1

I'm trying to get an OpenLDAP master to perform push-only replication to remote OpenLDAP consumers using the LDAP backend as a proxy. The master will be able to reach the slaves, but the slaves can't get to the master.

My problem is that I'm getting an LDAP constraint error during replication

Dec 12 11:51:27 rhel7 slapd[1417]: syncprov_search_response: cookie=rid=100,csn=20141211222736.923231Z#000000#000#000000
Dec 12 11:51:27 rhel7 slapd[1417]: do_syncrep2: rid=100 LDAP_RES_INTERMEDIATE - SYNC_ID_SET
Dec 12 11:51:27 rhel7 slapd[1417]: syncrepl_message_to_entry: rid=100 DN: dc=example,dc=com, UUID: 56f70834-13d3-1034-9c4b-b9373d9331cc
Dec 12 11:51:27 rhel7 slapd[1417]: syncrepl_entry: rid=100 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD)
Dec 12 11:51:27 rhel7 slapd[1417]: syncrepl_entry: rid=100 be_search (0)
Dec 12 11:51:27 rhel7 slapd[1417]: syncrepl_entry: rid=100 dc=example,dc=com
Dec 12 11:51:27 rhel7 slapd[1417]: null_callback : error code 0x13
Dec 12 11:51:27 rhel7 slapd[1417]: syncrepl_entry: rid=100 be_add dc=example,dc=com (19)
Dec 12 11:51:27 rhel7 slapd[1417]: syncrepl_entry: rid=100 be_add dc=example,dc=com failed (19)

Logs on the slave show a similar error:

Dec 12 14:13:24 authldap-01-cs slapd[2339]: conn=1004 op=15 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(entryUUID=56f70834-13d3-1034-9c4b-b9373d9331cc)"
Dec 12 14:13:24 authldap-01-cs slapd[2339]: conn=1004 op=15 SRCH attr=* +
Dec 12 14:13:24 authldap-01-cs slapd[2339]: conn=1004 op=15 SEARCH RESULT tag=101 err=0 nentries=0 text=
Dec 12 14:13:24 authldap-01-cs slapd[2339]: conn=1004 op=16 ADD dn="dc=example,dc=com"
Dec 12 14:13:24 authldap-01-cs slapd[2339]: conn=1004 op=16 RESULT tag=105 err=19 text=structuralObjectClass: no user modification allowed

My provider hdb config config. Domain components replaced.

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 7c7ced28
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
olcDbIndex: uid eq,pres,sub
structuralObjectClass: olcHdbConfig
entryUUID: f60bed20-13a3-1034-8f7e-113c69ebc9f8
creatorsName: cn=config
createTimestamp: 20141209040239Z
olcRootPW:: e1NTSEF9cVVvVFJQd3BwYWVkcUhRVGdZT1BZV29rcjNTaVhqYks=
olcSuffix: dc=example,dc=com
olcRootDN: cn=manager,dc=example,dc=com
entryCSN: 20141211014727.826962Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20141211014727Z

Provider ldap config

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 ff26115e
dn: olcDatabase={3}ldap
objectClass: olcDatabaseConfig
objectClass: olcLDAPConfig
olcDatabase: {3}ldap
olcHidden: TRUE
olcSuffix: dc=example,dc=com
olcAccess: {0}to *  by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externa
 l,cn=auth manage  by * break
olcAccess: {1}to *  by * read
olcLastMod: TRUE
olcRestrict: all
olcRootDN: cn=ldap-replroot
olcSyncrepl: {0}rid=100 provider="ldap://rhel7:389" tls_reqcert=never binddn="
 cn=replicator,dc=example,dc=com" bindmethod=simple credentials=supersecre
 tpassword searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 
 5 300 +"
olcDbStartTLS: start
olcDbACLBind: bindmethod=simple  binddn="cn=replicator,dc=example,dc=com" 
  credentials=supersecretpassword
structuralObjectClass: olcLDAPConfig
entryUUID: d4b45f1a-1522-1034-8b61-af7acc5313da
creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
createTimestamp: 20141211014320Z
olcDbURI: ldap://authldap-01-cs
entryCSN: 20141211052948.885859Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20141211052948Z

My slave config

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 a539163c
dn: olcDatabase={2}hdb
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {2}hdb
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
olcDbIndex: uid eq,pres,sub
olcDbIndex: entryUUID eq
olcDbIndex: entryCSN eq
structuralObjectClass: olcHdbConfig
entryUUID: a5ede4ec-1420-1034-9ec6-e93109d39d98
creatorsName: cn=config
createTimestamp: 20141209185511Z
olcSuffix: dc=example,dc=com
olcRootDN: cn=manager,dc=example,dc=com
olcRootPW:: e1NTSEF9cVVvVFJQd3BwYWVkcUhRVGdZT1BZV29rcjNTaVhqYks=
olcAccess: {0}to * by dn="cn=replicator,dc=example,dc=com" write by dn="cn
 =manager,dc=example,dc=com" write by * read
entryCSN: 20141212193340.646494Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20141212193340Z

I'd tried salting the consumer with slapcat export, and I've tried removing the entire domain component, and neither seem to be working for me.

0

You must log in to answer this question.

Browse other questions tagged .