--On Tuesday, June 01, 2010 9:51 AM +0100 "Gocher, Mark" Mark.Gocher.1@city.ac.uk wrote:
I'm receiving the following error on my consumer, using logging -d stats + args + trace + sync 2> /var/log/ldap
@(#) $OpenLDAP: slapd 2.4.22 (May 21 2010 12:10:42) $
@cambridge:/usr/local/openldap-2.4.22/servers/slapd
slapd starting
slap_client_connect: URI=ldap://oxford.unix1.city.ac.uk:389 DN="cn=replicator,dc=city,dc=ac,dc=uk" ldap_sasl_bind_s failed (49)
Error 49 says that an invalid password was provided (or that the DN isn't right).
I have created the uid for replicator and repeated this search with the 'access to attrs=userPassword' line commented out on the provider to ensure that the userPassword for replicator is clear text 'secret'. I can also perform this search from the consumer successfully.
Your provider conf file is a mess. It has a mix of global and database specific directives peppered through it. You load modules after using them, etc. I would spend some time cleaning up your provider's configuration (and possible the replica one too, I didn't look at it closely).
Provider ldap.conf:
database bdb
suffix "dc=city,dc=ac,dc=uk"
rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk"
rootpw {CRYPT}aZmvWMwFgg.vk
Crypt is non portable. You should use SSHA or similar.
directory /var/opt/csw/openldap-data
index default pres,eq,sub
index objectClass eq
index cn
index sn
index uid
access to *
by dn.base="cn=replicator,dc=city,dc=ac,dc=uk" read
by * break
access to attrs=userPassword
by anonymous auth
by * none
access to *
by * read
modulepath /usr/local/openldap-2.4.22
moduleload back_bdb.la
moduleload accesslog.la
moduleload syncprov.la
database bdb
suffix cn=accesslog
directory /var/opt/csw/accesslog
rootdn cn=accesslog
index default eq
index objectClass,reqEnd,reqResult,reqStart
overlay syncprov
syncprov-nopresent TRUE
syncprov-reloadhint TRUE
limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
# database bdb
# suffix "dc=dc=city,dc=ac,dc=uk"
# rootdn "cn=DSAmgr,dc=city,dc=ac,dc=uk"
index entryCSN eq
index entryUUID eq
overlay syncprov
syncprov-checkpoint 1000 60
overlay accesslog
logdb cn=accesslog
logops writes
logsuccess TRUE
logpurge 99+00:00 00+00:01
# Let the replica DN have limitless searches
limits dn.exact="cn=replicator,dc=city,dc=ac,dc=uk" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
database monitor
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration