I also have tried specifying chain-tls:
overlay chain chain-uri "ldap://masterldap.example.com:5389" chain-idassert-bind bindmethod="simple" binddn="cn=Manager,dc=example,dc=com" credentials="secret" mode="self" chain-return-error TRUE chain-tls start tls-cacert="/path/to/my/CA/cert.pem"
but I get the same error. I have verified the validity of the certificates.
Searching in the web, I got a posting of the same problem in a german forum last april. Unfortunately, no solution.
Does anybody know if the chaining overlay works with TLS? I got syncrepl working, but the chaining overlay I can only make it work using a non-secure connection.
-Jorge
-----Original Message----- From: openldap-software-bounces+jmedina=e-dialog.com@OpenLDAP.org [mailto:openldap-software-bounces+jmedina=e-dialog.com@OpenLDAP.org] On Behalf Of Jorge Medina Sent: Tuesday, July 01, 2008 5:22 PM To: openldap-software@openldap.org Subject: FW: Chaining
I mean, I get "TLS negotiation failure" on the syslog when attempting to change an attribute on an entry when using the slave server.
-----Original Message----- From: Jorge Medina Sent: Tuesday, July 01, 2008 5:08 PM To: openldap-software@openldap.org Subject: RE: Chaining
I am trying to create a master-slave replication with chaining overlay enabled in the slave to redirect writes request to the master.
I have it working using ldap:// but I have not been able to configure the chain overlay using a secure connection ldaps:// (running on port 5636 on the master)
My master server do not require client certificates.,
I added the following lines:
overlay chain chain-uri "ldaps://masterldap.example.com:5636" chain-idassert-bind bindmethod="simple" binddn="cn=Manager,dc=example,dc=com" credentials="secret" mode="self" tls_cacert="/path/to/my/CA/cert.pem" chain-return-error TRUE
But I get "TLS negotiation failure" on the syslog
I am using ldaps:// for replication, but I can't configure it for chaining
Any hints?
-----Original Message----- From: Gavin Henry [mailto:ghenry@suretecsystems.com] Sent: Tuesday, July 01, 2008 3:55 AM To: Jorge Medina Cc: openldap-software@openldap.org Subject: Re: Chaining
<quote who="Jorge Medina">
One more question, this time on the chaining overlay.
"What is chaining? It indicates the capability of a DSA to follow referrals on behalf of the client, so that distributed systems are viewed as a single virtual DSA by clients that are otherwise unable to "chase" (i.e. follow) referrals by themselves."
In the example shown athttp://www.openldap.org/doc/admin24/overlays.html#Chaining
Is the chaining overlay example used to forward writerequests from the syncrepl slaves to the master server?
Yes, correct.