PJunod@mediageneral.com wrote:
I have setup two ldap servers for authentication and access control in a multi-master configuration. I am concerned about the number of contextcsn entries that are supposed to be present in each database. Right now there are two servers participating in the multi-master configuration. From my understanding, there should be one contextCSN entry per database per host. My cn=config database has two contextCSN entries as I would expect. One for each syncrepl rid configured. My bdb database only has one contextCSN entry though, with an rid of just “000”. (my rid’s are 001, 002, 101, and 102)
ContextCSN is an attribute. Attributes have values, they do not have entries.
CSNs carry SIDs not RIDs.
If you don't use the correct terminology no one will understand what you're talking about.
If a database contains changes from more than one server, then its contextCSN should contain more than one value, and each value should have distinct SIDs. But the SIDs will only be used correctly if the URLs in the ServerID directive match the actual URLs given to the slapd -h option.
Replication seems to work fine on both databases. I can write to either one and the changes are replicated over immediately. I am just curious about this discrepancy in the number of contextCSN entries. Could someone confirm the number of contextCSN entries per database and if it should match the number of hosts participating in the multi-master replication? Here are some relevant settings for the replication:
dn: cn=config
olcServerID: 1 ldap://<server1>
olcServerID: 2 ldap://<server2>
#######################
# module{0}, config
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib64/openldap2.4
olcModuleLoad: {0}syncprov.la
#######################
# {0}config, config
dn: olcDatabase={0}config,cn=config
olcSyncrepl: {0}rid=001 provider=ldap://<server1> binddn="cn=Ma
nager,cn=config" bindmethod=simple credentials=<password> searchbase="cn=config
" type=refreshAndPersist retry="5 500 5 +" timeout=1 starttls=yes
olcSyncrepl: {1}rid=002 provider=ldap://<server2> binddn="cn=Ma
nager,cn=config" bindmethod=simple credentials=<password> searchbase="cn=config
" type=refreshAndPersist retry="5 500 5 +" timeout=1 starttls=yes
olcMirrorMode: TRUE
#######################
# {0}syncprov, {0}config, config
dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
#######################
# {1}bdb, config
dn: olcDatabase={1}bdb,cn=config
olcSyncrepl: {0}rid=101 provider=ldap://<server1> binddn="cn=Ma
nager,dc=mgcorp,dc=net" bindmethod=simple credentials=<password> searchbase="dc
=mgcorp,dc=net" type=refreshAndPersist interval=00:00:00:10 retry="5 500 5 +"
timeout=1 starttls=yes
olcSyncrepl: {1}rid=102 provider=ldap://<server2> binddn="cn=Ma
nager,dc=mgcorp,dc=net" bindmethod=simple credentials=<password> searchbase="dc
=mgcorp,dc=net" type=refreshAndPersist interval=00:00:00:10 retry="5 500 5 +"
timeout=1 starttls=yes
olcMirrorMode: TRUE
##############################
Here are the results of searches for contextCSN in cn=config and dc=mgcorp,dc=net:
ldapsearch -x -W -s base -D "cn=Manager,cn=config" -h "<server2>" -b "cn=config" contextCSN
contextCSN: 20101110214932.998233Z#000000#000#000000
contextCSN: 20101028121213.444193Z#000000#001#000000
ldapsearch -x -W -s base -D "cn=Manager,dc=mgcorp,dc=net" -h "<server2>" -b "dc=mgcorp,dc=net" contextCSN
contextCSN: 20101110213409.736943Z#000000#000#000000