Hi all, I tried for some days to make refint overlay work with refint_nothing filled. The slapo-refint man page says : refint_nothing <string> Specify an arbitrary value to be used as a placeholder when the last value would otherwise be deleted from an attribute. This can be useful in cases where the schema requires the existence of an attribute for which referential integrity is enforced. The attempted deletion of a required attribute will otherwise result in an Object Class Violation, causing the request to fail. The string must be a valid DN. but each time I try to delete the last member from a groupOfNames group, the deletion is refused because of schema violation. That's ok without refint_nothing but with the string set it should replace last member, right ? I tried to increase loglevel to 16383 but can't see any debug for refint overlay. So I'm not sure if refint is working or not. Is there another way to have some debug information from refint ? I have included my configuration, ldap tree and log content below. For the logs, I have snipped the content to the error directly but can provide full log if required. The tests are running on debian jessie 8.2 and slapd version 2.4.40+dfsg-1. And I know I can place the placeholder manually but doing it by hand each time is not what I want and, more important, I want to understand why the module is not worrking like it should. I hope I have posted to the right list and if there is something missing please ask. Thanks for help. ######### START CONF LDIF ######## dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: a00e3106-20ce-1035-8943-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z olcLogLevel: 16383 entryCSN: 20151116173108.585343Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116173108Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}refint olcModuleLoad: {2}memberof.la structuralObjectClass: olcModuleList entryUUID: a00edd9a-20ce-1035-894b-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116172537.271031Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116172537Z dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: a00e5a96-20ce-1035-8946-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.131180Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116165546Z ... schema listing skipped as they are not modified ... dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb structuralObjectClass: olcBackendConfig entryUUID: a00ef6cc-20ce-1035-894c-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.135178Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116165546Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: a00e4ec0-20ce-1035-8944-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.130875Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151116165546Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcRootDN: cn=admin,cn=config structuralObjectClass: olcDatabaseConfig entryUUID: a00e5654-20ce-1035-8945-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z olcRootPW:: e1NTSEF9NkdpY3VMWFhTUGpBa1IzM3UzcnkxVm1qY2N2ZVZXNHY= entryCSN: 20151116170655.978168Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116170655Z dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=nodomain olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=nodomain olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: a00efa64-20ce-1035-894d-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z olcRootPW:: e1NTSEF9SlExdmxnN1E0a0hNTTZtanZzdEtIcHBSYjBmNHJyaGI= entryCSN: 20151116170852.768823Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116170852Z dn: olcOverlay={0}refint,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {0}refint structuralObjectClass: olcRefintConfig entryUUID: cd95de54-20d2-1035-86bf-517b01ed1806 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151116172540Z olcRefintNothing: uid=myuser2,ou=users,dc=nodomain olcRefintAttribute: member entryCSN: 20151116174304.336010Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116174304Z ######### END CONF LDIF ######## ######### START DB LDIF ######## dn: dc=nodomain objectClass: top objectClass: dcObject objectClass: organization o: nodomain dc: nodomain structuralObjectClass: organization entryUUID: a01fd816-20ce-1035-8deb-e11fbfc8d840 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116165546Z entryCSN: 20151116165546.245753Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116165546Z dn: cn=admin,dc=nodomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9Z2doUHZPQVo2dnV5NzVSY1dFLzhhUFNGQjVZY1FXRHY= structuralObjectClass: organizationalRole entryUUID: a02629b4-20ce-1035-8dec-e11fbfc8d840 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116165546Z entryCSN: 20151116165546.287209Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116165546Z dn: ou=groups,dc=nodomain objectClass: organizationalUnit objectClass: top ou: groups structuralObjectClass: organizationalUnit entryUUID: 25ff55cc-20d1-1035-86b9-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171349Z entryCSN: 20151116171349.840889Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171349Z dn: ou=users,dc=nodomain objectClass: organizationalUnit objectClass: top ou: users structuralObjectClass: organizationalUnit entryUUID: 351d4e6a-20d1-1035-86ba-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171415Z entryCSN: 20151116171415.203147Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171415Z dn: uid=myuser1,ou=users,dc=nodomain cn: myuser1 objectClass: inetOrgPerson objectClass: top sn: myuser1 uid: myuser1 structuralObjectClass: inetOrgPerson entryUUID: bba534d4-20d1-1035-86bb-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171800Z entryCSN: 20151116171800.908475Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171800Z dn: uid=myuser2,ou=users,dc=nodomain cn: myuser2 objectClass: inetOrgPerson objectClass: top sn: myuser2 uid: myuser2 structuralObjectClass: inetOrgPerson entryUUID: d175bac2-20d1-1035-86bc-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171837Z entryCSN: 20151116171837.507205Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171837Z dn: cn=mygroup1,ou=groups,dc=nodomain cn: mygroup1 member: uid=myuser1,ou=users,dc=nodomain objectClass: groupOfNames objectClass: top structuralObjectClass: groupOfNames entryUUID: f9657978-20d1-1035-86bd-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171944Z entryCSN: 20151116171944.509541Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171944Z ######### END DB LDIF ######## ######### START LOG ######## ... Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: read active on 13 Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=9 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=10 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=11 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_get(13) Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_get(13): got connid=1154 Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_read(13): checking for input on id=1154 Nov 16 18:43:31 vm-rt1 slapd[15110]: op tag 0x66, time 1447695811 Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 do_modify Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 do_modify: dn (cn=mygroup1,ou=groups,dc=nodomain) Nov 16 18:43:31 vm-rt1 slapd[15110]: >>> dnPrettyNormal: <cn=mygroup1,ou=groups,dc=nodomain> Nov 16 18:43:31 vm-rt1 slapd[15110]: <<< dnPrettyNormal: <cn=mygroup1,ou=groups,dc=nodomain>, <cn=mygroup1,ou=groups,dc=nodomain> Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 modifications: Nov 16 18:43:31 vm-rt1 slapd[15110]: #011replace: member Nov 16 18:43:31 vm-rt1 slapd[15110]: #011#011no values Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 MOD dn="cn=mygroup1,ou=groups,dc=nodomain" Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 MOD attr=member Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify: cn=mygroup1,ou=groups,dc=nodomain Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_dn2entry("cn=mygroup1,ou=groups,dc=nodomain") Nov 16 18:43:31 vm-rt1 slapd[15110]: => mdb_dn2id("cn=mygroup1,ou=groups,dc=nodomain") Nov 16 18:43:31 vm-rt1 slapd[15110]: <= mdb_dn2id: got id=0x7 Nov 16 18:43:31 vm-rt1 slapd[15110]: => mdb_entry_decode: Nov 16 18:43:31 vm-rt1 slapd[15110]: <= mdb_entry_decode Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: 0x00000007: cn=mygroup1,ou=groups,dc=nodomain Nov 16 18:43:31 vm-rt1 slapd[15110]: <= acl_access_allowed: granted to database root Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace member Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace entryCSN Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace modifiersName Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace modifyTimestamp Nov 16 18:43:31 vm-rt1 slapd[15110]: oc_check_required entry (cn=mygroup1,ou=groups,dc=nodomain), objectClass "groupOfNames" Nov 16 18:43:31 vm-rt1 slapd[15110]: Entry (cn=mygroup1,ou=groups,dc=nodomain): object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: entry failed schema check: object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify: modify failed (65) Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_result: conn=1154 op=4 p=3 Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_result: err=65 matched="" text="object class 'groupOfNames' requires attribute 'member'" Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_response: msgid=5 tag=103 err=65 Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 RESULT tag=103 err=65 text=object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on 1 descriptor Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on: Nov 16 18:43:31 vm-rt1 slapd[15110]: Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=9 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=10 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=11 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on 1 descriptor Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on: ######### END LOG ########