I would like to be able to syncrepl only a subtree of cn=config, namely cn=schema,cn=config:

# {0}config, config
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth manage by * break
olcAccess: {1}to *  by * none
olcRootDN: cn=admin,cn=config
olcRootPW: {SSHA}just_another_secret
olcSyncUseSubentry: FALSE
olcSyncrepl: {0}rid=001 provider=ldap://provider.example.org binddn="cn=consumer
 ,dc=example,dc=org"  bindmethod=simple credentials="secret" searchbase="cn=sch
 ema,cn=config" type=refreshOnly  filter="(!(cn=*core))" interval=00:00:30:00 
 retry="5 5 30 +" timeout=1 scope=sub schemachecking=on starttls=yes

But, if I define cn=config as a shadow tree (even for a subtree, see searchbase) I am not longer allowed to modify it.

My error is:

modifying entry "cn=config"
ldap_modify: Server is unwilling to perform (53)
    additional info: shadow context; no update referral

even if I try to modify the attribute 'olcLogLevel', located in cn=config which is up-level respect the syncrepl-icated cn=schema,cn=config.

Which is the correct way to syncrepl just a subtree of cn=config?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.