Hello all, I just began to deploy a testbed with the 2.7 RC, which introduces the compare op for the slapo-otp [1]. TOTP verification works well on a standalone slapd, or a slapd provider DB.
1: https://git.openldap.org/openldap/openldap/-/merge_requests/755
I’m stuck with a configuration issue that I haven’t been able to resolve. In our environment the authentication-clients send TOTP verification requests against a slapd which runs a syncrepl'icated DB; not against the provider. The problem now is that the syncrepl DB is read-only and the slapo-otp overlay wants to update the attributes of the user-entry about the last successful TOTP verification (`attrs=oathTOTPLastTimeStep, oathTOTPTimeStepDrift`). This fails and the error message says 'otp_check_and_update: failed to invalidate provided token rc=53: shadow context; no update referral'
I had a go with adding the `updateref` to the syncrepl DB which points back to the provider. The modification of the entry would be sent to the provider and from there distributed to all providers and consumers. Adding `updateref` did not work unfortunately. The error message now says `otp_check_and_update: failed to invalidate provided token rc=10:`
I cannot tell where the problem lies. I tried to tune the ACLs on the provider. I opened write access step by step to those entries, ending up with a write access to anonymous. Withour success. I have the suspicion that slapo-otp and the updateref would not work together. I could not figure out if modifications are sent back to the updateref at all.
How does updateref with syncrepl is supposed to work? Should the syncrepl-client sending updates to the ref with it's credentials?
I would be happy to discuss this issue.
I'll paste parts of the configuration of the slapds below. Also the logmessages from the ldapcompare calls
Many thanks in advance,
slapd provider db config: ``` database mdb suffix dc=fz-juelich,dc=de rootdn cn=admin,dc=fz-juelich,dc=de rootpw ... dbnosync overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 overlay otp index ... multiprovider on ```
slapd consumer db config: ``` database mdb suffix dc=fz-juelich,dc=de rootdn cn=admin,dc=fz-juelich,dc=de rootpw ... dbnosync overlay otp syncrepl rid="1" provider="ldap://test_p0" bindmethod="simple" binddn="cn=consumer,..." keepalive="180:9:75" searchbase="dc=fz-juelich,dc=de" schemachecking="on" type="refreshAndPersist" retry="20 3 60 10 300 +" updateref ldap://test_p0 index ... monitoring on ```
slapd log without `updateref`: ``` conn=1000 fd=14 ACCEPT from IP=... conn=1000 fd=14 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 conn=1000 op=0 BIND dn="" method=128 conn=1000 op=0 RESULT tag=97 err=0 qtime=0.000010 etime=0.000055 text= conn=1000 op=1 CMP dn="uid=user,..." attr="oathSecret" conn=1000 op=1 otp_check_and_update: failed to invalidate provided token rc=53: shadow context; no update referral conn=1000 op=1 RESULT tag=111 err=5 qtime=0.000009 etime=0.000310 text= conn=1000 op=2 UNBIND conn=1000 fd=14 closed ```
slapd log with `updateref`: ``` conn=1005 fd=14 ACCEPT from IP=... conn=1005 fd=14 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 conn=1005 op=0 BIND dn="" method=128 conn=1005 op=0 RESULT tag=97 err=0 qtime=0.000010 etime=0.000083 text= conn=1005 op=1 CMP dn="uid=user,..." attr="oathSecret" conn=1005 op=1 otp_check_and_update: failed to invalidate provided token rc=10: conn=1005 op=1 RESULT tag=111 err=5 qtime=0.000009 etime=0.000231 text= conn=1005 op=2 UNBIND conn=1005 fd=14 closed ```