Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two OpenLDAP servers that are both running TLS. They are:

ldap1.mydomain.com
ldap2.mydomain.com

I also have a load balancer cluster with a dns name of it's own:

ldap.mydomain.com

The SSL certificate has a CN of ldap.mydomain.com, with SANs of ldap1.mydomain.com and ldap2.mydomain.com.

Everything works... Except mirror mode replication.

My mirror mode replication is setup like this:

ldap.conf

TLS_REQCERT allow

cn=config.ldif

olcServerID: 1 ldap://ldap1.mydomain.com
olcServerID: 2 ldap://ldap2.mydomain.com

On ldap1, olcDatabase{1}hdb.ldif

olcMirrorMode: TRUE
olcSyncrepl: {0}rid=001 provider=ldap://ldap2.mydomain.com bindmethod=simple bindmethod=simple binddn="cn=me,dc=mydomain,dc=com" credentials="REDACTED" starttls=yes searchbase="dc=mydomain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +"

On ldap2, olcDatabase{1}hdb.ldif

olcMirrorMode: TRUE
olcSyncrepl: {0}rid=001 provider=ldap://ldap1.mydomain.com bindmethod=simple bindmethod=simple binddn="cn=me,dc=mydomain,dc=com" credentials="REDACTED" starttls=yes searchbase="dc=mydomain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +"

Here's the errors I'm getting in syslog:

Dec  1 21:05:01 ldap1 slapd[6800]: slap_client_connect: URI=ldap://ldap2.mydomain.com DN="cn=me,dc=mydomain,dc=com" ldap_sasl_bind_s failed (-1)
Dec  1 21:05:01 ldap1 slapd[6800]: do_syncrepl: rid=001 rc -1 retrying
Dec  1 21:05:08 ldap1 slapd[6800]: conn=1111 fd=20 ACCEPT from IP=ldap.mydomain.com:2295 (IP=ldap1.mydomain.com:636)
Dec  1 21:05:08 ldap1 slapd[6800]: conn=1111 fd=20 closed (TLS negotiation failure)

Any ideas? I've been working on OpenLdap for way too long now.

share|improve this question
add comment

2 Answers 2

Fixed it. There were two problems.

1) The certificate CSR clearly showed subject alternate names for the two individual LDAP servers. I signed it using the usual openssl command that I use to sign with, and never checked the certificate itself. Turns out the certificate did not have the subject alternate names on it, because those require special v3 extensions. Here's the command I used.

openssl x509 -req -days 3650 -in ldap.csr -signkey ldapskey.pem -out cert.pem -extensions v3_req -extfile /etc/ssl/openssl.cnf

2) The REDACTED password I had in my olcSyncrepl directive was actually the SSHA hash. Looks like that's not cool. I replaced the SSHA hash with the clear text password.

Oh, and I also cleared up the syncprov overlays, so that only one overlay existed in each of the actual databases - not in the config databases.

BTW, I found a Howard Chu post where he said that the rid has to be unique within the server's configuration, not within your mirror configuration spanning servers. So, sounds like rid could be 001 on both servers, but anyway, I left it 001 and 002 and it's not harming anyone.

share|improve this answer
add comment

As stated in 16.5.3. MirrorMode Configuration,

You also need to make sure the rid of each mirror node pair is different...

So, on ldap2 change rid=001 to rid=002.

share|improve this answer
    
Ok, I've made that change, unfortunately the situation is unchanged. –  Lynn Owens Dec 2 '12 at 6:02
    
Can you make your full configuration available via a gist so people can try to reproduce the problem? –  aculich Dec 2 '12 at 6:14
    
gist.github.com/4187388 ... In compiling that, I see that I am missing the syncProv overlay in the global section of the second server... –  Lynn Owens Dec 2 '12 at 6:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.