Hi
I try to configure two openldap/kerberos server (provider and consumer), but I'm having some issues about replication. Under LDAP log, I have many entries like this: "slap_access_allowed: search access denied by none(=0)"
These messages are related to consumer access to the Kerberos database on provider and the kerberos database can't be replicated to the consumer. The others data are replicated normaly.
These are the ACL under privider: olcAccess: {0}to attrs=userPassword,shadowLastChange by dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" read by anonymous auth by * none
olcAccess: {1}to dn.subtree="ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" by dn="cn=krbadm,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" write by dn="cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" read by dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" read by * none
olcAccess: {2}to attrs=loginShell by self write by users read by * none
olcAccess: {3}to dn.base="" by * read
olcAccess: {4}to * by users read by * none
And bellow the ldap log snnipet:
=> access_allowed: search access to "cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" "objectClass" requested Oct 4 12:00:29 dns01 slapd[1163]: => dn: [2] ou=kerberos,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: => acl_get: [2] matched Oct 4 12:00:29 dns01 slapd[1163]: => acl_get: [2] attr objectClass Oct 4 12:00:29 dns01 slapd[1163]: => acl_mask: access to entry "cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br", attr "objectClass" requested Oct 4 12:00:29 dns01 slapd[1163]: => acl_mask: to all values by "uid=host/dns02.unisim.cepetro.unicamp.br,ou=users,dc=unisim,dc=cepetro,dc=unicamp,dc=br", (=0) Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: cn=krbadm,ou=kerberos,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: cn=krbkdc,ou=kerberos,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: ou=consumers,ou=ldap,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: * Oct 4 12:00:29 dns01 slapd[1163]: <= acl_mask: [4] applying none(=0) (stop) Oct 4 12:00:29 dns01 slapd[1163]: <= acl_mask: [4] mask: none(=0) Oct 4 12:00:29 dns01 slapd[1163]: => slap_access_allowed: search access denied by none(=0) Oct 4 12:00:29 dns01 slapd[1163]: => access_allowed: no more rules
Can anyone help me?
Regards
Daniel