Hi,
 
I want to configure openldap to work as a proxy for Active Directory.
I have :

This work fine but I have a problem with this type of filter :
- ldapsearch -x  -D "cn=manager,dc=openldap,dc=priv" -W "(&(objectClass=*)(whenChanged>=20080812000000.0Z))"
- ldapsearch -x  -D "cn=manager,dc=openldap,dc=priv" -W "(&(objectClass=*)(modifyTimestamp>=20080812000000.0Z))"

=> I have no result

But with this type of filter : ldapsearch -x  -D "cn=manager,dc=opencg21,dc=priv" -W "(&(objectClass=*)(uid=MyUsername))"

=> I can see the whenChanged and modifyTimestamp attributes.

Can someone help me?

I don't know how to have an error code to see where is the pb

Thanks a lot.

----------------------------------------------

here is my slapd.conf

--------------------------------------------


#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include  /etc/openldap/schema/corba.schema
include  /etc/openldap/schema/core.schema
include  /etc/openldap/schema/cosine.schema
include  /etc/openldap/schema/duaconf.schema
include  /etc/openldap/schema/dyngroup.schema
include  /etc/openldap/schema/inetorgperson.schema
include  /etc/openldap/schema/java.schema
include  /etc/openldap/schema/misc.schema
include  /etc/openldap/schema/nis.schema
include  /etc/openldap/schema/openldap.schema
include  /etc/openldap/schema/ppolicy.schema
include  /etc/openldap/schema/collective.schema
include  /etc/openldap/schema/microsoft-minimal.schema
# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile  /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time
# modulepath /usr/lib/openldap
# modulepath /usr/lib64/openldap
# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
# moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la
moduleload back_ldap
moduleload rwm

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile "\"OpenLDAP Server\""
TLSCertificateKeyFile /etc/openldap/certs/password
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
#  Allow self write access
#  Allow authenticated users read access
#  Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

# enable on-the-fly configuration (cn=config)
database config
access to *
 by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
 by * none
# enable server status monitoring (cn=monitor)
database monitor
access to *
 by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
        by dn.exact="cn=Manager,dc=opencg21,dc=priv" read
        by * none
############################################################
#LDAP
############################################################
database  ldap
suffix   "OU=MYOU,DC=MYDC,DC=PRIV"
uri ldap://mydc.cg21.priv
rebind-as-user
acl-bind
                bindmethod=simple
                binddn="CN=****,DC=PRIV"
                credentials="***"
idassert-bind  
  bindmethod=simple
  binddn="CN=****,DC=PRIV"
        credentials="***"
  mode=none
lastmod  on
idassert-authzFrom *
access to *
 by * read
############################################################
#RELAY
############################################################
database relay
suffix  "ou=myOU,dc=openldap,dc=priv"
relay  "ou=myOU,dc=mydc,dc=priv"
subordinate
overlay rwm
rwm-rewriteEngine on
rwm-rewriteContext default
rwm-rewriteRule "(.+,)?ou=myOU,dc=openldap,dc=priv$" "$1ou=myOU,dc=mydc,dc=priv" ":"
rwm-rewriteContext searchEntryDN
rwm-rewriteContext searchAttrDN
rwm-rewriteRule "(.+,)?dc=openldap,dc=priv$" "$1dc=openldap,dc=priv" ":"
rwm-rewriteContext searchFilter
rwm-rewriteContext referralAttrDN
rwm-rewriteContext referralDN
rwm-map attribute uid sAMAccountName
rwm-map attribute modifyTimestamp modifyTimestamp 
#rwm-map objectclass inetOrgPerson *
rwm-map objectclass groupOfNames group
rwm-normalize-mapped-attrs yes

#############################################################
#DATABASE PRINCIPALE
############################################################
database bdb
suffix  "dc=openldap,dc=priv"
checkpoint 1024 15
rootdn  "cn=Manager,dc=openldap,dc=priv"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw  {SSHA}qGb9L/sewV24o10bQNynt3Kb2Uyv0Ac8  
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap
lastmod  on
# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid   eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
#index samaccountname
# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
#     bindmethod=sasl saslmech=GSSAPI
#     authcId=host/ldap-master.example.com@EXAMPLE.COM




  

Ce message (pièces jointes comprises) est protégé par des règles relatives
au secret des correspondances ; il peut en outre contenir des informations à
caractère  confidentiel ; il est établi  à destination  exclusive de son destinataire.
Toute  divulgation, utilisation, diffusion  ou  reproduction (totale ou partielle) de
ce message, ou des informations  qu'il contient, doit être préalablement autorisée.
Tout message électronique est susceptible d'altération et son intégrité ne peut
être  assurée. Le  Conseil Général  de  la  Côte d'Or décline toute responsabilité
au  titre  de  ce message, s'il a été modifié ou falsifié.
Si  vous  n'êtes  pas  destinataire  de  ce message, merci  de le détruire
immédiatement et d'avertir l'expéditeur de l'erreur de distribution et de la
destruction du message.
Toute opinion  contenue  dans  ce  message appartient à son auteur : pour qu'il
engage la responsabilité de l'institution, il doit être confirmé par un écrit et son
auteur doit être dûment habilité.