Hi all,<br>Me too I am interested in knowing how forward_updates works in a multi-master environment .<br><br>If someone could share some experience about this, I would appreciate very much! :-)<br><br>Thanks in advance<br>

Marco<br><br><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Jonathan Clarke</b> <span dir="ltr">&lt;<a href="mailto:jonathan@phillipoux.net">jonathan@phillipoux.net</a>&gt;</span><br>

Date: Tue, Mar 2, 2010 at 12:33 PM<br>Subject: Re: syncrepl not working for pwdFailureTime attribute<br>To: <a href="mailto:openldap-technical@openldap.org">openldap-technical@openldap.org</a><br><br><br><div><div></div>
<div class="h5">
On 02/03/2010 11:51, Alex Samad wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hi<br>
<br>
I have setup a multi master as per the online doco.<br>
<br>
When I was checking recently, the 2 DB were out of sync, some record<br>
hadn&#39;t been transferred over, I force this by setting -c rid=,csn=<br>
<br>
<br>
But whilst checking this, I noticed that some attributes haven&#39;t been<br>
moved across pwdFailureTime was on a record on the primary ldap server and<br>
not on the secondary master, try what I could I couldn&#39;t force it over<br>
<br>
is this a feature or a bug  ?<br>
</blockquote>
<br></div></div>
The password policy overlay writes updates to the local database only, by default.<br>
<br>
As of recent-ish versions of OpenLDAP 2.4.*, an option is available to forward these updates via the frontend. The man page describes it:<br>
<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
       ppolicy_forward_updates<br>
              Specify that policy state changes that result from Bind operations (such as recording<br>
              failures, lockout, etc.) on a consumer should be forwarded to  a  master  instead  of<br>
              being  written directly into the consumer’s local database. This setting is only use‐<br>
              ful on a replication consumer, and also requires  the  updateref  setting  and  chain<br>
              overlay to be appropriately configured.<br>
</blockquote>
<br>
This option was clearly designed for read-only slaves.<br>
<br>
I&#39;m not sure what the behaviour would be in a multi-master setup. You could try this anyway. Any ideas from someone else?<br>
<br>
Regards,<br>
Jonathan<br><font color="#888888">
-- <br>
--------------------------------------------------------------<br>
Jonathan Clarke - <a href="mailto:jonathan@phillipoux.net" target="_blank">jonathan@phillipoux.net</a><br>
--------------------------------------------------------------<br>
Ldap Synchronization Connector (LSC) - <a href="http://lsc-project.org" target="_blank">http://lsc-project.org</a><br>
--------------------------------------------------------------<br>
</font></div><br><br clear="all"><br>-- <br>_________________________________________<br>Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi.<br>					Jim Morrison<br>