z &nbsp=3BkrbExtraData:: AAIcTbxQYWRta= W5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D<br= >&nbsp=3BentryCSN: 20121204032538.048010Z#000000#000#000000 &nbsp=3Bmodi= fiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BmodifyTimestamp: 20121204032538Z &nbsp=3B &nbsp=3B &nbsp=3B <= br>&nbsp=3Bvvvvvvvvvvvvvvvvvvvv replica config vvvvvvvvvvvvvvvvvvvvvvvvvvvv= vvvvvvvv &nbsp=3B &nbsp=3Bdn: cn=3Dconfig &nbsp=3BobjectClass: ol= cGlobal &nbsp=3Bcn: config &nbsp=3BolcArgsFile: /var/run/slapd/slapd.= args &nbsp=3BolcPidFile: /var/run/slapd/slapd.pid &nbsp=3BolcToolThre= ads: 1 &nbsp=3BstructuralObjectClass: olcGlobal &nbsp=3BentryUUID: af= 9b0068-d108-1031-9417-cd3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig = &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BolcTLSCACertificateFile= : /etc/ssl/certs/cacert.pem &nbsp=3BolcTLSCertificateFile: /etc/ssl/cert= s/replica_slapd_cert.pem &nbsp=3BolcTLSCertificateKeyFile: /etc/ldap/rep= lica_slapd_key.pem &nbsp=3BolcLogLevel: stats &nbsp=3BolcAuthzRegexp:= {0}uid=3Dldap/([^/\.]+).example.net=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn= =3Dauth cn=3D$1=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BolcAuthzR= egexp: {1}uid=3D([^=2C]+)=2Ccn=3Dexample.net=2Ccn=3Dgssapi=2Ccn=3Dauth uid= =3D$1=2Cou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BolcSaslHost: repli= ca.example.net &nbsp=3BolcSaslRealm: EXAMPLE.NET &nbsp=3BentryCSN: 20= 121204023449.956406Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber= =3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3Bm= odifyTimestamp: 20121204023449Z &nbsp=3Bdn: cn=3Dmodule{0}=2Ccn=3Dconfig= &nbsp=3BobjectClass: olcModuleList &nbsp=3Bcn: module{0} &nbsp=3B= olcModulePath: /usr/lib/ldap &nbsp=3BolcModuleLoad: {0}back_hdb &nbsp= =3BolcModuleLoad: {1}back_ldap &nbsp=3BstructuralObjectClass: olcModuleL= ist &nbsp=3BentryUUID: af9d1e34-d108-1031-941f-cd3569532aaf &nbsp=3Bc= reatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201457Z &nb= sp=3BentryCSN: 20121204041212.292184Z#000000#000#000000 &nbsp=3Bmodifier= sName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Da= uth &nbsp=3BmodifyTimestamp: 20121204041212Z &nbsp=3Bdn: cn=3Dschema= =2Ccn=3Dconfig &nbsp=3BobjectClass: olcSchemaConfig &nbsp=3Bcn: schem= a &nbsp=3BstructuralObjectClass: olcSchemaConfig &nbsp=3BentryUUID: a= f9b564e-d108-1031-941a-cd3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig<br= >&nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BentryCSN: 201212022014= 56.995860Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dconfig &nbsp= =3BmodifyTimestamp: 20121202201456Z &nbsp=3B&lt=3B snip schemas &gt=3B<B= R>&nbsp=3Bdn: olcBackend=3D{0}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olc= BackendConfig &nbsp=3BolcBackend: {0}hdb &nbsp=3BstructuralObjectClas= s: olcBackendConfig &nbsp=3BentryUUID: af9e498a-d108-1031-9420-cd3569532= aaf &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 201212= 02201457Z &nbsp=3BentryCSN: 20121202201457.015189Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dconfig &nbsp=3BmodifyTimestamp: 201212022014= 57Z &nbsp=3Bdn: olcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp=3Bobje= ctClass: olcDatabaseConfig &nbsp=3BobjectClass: olcFrontendConfig &nb= sp=3BolcDatabase: {-1}frontend &nbsp=3BolcAccess: {0}to * by dn.exact=3D= gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2C= cn=3Dauth manage by * break &nbsp=3BolcAccess: {1}to dn.exact=3D"" by * = read &nbsp=3BolcAccess: {2}to dn.base=3D"cn=3DSubschema" by * read &n= bsp=3BolcSizeLimit: 500 &nbsp=3BstructuralObjectClass: olcDatabaseConfig= &nbsp=3BentryUUID: af9b211a-d108-1031-9418-cd3569532aaf &nbsp=3Bcrea= torsName: cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp= =3BentryCSN: 20121202201456.994497Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dconfig &nbsp=3BmodifyTimestamp: 20121202201456Z &nbsp=3Bdn:= olcOverlay=3D{0}chain=2ColcDatabase=3D{-1}frontend=2Ccn=3Dconfig &nbsp= =3BobjectClass: olcOverlayConfig &nbsp=3BobjectClass: olcChainConfig = &nbsp=3BolcOverlay: {0}chain &nbsp=3BolcChainReturnError: TRUE &nbsp= =3BstructuralObjectClass: olcChainConfig &nbsp=3BentryUUID: 8605cc76-d21= 4-1031-93d2-613cc62fd42f &nbsp=3BcreatorsName: gidNumber=3D0+uidNumber= =3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BcreateTimestamp= : 20121204041212Z &nbsp=3BentryCSN: 20121204041212.352767Z#000000#000#00= 0000 &nbsp=3BmodifiersName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred= =2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyTimestamp: 20121204041212Z<br= >&nbsp=3Bdn: olcDatabase=3D{0}ldap=2ColcOverlay=3D{0}chain=2ColcDatabase=3D= {-1}frontend=2Ccn=3Dconfig &nbsp=3BobjectClass: olcLDAPConfig &nbsp= =3BobjectClass: olcChainDatabase &nbsp=3BolcDatabase: {0}ldap &nbsp= =3BolcDbURI: "<a href=3D"ldap://master.example.net:389/">ldap://master.exam= ple.net:389/</a>" &nbsp=3BolcDbIDAssertBind: bindmethod=3Dsimple binddn= =3D"cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cdc &nbsp=3B =3Dnet" crede= ntials=3D&lt=3Bsecret&gt=3B mode=3Dself flags=3Doverride starttls=3Dcritica= l tls_req &nbsp=3B cert=3Ddemand tls_cacert=3D/etc/ssl/certs/cacert.pem<= br>&nbsp=3BolcDbRebindAsUser: TRUE &nbsp=3BstructuralObjectClass: olcLDA= PConfig &nbsp=3BentryUUID: 8609b6f6-d214-1031-93d3-613cc62fd42f &nbsp= =3BcreatorsName: gidNumber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexterna= l=2Ccn=3Dauth &nbsp=3BcreateTimestamp: 20121204041212Z &nbsp=3BentryC= SN: 20121204041212.378432Z#000000#000#000000 &nbsp=3BmodifiersName: gidN= umber=3D0+uidNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbs= p=3BmodifyTimestamp: 20121204041212Z &nbsp=3Bdn: olcDatabase=3D{0}config= =2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbsp=3BolcData= base: {0}config &nbsp=3BolcAccess: {0}to * by dn.exact=3DgidNumber=3D0+u= idNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal &nbsp=3B =2Ccn=3Dauth manag= e by * break &nbsp=3BstructuralObjectClass: olcDatabaseConfig &nbsp= =3BentryUUID: af9b4528-d108-1031-9419-cd3569532aaf &nbsp=3BcreatorsName:= cn=3Dconfig &nbsp=3BcreateTimestamp: 20121202201456Z &nbsp=3BentryCS= N: 20121202201456.995421Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3D= config &nbsp=3BmodifyTimestamp: 20121202201456Z &nbsp=3Bdn: olcDataba= se=3D{1}hdb=2Ccn=3Dconfig &nbsp=3BobjectClass: olcDatabaseConfig &nbs= p=3BobjectClass: olcHdbConfig &nbsp=3BolcDatabase: {1}hdb &nbsp=3Bolc= DbDirectory: /var/lib/ldap &nbsp=3BolcSuffix: dc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BolcLastMod: TRUE &nbsp=3BolcRootDN: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BolcRootPW:: e1NTSEF9eW1nS3JTR0VkMW5LQ0VaQ0Y4UjJBTDlP= TlEveENDbzY=3D &nbsp=3BolcDbCheckpoint: 512 30 &nbsp=3BolcDbConfig: {= 0}set_cachesize 0 2097152 0 &nbsp=3BolcDbConfig: {1}set_lk_max_objects 1= 500 &nbsp=3BolcDbConfig: {2}set_lk_max_locks 1500 &nbsp=3BolcDbConfig= : {3}set_lk_max_lockers 1500 &nbsp=3BolcDbIndex: objectClass eq &nbsp= =3BolcDbIndex: uid eq &nbsp=3BolcDbIndex: cn eq &nbsp=3BolcDbIndex: o= u eq &nbsp=3BolcDbIndex: dc eq &nbsp=3BolcDbIndex: uidNumber eq &n= bsp=3BolcDbIndex: gidNumber eq &nbsp=3BolcDbIndex: memberUid eq &nbsp= =3BolcDbIndex: uniqueMember eq &nbsp=3BolcDbIndex: entryUUID eq &nbsp= =3BolcDbIndex: entryCSN eq &nbsp=3BolcDbIndex: krbPrincipalName eq=2Cpre= s=2Csub &nbsp=3BolcDbIndex: krbPwdPolicyReference eq &nbsp=3Bstructur= alObjectClass: olcHdbConfig &nbsp=3BentryUUID: af9e5d12-d108-1031-9421-c= d3569532aaf &nbsp=3BcreatorsName: cn=3Dconfig &nbsp=3BcreateTimestamp= : 20121202201457Z &nbsp=3BolcAccess: {0}to attrs=3DuserPassword=2Cshadow= LastChange by group.exact=3D"cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexample= =2Cdc=3Dnet" read by self write by anonymous auth &nbsp=3BolcAccess: {1}= to attrs=3DauthzTo=2CauthzFrom by group.exact=3D"cn=3Dreplicators=2Cou=3Dgr= oups=2Cdc=3Dexample=2Cdc=3Dnet" read by users read by anonymous none &nb= sp=3BolcAccess: {2}to attrs=3DkrbLastSuccessfulAuth=2CkrbExtraData=2CkrbLas= tFailedAuth=2CkrbLoginFailedCount by dn=3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cd= c=3Dexample=2Cdc=3Dnet" read by dn &nbsp=3B =3D"cn=3Dadm-srv=2Cou=3Dkerb= eros=2Cdc=3Dexample=2Cdc=3Dnet" read by self read by * none &nbsp=3BolcA= ccess: {3}to dn.subtree=3D"ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" by dn= =3D"cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet" read by dn=3D"c= n=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2C &nbsp=3B dc=3Dnet" read by= * none &nbsp=3BolcAccess: {4}to dn.base=3D"" by * read &nbsp=3BolcAc= cess: {5}to * by self write by users read &nbsp=3BolcSyncrepl: {0}rid=3D= 123 provider=3D"<a href=3D"ldap://master.example.net:389/">ldap://master.ex= ample.net:389/</a>" type=3DrefreshAndPersist retry=3D"60 30 300 +" searchba= se=3D"dc=3Dexample=2Cdc=3Dnet" bindmethod=3Dsasl &nbsp=3B&nbsp=3B saslme= ch=3Dgssapi starttls=3Dcritical tls_reqcert=3Ddemand tls_cacert=3D/etc/ssl/= certs/cacert.pem &nbsp=3BolcUpdateRef: "<a href=3D"ldap://master.example= .net:389/">ldap://master.example.net:389/</a>" &nbsp=3BentryCSN: 2012120= 4041212.283590Z#000000#000#000000 &nbsp=3BmodifiersName: gidNumber=3D0+u= idNumber=3D0=2Ccn=3Dpeercred=2Ccn=3Dexternal=2Ccn=3Dauth &nbsp=3BmodifyT= imestamp: 20121204041212Z &nbsp=3B &nbsp=3B &nbsp=3B &nbsp= =3Bdn: dc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3Bobjec= tClass: dcObject &nbsp=3BobjectClass: organization &nbsp=3Bo: example= .net &nbsp=3Bdc: example &nbsp=3BstructuralObjectClass: organization<= br>&nbsp=3BentryUUID: eac01854-d108-1031-95b6-31806daa9e45 &nbsp=3Bcreat= orsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2= 0121202201636Z &nbsp=3BentryCSN: 20121202201636.222029Z#000000#000#00000= 0 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BmodifyTimestamp: 20121202201636Z &nbsp=3BcontextCSN: 20121204035116.8= 90381Z#000000#000#000000 &nbsp=3Bdn: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: orga= nizationalRole &nbsp=3Bcn: admin &nbsp=3Bdescription: LDAP administra= tor &nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjec= tClass: organizationalRole &nbsp=3BentryUUID: eac2e160-d108-1031-95b7-31= 806daa9e45 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BcreateTimestamp: 20121202201636Z &nbsp=3BentryCSN: 201212022016= 36.240572Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dex= ample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121202201636Z &nbsp=3Bdn:= ou=3Dpeople=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organization= alUnit &nbsp=3Bou: people &nbsp=3Bdescription: user account objects<b= r>&nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUUID: 1= cee4810-d12b-1031-9787-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cd= c=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z &nbsp= =3BentryCSN: 20121203002123.299880Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121= 203002123Z &nbsp=3Bdn: ou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3B= objectClass: organizationalUnit &nbsp=3Bou: groups &nbsp=3Bdescriptio= n: group objects &nbsp=3BstructuralObjectClass: organizationalUnit &n= bsp=3BentryUUID: 1cfcb788-d12b-1031-9788-4f8d9abcea93 &nbsp=3BcreatorsNa= me: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212= 03002123Z &nbsp=3BentryCSN: 20121203002123.394485Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodi= fyTimestamp: 20121203002123Z &nbsp=3Bdn: ou=3Dhosts=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BobjectClass: organizationalUnit &nbsp=3Bou: hosts &= nbsp=3Bdescription: host/computer objects &nbsp=3BstructuralObjectClass:= organizationalUnit &nbsp=3BentryUUID: 1cfdb37c-d12b-1031-9789-4f8d9abce= a93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.400= 935Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: ou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: organizationa= lUnit &nbsp=3Bou: kerberos &nbsp=3Bdescription: kerberos realm contai= ner &nbsp=3BstructuralObjectClass: organizationalUnit &nbsp=3BentryUU= ID: 1cfef412-d12b-1031-978a-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmi= n=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z = &nbsp=3BentryCSN: 20121203002123.409140Z#000000#000#000000 &nbsp=3Bmodif= iersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: = 20121203002123Z &nbsp=3Bdn: cn=3Dreplica=2Cou=3Dhosts=2Cdc=3Dexample=2Cd= c=3Dnet &nbsp=3Bcn: replica &nbsp=3BobjectClass: simpleSecurityObject= &nbsp=3BobjectClass: organizationalRole &nbsp=3BobjectClass: krbPrin= cipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BauthzTo: dn:= * &nbsp=3Bdescription: LDAP server=2C replica &nbsp=3BstructuralObjec= tClass: organizationalRole &nbsp=3BentryUUID: 1d02dae6-d12b-1031-978b-4f= 8d9abcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BcreateTimestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a h= ref=3D"mailto:host/replica.example.net@EXAMPLE.NET">host/replica.example.ne= t(a)EXAMPLE.NET</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipal= Key:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp= =3B MEegAwIBEqFABD4gADgZgDa20URzdHWQ1WObQespjD5JMlRSb3fbZN8fG+gFml3DZQzinhb= RURAxZ &nbsp=3B oJVqBI/zPGh/FDf9m+5bDBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAz= 54uBWIC4AFa66jXa6Mn3k &nbsp=3B f62uOX1YE6N3JlXl1EG2abEzZw1xWglReNN68wTKA= HMAWgAwIBAKFBMD+gAwIBEKE4BDYYAKu6lb/ &nbsp=3B QQQHgCnrL6XaSAYoh3A5GHF0xa= 2/vTWwq+lX4zmCpbY2l2up3TBVKZrhlenNSkxswPKAHMAWgAwIB &nbsp=3B AKExMC+gAwI= BAaEoBCYIAGjfhZNlm0+a6MGvBgok7WxzB638xMCex7sQ1zfzZkLiViiKpw=3D=3D &nbsp= =3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 2012= 1203065600Z &nbsp=3BkrbExtraData:: AAIATbxQYWRtaW5pc3RyYXRvckBFWEFNUExFL= k5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BuserPassword:: = &lt=3Bsecret&gt=3B &nbsp=3BentryCSN: 20121203233422.105322Z#000000#000#0= 00000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BmodifyTimestamp: 20121203233422Z &nbsp=3Bdn: cn=3Dmaster=2Cou=3Dhos= ts=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: master &nbsp=3BobjectClass: = simpleSecurityObject &nbsp=3BobjectClass: organizationalRole &nbsp=3B= objectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux = &nbsp=3BauthzTo: dn:* &nbsp=3Bdescription: LDAP server=2C replica &nb= sp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectClass: or= ganizationalRole &nbsp=3BentryUUID: 1d0514dc-d12b-1031-978c-4f8d9abcea93= &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bc= reateTimestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a href=3D"mai= lto:host/master.example.net@EXAMPLE.NET">host/master.example.net(a)EXAMPLE.NE= T</a> &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MIIBRK= ADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIB= EqFABD4gACzEUo41sdOc4i+gbyFE/lai6sMdeygNYlf/SiWtzll+A7x/QBVoz7zFW+aWr &n= bsp=3B 8/FMEBj49p4Bn0Goa371TBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAGW4+8wBum86Xg= WwWj5522A &nbsp=3B i/CCoCVDIVBZHOI48rJZHrgu59tvH0fH7TDkcwTKAHMAWgAwIBAKF= BMD+gAwIBEKE4BDYYAH15xNZ &nbsp=3B VJSjkEKx2M7Ai17Og8lMWwXAsDB2h+LsGC+HsS= WdbE0P4yCNkjMOdIwnwJJ3OA48wPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAGu= LUyYlXYKdpNk9KEe7TuHulCL0Fzr4N8WXAv3DaIILvcKv0w=3D=3D &nbsp=3BkrbPasswor= dExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203060855Z<b= r>&nbsp=3BkrbExtraData:: AAL3QbxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D = &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203060855.932= 134Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadm-srv=2Cou=3Dkerber= os=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203060855Z<br= >&nbsp=3Bdn: cn=3Dadministrator=2Cou=3Dgroups=2Cdc=3Dexample=2Cdc=3Dnet = &nbsp=3BobjectClass: posixGroup &nbsp=3Bcn: administrator &nbsp=3Bgid= Number: 50000 &nbsp=3BstructuralObjectClass: posixGroup &nbsp=3Bentry= UUID: 1d079216-d12b-1031-978d-4f8d9abcea93 &nbsp=3BcreatorsName: cn=3Dad= min=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203002123Z<b= r>&nbsp=3BentryCSN: 20121203002123.465616Z#000000#000#000000 &nbsp=3Bmod= ifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp= : 20121203002123Z &nbsp=3Bdn: cn=3Dreplicators=2Cou=3Dgroups=2Cdc=3Dexam= ple=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3BobjectClass: groupOfN= ames &nbsp=3Bcn: replicators &nbsp=3Bmember: cn=3Dreplica=2Cou=3Dhost= s=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmember: cn=3Dmaster=2Cou=3Dhosts=2Cd= c=3Dexample=2Cdc=3Dnet &nbsp=3BstructuralObjectClass: groupOfNames &n= bsp=3BentryUUID: 1d096db6-d12b-1031-978e-4f8d9abcea93 &nbsp=3BcreatorsNa= me: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 201212= 03002123Z &nbsp=3BentryCSN: 20121203002123.477792Z#000000#000#000000 = &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmodi= fyTimestamp: 20121203002123Z &nbsp=3Bdn: uid=3Dadministrator=2Cou=3Dpeop= le=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass: top &nbsp=3BobjectC= lass: inetOrgPerson &nbsp=3BobjectClass: posixAccount &nbsp=3BobjectC= lass: shadowAccount &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3Bobje= ctClass: krbTicketPolicyAux &nbsp=3Bcn: administrator &nbsp=3Bsn: adm= inistrator &nbsp=3BuidNumber: 50000 &nbsp=3BgidNumber: 50000 &nbsp= =3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BhomeDirectory: /home/admini= strator &nbsp=3BstructuralObjectClass: inetOrgPerson &nbsp=3Buid: adm= inistrator &nbsp=3BentryUUID: 1d0a9bf0-d12b-1031-978f-4f8d9abcea93 &n= bsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateT= imestamp: 20121203002123Z &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ad= ministrator(a)EXAMPLE.NET">administrator(a)EXAMPLE.NET</a> &nbsp=3BkrbPrinci= palKey:: MIICa6ADAgEBoQMCAQGiAwIBAaMDAgEBpIICUzCCAk8wVKAHMAWgAwIBAKFJ &n= bsp=3B MEegAwIBEqFABD4gALWKtjcuVIPL0PLDhUQleHDwIp4PB4O0T3ays8putrnZEUxVC+Ec= qcdxailuD &nbsp=3B o3oHvU0K11YiAyckIKjfzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELh= AAQRTIM4QI0IPjmA1xg/Ot7l &nbsp=3B cXQSCNuv7MRgBJl7N1QsxS7naYbgLlyybkbXkw= TKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYADmOzq8 &nbsp=3B 96TliwJM9J3X0Dxb/Y+bcTz= 3e4/FarTIvzEMrMneaW57VGLWX1y162/LNz2jwAqIwPKAHMAWgAwIB &nbsp=3B AKExMC+g= AwIBAaEoBCYIAMBGuqUqQw8nhnQ194wQICvc+Iu0yPUdSTzjGXtDhPSaAHj70DA8oAcwB &n= bsp=3B aADAgEBoTEwL6ADAgEDoSgEJggA0mkFMVjyT2Jn553z2fZNIOQ8fYR2jtUcGFbyUL4s4= HaK+6yoME &nbsp=3B 2gGDAWoAMCAQKhDwQNYWRtaW5pc3RyYXRvcqExMC+gAwIBA6EoBCY= IAHKR4PzhneCY8c8tLpo8yyO &nbsp=3B mpk8FynWjl7rVe+Zqq9gIt4KXTTBLoBYwFKADA= gEDoQ0EC0VYQU1QTEUuTkVUoTEwL6ADAgEDoSgE &nbsp=3B JggA4e6VizsvWUEKEqAt58P= rPViScqavK7u2VuYDpNNuVwTv3zGmMEugFjAUoAMCAQWhDQQLRVhBT &nbsp=3B VBMRS5OR= VShMTAvoAMCAQOhKAQmCACA4sM1SoUcEEYGOMA8CDwINmmJXgnKPQr8jRDsxGToXGa5U+ &n= bsp=3B g=3D &nbsp=3BkrbLastPwdChange: 20121203054848Z &nbsp=3BkrbLast= FailedAuth: 20121204013714Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3Bde= scription: Network Administrator &nbsp=3BkrbLastSuccessfulAuth: 20121204= 035116Z &nbsp=3BkrbExtraData:: AAJAPbxQcm9vdC9hZG1pbkBFWEFNUExFLk5FVAA= =3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3BentryCSN: 20121204035= 116.890381Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou= =3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 201212040= 35116Z &nbsp=3Bdn: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BobjectClass: simpleSecurityObject &nbsp=3BobjectClass: orga= nizationalRole &nbsp=3Bcn: kdc-srv &nbsp=3Bdescription: Kerberos KDC<= br>&nbsp=3BuserPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectCla= ss: organizationalRole &nbsp=3BentryUUID: 1d168924-d12b-1031-9790-4f8d9a= bcea93 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nb= sp=3BcreateTimestamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.5= 63692Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexampl= e=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn= =3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BobjectClass= : simpleSecurityObject &nbsp=3BobjectClass: organizationalRole &nbsp= =3Bcn: adm-srv &nbsp=3Bdescription: Kerberos Admin Server &nbsp=3Buse= rPassword:: &lt=3Bsecret&gt=3B &nbsp=3BstructuralObjectClass: organizati= onalRole &nbsp=3BentryUUID: 1d18610e-d12b-1031-9791-4f8d9abcea93 &nbs= p=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTim= estamp: 20121203002123Z &nbsp=3BentryCSN: 20121203002123.575773Z#000000#= 000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<b= r>&nbsp=3BmodifyTimestamp: 20121203002123Z &nbsp=3Bdn: cn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcn: EXAMPLE.NET &n= bsp=3BobjectClass: top &nbsp=3BobjectClass: krbRealmContainer &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BkrbSubTrees: dc=3Dexample=2Cd= c=3Dnet &nbsp=3BkrbSearchScope: 2 &nbsp=3BkrbMaxRenewableAge: 604800<= br>&nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3BstructuralObjectClass: krbRea= lmContainer &nbsp=3BentryUUID: c03d58b8-d134-1031-83e7-0707760cf534 &= nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcreate= Timestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.757228Z#0000= 00#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dne= t &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mai= lto:krbPrincipalName=3DK/M@EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos= =2Cdc=3Dexample=2Cdc">krbPrincipalName=3DK/M(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc</a>=3D &nbsp=3B net &nbsp=3BkrbL= oginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3BkrbMaxRene= wableAge: 604800 &nbsp=3BkrbTicketFlags: 192 &nbsp=3BkrbPrincipalName= : <a href=3D"mailto:K/M@EXAMPLE.NET">K/M(a)EXAMPLE.NET</a> &nbsp=3BkrbPrin= cipalExpiration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MGagAwIBAaEDA= gEBogMCAQGjAwIBAKRQME4wTKAHMAWgAwIBAKFBMD+gAwIB &nbsp=3B EKE4BDYYALvAYAT= OnUQCrTUO54HKuJKnttvmnxYyud5Fh6T22oTH0qAUzKRfDdxTuO7OIrbK/c4Ks &nbsp=3B = HI=3D &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtraData:= : AAkBAAEArgC8UA=3D=3D &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARV= hBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAAAAAAA=3D &nbsp=3B= objectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPri= ncipal &nbsp=3BentryUUID: c04d9282-d134-1031-83e8-0707760cf534 &nbsp= =3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTime= stamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.863568Z#000000#0= 00#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:= krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou= =3Dkerberos">krbPrincipalName=3Dkrbtgt/EXAMPLE.NET(a)EXAMPLE.NET=2Ccn=3DEXAMP= LE.NET=2Cou=3Dkerberos</a> &nbsp=3B =2Cdc=3Dexample=2Cdc=3Dnet &nbsp= =3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 36000 &nbsp=3Bkrb= MaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 0 &nbsp=3BkrbPrincipa= lName: <a href=3D"mailto:krbtgt/EXAMPLE.NET@EXAMPLE.NET">krbtgt/EXAMPLE.NET= @EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbs= p=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgA= wIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAOyPPy2RLdudifS8baeUvv3AxlGKKubyeRUcnwF= c2CqS9kNvgpTNujaNnfmRR &nbsp=3B GQI5lTHUdwGYqHfr+ayuTBEoAcwBaADAgEAoTkwN= 6ADAgEXoTAELhAAe8n+vM9TXvNAG43Va7UKy1 &nbsp=3B 93EQx3jtSTiD0aa2tNK9Fbkom= kYG0mWlz/xW4wTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM9KwFT &nbsp=3B B9MqvfMfba= 37K7zY6lqPhLpF8d0uucRA/Ewed1i9wfjiOuxQVR0PWLB2OM5q1llQwPKAHMAWgAwIB &nbs= p=3B AKExMC+gAwIBAaEoBCYIAFObLZrmdRD8NEctxP0TySKwmGNnKiX7m+EMMvNj4xmNIa2yTT= A8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAXVm59rkWXluDnx/F0XOEDh4i3Nz9= HckLfrcVL5goKRVOV8oR &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp= =3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbEx= traData:: AAcBAAIAAgAAAAAAAAA=3D &nbsp=3BobjectClass: krbPrincipal &n= bsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyA= ux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c05= 18180-d134-1031-83e9-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc= =3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp= =3BentryCSN: 20121203013022.889347Z#000000#000#000000 &nbsp=3BmodifiersN= ame: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121= 203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/admin= @EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dex">krbPrincipalName= =3Dkadmin/admin(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc=3Dex</a= > &nbsp=3B ample=2Cdc=3Dnet &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbMaxTicketLife: 10800 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp= =3BkrbTicketFlags: 4 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/= admin(a)EXAMPLE.NET">kadmin/admin(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpi= ration: 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAw= IBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gAMjLoWHT= DPL9j+ribbAohbY8+SM973mU5iIvxN7MItjbLtXBh/7CF2xtCkdsY &nbsp=3B 5WwobkGKF= vGkZvTL+olZjBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAwMe5Vpq5Hd2Zy1E8M28Ix6 &nb= sp=3B SbAtMeUjzpEqwQM3P838foPwM9ZfRYhfZ0UfAwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDY= YAGZM5wu &nbsp=3B tIcsdKbsYTDZgUzqIADtNt4GYjBIJx13JO40Bto78eCybAvE4uqFiv= BmdH1kEy8cwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAHrJty4X1D5dPY/PW84= Lgb0YYuazteCJMYvphJZr3LeKs7suBzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJ= ggAMDfJDyzgWa4vsKv6rs9IkXOq8eEePAQPB9s0UPbM+9bG3aQz &nbsp=3BkrbLastPwdCh= ange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVh= BTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &nbsp=3Bo= bjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp= =3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPri= ncipal &nbsp=3BentryUUID: c05346be-d134-1031-83ea-0707760cf534 &nbsp= =3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTime= stamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.900950Z#000000#0= 00#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet<br= >&nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:= krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dke= rberos=2Cdc">krbPrincipalName=3Dkadmin/changepw(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.= NET=2Cou=3Dkerberos=2Cdc</a> &nbsp=3B =3Dexample=2Cdc=3Dnet &nbsp=3Bk= rbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 300 &nbsp=3BkrbMaxRen= ewableAge: 604800 &nbsp=3BkrbTicketFlags: 8196 &nbsp=3BkrbPrincipalNa= me: <a href=3D"mailto:kadmin/changepw@EXAMPLE.NET">kadmin/changepw(a)EXAMPLE.= NET</a> &nbsp=3BkrbPrincipalExpiration: 19700101000000Z &nbsp=3BkrbPr= incipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAgEApIIBajCCAWYwVKAHMAWgAwIBAKFJ<b= r>&nbsp=3B MEegAwIBEqFABD4gAHNxSgJ9GwIH0UmFf5Ol8WWQ/2Wy6nQqmf+yX4dVzEQFsmaB= p9l1hsceWqIB2 &nbsp=3B ic80wlAJW9Do0gSOaiYfjBEoAcwBaADAgEAoTkwN6ADAgEXoT= AELhAAt+ZrWZKAjKkUhSJt0wwSqU &nbsp=3B ootXhNduXIRVjUJxWVtXdPTI7RcL/yjZK2= M0MwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACd423Z &nbsp=3B epUHmGMVf2I5sRQZRuo= ypVddoREy1pTtTMIiGvqai7Z+PRHbpL0kTawz9zdg60IgwPKAHMAWgAwIB &nbsp=3B AKEx= MC+gAwIBAaEoBCYIAGGbQu5FJ0ewAsCALf9yDbvOIa7Abx0PmnGw+PSKWOt8Dsur9TA8oAcwB<b= r>&nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAjG9iwd398xO7bFH+bAQDGv0Hh6Qr+QIpNAUB/= w7dmvqU9zPl &nbsp=3BkrbLastPwdChange: 19700101000000Z &nbsp=3BkrbExtr= aData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: = AAcBAAIAAgAAAGlvbkA=3D &nbsp=3BobjectClass: krbPrincipal &nbsp=3Bobje= ctClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicyAux &nbs= p=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: c054d88a-d134= -1031-83eb-0707760cf534 &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample= =2Cdc=3Dnet &nbsp=3BcreateTimestamp: 20121203013022Z &nbsp=3BentryCSN= : 20121203013022.911237Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Da= dmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121203013022Z<= br>&nbsp=3Bdn: <a href=3D"mailto:krbPrincipalName=3Dkadmin/history@EXAMPLE.= NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc">krbPrincipalName=3Dkadmin/hist= ory(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dkerberos=2Cdc</a>=3D &nbsp=3B = example=2Cdc=3Dnet &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicke= tLife: 36000 &nbsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlag= s: 0 &nbsp=3BkrbPrincipalName: <a href=3D"mailto:kadmin/history@EXAMPLE.= NET">kadmin/history(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: 1970= 0101000000Z &nbsp=3BkrbPrincipalKey:: MGagAwIBAaEDAgEBogMCAQGjAwIBAKRQME= 4wTKAHMAWgAwIBAKFBMD+gAwIB &nbsp=3B EKE4BDYYAOhayj3RDyyg78DGPFKNATBnpKKb= f2qwLJbJ0nPXoUdjtbHpjECIfASUXjBoB+Pkd/N+Z &nbsp=3B 2g=3D &nbsp=3BkrbL= astPwdChange: 19700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXR= pb25ARVhBTVBMRS5ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAAGlvbkA=3D &= nbsp=3BobjectClass: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux<br= >&nbsp=3BobjectClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: = krbPrincipal &nbsp=3BentryUUID: c0562d3e-d134-1031-83ec-0707760cf534 = &nbsp=3BcreatorsName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bcreat= eTimestamp: 20121203013022Z &nbsp=3BentryCSN: 20121203013022.919957Z#000= 000#000#000000 &nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dn= et &nbsp=3BmodifyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"ma= ilto:krbPrincipalName=3Dkadmin/master.example.net@EXAMPLE.NET=2Ccn=3DEXAMPL= E.NET=2Cou=3Dk">krbPrincipalName=3Dkadmin/master.example.net(a)EXAMPLE.NET=2C= cn=3DEXAMPLE.NET=2Cou=3Dk</a> &nbsp=3B erberos=2Cdc=3Dexample=2Cdc=3Dnet= &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbMaxTicketLife: 10800 &n= bsp=3BkrbMaxRenewableAge: 604800 &nbsp=3BkrbTicketFlags: 4 &nbsp=3Bkr= bPrincipalName: <a href=3D"mailto:kadmin/master.example.net@EXAMPLE.NET">ka= dmin/master.example.net(a)EXAMPLE.NET</a> &nbsp=3BkrbPrincipalExpiration: = 19700101000000Z &nbsp=3BkrbPrincipalKey:: MIIBgqADAgEBoQMCAQGiAwIBAaMDAg= EApIIBajCCAWYwVKAHMAWgAwIBAKFJ &nbsp=3B MEegAwIBEqFABD4gABhOeGOuo9UBDjK7= hTQ3Xfs8vsWB+Afl0JkPaSt3T3tRkZbWxAhTxXl+4Ta3z &nbsp=3B Y4ZaEYItXr2awBW6Q= XSZzBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAUUoLikQRp1c+vGFRtGg1qY &nbsp=3B oe= v8m55VO73g+xEqcx02MJa1x+esm5y9VTMLswTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYACj0sgn= &nbsp=3B ZOyWATgpst3N3pSom4smhxBWYgpTMghwaS5gFeKMZhccDSI8Ahm4nQPFmq3Jrf= 4UwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYIAL0gPnqCvdlb4//Xw5iE8Jvj2qY= DwpK0Hycj+cwyCjFsVKTsjzA8oAcwB &nbsp=3B aADAgEAoTEwL6ADAgEDoSgEJggAxTSME= h/7bfV2AYx4VoP8cIeunsqtrcvNIItmDxSqZ0ecZABm &nbsp=3BkrbLastPwdChange: 19= 700101000000Z &nbsp=3BkrbExtraData:: AAKuALxQZGJfY3JlYXRpb25ARVhBTVBMRS5= ORVQA &nbsp=3BkrbExtraData:: AAcBAAIAAgAAANAD4gA=3D &nbsp=3BobjectCla= ss: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectC= lass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal = &nbsp=3BentryUUID: c0581144-d134-1031-83ed-0707760cf534 &nbsp=3Bcreators= Name: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012= 1203013022Z &nbsp=3BentryCSN: 20121203013022.932349Z#000000#000#000000<b= r>&nbsp=3BmodifiersName: cn=3Dadmin=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3Bmo= difyTimestamp: 20121203013022Z &nbsp=3Bdn: <a href=3D"mailto:krbPrincipa= lName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET=2Cou=3Dker">= krbPrincipalName=3Dldap/master.example.net(a)EXAMPLE.NET=2Ccn=3DEXAMPLE.NET= =2Cou=3Dker</a> &nbsp=3B beros=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BkrbP= rincipalName: <a href=3D"mailto:ldap/master.example.net@EXAMPLE.NET">ldap/m= aster.example.net(a)EXAMPLE.NET</a> &nbsp=3BobjectClass: krbPrincipal &= nbsp=3BobjectClass: krbPrincipalAux &nbsp=3BobjectClass: krbTicketPolicy= Aux &nbsp=3BstructuralObjectClass: krbPrincipal &nbsp=3BentryUUID: 91= a6199c-d15a-1031-9919-2f12ddec6588 &nbsp=3BcreatorsName: cn=3Dadm-srv=2C= ou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BcreateTimestamp: 2012120= 3060105Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp=3BkrbPrincipalKey:: MII= BRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAwIBAKFJ &nbsp=3B MEegA= wIBEqFABD4gAA6GzVEXOsoNQbzbqFy0KZqXt04aRDje4Gxq4ZS4b/z+l6pKgmUyVdsPUS2wz<br= >&nbsp=3B qeKY56slAvVlnRCQt+uZTBEoAcwBaADAgEAoTkwN6ADAgEXoTAELhAAkzwNhAF14T= YWZyLZem5kvD &nbsp=3B yuLARt7Z3LLsduQ1j6s7P6EFMDNWPaHCJf09cwTKAHMAWgAwIB= AKFBMD+gAwIBEKE4BDYYAAbNr3p &nbsp=3B vkmNXkIZNgUtw2FJ3VtGEU9MmDmNHCFKSk4= kHCR9naWPkbMzRmWA7s/yGkwIWxCMwPKAHMAWgAwIB &nbsp=3B AKExMC+gAwIBAaEoBCYI= APc+l15I9VR4tYjNfS6XRX09JRoioaavGokNvj0RJa1/h4j3hg=3D=3D &nbsp=3BkrbPass= wordExpiration: 19700101000000Z &nbsp=3BkrbLastPwdChange: 20121203060153= Z &nbsp=3BkrbLastSuccessfulAuth: 20121203061721Z &nbsp=3BkrbExtraData= :: AAJRQLxQYWRtaW5pc3RyYXRvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData::= AAgBAA=3D=3D &nbsp=3BentryCSN: 20121203061721.358939Z#000000#000#000000= &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BmodifyTimestamp: 20121203061721Z &nbsp=3Bdn: <a href= =3D"mailto:krbPrincipalName=3Dldap/replica.example.net@EXAMPLE.NET=2Ccn=3DE= XAMPLE.NET=2Cou=3Dke">krbPrincipalName=3Dldap/replica.example.net(a)EXAMPLE.N= ET=2Ccn=3DEXAMPLE.NET=2Cou=3Dke</a> &nbsp=3B rberos=2Cdc=3Dexample=2Cdc= =3Dnet &nbsp=3BkrbPrincipalName: <a href=3D"mailto:ldap/replica.example.= net(a)EXAMPLE.NET">ldap/replica.example.net(a)EXAMPLE.NET</a> &nbsp=3Bobject= Class: krbPrincipal &nbsp=3BobjectClass: krbPrincipalAux &nbsp=3Bobje= ctClass: krbTicketPolicyAux &nbsp=3BstructuralObjectClass: krbPrincipal<= br>&nbsp=3BentryUUID: 205686f2-d162-1031-9537-2fa18b539eb9 &nbsp=3Bcreat= orsName: cn=3Dadm-srv=2Cou=3Dkerberos=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3B= createTimestamp: 20121203065511Z &nbsp=3BkrbLoginFailedCount: 0 &nbsp= =3BkrbPrincipalKey:: MIIBRKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBLDCCASgwVKAHMAWgAw= IBAKFJ &nbsp=3B MEegAwIBEqFABD4gABVJBbD8SWzRxzA92ncPp+x/Trd3GJY/P6w+ErH3= wddcUmq3o092v7mUXFMNw &nbsp=3B 2R8oC1rwLD2B/deCyuHDTBEoAcwBaADAgEAoTkwN6= ADAgEXoTAELhAApsEJiySukR8L5M3DKbipUj &nbsp=3B AITSVQQL2YSqY7xr/BY7Hm3huN= /juvnC7u/ZQwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAOvmT4x &nbsp=3B MDAmgH2qTgq= XTSLwRcBvT7QMWYMH0oi7HW8DYC09HDAdD2/vqaBsgthQCj3BCDmkwPKAHMAWgAwIB &nbsp= =3B AKExMC+gAwIBAaEoBCYIALQe5Qa57ZwsYK2mxhbNOhrO0Yn/OVLez1VQiEmrpj2/GvJLXA= =3D=3D &nbsp=3BkrbPasswordExpiration: 19700101000000Z &nbsp=3BkrbLast= PwdChange: 20121203065628Z &nbsp=3BkrbExtraData:: AAIcTbxQYWRtaW5pc3RyYX= RvckBFWEFNUExFLk5FVAA=3D &nbsp=3BkrbExtraData:: AAgBAA=3D=3D &nbsp=3B= krbLastSuccessfulAuth: 20121204032538Z &nbsp=3BentryCSN: 20121204032538.= 048010Z#000000#000#000000 &nbsp=3BmodifiersName: cn=3Dkdc-srv=2Cou=3Dker= beros=2Cdc=3Dexample=2Cdc=3Dnet &nbsp=3BmodifyTimestamp: 20121204032538Z= &nbsp=3B <div><div id=3D"SkyDrivePlaceholder"></div>&gt=3B Date: Fri= =2C 9 Nov 2012 01:55:32 +0000 &gt=3B From: openldap-its(a)OpenLDAP.org = &gt=3B To: blance3459(a)hotmail.com &gt=3B Subject: Re: (ITS#7434) idasser= t-bind fails after restarting slapd &gt=3B &gt=3B &gt=3B *** THI= S IS AN AUTOMATICALLY GENERATED REPLY *** &gt=3B &gt=3B Thanks for y= our report to the OpenLDAP Issue Tracking System. Your &gt=3B report ha= s been assigned the tracking number ITS#7434. &gt=3B &gt=3B One of o= ur support engineers will look at your report in due course. &gt=3B Note= that this may take some time because our support engineers &gt=3B are v= olunteers. They only work on OpenLDAP when they have spare &gt=3B time.= &gt=3B &gt=3B If you need to provide additional information in rega= rds to your &gt=3B issue report=2C you may do so by replying to this mes= sage. Note that &gt=3B any mail sent to openldap-its(a)openldap.org with = (ITS#7434) &gt=3B in the subject will automatically be attached to the i= ssue report. &gt=3B &gt=3B mailto:openldap-its@openldap.org?subject= =3D(ITS#7434) &gt=3B &gt=3B You may follow the progress of this repo= rt by loading the following &gt=3B URL in a web browser: &gt=3B h= ttp://www.OpenLDAP.org/its/index.cgi?findid=3D7434 &gt=3B &gt=3B Ple= ase remember to retain your issue tracking number (ITS#7434) &gt=3B on a= ny further messages you send to us regarding this report. If &gt=3B you= don't then you'll just waste our time and yours because we &gt=3B won't= be able to properly track the report. &gt=3B &gt=3B Please note tha= t the Issue Tracking System is not intended to &gt=3B be used to seek he= lp in the proper use of OpenLDAP Software. &gt=3B Such requests will be = closed. &gt=3B &gt=3B OpenLDAP Software is user supported. &gt=3B= http://www.OpenLDAP.org/support/ &gt=3B &gt=3B -------------- &= gt=3B Copyright 1998-2007 The OpenLDAP Foundation=2C All Rights Reserved.<b= r>&gt=3B </div> </div></body> </html>= --_e0f270ad-e1a3-48b6-986f-f9f11dfd57c0_--

1 0

(ITS#7462) olcPcache cannot be modified
by tioteath＠gmail.com 04 Dec '12

04 Dec '12

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.172.239.4) I'm getting 'LDAP: error code 80 - cannot delete olcPcache' while I'm trying to perform olcPcache modification: dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config changetype: modify replace: olcPcache olcPcache: hdb 10000 4 500 100 - I have to perform this action in case, I need to extend the number of pcacheAttrset directives.

1 0

(ITS#7461) slapo-pcache not used for ACL which contains DN pointing to the remote LDAP server
by tioteath＠gmail.com 04 Dec '12

04 Dec '12

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.172.239.4) I'm trying to set up group ACL, which contains DN located on the remote LDAP server. I have working ldap-proxy (olcSuffix: dc=remote) with slapo-pcache up and running. I can do the following search request, and get proper result, stored in the pcache database: ldapsearch -bcn=test2,ou=group,dc=remote "(objectClass=groupOfNames)" objectClass member But whenever I trying to get access to the RDN, the ACL of which contains following group entry: 'to dn.base="ou=people,dc=local" by group.exact="cn=test2,ou=group,dc=remote" write' I can't see any activity in the log (using pcache loglevel). Looks like, for some unknown reason, pcache are totally ignored while ACLs are processed. This decreases performance dramatically, as search statements are produced for each ACL containing remote DN.

1 0

Re: (ITS#7458) No matching rules for attribute mailPreferenceOption
by jonas.d.lindstrom＠ericsson.com 04 Dec '12

04 Dec '12

Yes, you are right of course. And thanks for the tip about forcing a matching rule, it works fine. /JL On 2012-12-04 02:29, Quanah Gibson-Mount wrote: > --On Monday, December 03, 2012 9:06 AM +0000 > jonas.d.lindstrom(a)ericsson.com wrote: > >> Full_Name: Jonas Lindstr?m >> Version: 2.4.33 >> OS: Linux >> URL: ftp://ftp.openldap.org/incoming/ >> Submission from: (NULL) (194.237.142.6) >> >> >> The attribute mailPreferenceOption in the cosine schema is defined >> without any matching rules, so filters such as (mailPreferenceOption=0) >> fail. > > Core schema are defined by RFCs. If the RFC defines no matching rule, > then there isn't one in the schema. If you want to see this changed, > I advise filing an RFC to update the schema definition. For this > particular attribute, see <https://www.ietf.org/rfc/rfc1274.txt> > > You can, of course, force matching rules for your search. See the > slapcat manpage for examples of how to force matching rules. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7458) No matching rules for attribute mailPreferenceOption
by quanah＠zimbra.com 03 Dec '12

03 Dec '12

--On Monday, December 03, 2012 9:06 AM +0000 jonas.d.lindstrom(a)ericsson.com wrote: > Full_Name: Jonas Lindstr?m > Version: 2.4.33 > OS: Linux > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (194.237.142.6) > > > The attribute mailPreferenceOption in the cosine schema is defined > without any matching rules, so filters such as (mailPreferenceOption=0) > fail. Core schema are defined by RFCs. If the RFC defines no matching rule, then there isn't one in the schema. If you want to see this changed, I advise filing an RFC to update the schema definition. For this particular attribute, see <https://www.ietf.org/rfc/rfc1274.txt> You can, of course, force matching rules for your search. See the slapcat manpage for examples of how to force matching rules. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7456) slapo-smbk5pwd: Makefile with -L
by quanah＠zimbra.com 03 Dec '12

03 Dec '12

--On Monday, December 03, 2012 6:22 AM +0000 michael(a)stroeder.com wrote: > fumiyas(a)osstech.jp wrote: >> At Wed, 28 Nov 2012 20:04:41 GMT, >> michael(a)stroeder.com wrote: >>> I'd like to propose the following patch to Makefile of slapo-smbk5pwd >>> to ease building it without installed OpenLDAP client libs: >> >> This ITS is a dup of #7309. >> http://www.openldap.org/its/index.cgi?findid=7309 >> >> And see also: >> http://www.openldap.org/its/index.cgi?findid=7308 >> >> This problem is fixed in master, but not in 2.4 branch... > > Ah, thanks for the hint. The Makefile in master looks much better than my > suggestion. > > @Quanah: Could you please port this to RE24 branch? My recollection is we've been waiting on someone to go through and test the changes. Are you willing to do that? it sounds like you've started... --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: (ITS#7460) command-line option to ldapsearch to ignore server SSL certificate
by hyc＠symas.com 03 Dec '12

03 Dec '12

hauser(a)acm.org wrote: > Full_Name: Ralf Hauser > Version: 2.4.23 > OS: debian stable > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.25.16.113) > > > to test, it would be great to have a ldapsearch command-line option to ignore > the server cert. > > a) is that already existing ? No. > b) how would this be done otherwise? Use ldaprc. Read the ldap.conf(5) manpage. Closing this ITS. > > Many thanks in advance! > > Ralf > > P.S.: Perhaps, this could be added to a FAQ > http://www.openldap.org/faq/data/cache/2.html > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#7459) It is impossible to modify attributes olcPcacheTemplate, olcPcacheAttrset
by hyc＠symas.com 03 Dec '12

03 Dec '12

tioteath(a)gmail.com wrote: > Full_Name: Tio Teath > Version: 2.4.33 > OS: Debian GNU Linux Wheezy > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (178.172.239.4) > > > It is impossible to modify attributes olcPcacheTemplate, olcPcacheAttrset: > modify/add: olcPcacheTemplate: no equality matching rule > > Fixed now in git master. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(ITS#7460) command-line option to ldapsearch to ignore server SSL certificate
by hauser＠acm.org 03 Dec '12

03 Dec '12

Full_Name: Ralf Hauser Version: 2.4.23 OS: debian stable URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.25.16.113) to test, it would be great to have a ldapsearch command-line option to ignore the server cert. a) is that already existing ? b) how would this be done otherwise? Many thanks in advance! Ralf P.S.: Perhaps, this could be added to a FAQ http://www.openldap.org/faq/data/cache/2.html

1 0

(ITS#7459) It is impossible to modify attributes olcPcacheTemplate, olcPcacheAttrset
by tioteath＠gmail.com 03 Dec '12

03 Dec '12

Full_Name: Tio Teath Version: 2.4.33 OS: Debian GNU Linux Wheezy URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (178.172.239.4) It is impossible to modify attributes olcPcacheTemplate, olcPcacheAttrset: modify/add: olcPcacheTemplate: no equality matching rule

1 0

(ITS#7458) No matching rules for attribute mailPreferenceOption
by jonas.d.lindstrom＠ericsson.com 03 Dec '12

03 Dec '12

Full_Name: Jonas Lindström Version: 2.4.33 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.237.142.6) The attribute mailPreferenceOption in the cosine schema is defined without any matching rules, so filters such as (mailPreferenceOption=0) fail.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs