Trying to figure out if this search is being denied. I wouldn't think so but the last 3 lines at the end suggest otherwise.
5552876b conn=1000 fd=21 ACCEPT from IP=172.29.34.47:42310 (IP=0.0.0.0:389)
5552876b conn=1000 op=0 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" method=128
5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com"
5552876b => bdb_entry_get: found entry: "cn=defaultpp,ou=policies,dc=doesn't_matter,dc=com"
5552876b => access_allowed: result not in cache (userPassword)
5552876b => access_allowed: auth access to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" "userPassword" requested
5552876b => acl_get: [1] attr userPassword
5552876b => acl_mask: access to entry "uid=an_admin,ou=People,dc=doesn't_matter,dc=com", attr "userPassword" requested
5552876b => acl_mask: to value by "", (=0)
5552876b <= check a_dn_pat: self
5552876b <= check a_dn_pat: anonymous
5552876b <= acl_mask: [2] applying auth(=xd) (stop)
5552876b <= acl_mask: [2] mask: auth(=xd)
5552876b => slap_access_allowed: auth access granted by auth(=xd)
5552876b => access_allowed: auth access granted by auth(=xd)
5552876b conn=1000 op=0 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" mech=SIMPLE ssf=0
5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com"
5552876b conn=1000 op=0 RESULT tag=97 err=0 text=
5552876b conn=1000 op=1 BIND anonymous mech=implicit ssf=0
5552876b conn=1000 op=1 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" method=128
5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com"
5552876b => bdb_entry_get: found entry: "cn=defaultpp,ou=policies,dc=doesn't_matter,dc=com"
5552876b => access_allowed: result not in cache (userPassword)
5552876b => access_allowed: auth access to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" "userPassword" requested
5552876b => acl_get: [1] attr userPassword
5552876b => acl_mask: access to entry "uid=an_admin,ou=People,dc=doesn't_matter,dc=com", attr "userPassword" requested
5552876b => acl_mask: to value by "", (=0)
5552876b <= check a_dn_pat: self
5552876b <= check a_dn_pat: anonymous
5552876b <= acl_mask: [2] applying auth(=xd) (stop)
5552876b <= acl_mask: [2] mask: auth(=xd)
5552876b => slap_access_allowed: auth access granted by auth(=xd)
5552876b => access_allowed: auth access granted by auth(=xd)
5552876b conn=1000 op=1 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" mech=SIMPLE ssf=0
5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com"
5552876b conn=1000 op=1 RESULT tag=97 err=0 text=
5552876b begin get_filter
5552876b PRESENT
5552876b end get_filter 0
5552876b conn=1000 op=2 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
5552876b conn=1000 op=2 SRCH attr=* + altServer changelog firstChangeNumber lastChangeNumber lastPurgedChangeNumber namingContexts subschemaSubentry supportedAuthPasswordSchemes supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms vendorName vendorVersion
5552876b => test_filter
5552876b PRESENT
5552876b => access_allowed: search access to "" "objectClass" requested
5552876b => slap_access_allowed: backend default search access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: search access granted by read(=rscxd)
5552876b <= test_filter 6
5552876b => access_allowed: read access to "" "entry" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result not in cache (objectClass)
5552876b => access_allowed: read access to "" "objectClass" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (objectClass)
5552876b => access_allowed: result not in cache (structuralObjectClass)
5552876b => access_allowed: read access to "" "structuralObjectClass" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result not in cache (configContext)
5552876b => access_allowed: read access to "" "configContext" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result not in cache (namingContexts)
5552876b => access_allowed: read access to "" "namingContexts" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (namingContexts)
5552876b => access_allowed: result not in cache (monitorContext)
5552876b => access_allowed: read access to "" "monitorContext" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result not in cache (supportedControl)
5552876b => access_allowed: read access to "" "supportedControl" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result was in cache (supportedControl)
5552876b => access_allowed: result not in cache (supportedExtension)
5552876b => access_allowed: read access to "" "supportedExtension" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (supportedExtension)
5552876b => access_allowed: result was in cache (supportedExtension)
5552876b => access_allowed: result was in cache (supportedExtension)
5552876b => access_allowed: result not in cache (supportedFeatures)
5552876b => access_allowed: read access to "" "supportedFeatures" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (supportedFeatures)
5552876b => access_allowed: result was in cache (supportedFeatures)
5552876b => access_allowed: result was in cache (supportedFeatures)
5552876b => access_allowed: result was in cache (supportedFeatures)
5552876b => access_allowed: result was in cache (supportedFeatures)
5552876b => access_allowed: result not in cache (supportedLDAPVersion)
5552876b => access_allowed: read access to "" "supportedLDAPVersion" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result not in cache (supportedSASLMechanisms)
5552876b => access_allowed: read access to "" "supportedSASLMechanisms" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result not in cache (entryDN)
5552876b => access_allowed: read access to "" "entryDN" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (entryDN)
5552876b => access_allowed: result not in cache (subschemaSubentry)
5552876b => access_allowed: read access to "" "subschemaSubentry" requested
5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com"
5552876b => access_allowed: read access granted by read(=rscxd)
5552876b => access_allowed: result was in cache (subschemaSubentry)
5552876b conn=1000 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=
5552876b begin get_filter
5552876b EQUALITY
5552876b end get_filter 0
5552876b conn=1000 op=3 SRCH base="cn=accesslog" scope=2 deref=0 filter="(uid=global.admin)"
5552876b => access_allowed: search access to "cn=accesslog" "entry" requested
5552876b => acl_get: [1] attr entry
5552876b => acl_mask: access to entry "cn=accesslog", attr "entry" requested
5552876b => acl_mask: to all values by "uid=an_admin,ou=people,dc=doesn't_matter,dc=com", (=0)
5552876b <= check a_dn_pat: cn=admin,dc=doesn't_matter,dc=com
5552876b <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
5552876b <= acl_mask: no more <who> clauses, returning =0 (stop)
5552876b => slap_access_allowed: search access denied by =0
5552876b => access_allowed: no more rules
5552876b conn=1000 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text=
So the application is a java application and the developers haven't a clue on how to debug the java ldap side. I am not sure why it's looking at accesslog in the context of this connection, and it shouldn't have access to accesslog but it shouldn't matter anyway, accesslog is database{1} and the actual suffix to be searched is database{3}
User uid=an_admin,ou=People,dc=doesn't_matter,dc=com is pretty much allowed to do anything in the suffixed database {dc=doesn't_matter,dc=com}
My contention is that there isn't an error here but the application isn't happy with the new setup and as I said, they are not knowledgeable about how to debug from the java side.
Does this log indicate an error? (I know err=32 is no such object)
Craig
