Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a LDAP master server installed on CentOS-5.4 and I have installed LDAP on one more machine and I want it be configured as LDAP slave server but when I am importing the LDIF file or trying to create any new object in slave LDAP getting the below errors:

LDIF text import Could not add object dc=transcomus,dc=com LDAP said: Server is unwilling to perform Error number: 0x35 (LDAP_UNWILLING_TO_PERFORM) Description: The LDAP server refused to perform the operation.

There is no permission issue already checked that on /var/lib/ldap

Any help much appreciate..

Thanks Ramesh

share|improve this question
What kind of replication have you set up / are you trying to set up? Are you following the instructions from , or somewhere else? – voretaq7 Jan 27 '11 at 21:34
yes, I am using slurpd replication method. It was running fine but somehow it broke down and till then its not working.. – Ramesh Kumar Jan 27 '11 at 22:16
up vote 2 down vote accepted

It sounds to me like you're attempting to import a database dump into a running slave, either by means of ldapadd or slapcat. A running slapd instance with a replication mechanism configured in slave mode will reject all write attempts and return the message you provided.

If my slurpd based slapd servers ever became inconsistent I executed a fairly straight forward recovery procedure:

  1. Put the master into read-only mode.
  2. Make a fresh dump from the master and copy it to any inconsistent slaves (or copy from backups).
  3. Completely stop slapd on the slave you want to recover.
  4. Clear the contents of the data directory, /var/lib/ldap (you might want to save your DB_CONFIG file if the parameters aren't defined in slapd.conf)
  5. Use slapadd to rebuild the directory on the slave (move DB_CONFIG back if necessary)
  6. Start the slave normally.
  7. Switch the master back into read-write mode.

    yes, I am using slurpd replication method. It was running fine but somehow it broke down and till then its not working

You're probably running OpenLDAP 2.3.43 since that's what's packaged in CentOS 5.4. Unfortunately because of that you're also likely to run into replication issues again in the future unless you can upgrade to a newer OpenLDAP (2.4) server.

slurpd was very flawed, check out the OpenLDAP 2.4 docs for a complete explanation of why. The newer OpenLDAP releases come with a new replication mechanism called syncrepl which is much more robust and nearly impervious to failure.

In the future if you're interested in getting help migrating to a newer OpenLDAP server I can offer guidance there as well.

share|improve this answer
Thanks Tim, I have already implemented the syncrepl machenism. I found it very robust and easy to configure. Syncrepl can be configured on 2.3.x versions of openldap. But in synrepl mastertomaster replication support starts with 2.4 versions. I have implemented RefreshOnly as of now, but I have plans to implement mastertomaster in future and want to have Windows AD(LDAP) server to be used to sync with OpenLDAP... any thoughts on this. – Ramesh Kumar Feb 10 '11 at 15:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.