Hi ,

 

My application was using replication using Slurpd .

Now, we want to move to openldap version 2.4 (RHEL 6.x)from 2.2, so I should use syncrepl  instead slurpd. Replication clients(slaves) can still be of older version(2.2)

 

I am tried to replication setup using sincerely using doc http://www.openldap.org/doc/admin24/replication.html

I am following first of two topologies suggested for replacing slurped in doc http://www.openldap.org/doc/admin24/replication.html

It says (Master/Provider configuration) ---àProxy consumer configuration --sincerely-àold Slaves(which were working with slurpd)

 

Following are my Master and Proxy configuration file they are similar to what above documents says

 

 

Master slapd.conf [ /usr/sbin/slapd -h ldap://localhost:389 -f /usr/share/openldap-servers/slapd.conf ]

--------------------------------------------------------------------------------------------------------------------------------------------------------------

access to *

             by dn.base="cn=replicator,dc=Avaya" write

             by dn.base="cn=root,dc=Avaya" write

             by dn.base=umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya read

             by * break

access to dn.base=""

                by * read

access to dn.base="dc=Avaya"

                by * read

access to dn.subtree="ou=People,dc=Avaya"

            by dn.exact="cn=root,dc=Avaya" write

            by users read

            by * read

access to *

                by self write

                by * read

database        bdb

suffix          "dc=Avaya"

rootdn          "cn=root,dc=Avaya"

rootpw          secret

rootpw          Testpw

 

# The database directory MUST exist prior to running slapd AND

# should only be accessible by the slapd and slap tools.

# Mode 700 recommended.

password-hash {CLEARTEXT},{SHA},{SSHA}

directory       /var/lib/ldap

 

index objectClass                       eq

index       default     sub

index ou,cn,mail,surname,givenname      eq,pres,sub

index nisMapName,nisMapEntry            eq,pres,sub

index entryCSN eq

index entryUUID eq

 

checkpoint      1024 15

cachesize       10000

idlcachesize    10000

#syncrepl Provider for primary db

        overlay syncprov

        syncprov-checkpoint 1000 60

        # Let the replica DN have limitless searches

        limits dn.exact="umObjectGUID=218afb42cb5e11e09542001a64e587d4,ou=People,dc=Avaya" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

        limits dn.exact="cn=replicator,dc=Avaya" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

 

 

 

 

Proxy slapd_p.conf  [ /usr/sbin/slapd -h ldap://localhost:50389 -f /usr/share/openldap-servers/slapd_p.conf ]

--------------------------------------------------------------------------------------------------------------------------------------------------------------

access to *

        by * read

        # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap

        database        ldap

        # ignore conflicts with other databases, as we need to push out to same suffix

        hidden              on

        suffix          "dc=Avaya"

        rootdn         "cn=slapd-ldap,dc=Avaya"

        uri     ldap://localhost:50389

        rootpw          secret

        rootpw          testing

        lastmod         on

        acl-bind     bindmethod=simple

binddn=”cn=replicator,dc=Avaya”

credentials=Testpw

                        #binddn="umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya"

                        #credentials=1234

        syncrepl        rid=001

                        provider=ldap://localhost:389/

                        binddn=”cn=replicator,dc=Avaya”

                        #binddn="umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya

                        bindmethod=simple

                        credentials=Testpw

                        #credentials=1234

                        searchbase="dc=Avaya"

                        type=refreshAndPersist

                        retry="5 5 300 5"

        overlay         syncprov

 

 

 

1)I am able to query Master database but not to proxy database why so ?

ps -ef | grep slapd

/usr/sbin/slapd -h ldap://localhost:389 -f /usr/share/openldap-servers/slapd.conf

/usr/sbin/slapd -h ldap://localhost:50389 -f /usr/share/openldap-servers/slapd_P.conf

 

lsearch query to master database(port 389) is working

/usr/bin/ldapsearch  -x -h localhost -p 389 -D"cn=root,dc=Avaya" -w w00dstock -b"dc=Avaya" '(objectClass=*)'

 

Why following query to proxy (50389) is failing even though database has read permissions to everyone .

 

/usr/bin/ldapsearch  -x -h localhost -p 50389 -D"cn=slapd-ldap" -w w00dstock -b"dc=Avaya" '(objectClass=*)'

ldap_bind: Invalid credentials (49)

 

2)is  "cn=replicator,dc=Avaya" here should be rootdn user or normal database(slapd) user ?.

 

I tried this ldap slapd user "umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya” and with password ”1234” and restarting both master and proxy still query fails

 

Can you point me where am I wrong ?

 

 

Thanks

Rupesh