Michael Ströder wrote:

On Wed, 9 Oct 2013 14:05:52 GMT hyc@symas.com wrote

...

Howard Chu wrote:

...

Michael Ströder wrote:

...

But now I see this during initial refresh phase of second server:

send_ldap_result: err=20 matched="" text="modify/add: memberOf: value #0 already exists"

Is that expected?

Not seeing that with your testcase.

Ah, I see it now. Yes, it's normal; memberOf on the provider already added the relevant values. The consumer receives a group entry and performs the same set of memberof updates, which are redundant at that point. It's harmless.

Hmm, wouldn't it be reasonable to strip those attributes marked as non-replication attrs when generating syncrepl search results at the provider? (Even if consumer asks for attrs=*,+)

slapd already strips DSA-specific attributes before sending a syncrepl entry. memberOf is not marked in the schema as DSA-specific. This is working as designed.