Hello everybody

I'm trying to start a two server multimaster installation.

OpenLDAP is 2.4.23 built from sources, bdb 4.8.30

Configure options are: --enable-crypt --enable-overlays -enable-ppolicy --enable-memberof (maybe some are unuseful).

OS is Centos 5.5, patched, virtual machines.

LDAP server are addressed by client thru round-robin DNS registration.

Behaviour: when a ldap user connected to a client try to change it's password thru the passwd command, on the LDAP server connected by the client thru the DNS name resolution, userPassword and shadowLastChange are updated, on the other LDAP server the field userPassword disappear (checked with slapcat).

I suppose that this happen because on userPassword attribute there are ACL's (reported below) that permit only read action to syncuser.

Infact, if I change the syncrepl instances and swap syncuser with admin (rootDN), the password change happens successfully and replica too.

Now the question to the list: if I don't want to have rootDN used for replication, I must give the write permissions to syncuser to guarantee the replica, leaving the "bug" to have the a write account password written in clear text in config file ? There's a smarter method to reach the goal ?

I apologize if solution is written on the documentation, but I've tried to find without success.

Slapd config is still supplied thru slapd.conf.

These are acl on bdb instance on userPassword and shadowLastChange attributes:

access to attrs=userPassword

by dn="cn=admin,dc=somedomain,dc=it" write

by dn.base="cn=syncuser,ou=People,dc=somedomain,dc=it" read

by anonymous auth

by self write

by * none

access to attrs=shadowLastChange

by dn="cn=admin,dc=somedomain,dc=it" write

by dn.base="cn=syncuser,ou=People,dc=somedomain,dc=it" read

by self write

by * read

syncrepl is configured as follow:

syncrepl rid=000

provider=ldap://server1.somedomain.it:389

type=refreshAndPersist

retry="5 5 300 +"

searchbase="dc=somedomain,dc=it"

attrs="*,+"

bindmethod=simple

binddn="cn=syncuser,dc=somedomain,dc=it"

credentials=syncuser_password

syncrepl rid=001

provider=ldap://server2.somedomain.it:389

type=refreshAndPersist

retry="5 5 300 +"

searchbase="dc=somedomain,dc=it"

attrs="*,+"

bindmethod=simple

binddn="cn=syncuser,dc=somedomain,dc=it"

credentials=syncuser_password

MirrorMode TRUE

Obviously servers are identified as serverID 001 and serverID 002 and both are started to listen only on their FQDN.

Thanks to all for attention and support.

Roberto Nunin

Comifar Service SpA

Italy

Questo messaggio e' indirizzato esclusivamente al destinatario indicato e potrebbe contenere informazioni confidenziali, riservate o proprietarie. Qualora la presente venisse ricevuta per errore, si prega di segnalarlo immediatamente al mittente, cancellando l'originale e ogni sua copia e distruggendo eventuali copie cartacee. Ogni altro uso e' strettamente proibito e potrebbe essere fonte di violazione di legge.

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately, deleting the original and all copies and destroying any hard copies. Any other use is strictly prohibited and may be unlawful.