Hello all,

I am having problems with chasing referrals on my slave OpenLDAP server. I feel like I'm repeating an older thread here, but despite everything I have read I cannot find a solution.

My setup is as follows: Both the master and the slave are OpenLDAP 2.3.32 builds with the follwing configure parameters, LD_LIBRARY_PATH="/usr/local/lib" ./configure --prefix=/usr/local --disable-ipv6 --with-tls --enable-dynamic --enable-slapd --enable-modules --enable-crypt --enable-bdb --enable-rewrite --enable-backends=yes --enable-rlookups --disable-shell --disable-sql --enable-overlays=yes --enable-slurpd=yes At the end of the email, I have attached both the master and the slave slapd.conf.

The problem is that when I attempt an ldapadd against the slave server, I am returned a referral instead of having the slave forward the request to the master. I see no attempt to contact the master server in either the slave or master logs. Nor do I see any traffic between the two (other than syncrepl stuff) in a tcpdump. As far as I can tell the chain overlay is being ignored entirely.

Any suggestions or fixes would be greatly appreciated.

- Scott Sanders

############################################ # Master slapd.conf -- ldap://info.domain.com:389 ############################################ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema

pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args

password-hash {ssha}

security tls=1 TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificatePath /etc/pki/CA TLSCertificateFile /usr/local/etc/openldap/security/ldap-master.crt TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-master.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSVerifyClient allow

limits dn.exact="cn=syncuser,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

access to attrs=userPassword by self write by dn="cn=admin,dc=domain,dc=com" write by dn="cn=syncuser,dc=domain,dc=com" read by * auth

access to * by dn="cn=admin,dc=domain,dc=com" write by dn="cn=syncuser,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" read by * read

database hdb suffix cn=accesslog directory /usr/local/var/openldap-accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart

overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE

database bdb suffix "dc=domain,dc=com" rootdn "cn=admin,dc=domain,dc=com" rootpw {SSHA}T2JGZSB3Q2x57s/O directory /usr/local/var/openldap-data index objectClass eq index entryCSN eq index entryUUID eq

overlay syncprov syncprov-checkpoint 1000 60

overlay accesslog logdb cn=accesslog logops writes logsuccess true logpurge 07+00:00 01+00:00

############################################ # Slave slapd.conf -- ldap://arch.domain.com ############################################ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema

pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args

password-hash {ssha}

security tls=1 TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificatePath /etc/pki/CA TLSCertificateFile /usr/local/etc/openldap/security/ldap-slave.crt TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-slave.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSVerifyClient allow

access to attrs=userPassword by self write by dn="cn=admin,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" write by * auth

access to * by dn="cn=admin,dc=domain,dc=com" read by dn="cn=syncuser,dc=domain,dc=com" write by * read

database bdb suffix "dc=domain,dc=com" rootdn "cn=admin,dc=domain,dc=com" rootpw {SSHA}T2JGZkB3Q2x57s/O overlay chain chain-uri ldap://info.domain.com:389 chain-rebind-as-user TRUE chain-idassert-bind bindmethod=simple binddn="cn=admin,dc=domain,dc=com" credentials=secret mode=self directory /usr/local/var/openldap-data index objectClass eq index entryUUID eq

syncrepl rid=0 provider=ldap://info.domain.com:389 starttls=yes bindmethod=simple binddn="cn=syncuser,dc=domain,dc=com" credentials=secretsyncpasswd searchbase="dc=domain,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemaChecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog

updateref ldap://info.domain.com:389