Hello all,<br><br>I am having problems with chasing referrals on my slave OpenLDAP server. I feel like I&#39;m repeating an older thread here, but despite everything I have read I cannot find a solution.<br><br>My setup is as follows:
<br>Both the master and the slave are OpenLDAP 2.3.32 builds with the follwing configure parameters,<br>LD_LIBRARY_PATH=&quot;/usr/local/lib&quot; ./configure --prefix=/usr/local --disable-ipv6 --with-tls --enable-dynamic --enable-slapd --enable-modules&nbsp; --enable-crypt --enable-bdb --enable-rewrite --enable-backends=yes --enable-rlookups --disable-shell --disable-sql --enable-overlays=yes --enable-slurpd=yes
<br>At the end of the email, I have attached both the master and the slave slapd.conf.<br><br>The problem is that when I attempt an ldapadd against the slave server, I am returned a referral instead of having the slave forward the request to the master. I see no attempt to contact the master server in either the slave or master logs. Nor do I see any traffic between the two (other than syncrepl stuff) in a tcpdump. As far as I can tell the chain overlay is being ignored entirely.
<br><br>Any suggestions or fixes would be greatly appreciated.<br><br>- Scott Sanders<br><br>############################################<br># Master slapd.conf&nbsp; --&nbsp; ldap://info.domain.com:389<br>############################################
<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/core.schema<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/cosine.schema<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/inetorgperson.schema<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/nis.schema
<br><br>pidfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/var/run/slapd.pid<br>argsfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/var/run/slapd.args<br><br>password-hash {ssha} <br><br>security tls=1<br>TLSCACertificateFile /etc/pki/CA/cacert.pem<br>TLSCACertificatePath /etc/pki/CA
<br>TLSCertificateFile&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/security/ldap-master.crt<br>TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-master.key<br>TLSCipherSuite HIGH:MEDIUM:+SSLv2<br>TLSVerifyClient allow<br><br>limits 
dn.exact=&quot;cn=syncuser,dc=domain,dc=com&quot; time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited<br><br>access to attrs=userPassword<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by self write<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=admin,dc=domain,dc=com&quot; write
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=syncuser,dc=domain,dc=com&quot; read<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by * auth<br><br>access to *<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=admin,dc=domain,dc=com&quot; write<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=syncuser,dc=domain,dc=com&quot; read
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=syncuser,dc=domain,dc=com&quot; read<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by * read<br><br>database hdb<br>suffix cn=accesslog<br>directory /usr/local/var/openldap-accesslog<br>rootdn cn=accesslog<br>index default eq<br>
index entryCSN,objectClass,reqEnd,reqResult,reqStart<br><br>overlay syncprov<br>syncprov-nopresent TRUE<br>syncprov-reloadhint TRUE<br><br>database&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bdb<br>suffix&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;dc=domain,dc=com&quot;<br>rootdn&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;cn=admin,dc=domain,dc=com&quot;
<br>rootpw&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {SSHA}T2JGZSB3Q2x57s/O<br>directory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/var/openldap-data<br>index&nbsp;&nbsp; objectClass&nbsp;&nbsp;&nbsp;&nbsp; eq<br>index entryCSN eq<br>index entryUUID eq<br><br>overlay syncprov<br>syncprov-checkpoint 1000 60<br>
<br>overlay accesslog<br>logdb cn=accesslog<br>logops writes<br>logsuccess true<br>logpurge 07+00:00 01+00:00<br><br><br>############################################<br># Slave slapd.conf&nbsp; --&nbsp; ldap://arch.domain.com<br>############################################
<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/core.schema<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/cosine.schema<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/inetorgperson.schema<br>include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/schema/nis.schema
<br><br>pidfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/var/run/slapd.pid<br>argsfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/var/run/slapd.args<br><br>password-hash {ssha}<br><br>security tls=1<br>TLSCACertificateFile /etc/pki/CA/cacert.pem<br>TLSCACertificatePath /etc/pki/CA
<br>TLSCertificateFile&nbsp;&nbsp;&nbsp; /usr/local/etc/openldap/security/ldap-slave.crt<br>TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-slave.key<br>TLSCipherSuite HIGH:MEDIUM:+SSLv2<br>TLSVerifyClient allow<br><br>access to attrs=userPassword
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by self write<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=admin,dc=domain,dc=com&quot; read<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=syncuser,dc=domain,dc=com&quot; write<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by * auth<br><br>access to *<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=admin,dc=domain,dc=com&quot; read
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by dn=&quot;cn=syncuser,dc=domain,dc=com&quot; write<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; by * read<br><br>database&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bdb<br>suffix&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;dc=domain,dc=com&quot;<br>rootdn&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;cn=admin,dc=domain,dc=com&quot;<br>
rootpw&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {SSHA}T2JGZkB3Q2x57s/O<br>overlay&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; chain<br>chain-uri&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ldap://info.domain.com:389<br>chain-rebind-as-user&nbsp;&nbsp;&nbsp; TRUE<br>chain-idassert-bind&nbsp;&nbsp;&nbsp;&nbsp; bindmethod=simple<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; binddn=&quot;cn=admin,dc=domain,dc=com&quot;
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; credentials=secret<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mode=self<br>directory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /usr/local/var/openldap-data<br>index&nbsp;&nbsp; objectClass&nbsp;&nbsp;&nbsp;&nbsp; eq<br>index entryUUID eq<br><br>syncrepl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rid=0<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; provider=ldap://info.domain.com:389
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; starttls=yes<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bindmethod=simple<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &nbsp;&nbsp; &nbsp; binddn=&quot;cn=syncuser,dc=domain,dc=com&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; credentials=secretsyncpasswd<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; searchbase=&quot;dc=domain,dc=com&quot;
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; logbase=&quot;cn=accesslog&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; logfilter=&quot;(&amp;(objectClass=auditWriteObject)(reqResult=0))&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; schemaChecking=on<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type=refreshAndPersist
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; retry=&quot;60 +&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; syncdata=accesslog<br><br>updateref&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ldap://info.domain.com:389<br><br>