Hi,
Your suggestion indeed seems to work ! I'll be monitoring the system for lockups, but since there are no self-references from the server to itself involved, I don't expect problems. Below is the layout of the working configuration, for future references.
... moduleload back_ldap moduleload back_bdb ... backend bdb backend ldap ... # bdb backend, configured as a subordinate of the main server database bdb suffix "dc=SUB,dc=EXAMPLE,dc=COM" readonly on subordinate ... # ldap backend, with the right DN base database ldap lastmod off suffix "dc=EXAMPLE,dc=COM" uri "ldaps://REMOTE_SERVER/" ...
Works like charm :) Many thanks to all those that tried to help me sort out the problem.
Oren.
Dieter Kluenter wrote:
Hi,
Oren Laadan orenl@cs.columbia.edu writes:
Hi,
I want to setup a local ldap server for my team that will extend a remote ldap server (whose database is inaccessible to me and I cannot simply replicate) with a small number (less than 100) of new (local) entries. For example, the local server may add entries for new users only in my team, but also support authentication of all users in the remote server.
I tried to use back-meta, which seems most suitable for merging data from multiple targets. Assume the DN base is "dc=EXAMPLE,dc=COM", which is what the clients use.
To set it up, I used the following config snippets:
... moduleload back_ldap moduleload back_meta moduleload back_bdb ... backend bdb backend meta ... # bdb backend, with a "local" DN base different than the main one\ # not intended to serve clients, but to serve the meta backend only database bdb suffix "dc=TMP,dc=EXAMPLE,dc=COM" readonly on ... # meta backend, with the right DN base, serving the clients database meta lastmod off suffix "dc=EXAMPLE,dc=COM" uri "ldaps://REMOTE_SERVER/dc=EXAMPLE,dc=COM" uri "ldaps:///dc=TMP,dc=EXAMPLE,dc=COM" suffixmassage "dc=EXAMPLE,dc=COM" "dc=TMP,dc=EXAMPLE,dc=COM" ...
Declare back-bdb as subbordinate to back-meta. Something like
database bdb suffix dc=tmp,dc=example,dc=com ... subordinate
database meta suffix dc=example,dc=com uri ... uri ...
hehehe .. one of these uri's used to point to the server itself, and this is not well supported by openldap, hence the original problem.
-Dieter