On Dienstag 12 Juli 2011 19:38:57 Jonathan Underwood wrote:
Hi,
[..]
where rid=001 corresponds to the entry:
olcSyncRepl: rid=001 provider=ldap://auth0.domain bindmethod=sasl saslmech=gssapi searchbase="cn=config" type=refreshAndPersist retry="30 30 300 +" timeout=1
The reason this isn't working is clear: slapd on the consumer is not binding as the rootdn of the cn=config tree, and so therefore cannot search that database.
I am not sure what the best fix is for this, particularly from a security point-of-view. My first thought was to add an ACL to the cn=config database such as olcAccess: to * by users read by * none, but this then opens up the cn=config tree to be readable by any authenticated user, which is somewhat undesirable.
Why not use a more restrictive ACL that only gives the identities read access that really need it? E.g. by using the UID=<username>[[,CN=<realm>],CN=<mechanism>],CN=auth DN form that slapd generates when SASL is used. (If you plan add more mirrormode nodes, it might probably be better to create a group for them)
Does anyone have a suggestion as to a good strategy to allow cn=config replication in this situation?
Thanks in advance, Jonathan.
Ralf