(ITS#7848) openldap n-way multi-master replication - openldap-bugs

5 May 2014


      Full_Name: Robert.YQ.Feng
Version: 2.4.23-31
OS: redhat linux 6.4
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (218.29.136.228)
Hello:
    my issuse is  under bellow:
     1. My ldapserver01's  cn=config file  is enable to  replicat  with 
ldapserver02  but  the  entries(just like users ,ou etc.) in olcDatabase={2}bdb
is not.
2. When i delete a user in ldapserver01 ,the same entry in  ldapserver02 was
delted too.
3. when i add a new user to  ldapserver01 ,the entries in ldapserver02 change to
old(primitive) data
4. when i add a new user to  ldapserver02 ,the entries in ldapserver01 change to
old(primitive) data,the new entry in ldapserver01 just add no longer is
disappear!!
Ldapserv01
1. slapd port  389
[root@ldapserver01 ~]# netstat -anulpt  |grep slapd
tcp        0      0 0.0.0.0:389                 0.0.0.0:*                  
LISTEN      21555/slapd         
tcp        0      0 10.195.157.170:389          10.195.143.28:54866        
ESTABLISHED 21555/slapd         
tcp        0      0 10.195.157.170:35366        10.195.157.170:389         
ESTABLISHED 21555/slapd         
tcp        0      0 10.195.157.170:389          10.195.157.170:35366       
ESTABLISHED 21555/slapd         
tcp        0      0 10.195.157.170:57629        10.195.143.28:389          
ESTABLISHED 21555/slapd         
tcp        0      0 :::389                      :::*                       
LISTEN      21555/slapd
2. openldap version 2.4.23
[root@ldapserver01 ~]# rpm -qa openldap*
openldap-clients-2.4.23-31.el6.x86_64
openldap-devel-2.4.23-31.el6.x86_64
openldap-servers-2.4.23-31.el6.x86_64
openldap-2.4.23-31.el6.x86_64
3. serverhostname
[root@ldapserver01 ~]# hostname
ldapserver01
4. host content
[root@ldapserver01 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.195.157.170     ldapserver01   ldapserver01.ldap.idpbg.com
10.195.143.28      ldapserver02   ldapserver02.ldap.idpbg.com
5. os version
[root@ldapserver01 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.4 (Santiago)
Ldapserver02
[root@ldapserver02 ~]# netstat -anulpt  |grep slapd
tcp        0      0 0.0.0.0:389                 0.0.0.0:*                  
LISTEN      1625/slapd          
tcp        0      0 10.195.143.28:389           10.195.157.170:57629       
ESTABLISHED 1625/slapd          
tcp        0      0 10.195.143.28:54866         10.195.157.170:389         
ESTABLISHED 1625/slapd          
tcp        0      0 10.195.143.28:51667         10.195.143.28:389          
ESTABLISHED 1625/slapd          
tcp        0      0 10.195.143.28:389           10.195.143.28:51667        
ESTABLISHED 1625/slapd          
tcp        0      0 :::389                      :::*                       
LISTEN      1625/slapd
[root@ldapserver02 ~]# rpm -qa openldap*
openldap-2.4.23-31.el6.x86_64
openldap-clients-2.4.23-31.el6.x86_64
openldap-servers-2.4.23-31.el6.x86_64
openldap-devel-2.4.23-31.el6.x86_64
[root@ldapserver02 ~]# hostname
ldapserver02
[root@ldapserver02 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.195.143.28    ldapserver02   ldapserver02.ldap.idpbg.com
10.195.157.170    ldapserver01   ldapserver01.ldap.idpbg.com
[root@ldapserver02 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.4 (Santiago)
ldapserver02's  cn=config configuration file
--------------------------------------------------------------------------------------------------------------------------
[root@ldapserver02 ~]# ldapsearch -LLLQY  EXTERNAL  -H ldapi:/// -b cn=config 
"(|(cn=config)(olcDatabase={0}config))"
dn: cn=config
objectClass: olcGlobal
cn: config
olcConfigFile: /etc/openldap/slapd.conf
olcConfigDir: /etc/openldap/slapd.d
olcAllows: bind_v2
olcArgsFile: /var/run/openldap/slapd.args
olcAttributeOptions: lang-
olcAuthzPolicy: none
olcConcurrency: 0
olcConnMaxPending: 100
olcConnMaxPendingAuth: 1000
olcGentleHUP: FALSE
olcIdleTimeout: 0
olcIndexSubstrIfMaxLen: 4
olcIndexSubstrIfMinLen: 2
olcIndexSubstrAnyLen: 4
olcIndexSubstrAnyStep: 2
olcIndexIntLen: 4
olcLocalSSF: 71
olcPidFile: /var/run/openldap/slapd.pid
olcReadOnly: FALSE
olcReverseLookup: FALSE
olcSaslSecProps: noplain,noanonymous
olcServerID: 1 ldap://ldapserver01.ldap.idpbg.com
olcServerID: 2 ldap://ldapserver02.ldap.idpbg.com
olcSockbufMaxIncoming: 262143
olcSockbufMaxIncomingAuth: 16777215
olcThreads: 16
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: "OpenLDAP Server"
olcTLSCertificateKeyFile: /etc/openldap/certs/password
olcTLSVerifyClient: never
olcToolThreads: 1
olcWriteTimeout: 0
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to *  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=externa
 l,cn=auth" manage  by *   break
olcAddContentAcl: TRUE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=admin,cn=config
olcRootPW: {SSHA}hI5Dhjq/poZ0Wvu5B7ovYKPiNWAIMqR+
olcSyncUseSubentry: FALSE
olcSyncrepl: {0}rid=001 provider=ldap://ldapserver01.ldap.idpbg.com binddn="cn
 =admin,cn=config" bindmethod=simple  credentials=ldap searchbase="cn=config" 
 type=refreshAndPersist  retry="5 5 300 5"  timeout=1
olcSyncrepl: {1}rid=002 provider=ldap://ldapserver02.ldap.idpbg.com binddn="cn
 =admin,cn=config" bindmethod=simple  credentials=ldap searchbase="cn=config" 
 type=refreshAndPersist  retry="5 5 300 5"  timeout=1
olcMirrorMode: TRUE
olcMonitoring: FALSE
ldapserver02's olcDatabase configuration
----------------------------------------------------------------------------------------------
[root@ldapserver02 ~]#  ldapsearch  -LLLQY EXTERNAL -H ldapi:/// -b cn=config 
"(| (olcDatabase={2}bdb)(olcOverlay=syncprov))"
dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
dn: olcDatabase={2}bdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcBdbConfig
olcDatabase: {2}bdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=ldap,dc=idpbg,dc=com
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcReadOnly: FALSE
olcRootDN: cn=Manager,dc=ldap,dc=idpbg,dc=com
olcRootPW: {SSHA}hI5Dhjq/poZ0Wvu5B7ovYKPiNWAIMqR+
olcSyncUseSubentry: FALSE
olcSyncrepl: {0}rid=004  provider=ldap://ldapserver01.ldap.idpbg.com  binddn="
 cn=Manager,dc=ldap,dc=idpbg,dc=com" bindmethod=simple  credentials=ldap  sear
 chbase="dc=ldap,dc=idpbg,dc=com"  type=refreshOnly    interval=00:00:00:10  r
 etry="5 5 300 5" timeout=1
olcSyncrepl: {1}rid=005  provider=ldap://ldapserver02.ldap.idpbg.com  binddn="
 cn=Manager,dc=ldap,dc=idpbg,dc=com" bindmethod=simple  credentials=ldap  sear
 chbase="dc=ldap,dc=idpbg,dc=com"  type=refreshOnly    interval=00:00:00:10  r
 etry="5 5 300 5" timeout=1
olcMirrorMode: TRUE
olcMonitoring: TRUE
olcDbCacheSize: 1000
olcDbCheckpoint: 1024 15
olcDbConfig: {0}# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/1
 2/18 11:53:27 ghenry Exp $
olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas
 es.
olcDbConfig: {2}#
olcDbConfig: {3}# See the Oracle Berkeley DB documentation
olcDbConfig: {4}#   <http://www.oracle.com/technology/documentation/berkeley-d
 b/db/ref/env/db_config.html>
olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics.
olcDbConfig: {6}#
olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ
olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl
 PTI+
olcDbConfig: {9}# in particular:
olcDbConfig: {10}#   http://www.openldap.org/faq/index.cgi?file=1075
olcDbConfig: {11}
olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re
 building
olcDbConfig: {13}# the DB environment.
olcDbConfig: {14}
olcDbConfig: {15}# one 0.25 GB cache
olcDbConfig: {16}set_cachesize 0 268435456 1
olcDbConfig: {17}
olcDbConfig: {18}# Data Directory
olcDbConfig: {19}#set_data_dir db
olcDbConfig: {20}
olcDbConfig: {21}# Transaction Log settings
olcDbConfig: {22}set_lg_regionmax 262144
olcDbConfig: {23}set_lg_bsize 2097152
olcDbConfig: {24}#set_lg_dir logs
olcDbConfig: {25}
olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui
 ck"
olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl
 aXIgLXEgb3B0aW9uKS4g
olcDbNoSync: FALSE
olcDbDirtyRead: FALSE
olcDbIDLcacheSize: 0
olcDbIndex: objectClass pres,eq
olcDbIndex: cn pres,eq,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: uidNumber pres,eq
olcDbIndex: gidNumber pres,eq
olcDbIndex: memberUid pres,eq,sub
olcDbIndex: mail pres,eq,sub
olcDbIndex: sn pres,eq,sub
olcDbIndex: givenName pres,eq,sub
olcDbIndex: loginShell pres,eq
olcDbIndex: ou pres,eq,sub
olcDbIndex: nisMapName pres,eq,sub
olcDbIndex: nisMapEntry pres,eq,sub
olcDbIndex: sambaSID pres,eq
olcDbIndex: sambaSIDList pres,eq
olcDbIndex: sambaGroupType pres,eq
olcDbLinearIndex: FALSE
olcDbMode: 0600
olcDbSearchStack: 16
olcDbShmKey: 0
olcDbCacheFree: 1
olcDbDNcacheSize: 0
dn: olcOverlay={0}syncprov,olcDatabase={2}bdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
-------------------------------------------------------------------------------------------------
[root@ldapserver02 ~]# ll /var/lib/ldap/
total 11780
-rw-r--r--. 1 ldap ldap      4096 May  5 17:48 alock
-rw-------. 1 ldap ldap      8192 May  6 09:05 cn.bdb
-rw-------. 1 ldap ldap     24576 May  5 17:48 __db.001
-rw-------. 1 ldap ldap   9093120 May  6 09:05 __db.002
-rw-------. 1 ldap ldap 335552512 May  6 09:05 __db.003
-rw-------. 1 ldap ldap   2359296 May  6 09:05 __db.004
-rw-------. 1 ldap ldap    753664 May  6 09:05 __db.005
-rw-------. 1 ldap ldap     32768 May  6 09:05 __db.006
-rw-r--r--. 1 root root       921 Apr 22 16:03 DB_CONFIG
-rw-------. 1 ldap ldap      8192 May  6 09:05 dn2id.bdb
-rw-------. 1 ldap ldap      8192 May  6 09:05 gidNumber.bdb
-rw-------. 1 ldap ldap     32768 May  6 09:05 id2entry.bdb
-rw-------. 1 ldap ldap  10485760 May  6 09:05 log.0000000001
-rw-------. 1 ldap ldap      8192 May  6 09:05 loginShell.bdb
-rw-------. 1 ldap ldap      8192 May  6 09:05 objectClass.bdb
-rw-------. 1 ldap ldap      8192 May  5 14:20 ou.bdb
-rw-------. 1 ldap ldap      8192 May  6 09:05 uid.bdb
-rw-------. 1 ldap ldap      8192 May  6 09:05 uidNumber.bdb
[root@ldapserver01 userinfo]# ll /var/lib/ldap/
total 11996
-rw-r--r--. 1 ldap ldap      2048 May  5 16:59 alock
-rw-------. 1 ldap ldap      8192 May  5 17:14 cn.bdb
-rw-------. 1 ldap ldap     24576 May  5 16:59 __db.001
-rw-------. 1 ldap ldap   9093120 May  6 09:14 __db.002
-rw-------. 1 ldap ldap 335552512 May  6 09:05 __db.003
-rw-------. 1 ldap ldap   2359296 May  6 09:05 __db.004
-rw-------. 1 ldap ldap    753664 May  6 09:05 __db.005
-rw-------. 1 ldap ldap     32768 May  6 09:05 __db.006
-rw-r--r--. 1 ldap ldap       921 Apr 22 16:06 DB_CONFIG
-rw-------. 1 ldap ldap      8192 May  6 09:05 dn2id.bdb
-rw-------. 1 ldap ldap      8192 May  5 17:14 gidNumber.bdb
-rw-------. 1 ldap ldap     32768 May  6 09:05 id2entry.bdb
-rw-------. 1 ldap ldap  10485760 May  6 09:05 log.0000000001
-rw-------. 1 ldap ldap      8192 May  5 17:14 loginShell.bdb
-rw-------. 1 ldap ldap      8192 May  6 09:05 objectClass.bdb
-rw-------. 1 ldap ldap      8192 May  6 09:05 ou.bdb
-rw-------. 1 ldap ldap      8192 May  5 17:14 uid.bdb
-rw-------. 1 ldap ldap      8192 May  5 17:14 uidNumber.bdb
ldapserver02  slapd.conf file content
---------------------------------------------------------------------------------------------
[root@ldapserver02 ~]# cat /etc/openldap/slapd.conf 
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /etc/openldap/schema/corba.schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/duaconf.schema
include         /etc/openldap/schema/dyngroup.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/java.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/openldap.schema
include         /etc/openldap/schema/ppolicy.schema
include         /etc/openldap/schema/collective.schema
##add a line underline
include         /etc/openldap/schema/samba.schema
# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org
pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args
# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
# modulepath /usr/lib/openldap
# modulepath /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la
# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile ""OpenLDAP Server""
TLSCertificateKeyFile /etc/openldap/certs/password
# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# enable on-the-fly configuration (cn=config)
database config
rootdn          "cn=admin,cn=config"
rootpw          {SSHA}hI5Dhjq/poZ0Wvu5B7ovYKPiNWAIMqR+
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
manage
        by * break
# enable server status monitoring (cn=monitor)
database monitor
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read
        by dn.exact="cn=Manager,dc=ldap,dc=idpbg,dc=com" read
        by * none
#######################################################################
# database definitions
#######################################################################
database        bdb
suffix          "dc=ldap,dc=idpbg,dc=com"
checkpoint      1024 15
rootdn          "cn=Manager,dc=ldap,dc=idpbg,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
# rootpw                {crypt}ijFYNcSNctBYg
rootpw        {SSHA}hI5Dhjq/poZ0Wvu5B7ovYKPiNWAIMqR+
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/lib/ldap
# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
###add a line under
index sambaSID,sambaSIDList,sambaGroupType  eq,pres
# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
#     bindmethod=sasl saslmech=GSSAPI
#     authcId=host/ldap-master.example.com@EXAMPLE.COM
--------------------------------------------------------------------------------
ldapserver01  slapd.conf  file content
-----------------------------------------------------------------------------
[root@ldapserver01 userinfo]# cat /etc/openldap/slapd.conf 
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /etc/openldap/schema/corba.schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/duaconf.schema
include         /etc/openldap/schema/dyngroup.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/java.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/openldap.schema
include         /etc/openldap/schema/ppolicy.schema
include         /etc/openldap/schema/collective.schema
##add a line underline 
include         /etc/openldap/schema/samba.schema
# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org
pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args
# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
# modulepath /usr/lib/openldap
# modulepath /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la
# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile ""OpenLDAP Server""
TLSCertificateKeyFile /etc/openldap/certs/password
# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# enable on-the-fly configuration (cn=config)
database config
rootdn          "cn=admin,cn=config"
rootpw          {SSHA}hI5Dhjq/poZ0Wvu5B7ovYKPiNWAIMqR+
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
manage
        by * break
# enable server status monitoring (cn=monitor)
database monitor
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
read
        by dn.exact="cn=Manager,dc=ldap,dc=idpbg,dc=com" read
        by * none
#######################################################################
# database definitions
#######################################################################
database        bdb
suffix          "dc=ldap,dc=idpbg,dc=com"
checkpoint      1024 15
rootdn          "cn=Manager,dc=ldap,dc=idpbg,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
# rootpw                {crypt}ijFYNcSNctBYg
rootpw                  {SSHA}hI5Dhjq/poZ0Wvu5B7ovYKPiNWAIMqR+
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/lib/ldap
# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
###add a line under
index sambaSID,sambaSIDList,sambaGroupType  eq,pres
# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
#     bindmethod=sasl saslmech=GSSAPI
#     authcId=host/ldap-master.example.com@EXAMPLE.COM