Re: refreshAndPersit vs. ACLs

[Howard Chu <hyc@symas.com>]

Norbert Klasen wrote:
> Hi,
> we want entries to be replicated to a public slave, only if they have an 
> attribute worldreadable=TRUE.
>
> So I've setup an ACL on the master which basically is like
> access to * filter=(worldreadable=FALSE)
>     by * none
> access to *
>     by * read
> Thus, the consumer only sees entries it is allowed to replicate.
>
> Now if an entry's worldreadable attribute is changed from TRUE to false, 
> this modification will not propagate to the consumer and the entry stays 
> visible.
> However, with refreshOnly this 'lost' entry is detected and removed 
> (syncrepl_del_nonpresent).
You should include the filter in your consumer's search spec in order to 
get these changes propagated immediately.

--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc
  OpenLDAP Core Team            http://www.openldap.org/project/