You're right I might have forgotten the most essential :)
You'll find in attachment the script I'm using to set up the replication (modified version of test050-syncrepl-multimaster).
Here is the config : initialization of m1 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1
dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD}
initialization of m2 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2
dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD}
syncprov overlay on m1 : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov
dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE
syncrepl on m2: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 - add: olcMirrorMode olcMirrorMode: TRUE
schema on m1: include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif include: file://$ABS_SCHEMADIR/corba.ldif include: file://$ABS_SCHEMADIR/java.ldif include: file://$ABS_SCHEMADIR/misc.ldif include: file://$ABS_SCHEMADIR/nds.ldif include: file://$ABS_SCHEMADIR/dit.ldif
database en m1: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: ${PASSWD} olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,seeAlso,entryUUID eq olcDbIndex: mail,givenName,uid pres,eq,sub olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE
dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov
After that I populate m1 with attached arbre.ldif.
Thanks in advance.
Adrien
======================================== Message date : Dec 24 2008, 03:23 PM From : "Gavin Henry" gavin.henry@gmail.com To : adrien.futschik@atosorigin.com, openldap-technical@openldap.org Copy to : Subject : Re: CSN too old, ignoring - and therefore not syncing
Config?
On 24/12/2008, Adrien Futschik adrien.futschik@atosorigin.com wrote:
I'm facing a similar problem. I'm testing N-way multimaster replication with OpenLDAP 2.4.13.
I'm able to successfully import data into an instance and have my two masters to sync correctly but then when I try to add a new entry in one of the two masters, I'm getting strange messages :
let's say we have m1 & m2 (m1 & m2 are on the same server): I initial import data into m1, it is successfully imported into m2 (at least it looks like it). Then I'm trying to add an entry on m2 (cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm getting strange message on m1 & m2 :
m1 log :(repetitively) [...] Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224125950.481561Z#000000#001#000000 older or equal to ctx 20081224125950.481561Z#000000#001#000000 Entry cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr changed by peer, ignored syncprov_search_response: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT [...]
m2 log : (repetitively) [...] master where I added an entry : do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000 [...]
Is this a bug ? Am-I doing something wrong ?
If I add the same entry to m1 and not m2 I get the following messages :
on m2 : syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed syncprov_search_response: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 syncrepl_entry: rid=004 be_add (0) do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 <= bdb_inequality_candidates: (entryCSN) not indexed nonpresent_callback: rid=004 present UUID 96268508-6609-102d-9d8e-9742e72db399, dn c=fr nonpresent_callback: rid=004 present UUID 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630bfa0-6609-102d-9d9d-9742e72db399, dn ou=administrateurs,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID ae0e93d6-6609-102d-9d9e-9742e72db399, dn cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x83d6410 20081224132238.790862Z#000000#001#000000
on m1 : slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x9703700 20081224132238.790862Z#000000#001#000000 <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224132158.749532Z#000000#001#000000 older or equal to ctx 20081224132158.749532Z#000000#001#000000 syncprov_search_response: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000
Here is the entry I'm adding :
dn: cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf, c=fr objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: ditPerson cn: adrien-externe.futschik@edfgdf.fr sn: Futschik givenName: Adrien uid: adrien-externe.futschik@edfgdf.fr mail: adrien-externe.futschik@edfgdf.fr telephonenumber: 0123456789 userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r allowedServices: appli20
pretty simple isn't it ? What's going wrong ?
Adrien
======================================== Message date : Dec 23 2008, 07:39 PM From : "Gavin Henry" gavin.henry@gmail.com To : openldap-technical@openldap.org Copy to : Subject : Fwd: CSN too old, ignoring - and therefore not syncing
---------- Forwarded message ---------- From: Pat Riehecky prieheck@iwu.edu Date: Tue, 23 Dec 2008 12:34:33 -0600 Subject: Re: CSN too old, ignoring - and therefore not syncing To: Gavin Henry gavin.henry@gmail.com
On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote:
Where did you read that those were needed anyway? If it was the admin guide then I need to fix it ;-)
Gavin.
I have no idea where I found those at... I know it wasn't the (recent) admin guide. It may have been from around the 2.4.8 release, but that is long gone...
Pat
On 23/12/2008, Pat Riehecky prieheck@iwu.edu wrote:
On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote:
Try dropping nopresent and reloadhint relating to ITS5669. You only need these two syncprov settings on an accesslog db.
Gavin.
Thanks, that did the job!
Pat
On 23/12/2008, Pat Riehecky prieheck@iwu.edu wrote:
On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote:
Can you post your config somewhere?
allow bind_v2
include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/eduperson-200412.schema include /etc/ldap/schema/hdb.schema include /etc/ldap/schema/IWU.schema
pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args
modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor moduleload memberof moduleload syncprov moduleload smbk5pwd
tool-threads 2 sizelimit 500 idletimeout 7200
TLSCACertificateFile /etc/ldap/ssl/IWU.crt TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key TLSVerifyClient allow
localSSF 160 security ssf=1 update_ssf=128 simple_bind=112 sasl-secprops noanonymous
access to dn.base="" by * read access to dn.base="cn=Subschema" by * read
backend hdb database hdb
overlay memberof overlay smbk5pwd overlay syncprov
smbk5pwd-enable samba smbk5pwd-enable krb5 smbk5pwd-must-change 0
syncprov-checkpoint 100 10 syncprov-sessionlog 200 syncprov-nopresent TRUE syncprov-reloadhint TRUE
suffix "dc=iwu,dc=edu"
rootdn "cn=admin,dc=iwu,dc=edu" rootpw {redacted}
authz-regexp "uidNumber=0\\ +gidNumber=.*,cn=peercred,cn=external,cn=auth" "cn=ldapi,dc=iwu,dc=edu" authz-regexp "gidNumber=.*\\ +uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=ldapi,dc=iwu,dc=edu"
authz-regexp "uid=(.+),cn=.+,cn=auth"
"uid=$1,ou=People,dc=iwu,dc=edu"
directory "/var/lib/ldap/"
dbconfig set_cachesize 0 62914560 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500
# Make sure to do a nightly slapcat dbconfig set_flags DB_LOG_AUTOREMOVE
index objectClass eq,pres index default eq,sub,pres index mail eq,sub,pres index sn eq,sub,pres index cn eq,sub,pres index displayName eq,sub,pres index gecos eq,sub,pres index uid eq,sub,pres index memberUid eq,sub,pres index uidNumber eq,pres index gidNumber eq,pres index entryCSN eq,pres index entryUUID eq,pres index uniqueMember eq,pres index userPassword eq,pres index krb5PrincipalName eq,pres index krb5PrincipalRealm eq,pres index sambaDomainName eq,pres index sambaSID eq,pres index sambaPrimaryGroupSID eq,pres index sambaSIDList eq,pres
lastmod on
checkpoint 256 15
password-hash {SSHA}
limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited
access to dn.sub="dc=iwu,dc=edu" by dn.exact="cn=ldapi,dc=iwu,dc=edu" write by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write by dn.exact="cn=mirror,dc=iwu,dc=edu" read by dn.exact="cn=freeradius,dc=iwu,dc=edu" read by * break
access to dn.sub="dc=iwu,dc=edu"
attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key
by anonymous auth by self write by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" writeby users auth by * break
access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none
access to dn.regex="uid=.*$,ou=People,dc=iwu,dc=edu" by self read
by *
none access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by * none access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by self
read
by * none access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by
self
read by * none access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self read
by *
none
access to dn.regex="krb5PrincipalName=.*@IWU.EDU,ou=People,dc=iwu,dc=edu" by
self
read by * none
access to dn.sub="dc=iwu,dc=edu"
attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName
by self write by users read by anonymous none by * break
access to dn.sub="dc=iwu,dc=edu"
attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber
by self read by anonymous none by * breakaccess to dn.sub="dc=iwu,dc=edu"
attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid
by * noneaccess to dn.sub="dc=iwu,dc=edu"
attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength
by self read by anonymous none by * breakaccess to dn.sub="dc=iwu,dc=edu" by * read
serverID 1
syncrepl rid=2 provider=ldap://ldap2.iwu.edu/ schemachecking=off searchbase="dc=iwu,dc=edu" scope=sub type=refreshAndPersist binddn="cn=mirror,dc=iwu,dc=edu" credentials={redacted} bindmethod=simple starttls=yes tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt tls_key=/etc/ldap/ssl/ldap.iwu.edu.key tls_cacert=/etc/ldap/ssl/IWU.crt tls_reqcert=try interval=00:00:00:30 retry="15 +" timeout=1 timelimit=unlimited sizelimit=unlimited
mirrormode on
############################### database monitor limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited
access to dn.exact="cn=Monitor" by dn.exact="cn=admin,dc=iwu,dc=edu" read by * none
access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,dc=iwu,dc=edu" read by * none
On 22/12/2008, Pat Riehecky prieheck@iwu.edu wrote: > Here is the quick and dirty what I am trying to do: > > ldap1 and ldap2 are supposed to be in MultiMaster. They are time > synced > to pool.ntp.org and each other (if they drift I would rather they > sorta > drift together, but pool should be keeping that in check). > > Right now I am just beating them up to see how 2.4.13 performs.
(So
> far > VERY well, minus this little problem) > > I have a rather small ldif (41 entries) that just wont sync (I'm > starting small). Debug gives me > > ber_scanf fmt (m}) ber: > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > 30 .<rid=001,sid=00 > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > 2,csn=2008122217 > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > 4721.855904Z#000 > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > 000#001#000000 > do_syncrep2: >
cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000
> do_syncrep2: rid=001 CSN too old, ignoring > 20081222174721.855904Z#000000#001#000000 > ldap_msgfree > > I am not exactly sure how it gotten to be "too old." The ldif I
am
> importing is not the result of a slapcat or anything that would > preserve > the CSN or UUID attributes (not that syncrepl uses UUID). I am > loading > one single file with ldapadd which, in my understanding, sets up
the
> CSN > and wouldn't let me import one anyway. > > Each server has no entries until I load the one, so there
shouldn't
> be > any weird stale CSNs causing this. They are "sync'ed" almost > instantly > after the one system is loaded - I just don't have everything. > > After a sync: > ldap1 - slapcat |grep dn: |wc -l = 41 > ldap2 - slapcat |grep dn: |wc -l = 18 > > Right now I can get them in sync with a slapcat/slapadd, but when
the
> go > into production I wont be able to say for certain which one is > authoritative. That is the purpose of multi-master.... > > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu Linux
32
> bit > > Any ideas as to what I can do to stop this from happening? > > Pat > > > >
-- Sent from my mobile device
http://www.suretecsystems.com/services/openldap/
Adrien Futschik
-- Sent from my mobile device
http://www.suretecsystems.com/services/openldap/
Adrien Futschik
Do us a favour and start a new thread with all this info in one email. It's annoying to put this all together over your two emails and burried in another thread.
It will help others this way too.
Thanks.
On 24/12/2008, Adrien Futschik adrien.futschik@atosorigin.com wrote:
You're right I might have forgotten the most essential :)
You'll find in attachment the script I'm using to set up the replication (modified version of test050-syncrepl-multimaster).
Here is the config : initialization of m1 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1
dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD}
initialization of m2 : dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2
dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: ${PASSWD}
syncprov overlay on m1 : dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov
dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3
add: olcMirrorMode olcMirrorMode: TRUE
syncrepl on m2: dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=3
add: olcMirrorMode olcMirrorMode: TRUE
schema on m1: include: file://$ABS_SCHEMADIR/core.ldif include: file://$ABS_SCHEMADIR/cosine.ldif include: file://$ABS_SCHEMADIR/inetorgperson.ldif include: file://$ABS_SCHEMADIR/openldap.ldif include: file://$ABS_SCHEMADIR/nis.ldif include: file://$ABS_SCHEMADIR/corba.ldif include: file://$ABS_SCHEMADIR/java.ldif include: file://$ABS_SCHEMADIR/misc.ldif include: file://$ABS_SCHEMADIR/nds.ldif include: file://$ABS_SCHEMADIR/dit.ldif
database en m1: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./openldap-data olcRootDN: $MANAGERDN olcRootPW: ${PASSWD} olcDbIndex: default pres,eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: objectClass,seeAlso,entryUUID eq olcDbIndex: mail,givenName,uid pres,eq,sub olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=secret searchbase="$BASEDN" type=refreshOnly interval=$INTERVAL retry="5 5 300 5" timeout=3 olcMirrorMode: TRUE
dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov
After that I populate m1 with attached arbre.ldif.
Thanks in advance.
Adrien
======================================== Message date : Dec 24 2008, 03:23 PM From : "Gavin Henry" gavin.henry@gmail.com To : adrien.futschik@atosorigin.com, openldap-technical@openldap.org Copy to : Subject : Re: CSN too old, ignoring - and therefore not syncing
Config?
On 24/12/2008, Adrien Futschik adrien.futschik@atosorigin.com wrote:
I'm facing a similar problem. I'm testing N-way multimaster replication with OpenLDAP 2.4.13.
I'm able to successfully import data into an instance and have my two masters to sync correctly but then when I try to add a new entry in one
of
the two masters, I'm getting strange messages :
let's say we have m1 & m2 (m1 & m2 are on the same server): I initial import data into m1, it is successfully imported into m2 (at
least
it looks like it). Then I'm trying to add an entry on m2 (cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr). I'm getting strange message on m1 & m2 :
m1 log :(repetitively) [...] Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224125950.481561Z#000000#001#000000 older or equal to ctx 20081224125950.481561Z#000000#001#000000 Entry cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr changed by peer, ignored syncprov_search_response:
cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000
do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT [...]
m2 log : (repetitively) [...] master where I added an entry : do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2:
cookie=rid=004,sid=002,csn=20081224125950.481561Z#000000#001#000000;20081224130148.522455Z#000000#002#000000
[...]
Is this a bug ? Am-I doing something wrong ?
If I add the same entry to m1 and not m2 I get the following messages :
on m2 : syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=004 be_search (0) syncrepl_entry: rid=004 cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed syncprov_search_response: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000 syncrepl_entry: rid=004 be_add (0) do_syncrep2: rid=004 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 <= bdb_inequality_candidates: (entryCSN) not indexed nonpresent_callback: rid=004 present UUID 96268508-6609-102d-9d8e-9742e72db399, dn c=fr nonpresent_callback: rid=004 present UUID 962af700-6609-102d-9d8f-9742e72db399, dn o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962bd698-6609-102d-9d90-9742e72db399, dn ou=personnes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c00b4-6609-102d-9d91-9742e72db399, dn ou=appli,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962c2634-6609-102d-9d92-9742e72db399, dn ou=groupes,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962ca492-6609-102d-9d93-9742e72db399, dn ou=administrateurs,o=edfgdf,c=fr nonpresent_callback: rid=004 present UUID 962cce90-6609-102d-9d94-9742e72db399, dn o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d7138-6609-102d-9d95-9742e72db399, dn ou=personnes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962d96f4-6609-102d-9d96-9742e72db399, dn ou=appli,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962deafa-6609-102d-9d97-9742e72db399, dn ou=groupes,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962ef026-6609-102d-9d98-9742e72db399, dn ou=administrateurs,o=edf,c=fr nonpresent_callback: rid=004 present UUID 962f156a-6609-102d-9d99-9742e72db399, dn o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fca8c-6609-102d-9d9a-9742e72db399, dn ou=personnes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 962fef76-6609-102d-9d9b-9742e72db399, dn ou=appli,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630106e-6609-102d-9d9c-9742e72db399, dn ou=groupes,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID 9630bfa0-6609-102d-9d9d-9742e72db399, dn ou=administrateurs,o=gazdefrance,c=fr nonpresent_callback: rid=004 present UUID ae0e93d6-6609-102d-9d9e-9742e72db399, dn cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf,c=fr slap_queue_csn: queing 0x843fef0 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x83d6410 20081224132238.790862Z#000000#001#000000
on m1 : slap_queue_csn: queing 0x1df3860 20081224132238.790862Z#000000#001#000000 slap_graduate_commit_csn: removing 0x9703700 20081224132238.790862Z#000000#001#000000 <= bdb_equality_candidates: (entryCSN) not indexed <= bdb_inequality_candidates: (entryCSN) not indexed Entry ou=administrateurs,o=gazdefrance,c=fr CSN 20081224132158.749532Z#000000#001#000000 older or equal to ctx 20081224132158.749532Z#000000#001#000000 syncprov_search_response: cookie=rid=004,sid=002,csn=20081224132238.790862Z#000000#001#000000 do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT do_syncrep2: cookie=rid=005,sid=001,csn=20081224132158.749532Z#000000#001#000000
Here is the entry I'm adding :
dn: cn=adrien-externe.futschik@edfgdf.fr,ou=personnes,o=edfgdf, c=fr objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: ditPerson cn: adrien-externe.futschik@edfgdf.fr sn: Futschik givenName: Adrien uid: adrien-externe.futschik@edfgdf.fr mail: adrien-externe.futschik@edfgdf.fr telephonenumber: 0123456789 userpassword: {SSHA}GuU6CMRoOxp9EA1ANafzuRUXADKlBA0r allowedServices: appli20
pretty simple isn't it ? What's going wrong ?
Adrien
======================================== Message date : Dec 23 2008, 07:39 PM From : "Gavin Henry" gavin.henry@gmail.com To : openldap-technical@openldap.org Copy to : Subject : Fwd: CSN too old, ignoring - and therefore not syncing
---------- Forwarded message ---------- From: Pat Riehecky prieheck@iwu.edu Date: Tue, 23 Dec 2008 12:34:33 -0600 Subject: Re: CSN too old, ignoring - and therefore not syncing To: Gavin Henry gavin.henry@gmail.com
On Tue, 2008-12-23 at 18:28 +0000, Gavin Henry wrote:
Where did you read that those were needed anyway? If it was the admin guide then I need to fix it ;-)
Gavin.
I have no idea where I found those at... I know it wasn't the (recent) admin guide. It may have been from around the 2.4.8 release, but that is long gone...
Pat
On 23/12/2008, Pat Riehecky prieheck@iwu.edu wrote:
On Tue, 2008-12-23 at 15:55 +0000, Gavin Henry wrote:
Try dropping nopresent and reloadhint relating to ITS5669. You only need these two syncprov settings on an accesslog db.
Gavin.
Thanks, that did the job!
Pat
On 23/12/2008, Pat Riehecky prieheck@iwu.edu wrote:
On Tue, 2008-12-23 at 11:45 +0000, Gavin Henry wrote: > Can you post your config somewhere?
allow bind_v2
include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/eduperson-200412.schema include /etc/ldap/schema/hdb.schema include /etc/ldap/schema/IWU.schema
pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args
modulepath /usr/lib/ldap moduleload back_hdb moduleload back_monitor moduleload memberof moduleload syncprov moduleload smbk5pwd
tool-threads 2 sizelimit 500 idletimeout 7200
TLSCACertificateFile /etc/ldap/ssl/IWU.crt TLSCertificateFile /etc/ldap/ssl/ldap.iwu.edu.crt TLSCertificateKeyFile /etc/ldap/ssl/ldap.iwu.edu.key TLSVerifyClient allow
localSSF 160 security ssf=1 update_ssf=128 simple_bind=112 sasl-secprops noanonymous
access to dn.base="" by * read access to dn.base="cn=Subschema" by * read
backend hdb database hdb
overlay memberof overlay smbk5pwd overlay syncprov
smbk5pwd-enable samba smbk5pwd-enable krb5 smbk5pwd-must-change 0
syncprov-checkpoint 100 10 syncprov-sessionlog 200 syncprov-nopresent TRUE syncprov-reloadhint TRUE
suffix "dc=iwu,dc=edu"
rootdn "cn=admin,dc=iwu,dc=edu" rootpw {redacted}
authz-regexp "uidNumber=0\\ +gidNumber=.*,cn=peercred,cn=external,cn=auth" "cn=ldapi,dc=iwu,dc=edu" authz-regexp "gidNumber=.*\\ +uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=ldapi,dc=iwu,dc=edu"
authz-regexp "uid=(.+),cn=.+,cn=auth"
"uid=$1,ou=People,dc=iwu,dc=edu"
directory "/var/lib/ldap/"
dbconfig set_cachesize 0 62914560 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500
# Make sure to do a nightly slapcat dbconfig set_flags DB_LOG_AUTOREMOVE
index objectClass eq,pres index default eq,sub,pres index mail eq,sub,pres index sn eq,sub,pres index cn eq,sub,pres index displayName eq,sub,pres index gecos eq,sub,pres index uid eq,sub,pres index memberUid eq,sub,pres index uidNumber eq,pres index gidNumber eq,pres index entryCSN eq,pres index entryUUID eq,pres index uniqueMember eq,pres index userPassword eq,pres index krb5PrincipalName eq,pres index krb5PrincipalRealm eq,pres index sambaDomainName eq,pres index sambaSID eq,pres index sambaPrimaryGroupSID eq,pres index sambaSIDList eq,pres
lastmod on
checkpoint 256 15
password-hash {SSHA}
limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=ldapi,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=sambaadmin,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=mirror,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited limits dn.exact="cn=freeradius,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited
access to dn.sub="dc=iwu,dc=edu" by dn.exact="cn=ldapi,dc=iwu,dc=edu" write by dn.exact="cn=sambaadmin,dc=iwu,dc=edu" write by dn.exact="cn=mirror,dc=iwu,dc=edu" read by dn.exact="cn=freeradius,dc=iwu,dc=edu" read by * break
access to dn.sub="dc=iwu,dc=edu"
attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,krb5Key
by anonymous auth by self write by dn.exact="cn=passwordmanager,dc=iwu,dc=edu" writeby users auth by * break
access to dn.exact="cn=ldapi,dc=iwu,dc=edu" by * none access to dn.exact="cn=sambaadmin,dc=iwu,dc=edu" by * none access to dn.exact="cn=mirror,dc=iwu,dc=edu" by * none access to dn.exact="cn=freeradius,dc=iwu,dc=edu" by * none access to dn.exact="cn=passwordmanager,dc=iwu,dc=edu" by * none access to dn.exact="cn=admin,dc=iwu,dc=edu" by * none
access to dn.regex="uid=.*$,ou=People,dc=iwu,dc=edu" by self
read
by *
none access to dn.sub="ou=Computers,dc=iwu,dc=edu" by self read by *
none
access to dn.sub="ou=Idmap,dc=iwu,dc=edu" by self read by * none access to dn.exact="sambaDomainName=IWU.EDU,dc=iwu,dc=edu" by
self
read
by * none access to dn.exact="uid=Administrator,ou=People,dc=iwu,dc=edu" by
self
read by * none access to dn.exact="uid=root,ou=People,dc=iwu,dc=edu" by self
read
by *
none
access to dn.regex="krb5PrincipalName=.*@IWU.EDU,ou=People,dc=iwu,dc=edu"
by
self
read by * none
access to dn.sub="dc=iwu,dc=edu"
attrs=telephoneNumber,mobileTelephoneNumber,homePostalAddress,streetAddress,physicalDeliveryOfficeName,roomNumber,preferredLanguage,localityName,postOfficeBox,postalCode,stateOrProvinceName
by self write by users read by anonymous none by * break
access to dn.sub="dc=iwu,dc=edu"
attrs=krb5PrincipalName,krb5MaxLife,krb5MaxRenew,krb5KDCFlags,krb5KeyVersionNumber
by self read by anonymous none by * breakaccess to dn.sub="dc=iwu,dc=edu"
attrs=sambaPrimaryGroupSID,sambaSID,sambaAlgorithmicRidBase,sambaNextRid
by * noneaccess to dn.sub="dc=iwu,dc=edu"
attrs=sambaPwdCanChange,sambaLogonTime,sambaLogoffTime,sambaAcctFlags,sambaPasswordHistory,sambaPwdLastSet,sambaGroupType,sambaPwdMustChange,sambaKickoffTime,sambaLockoutThreshold,sambaForceLogoff,sambaRefuseMachinePwdChange,sambaLockoutObservationWindow,sambaLockoutDuration,sambaMinPwdAge,sambaMaxPwdAge,sambaLogonToChgPwd,sambaPwdHistoryLength,sambaMinPwdLength
by self read by anonymous none by * breakaccess to dn.sub="dc=iwu,dc=edu" by * read
serverID 1
syncrepl rid=2 provider=ldap://ldap2.iwu.edu/ schemachecking=off searchbase="dc=iwu,dc=edu" scope=sub type=refreshAndPersist binddn="cn=mirror,dc=iwu,dc=edu" credentials={redacted} bindmethod=simple starttls=yes tls_cert=/etc/ldap/ssl/ldap.iwu.edu.crt tls_key=/etc/ldap/ssl/ldap.iwu.edu.key tls_cacert=/etc/ldap/ssl/IWU.crt tls_reqcert=try interval=00:00:00:30 retry="15 +" timeout=1 timelimit=unlimited sizelimit=unlimited
mirrormode on
############################### database monitor limits dn.exact="cn=admin,dc=iwu,dc=edu" size.hard=unlimited time.hard=unlimited size.soft=unlimited time.soft=unlimited
access to dn.exact="cn=Monitor" by dn.exact="cn=admin,dc=iwu,dc=edu" read by * none
access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,dc=iwu,dc=edu" read by * none
> > On 22/12/2008, Pat Riehecky prieheck@iwu.edu wrote: > > Here is the quick and dirty what I am trying to do: > > > > ldap1 and ldap2 are supposed to be in MultiMaster. They are
time
> > synced > > to pool.ntp.org and each other (if they drift I would rather
they
> > sorta > > drift together, but pool should be keeping that in check). > > > > Right now I am just beating them up to see how 2.4.13
performs.
(So
> > far > > VERY well, minus this little problem) > > > > I have a rather small ldif (41 entries) that just wont sync
(I'm
> > starting small). Debug gives me > > > > ber_scanf fmt (m}) ber: > > ber_dump: buf=0xb806f120 ptr=0xb806f137 end=0xb806f175 len=62 > > 0000: 00 3c 72 69 64 3d 30 30 31 2c 73 69 64 3d 30 > > 30 .<rid=001,sid=00 > > 0010: 32 2c 63 73 6e 3d 32 30 30 38 31 32 32 32 31 37 > > 2,csn=2008122217 > > 0020: 34 37 32 31 2e 38 35 35 39 30 34 5a 23 30 30 30 > > 4721.855904Z#000 > > 0030: 30 30 30 23 30 30 31 23 30 30 30 30 30 30 > > 000#001#000000 > > do_syncrep2: > >
cookie=rid=001,sid=002,csn=20081222174721.855904Z#000000#001#000000
> > do_syncrep2: rid=001 CSN too old, ignoring > > 20081222174721.855904Z#000000#001#000000 > > ldap_msgfree > > > > I am not exactly sure how it gotten to be "too old." The ldif
I
am
> > importing is not the result of a slapcat or anything that
would
> > preserve > > the CSN or UUID attributes (not that syncrepl uses UUID). I am > > loading > > one single file with ldapadd which, in my understanding, sets
up
the
> > CSN > > and wouldn't let me import one anyway. > > > > Each server has no entries until I load the one, so there
shouldn't
> > be > > any weird stale CSNs causing this. They are "sync'ed" almost > > instantly > > after the one system is loaded - I just don't have everything. > > > > After a sync: > > ldap1 - slapcat |grep dn: |wc -l = 41 > > ldap2 - slapcat |grep dn: |wc -l = 18 > > > > Right now I can get them in sync with a slapcat/slapadd, but
when
the
> > go > > into production I wont be able to say for certain which one is > > authoritative. That is the purpose of multi-master.... > > > > OpenLDAP 2.4.13, built by me (passed all tests) on Ubuntu
Linux
32
> > bit > > > > Any ideas as to what I can do to stop this from happening? > > > > Pat > > > > > > > > >
-- Sent from my mobile device
http://www.suretecsystems.com/services/openldap/
Adrien Futschik
-- Sent from my mobile device
http://www.suretecsystems.com/services/openldap/
Adrien Futschik
openldap-technical@openldap.org
-
Adrien Futschik -
Gavin Henry