hi¡¡ I have working openldap, and I want to add replication, I follow hpwtos from many maillist but it doesn't works, my slapd.conf files are:

MASTER:

# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options.

####################################################################### # Global Directives:

# Features to permit #allow bind_v2

# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema #include /etc/ldap/schema/autofs.schema #include /etc/ldap/schema/krb5-kdc.schema

#include /etc/ldap/schema/unixtng.schema

#include /etc/ldap/schema/krb5-kdc.schema

# Schema check allows for forcing entries to # match schemas for their objectClasses's schemacheck on

# Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server argsfile /var/run/slapd.args

# Read slapd.conf(5) for possible values loglevel 0

# Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_ldbm

sasl-realm IRONMAN.ES sasl-host shogun.ironman.es

#################TLS/SSL#################### # Certificado firmado de una entidad certificadora y # el certificado del servidor

TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem

# Si desea que el cliente necesite autentificaci�, # descomente la siguiente l�ea #TLSVerifyClient demand # ... si no, descomente esta otra TLSVerifyClient never

####################################################################### # Specific Backend Directives for ldbm: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend ldbm

####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other>

####################################################################### # Specific Directives for database #1, of type ldbm: # Database specific directives apply to this databasse until another # 'database' directive occurs database ldbm

# The base of your directory in database #1 suffix "dc=ironman,dc=es" rootdn "cn=admin,dc=ironman,dc=es" rootpw secret

#########REPLICA#############

replica host=shinobi.ironman.es:636 tls=yes bindmethod=sasl

binddn="cn=replicauser,dc=ironman,dc=es"

saslmech=gssapi

replogfile /var/lib/ldap/openldap-master-replog

##############################

# Where the database file are physically stored for database #1 directory "/var/lib/ldap"

# Indexing options for database #1 # Requerido por OpenLDAP index objectclass eq

index default sub index cn pres,sub,eq index sn pres,sub,eq

# Requerido para soportar pdb_getsampwnam index uid pres,sub,eq

# Requerido para soportar pdb_getsambapwrid() index displayName pres,sub,eq

# Descomente las siguientes l�eas si est�almacenando entradas # posixAccount y posixGroup en el directorio index uidNumber eq index gidNumber eq index memberUid eq

# Samba 3.* index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq

# Include the access lists include /etc/ldap/slapd.access

# Save the time that the entry gets modified, for database #1 lastmod on

# Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog

# The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by anonymous auth # by self write # by * none

# Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. #access to dn.base="" by * read

# The admin dn has full write access, everyone else # can read everything. #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by * read

# For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=ironman,dc=es" write # by dnattr=owner write

####################################################################### # Specific Directives for database #2, of type 'other' (can be ldbm too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other>

# The base of your directory for database #2 #suffix "dc=debian,dc=org"

SLAVE

# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options.

####################################################################### # Global Directives:

# Features to permit #allow bind_v2

# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/samba.schema #include /etc/ldap/schema/autofs.schema #include /etc/ldap/schema/krb5-kdc.schema

#include /etc/ldap/schema/unixtng.schema

#include /etc/ldap/schema/krb5-kdc.schema

# Schema check allows for forcing entries to # match schemas for their objectClasses's schemacheck on

# Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid

# List of arguments that were passed to the server argsfile /var/run/slapd.args

# Read slapd.conf(5) for possible values loglevel 0

# Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_ldbm

sasl-realm IRONMAN.ES sasl-host shogun.ironman.es

#################TLS/SSL#################### # Certificado firmado de una entidad certificadora y # el certificado del servidor

TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateFile /etc/ldap/ssl/server.pem TLSCertificateKeyFile /etc/ldap/ssl/server.pem

# Si desea que el cliente necesite autentificaci�, # descomente la siguiente l�ea #TLSVerifyClient demand # ... si no, descomente esta otra TLSVerifyClient never

####################################################################### # Specific Backend Directives for ldbm: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend ldbm

####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other>

####################################################################### # Specific Directives for database #1, of type ldbm: # Database specific directives apply to this databasse until another # 'database' directive occurs database ldbm

# The base of your directory in database #1 suffix "dc=ironman,dc=es" rootdn "cn=admin,dc=ironman,dc=es" rootpw secret

#########ESCLAVO#############

updatedn cn=replicauser,dc=ironman,dc=es updateref ldaps://shogun.ironman.es ##############################

# Where the database file are physically stored for database #1 directory "/var/lib/ldap"

# Indexing options for database #1 # Requerido por OpenLDAP index objectclass eq

index default sub index cn pres,sub,eq index sn pres,sub,eq

# Requerido para soportar pdb_getsampwnam index uid pres,sub,eq

# Requerido para soportar pdb_getsambapwrid() index displayName pres,sub,eq

# Descomente las siguientes l�eas si est�almacenando entradas # posixAccount y posixGroup en el directorio #index uidNumber eq #index gidNumber eq #index memberUid eq

# Samba 3.* index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq

# Include the access lists #include /etc/ldap/slapd.access access to * by dn=cn=replicauser,dc=ironman,dc=es write by * read

# Save the time that the entry gets modified, for database #1 lastmod on

# Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog

# The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only #access to attrs=userPassword # by dn="cn=admin,dc=ironman,dc=es" write # by anonymous auth # by self write # by * none

# Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. #access to dn.base="" by * read

# The admin dn has full write access, everyone else # can read everything. #access to * # by dn="cn=admin,dc=ironman,dc=es" write # by * read

# For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=ironman,dc=es" write # by dnattr=owner write

####################################################################### # Specific Directives for database #2, of type 'other' (can be ldbm too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other>

# The base of your directory for database #2 #suffix "dc=debian,dc=org"

I add user replicauser to ldap, and I add the key to kerberos database by:

kadmin.local -q "addprinc -randkey replicauser@IRONMAN.ES"

kadmin.local -q "ktadd -k /etc/krb5.keytab.slurpd replicauser" kinit -r 7d -k -t /etc/krb5.keytab.slurpd replicauser@IRONMAN.ES

thanks