Howard Chu wrote:

Michael Ströder wrote:

...

Unfortunately for privacy reasons I can't provide example data.

I'm using slapo-memberof, slapo-refint and slapo-access in exactly this order.

Now I'm analysing some strange things where modifications to group entries and the subsequent modifications by slapo-memberof are not correctly written to the accesslog DB.

Questions:

1. Is this overlay order a correct setup? Should this work? Or should

slapo-memberof be invoked after slapo-access?

Try changing the order and see for yourself.

The order in slapd.conf is now

overlay refint overlay accesslog overlay memberof

But now solely the write operations of slapo-memberof as rootdn are recorded in the accesslog-DB. I would have expected to see only the write operations to the group entries. The latter is obviously what I want.

Ciao, Michael.