I just set up an OpenLDAP server (v2.4.23) and loaded some data. I can browse and edit via Apache Directory Studio, but not deletions all fail.

For example, I tried to delete a list of DNs from a file:

ldapdelete -f rmroles.txt -W -D "cn=admin,cn=config"

but it dies with the message:

ldap_delete: Server is unwilling to perform (53)
        additional info: shadow context; no update referral

Most of the info I've found suggests that this is related to replication, but I haven't set up replication on this server yet. olcReadOnly is FALSE, and I've set olcAccess to to * by * manage.

Any other ideas what could be wrong?

up vote 2 down vote accepted

Apparently just having the olcMirrorMode attribute present on cn=config (even when set to FALSE) is enough to trigger shadow context. Delete the attribute and restart slapd.

  • Another contribution: I was defining olcMirrorMode on a separate "changetype: modify" in the end of the .ldif file. It does not seem to be a good idea. When I added the olcMirrorMode as part of the previous "changetype: modify" I as doing, it ran successfully. – Richard Gomes Oct 9 '13 at 21:49

Old thread, but I found that my solution was slightly different.

Again, my LDAP server was in a sync/replication setup and needed to be disabled.

In /etc/openldap/slapd.conf the syncrepl directive was specified (and some associated configuration underneath).

Commenting this out and restarting the ldap server allowed me to make changes to the LDAP database.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.