11:43 a.m.
https://bugs.openldap.org/show_bug.cgi?id=9772
Issue ID: 9772
Summary: replication of cn=config for
olcDatabase={2}mdb,cn=config not working
Product: OpenLDAP
Version: 2.6.0
Hardware: All
OS: All
Status: UNCONFIRMED
Keywords: needs_review
Severity: normal
Priority: ---
Component: slapd
Assignee: bugs(a)openldap.org
Reporter: stefan(a)kania-online.de
Target Milestone: ---
My setup is a mmr for cn=config. The configuration of all servers is:
---------------
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
dn: olcDatabase={0}config,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=1
provider=ldap://ldap01.example.net
binddn="cn=admin,cn=config"
bindmethod=simple
credentials=secret
searchbase="cn=config"
type=refreshAndPersist
retry="5 5 300 20"
timeout=1
starttls=yes
tls_reqcert=allow
olcSyncRepl: rid=2
provider=ldap://ldap02.example.net
binddn="cn=admin,cn=config"
bindmethod=simple
credentials=secret
searchbase="cn=config"
type=refreshAndPersist
retry="5 5 300 20"
timeout=1
starttls=yes
tls_reqcert=allow
olcSyncRepl: rid=3
provider=ldap://ldap03.example.net
binddn="cn=admin,cn=config"
bindmethod=simple
credentials=secret
searchbase="cn=config"
type=refreshAndPersist
retry="5 5 300 20"
timeout=1
starttls=yes
tls_reqcert=allow
olcSyncRepl: rid=4
provider=ldap://ldap04.example.net
binddn="cn=admin,cn=config"
bindmethod=simple
credentials=secret
searchbase="cn=config"
type=refreshAndPersist
retry="5 5 300 20"
timeout=1
starttls=yes
tls_reqcert=allow
-
add: olcMultiprovider
olcMultiprovider: TRUE
-------------
Replication is working for dn: olcDatabase={-1}frontend,cn=config
but not for the configuration of the main DB dn: olcDatabase={2}mdb,cn=config
When I do a change I got the following messages:
-----------------
messages on provider
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 fd=18 ACCEPT from
IP=192.168.56.46:57844 (IP=0.0.0.0:389)
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=0 EXT
oid=1.3.6.1.4.1.1466.20037
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=0 STARTTLS
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=0 RESULT oid= err=0
qtime=0.000023 etime=0.000176 text=
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 fd=18 TLS established tls_ssf=256
ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=1 BIND dn="cn=admin,cn=config"
method=128
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=1 BIND dn="cn=admin,cn=config"
mech=SIMPLE bind_ssf=0 ssf=256
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=1 RESULT tag=97 err=0
qtime=0.000027 etime=0.020422 text=
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 SRCH base="cn=config"
scope=2 deref=0 filter="(objectClass=*)"
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 SRCH attr=* +
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_op_search: got a
persistent search with a
cookie=rid=004,sid=002,csn=20211215092402.061636Z#000000#002#000000
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_findbase: searching
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_op_search:
registered persistent search
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_op_search: consumer
cookie is missing a csn we track
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_search_response:
cookie=rid=004,sid=004,csn=20211215092401.968707Z#000000#001#000000;20211215092402.061636Z#000000#002#000000;20211215092402.073013Z#000000#003#000000;20211215092402.084067Z#000000#004#000000
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_sendinfo:
refreshPresent
cookie=rid=004,sid=004,csn=20211215092401.968707Z#000000#001#000000;20211215092402.061636Z#000000#002#000000;20211215092402.073013Z#000000#003#000000;20211215092402.084067Z#000000#004#000000
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=2 syncprov_search_response:
detaching op
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 op=3 UNBIND
Dez 15 10:37:56 ldap04 slapd[6319]: conn=1013 fd=18 closed
messages on consumer
Dez 15 10:37:56 ldap02 slapd[6271]: do_syncrep1: rid=004 starting refresh
(sending cookie=rid=004,sid=002,csn=20211215092402.061636Z#000000#002#000000)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn=config, UUID: 5d4870f0-f1d0-103b-92fc-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d4870f0-f1d0-103b-92fc-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn=config 20211215085439.318447Z#000000#004#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn=module{0},cn=config, UUID: 5d487b22-f1d0-103b-92fe-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d487b22-f1d0-103b-92fe-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn=module{0},cn=config 20211215085432.145148Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn=module{0},cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn=module{0},cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn=schema,cn=config, UUID: 5d4877bc-f1d0-103b-92fd-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d4877bc-f1d0-103b-92fd-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_add
cn=schema,cn=config (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn={0}core,cn=schema,cn=config, UUID: 5d48abc4-f1d0-103b-92ff-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48abc4-f1d0-103b-92ff-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn={0}core,cn=schema,cn=config 20211215085432.146392Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn={0}core,cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn={0}core,cn=schema,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn={1}cosine,cn=schema,cn=config, UUID: 5d48c23a-f1d0-103b-9300-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48c23a-f1d0-103b-9300-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn={1}cosine,cn=schema,cn=config 20211215085432.146967Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn={1}cosine,cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn={1}cosine,cn=schema,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn={2}nis,cn=schema,cn=config, UUID: 5d48d1b2-f1d0-103b-9301-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48d1b2-f1d0-103b-9301-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn={2}nis,cn=schema,cn=config 20211215085432.147363Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn={2}nis,cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn={2}nis,cn=schema,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn={3}inetorgperson,cn=schema,cn=config, UUID:
5d48dbc6-f1d0-103b-9302-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48dbc6-f1d0-103b-9302-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn={3}inetorgperson,cn=schema,cn=config
20211215085432.147621Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn={3}inetorgperson,cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn={3}inetorgperson,cn=schema,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn={4}dyngroup,cn=schema,cn=config, UUID: 5d48e152-f1d0-103b-9303-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48e152-f1d0-103b-9303-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn={4}dyngroup,cn=schema,cn=config 20211215085432.147763Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn={4}dyngroup,cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn={4}dyngroup,cn=schema,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
cn={5}kerberos,cn=schema,cn=config, UUID: 5d48e79c-f1d0-103b-9304-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48e79c-f1d0-103b-9304-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
cn={5}kerberos,cn=schema,cn=config 20211215085432.147924Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
cn={5}kerberos,cn=schema,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (cn={5}kerberos,cn=schema,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
olcDatabase={-1}frontend,cn=config, UUID: 5d48f458-f1d0-103b-9305-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48f458-f1d0-103b-9305-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
olcDatabase={-1}frontend,cn=config 20211215085432.148251Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
olcDatabase={-1}frontend,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (olcDatabase={-1}frontend,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
olcDatabase={0}config,cn=config, UUID: 5d48f7aa-f1d0-103b-9306-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48f7aa-f1d0-103b-9306-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
olcDatabase={0}config,cn=config 20211215092402.084067Z#000000#004#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
olcDatabase={0}config,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (olcDatabase={0}config,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
olcOverlay={0}syncprov,olcDatabase={0}config,cn=config, UUID:
7c3fa65a-f1d4-103b-983d-81584f1425b7
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
7c3fa65a-f1d4-103b-983d-81584f1425b7
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
olcOverlay={0}syncprov,olcDatabase={0}config,cn=config
20211215092402.083542Z#000000#004#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
olcOverlay={0}syncprov,olcDatabase={0}config,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (olcOverlay={0}syncprov,olcDatabase={0}config,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
olcDatabase={1}monitor,cn=config, UUID: 5d48fa48-f1d0-103b-9307-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48fa48-f1d0-103b-9307-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: dn_callback : entries have identical CSN
olcDatabase={1}monitor,cn=config 20211215085432.148402Z#000000#000#000000
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
olcDatabase={1}monitor,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 entry unchanged,
ignored (olcDatabase={1}monitor,cn=config)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_message_to_entry: rid=004 DN:
olcDatabase={2}mdb,cn=config, UUID: 5d48fd0e-f1d0-103b-9308-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f0589699700
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 inserted UUID
5d48fd0e-f1d0-103b-9308-1b7679847168
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_search (0)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004
olcDatabase={2}mdb,cn=config
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_add
olcDatabase={2}mdb,cn=config (68)
Dez 15 10:37:56 ldap02 slapd[6271]: conn=-1 op=0 syncprov_matchops: recording
uuid for dn=olcDatabase={2}mdb,cn=config on opc=0x7ef1740062c0
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_null_callback : error code 0x35
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_modify
olcDatabase={2}mdb,cn=config (53)
Dez 15 10:37:56 ldap02 slapd[6271]: syncrepl_entry: rid=004 be_modify failed
(53)
Dez 15 10:37:56 ldap02 slapd[6271]: do_syncrepl: rid=004 rc 53 retrying (18
retries left)
-----------------
A change with ldapmodify is only changing the cn=config on the server I did the
ldapmodify. All other servers do not see anything, no message in the log.
All systems are Debian 11 with symas packages 2.6.0-5.
--
You are receiving this mail because:
You are on the CC list for the issue.
11:48 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |replication
Summary|replication of cn=config |cn=config replication of
|for |olcDbCheckpoint is broken
|olcDatabase={2}mdb,cn=confi |
|g not working |
--
You are receiving this mail because:
You are on the CC list for the issue.
11:48 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #1 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
The problematic change is missing from the bug report. From the mailing list,
the change that broke cn=config replication is:
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcDbCheckpoint
olcDbCheckpoint: 1 1
--
You are receiving this mail because:
You are on the CC list for the issue.
8:40 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CONFIRMED |IN_PROGRESS
--- Comment #21 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
https://git.openldap.org/openldap/openldap/-/merge_requests/476
--
You are receiving this mail because:
You are on the CC list for the issue.
9:52 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |CONFIRMED
Ever confirmed|0 |1
--
You are receiving this mail because:
You are on the CC list for the issue.
4:33 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #20 from stefan(a)kania-online.de ---
FINALLY it's working :-). I hope that's the only attribute that is case
sensitiv now.
--
You are receiving this mail because:
You are on the CC list for the issue.
2:59 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #19 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
I can see it's because attr_cmp picks up on the difference between
'olcmdbConfig' and 'olcMdbConfig'. For now you can avoid it by making sure
you
use the latter everywhere.
--
You are receiving this mail because:
You are on the CC list for the issue.
8:41 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #18 from stefan(a)kania-online.de ---
Created attachment 874
--> https://bugs.openldap.org/attachment.cgi?id=874&action=edit
Setup for the replication of cn=config
--
You are receiving this mail because:
You are on the CC list for the issue.
8:41 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #17 from stefan(a)kania-online.de ---
Created attachment 873
--> https://bugs.openldap.org/attachment.cgi?id=873&action=edit
setup for the delta-syncrepl replication of the main DB
--
You are receiving this mail because:
You are on the CC list for the issue.
8:40 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #16 from stefan(a)kania-online.de ---
Created attachment 872
--> https://bugs.openldap.org/attachment.cgi?id=872&action=edit
ldif for initial setup via slapadd
--
You are receiving this mail because:
You are on the CC list for the issue.
8:39 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #15 from stefan(a)kania-online.de ---
Here the content of "dn: olcDatabase={2}mdb,cn=config" from ldap01 the server
where I made the changes:
-----------
dn: olcDatabase={2}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcmdbConfig
olcDatabase: {2}mdb
olcDbDirectory: /var/symas/openldap-data
olcSuffix: dc=example,dc=net
olcAccess: {0}to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=externa
l,cn=auth" manage by dn.exact="gidNumber=1111+uidNumber=1111,cn=peercred,cn=e
xternal,cn=auth" manage by dn.exact="uid=ldap-admin,ou=users,dc=example,dc=ne
t" write by dn.exact="uid=repl-user,ou=users,dc=example,dc=net" read by
dn.ex
act="uid=sssd-user,cn=gssapi,cn=auth" read by
dn.exact="krbPrincipalName=K/M@
EXAMPLE.NET,cn=EXAMPLE.NET,cn=kerberos,dc=example,dc=net" write by dn.exact="
uid=kdc,ou=kerberos-adm,dc=example,dc=net" write by dn.exact="uid=kadmin,ou=k
erberos-adm,dc=example,dc=net" write by * read
olcAccess: {1}to dn.exact="" by * read
olcAccess: {2}to dn.base="cn=subschema" by * read
olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none
olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimi
ted size=unlimited
olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlim
ited size=unlimited
olcRootDN: cn=admin,dc=example,dc=net
olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7
ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4
olcSizeLimit: unlimited
olcSyncrepl: {0}rid=101 provider=ldap://ldap01.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcSyncrepl: {1}rid=102 provider=ldap://ldap02.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcSyncrepl: {2}rid=103 provider=ldap://ldap03.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcSyncrepl: {3}rid=104 provider=ldap://ldap04.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcTimeLimit: unlimited
olcMultiProvider: TRUE
olcDbCheckpoint: 512 30
olcDbIndex: default eq
olcDbIndex: objectClass
olcDbIndex: entryUUID
olcDbIndex: entryCSN
olcDbIndex: cn pres,eq,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: mail pres,eq,sub
olcDbIndex: sn pres,eq,sub
olcDbIndex: description pres,eq,sub
olcDbIndex: title pres,eq,sub
olcDbIndex: givenName pres,eq,sub
olcDbMaxSize: 85899345920
-----------
And here the content of "dn: olcDatabase={2}mdb,cn=config" from one of the
other ldap-server:
-----------
dn: olcDatabase={2}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcmdbConfig
olcDatabase: {2}mdb
olcDbDirectory: /var/symas/openldap-data
olcSuffix: dc=example,dc=net
olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=ex
ternal,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net w
rite by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break
olcAccess: {1}to dn.exact="" by * read
olcAccess: {2}to dn.base="cn=subschema" by * read
olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * none
olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unlimi
ted size=unlimited
olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlim
ited size=unlimited
olcRootDN: cn=admin,dc=example,dc=net
olcRootPW: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7
ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4
olcSizeLimit: unlimited
olcSyncrepl: {0}rid=101 provider=ldap://ldap01.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcSyncrepl: {1}rid=102 provider=ldap://ldap02.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcSyncrepl: {2}rid=103 provider=ldap://ldap03.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcSyncrepl: {3}rid=104 provider=ldap://ldap04.example.net bindmethod=simple t
imeout=0 network-timeout=0 binddn=uid=repl-user,ou=users,dc=example,dc=net cr
edentials=secret filter="(objectclass=*)"
searchbase="dc=example,dc=net" logf
ilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog
s
cope=sub schemachecking=off type=refreshAndPersist retry="60 +" syncdata=acce
sslog keepalive=240:10:30 starttls=yes tls_reqcert=allow
olcTimeLimit: unlimited
olcMultiProvider: TRUE
olcDbCheckpoint: 512 30
olcDbIndex: default eq
olcDbIndex: objectClass
olcDbIndex: entryUUID
olcDbIndex: entryCSN
olcDbIndex: cn pres,eq,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: mail pres,eq,sub
olcDbIndex: sn pres,eq,sub
olcDbIndex: description pres,eq,sub
olcDbIndex: title pres,eq,sub
olcDbIndex: givenName pres,eq,sub
olcDbMaxSize: 85899345920
-----------
I made a diff on both and only the changed ACL is listed:
-----------------
diff config-ldap01.txt config-ldap02.txt
✔ 4468
17:19:53
7,14c7,10
< olcAccess: {0}to * by
dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=externa
< l,cn=auth" manage by
dn.exact="gidNumber=1111+uidNumber=1111,cn=peercred,cn=e
< xternal,cn=auth" manage by
dn.exact="uid=ldap-admin,ou=users,dc=example,dc=ne
< t" write by dn.exact="uid=repl-user,ou=users,dc=example,dc=net" read
by
dn.ex
< act="uid=sssd-user,cn=gssapi,cn=auth" read by
dn.exact="krbPrincipalName=K/M@
< EXAMPLE.NET,cn=EXAMPLE.NET,cn=kerberos,dc=example,dc=net" write by
dn.exact="
< uid=kdc,ou=kerberos-adm,dc=example,dc=net" write by
dn.exact="uid=kadmin,ou=k
< erberos-adm,dc=example,dc=net" write by * read
---
olcAccess: {0} to * by
dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=ex
ternal,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net w
rite by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break
-----------------
Again I'm setting up my four ldap-server via Ansible.
The first step, after installing the symas-packages (on debian11), is adding
the config from file "config.ldif" (see attachment).
The next step is configuring the certificates for TLS via Ansible-tasks with
the Ansible module "ldap_attr".
Then create the initial objects on the first ldap-server (ldap01), via
Ansible-module ldap_entry.
Then configuring the delta-syncrepl of the main DB via Ansible with
"main-db-repl.ldif (see attachment) on all four servers.
Then configuring the replication of cn=config on all four server with
"repl_config.ldif" (see attachment)
And that's how I setup the all servers with my Ansible-role
--
You are receiving this mail because:
You are on the CC list for the issue.
5:46 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #14 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
On Fri, Jan 07, 2022 at 12:48:29PM +0000, openldap-its(a)openldap.org wrote:
It worked with "olcLogOps: writes". So here is the result
from the accesslog
when I try to change an ACL in the configuration of the main DB:
reqMod: objectClass:= olcDatabaseConfig
reqMod: objectClass:= olcMdbConfig
It is replacing the objectClass which is what I saw might cause this,
what is the content of the entry on both hosts? Again, starting from
test050 I don't see this behaviour and not sure what it is that makes
your environment different.
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.
4:48 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #13 from stefan(a)kania-online.de ---
Hi Ondřej,
t worked with "olcLogOps: writes". So here is the result from the accesslog
when I try to change an ACL in the configuration of the main DB:
-------------
dn: reqStart=20220107124049.000003Z,cn=configlog
objectClass: auditModify
reqStart: 20220107124049.000003Z
reqEnd: 20220107124049.000004Z
reqType: modify
reqSession: 1
reqAuthzID: cn=admin,cn=config
reqDN: olcDatabase={2}mdb,cn=config
reqMessage:
reqResult: 53
reqMod: objectClass:= olcDatabaseConfig
reqMod: objectClass:= olcMdbConfig
reqMod: olcAccess:- {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,
cn=external,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peerc
red,cn=external,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example
,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by *
break
reqMod: olcAccess:+ {0}to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,c
n=external,cn=auth" manage by dn.exact="gidNumber=1111+uidNumber=1111,cn=peer
cred,cn=external,cn=auth" manage by dn.exact="uid=ldap-admin,ou=users,dc=exam
ple,dc=net" write by dn.exact="uid=repl-user,ou=users,dc=example,dc=net"
read
by dn.exact="uid=sssd-user,cn=gssapi,cn=auth" read by
dn.exact="krbPrincipal
Name=K/M(a)EXAMPLE.NET,cn=EXAMPLE.NET,cn=kerberos,dc=example,dc=net" write by d
n.exact="uid=kdc,ou=kerberos-adm,dc=example,dc=net" write by
dn.exact="uid=ka
dmin,ou=kerberos-adm,dc=example,dc=net" write by * read
reqMod: entryUUID:= 74b8ed7a-0290-103c-8a96-1feb14c990fb
reqMod: entryCSN:= 20220107124044.203563Z#000000#001#000000
reqMod: modifiersName:= cn=admin,cn=config
reqMod: modifyTimestamp:= 20220107124044Z
reqEntryUUID: 74b7f7bc-0290-103c-9fd6-f16d7542d525
-------------
I hope, it will help.
Stefan
--
You are receiving this mail because:
You are on the CC list for the issue.
8:49 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |VERIFIED
--
You are receiving this mail because:
You are on the CC list for the issue.
8:55 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #11 from stefan(a)kania-online.de ---
Created attachment 869
--> https://bugs.openldap.org/attachment.cgi?id=869&action=edit
configuration with overlay accesslog to cn=config
--
You are receiving this mail because:
You are on the CC list for the issue.
8:54 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #10 from stefan(a)kania-online.de ---
I add the access-config-log.ldif to the first ldap-server and the change in the
configuration was replicated to all other ldap-server. Then I did a:
---------
ldapmodify -x -D cn=admin,cn=config -w secret -f
/home/ansible/access-log-config-overly.ldif -H ldap://ldap01
---------
to add the overlay and the server crashes:
-----------
Jan 05 17:37:46 ldap01 kernel: slapd[3254]: segfault at 48 ip 00007f7f376e3ad1
sp 00007f572e7fab68 error 4 in libc-2.31.so[7f7f375a9000+14b000]
Jan 05 17:37:46 ldap01 kernel: Code: 84 00 00 00 00 00 0f 1f 00 31 c0 c5 f8 77
c3 66 2e 0f 1f 84 00 00 00 00 00 89 f9 48 89 fa c5 f9 ef c0 83 e1 3f 83 f9 20
77 1f <c5> fd 74 0f c5 fd d7 c1 85 c0 0f 85 df 00 00 00 48 83 c7 20 83 e1
Jan 05 17:37:46 ldap01 systemd[1]: symas-openldap-server.service: Main process
exited, code=killed, status=11/SEGV
Jan 05 17:37:46 ldap01 systemd[1]: symas-openldap-server.service: Failed with
result 'signal'
-----------
After a few seconds the other 3 ldap servers are chrashing with the same error.
Trying to restart slapd shows the following error:
-------------
Jan 05 17:44:48 ldap03 systemd[1]: symas-openldap-server.service: Main process
exited, code=killed, status=6/ABRT
Jan 05 17:44:48 ldap03 slapd[3170]: slapd: accesslog.c:1603:
accesslog_response: Assertion `0' failed.
Jan 05 17:44:48 ldap03 slapd[3170]: syncrepl_entry: rid=004 be_add
olcDatabase={2}mdb,cn=config (68)
Jan 05 17:44:48 ldap03 systemd[1]: symas-openldap-server.service: Failed with
result 'signal'.
Jan 05 17:44:48 ldap03 slapd[3170]: conn=-1 op=0 accesslog_response: the op had
a CSN assigned, if you're replicating the accesslog at (null), you might lose
changes
-------------
Either a new bug or I did something wrong in my ldif to add the overlay.
BTW doing the modify to add the overlay is replicated to all ldap server,
that's why all servers chrashes.
I will add the actual configuration in attachment "slapcat-with-overlay.txt"
it's with the overlay configured.
--
You are receiving this mail because:
You are on the CC list for the issue.
8:15 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #9 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
On Wed, Jan 05, 2022 at 02:57:03PM +0000, openldap-its(a)openldap.org wrote:
before I did not get the right information for you, here are two
ldifs
for setting up accesslog on cn=config. Could you take a look if its ok.
If not what do I have to change?
Hi Stefan,
that should be fine for the database storing the data, the more
important part is actually adding the acceslog overlay to the
database in "olcDatabase={0}config,cn=config", making sure it logs
failed operations and making the failing change again. I'm interested in
an operation that failed to replicate and what it looks like on both
servers (where it succeeded and the one it failed on).
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.
6:57 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #6 from stefan(a)kania-online.de ---
Hi Ondřej,
before I did not get the right information for you, here are two ldifs
for setting up accesslog on cn=config. Could you take a look if its ok.
If not what do I have to change?
Stefan
Am 05.01.22 um 10:26 schrieb openldap-its(a)openldap.org:
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #5 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
On Tue, Jan 04, 2022 at 06:45:27PM +0000, openldap-its(a)openldap.org wrote:
> See my config of all ldap-server in cn_config.txt. With this configuration I
> modify "serverID" in "dn: cn=config" and I see the following
messages on the
> ldap where I do the changes:
>
> Here you see the error 53. So changing the "dn:
> olcDatabase={2}mdb,cn=config"always fails. I can do changes to any othe of the
> dn: entries in cn=config only the changes in the configuration of the main DB
> are failing.
It doesn't say why it failed, could you set up accesslog on its config
database with olclogsuccess: FALSE and post the failed operation?
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.
1:26 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #5 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
On Tue, Jan 04, 2022 at 06:45:27PM +0000, openldap-its(a)openldap.org wrote:
See my config of all ldap-server in cn_config.txt. With this
configuration I
modify "serverID" in "dn: cn=config" and I see the following messages
on the
ldap where I do the changes:
Here you see the error 53. So changing the "dn:
olcDatabase={2}mdb,cn=config"always fails. I can do changes to any othe of the
dn: entries in cn=config only the changes in the configuration of the main DB
are failing.
It doesn't say why it failed, could you set up accesslog on its config
database with olclogsuccess: FALSE and post the failed operation?
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.
10:45 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #4 from stefan(a)kania-online.de ---
See my config of all ldap-server in cn_config.txt. With this configuration I
modify "serverID" in "dn: cn=config" and I see the following messages
on the
ldap where I do the changes:
-------------
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 fd=39 ACCEPT from
IP=192.168.56.45:60488 (IP=0.0.0.0:389)
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=0 BIND dn="cn=admin,cn=config"
method=128
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=0 BIND dn="cn=admin,cn=config"
mech=SIMPLE bind_ssf=0 ssf=0
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=0 RESULT tag=97 err=0
qtime=0.000005 etime=0.004416 text=
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 MOD dn="cn=config"
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 MOD attr=olcServerID
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 syncprov_matchops: recording
uuid for dn=cn=config on opc=0x7f57d4000d18
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 syncprov_findbase: searching
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 syncprov_findbase: searching
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 syncprov_findbase: searching
Jan 04 19:25:55 ldap01 slapd[289]: slap_get_csn: conn=1053 op=1 generated new
csn=20220104182555.949883Z#000000#001#000000 manage=1
Jan 04 19:25:55 ldap01 slapd[289]: slap_queue_csn: queueing 0x7f57d422b4a0
20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1047 op=2 syncprov_qresp: set up a new
syncres mode=1 csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1046 op=2 syncprov_qresp: set up a new
syncres mode=1 csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1045 op=2 syncprov_qresp: set up a new
syncres mode=1 csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=1 RESULT tag=103 err=0
qtime=0.000007 etime=0.000332 text=
Jan 04 19:25:55 ldap01 slapd[289]: slap_graduate_commit_csn: removing
0x7f57d422b4a0 20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1047 op=2 syncprov_sendresp: to=004,
cookie=rid=001,sid=001,csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1047 op=2 syncprov_sendresp: sending
LDAP_SYNC_ADD, dn=cn=config
Jan 04 19:25:55 ldap01 slapd[289]: conn=1046 op=2 syncprov_sendresp: to=003,
cookie=rid=001,sid=001,csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1046 op=2 syncprov_sendresp: sending
LDAP_SYNC_ADD, dn=cn=config
Jan 04 19:25:55 ldap01 slapd[289]: conn=1045 op=2 syncprov_sendresp: to=002,
cookie=rid=001,sid=001,csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap01 slapd[289]: conn=1045 op=2 syncprov_sendresp: sending
LDAP_SYNC_ADD, dn=cn=config
Jan 04 19:25:55 ldap01 ldapmodify[2589]: DIGEST-MD5 common mech free
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 op=2 UNBIND
Jan 04 19:25:55 ldap01 slapd[289]: conn=1053 fd=39 closed
-------------
On all other ldap-servers I see:
-------------
Jan 04 19:25:55 ldap02 slapd[493]: do_syncrep2: rid=001
cookie=rid=001,sid=001,csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: syncrepl_message_to_entry: rid=001 DN:
cn=config, UUID: 1298b21a-fb42-103b-84c0-7f85171bcaa6
Jan 04 19:25:55 ldap02 slapd[493]: syncrepl_entry: rid=001
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD)
csn=20220104182555.949883Z#000000#001#000000 tid 0x7f5c535d0700
Jan 04 19:25:55 ldap02 slapd[493]: syncrepl_entry: rid=001 be_search (0)
Jan 04 19:25:55 ldap02 slapd[493]: syncrepl_entry: rid=001 cn=config
Jan 04 19:25:55 ldap02 slapd[493]: slap_queue_csn: queueing 0x7f5c3812d290
20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: conn=-1 op=0 syncprov_matchops: recording
uuid for dn=cn=config on opc=0x7f5c380035b8
Jan 04 19:25:55 ldap02 slapd[493]: conn=-1 op=0 syncprov_findbase: searching
Jan 04 19:25:55 ldap02 slapd[493]: conn=-1 op=0 syncprov_findbase: searching
Jan 04 19:25:55 ldap02 slapd[493]: conn=1007 op=2 syncprov_qresp: set up a new
syncres mode=1 csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: conn=1005 op=2 syncprov_qresp: set up a new
syncres mode=1 csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: slap_graduate_commit_csn: removing
0x7f5c3812d290 20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: syncrepl_entry: rid=001 be_modify cn=config
(0)
Jan 04 19:25:55 ldap02 slapd[493]: slap_queue_csn: queueing 0x7f5c38139c50
20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: conn=1007 op=2 syncprov_sendresp: to=004,
cookie=rid=002,sid=002,csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 systemd[1]: Starting Cleanup of Temporary Directories...
Jan 04 19:25:55 ldap02 slapd[493]: conn=1007 op=2 syncprov_sendresp: sending
LDAP_SYNC_ADD, dn=cn=config
Jan 04 19:25:55 ldap02 slapd[493]: conn=1005 op=2 syncprov_sendresp: to=003,
cookie=rid=002,sid=002,csn=20220104182555.949883Z#000000#001#000000
Jan 04 19:25:55 ldap02 slapd[493]: conn=1005 op=2 syncprov_sendresp: sending
LDAP_SYNC_ADD, dn=cn=config
Jan 04 19:25:55 ldap02 slapd[493]: slap_graduate_commit_csn: removing
0x7f5c38139c50 20220104182555.949883Z#000000#001#000000
-------------
Looks good to me
then I change an ACL in "dn: olcDatabase={2}mdb,cn=config" that's my main
DB
for all my objects.
This is the ldif I use:
---------------
dn: olcDatabase={2}mdb,cn=config
changeType: modify
delete: olcAccess
olcAccess: {0}
-
add: olcAccess
olcAccess: {0}to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by dn.exact="gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth"
manage
by dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" write
by dn.exact="uid=repl-user,ou=users,dc=example,dc=net" read
by dn.exact="uid=sssd-user,cn=gssapi,cn=auth" read
by
dn.exact="krbPrincipalName=K/M(a)EXAMPLE.NET,cn=EXAMPLE.NET,cn=kerberos,dc=example,dc=net"
write
by dn.exact="uid=kdc,ou=kerberos-adm,dc=example,dc=net" write
by dn.exact="uid=kadmin,ou=kerberos-adm,dc=example,dc=net" write
by * break
---------------
The messages on the ldap where I do the modify:
---------------
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=0 BIND dn="cn=admin,cn=config"
method=128
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=0 BIND dn="cn=admin,cn=config"
mech=SIMPLE bind_ssf=0 ssf=0
Jan 04 19:36:13 ldap01 slapd[289]: connection_input: conn=1055 deferring
operation: binding
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=0 RESULT tag=97 err=0
qtime=0.000023 etime=0.016252 text=
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=1 MOD
dn="olcDatabase={2}mdb,cn=config"
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=1 MOD attr=olcAccess olcAccess
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=1 syncprov_matchops: recording
uuid for dn=olcDatabase={2}mdb,cn=config on opc=0x7f57c4001db8
Jan 04 19:36:13 ldap01 slapd[289]: slap_get_csn: conn=1055 op=1 generated new
csn=20220104183613.852654Z#000000#001#000000 manage=1
Jan 04 19:36:13 ldap01 slapd[289]: slap_queue_csn: queueing 0x7f57c4119860
20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1047 op=2 syncprov_qresp: set up a new
syncres mode=2 csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1046 op=2 syncprov_qresp: set up a new
syncres mode=2 csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1045 op=2 syncprov_qresp: set up a new
syncres mode=2 csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=1 RESULT tag=103 err=0
qtime=0.000946 etime=0.002456 text=
Jan 04 19:36:13 ldap01 slapd[289]: slap_graduate_commit_csn: removing
0x7f57c4119860 20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1047 op=2 syncprov_sendresp: to=004,
cookie=rid=001,sid=001,csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1047 op=2 syncprov_sendresp: sending
LDAP_SYNC_MODIFY, dn=olcDatabase={2}mdb,cn=config
Jan 04 19:36:13 ldap01 slapd[289]: conn=1046 op=2 syncprov_sendresp: to=003,
cookie=rid=001,sid=001,csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1046 op=2 syncprov_sendresp: sending
LDAP_SYNC_MODIFY, dn=olcDatabase={2}mdb,cn=config
Jan 04 19:36:13 ldap01 slapd[289]: conn=1045 op=2 syncprov_sendresp: to=002,
cookie=rid=001,sid=001,csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap01 slapd[289]: conn=1045 op=2 syncprov_sendresp: sending
LDAP_SYNC_MODIFY, dn=olcDatabase={2}mdb,cn=config
Jan 04 19:36:13 ldap01 ldapmodify[2611]: DIGEST-MD5 common mech free
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 op=2 UNBIND
Jan 04 19:36:13 ldap01 slapd[289]: conn=1055 fd=39 closed
Jan 04 19:36:13 ldap01 slapd[289]: conn=1046 op=3 UNBIND
Jan 04 19:36:13 ldap01 slapd[289]: conn=1046 fd=41 closed
Jan 04 19:36:13 ldap01 slapd[289]: conn=1047 op=3 UNBIND
Jan 04 19:36:13 ldap01 slapd[289]: conn=1047 fd=42 closed
Jan 04 19:36:13 ldap01 slapd[289]: conn=1045 op=3 UNBIND
Jan 04 19:36:13 ldap01 slapd[289]: conn=1045 fd=40 closed
---------------
and here the messages on all other ldap:
--------------
Jan 04 19:36:13 ldap02 slapd[493]: do_syncrep2: rid=001
cookie=rid=001,sid=001,csn=20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_message_to_entry: rid=001 DN:
olcDatabase={2}mdb,cn=config, UUID: 129bc81a-fb42-103b-999a-95e961ed368a
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_entry: rid=001
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY)
csn=20220104183613.852654Z#000000#001#000000 tid 0x7f5c51dcd700
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_entry: rid=001 be_search (0)
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_entry: rid=001
olcDatabase={2}mdb,cn=config
Jan 04 19:36:13 ldap02 slapd[493]: slap_queue_csn: queueing 0x7f5c44243640
20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap02 slapd[493]: slap_graduate_commit_csn: removing
0x7f5c44243640 20220104183613.852654Z#000000#001#000000
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_entry: rid=001 be_add
olcDatabase={2}mdb,cn=config (68)
Jan 04 19:36:13 ldap02 slapd[493]: conn=-1 op=0 syncprov_matchops: recording
uuid for dn=olcDatabase={2}mdb,cn=config on opc=0x7f5c44000ce8
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_null_callback : error code 0x35
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_entry: rid=001 be_modify
olcDatabase={2}mdb,cn=config (53)
Jan 04 19:36:13 ldap02 slapd[493]: syncrepl_entry: rid=001 be_modify failed
(53)
Jan 04 19:36:13 ldap02 slapd[493]: do_syncrepl: rid=001 rc 53 retrying (2
retries left)
Jan 04 19:36:18 ldap02 slapd[493]: do_syncrep1: rid=001 starting refresh
(sending
cookie=rid=001,sid=002,csn=20220104182555.949883Z#000000#001#000000;20220104181643.625745Z#000000#002#000000)
Jan 04 19:36:18 ldap02 slapd[493]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE -
SYNC_ID_SET
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_message_to_entry: rid=001 DN:
olcDatabase={2}mdb,cn=config, UUID: 129bc81a-fb42-103b-999a-95e961ed368a
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_entry: rid=001
LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) csn=(none) tid 0x7f5c51dcd700
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_entry: rid=001 be_search (0)
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_entry: rid=001
olcDatabase={2}mdb,cn=config
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_entry: rid=001 be_add
olcDatabase={2}mdb,cn=config (68)
Jan 04 19:36:18 ldap02 slapd[493]: conn=-1 op=0 syncprov_matchops: recording
uuid for dn=olcDatabase={2}mdb,cn=config on opc=0x7f5c44000cb0
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_null_callback : error code 0x35
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_entry: rid=001 be_modify
olcDatabase={2}mdb,cn=config (53)
Jan 04 19:36:18 ldap02 slapd[493]: syncrepl_entry: rid=001 be_modify failed
(53)
Jan 04 19:36:18 ldap02 slapd[493]: do_syncrepl: rid=001 rc 53 retrying (1
retries left)
--------------
Here you see the error 53. So changing the "dn:
olcDatabase={2}mdb,cn=config"always fails. I can do changes to any othe of the
dn: entries in cn=config only the changes in the configuration of the main DB
are failing.
--
You are receiving this mail because:
You are on the CC list for the issue.
10:42 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #3 from stefan(a)kania-online.de ---
Created attachment 864
--> https://bugs.openldap.org/attachment.cgi?id=864&action=edit
dump from cn=config
--
You are receiving this mail because:
You are on the CC list for the issue.
3:22 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #2 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
I cannot reproduce this issue:
```
cd tests
./run -k test050-syncrepl-multiprovider
ldapmodify -x -H ldap://localhost:9011/ -D 'cn=config' -y testrun/configpw
<<EOMOD
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcDbCheckpoint
olcDbCheckpoint: 1 1
EOMOD
for uri in ldap://localhost:{9011..9014}/; do ldapsearch -xLLL -o ldif-wrap=no
-H ldap://localhost:9012/ -D 'cn=config' -y testrun/configpw -b
'olcDatabase={1}mdb,cn=config' -s base olcDbCheckpoint entryCSN; done
```
Please provide a more complete description on how to get to that point or logs
that actually show the relevant events (the write and its replication).
--
You are receiving this mail because:
You are on the CC list for the issue.
9:46 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|bugs(a)openldap.org |ondra(a)mistotebe.net
Target Milestone|--- |2.5.10
Keywords|needs_review |
--
You are receiving this mail because:
You are on the CC list for the issue.
4:01 a.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
--- Comment #12 from Ondřej Kuzník <ondra(a)mistotebe.net> ---
On Wed, Jan 05, 2022 at 04:54:19PM +0000, openldap-its(a)openldap.org wrote:
I add the access-config-log.ldif to the first ldap-server and the
change in the
configuration was replicated to all other ldap-server. Then I did a:
[...]
Either a new bug or I did something wrong in my ldif to add the overlay.
BTW doing the modify to add the overlay is replicated to all ldap server,
that's why all servers chrashes.
I will add the actual configuration in attachment "slapcat-with-overlay.txt"
it's with the overlay configured.
Hi Stefan,
just to make sure you're not hitting ITS#9538 (the only crashes I've
seen locally), could you change olcLogOps from 'all' to 'writes'?
If it still crashes for you, can you run it under gdb and provide the
output of 'thread apply all backtrace'?
Thanks,
--
You are receiving this mail because:
You are on the CC list for the issue.
3:16 p.m.
New subject: [Issue 9772] cn=config replication of olcDbCheckpoint is broken
https://bugs.openldap.org/show_bug.cgi?id=9772
Quanah Gibson-Mount <quanah(a)openldap.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|IN_PROGRESS |RESOLVED
--- Comment #22 from Quanah Gibson-Mount <quanah(a)openldap.org> ---
head:
• 2443e986
by Ondřej Kuzník at 2022-01-18T05:12:53+00:00
ITS#9772 Allow objectClass edits that don't actually change them
re26:
• 4c33ce65
by Ondřej Kuzník at 2022-01-18T23:02:55+00:00
ITS#9772 Allow objectClass edits that don't actually change them
re25:
• 57c3bd5d
by Ondřej Kuzník at 2022-01-18T23:04:09+00:00
ITS#9772 Allow objectClass edits that don't actually change them
--
You are receiving this mail because:
You are on the CC list for the issue.
165
days inactive
201
days old
24 comments
1 participants
participants (1)
-
openldap-its＠openldap.org