Chain Overlay and Syncrepl

["Scott Sanders" <lists@jssjr.com>]

Hello all,

I am having problems with chasing referrals on my slave OpenLDAP server. I feel like I'm repeating an older thread here, but despite everything I have read I cannot find a solution.

My setup is as follows:
Both the master and the slave are OpenLDAP 2.3.32 builds with the follwing configure parameters,
LD_LIBRARY_PATH="/usr/local/lib" ./configure --prefix=/usr/local --disable-ipv6 --with-tls --enable-dynamic --enable-slapd --enable-modules  --enable-crypt --enable-bdb --enable-rewrite --enable-backends=yes --enable-rlookups --disable-shell --disable-sql --enable-overlays=yes --enable-slurpd=yes
At the end of the email, I have attached both the master and the slave slapd.conf.

The problem is that when I attempt an ldapadd against the slave server, I am returned a referral instead of having the slave forward the request to the master. I see no attempt to contact the master server in either the slave or master logs. Nor do I see any traffic between the two (other than syncrepl stuff) in a tcpdump. As far as I can tell the chain overlay is being ignored entirely.

Any suggestions or fixes would be greatly appreciated.

- Scott Sanders

############################################
# Master slapd.conf  --  ldap://info.domain.com:389
############################################
include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/nis.schema

pidfile         /usr/local/var/run/slapd.pid
argsfile        /usr/local/var/run/slapd.args

password-hash {ssha} 

security tls=1
TLSCACertificateFile /etc/pki/CA/cacert.pem
TLSCACertificatePath /etc/pki/CA
TLSCertificateFile    /usr/local/etc/openldap/security/ldap-master.crt
TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-master.key
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSVerifyClient allow

limits 
dn.exact="cn=syncuser,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

access to attrs=userPassword
        by self write
        by dn="cn=admin,dc=domain,dc=com" write
        by dn="cn=syncuser,dc=domain,dc=com" read
        by * auth

access to *
        by dn="cn=admin,dc=domain,dc=com" write
        by dn="cn=syncuser,dc=domain,dc=com" read
        by dn="cn=syncuser,dc=domain,dc=com" read
        by * read

database hdb
suffix cn=accesslog
directory /usr/local/var/openldap-accesslog
rootdn cn=accesslog
index default eq
index entryCSN,objectClass,reqEnd,reqResult,reqStart

overlay syncprov
syncprov-nopresent TRUE
syncprov-reloadhint TRUE

database        bdb
suffix          "dc=domain,dc=com"
rootdn          "cn=admin,dc=domain,dc=com"
rootpw          {SSHA}T2JGZSB3Q2x57s/O
directory       /usr/local/var/openldap-data
index   objectClass     eq
index entryCSN eq
index entryUUID eq

overlay syncprov
syncprov-checkpoint 1000 60

overlay accesslog
logdb cn=accesslog
logops writes
logsuccess true
logpurge 07+00:00 01+00:00


############################################
# Slave slapd.conf  --  ldap://arch.domain.com
############################################
include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/nis.schema

pidfile         /usr/local/var/run/slapd.pid
argsfile        /usr/local/var/run/slapd.args

password-hash {ssha}

security tls=1
TLSCACertificateFile /etc/pki/CA/cacert.pem
TLSCACertificatePath /etc/pki/CA
TLSCertificateFile    /usr/local/etc/openldap/security/ldap-slave.crt
TLSCertificateKeyFile /usr/local/etc/openldap/security/ldap-slave.key
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSVerifyClient allow

access to attrs=userPassword
        by self write
        by dn="cn=admin,dc=domain,dc=com" read
        by dn="cn=syncuser,dc=domain,dc=com" write
        by * auth

access to *
        by dn="cn=admin,dc=domain,dc=com" read
        by dn="cn=syncuser,dc=domain,dc=com" write
        by * read

database        bdb
suffix          "dc=domain,dc=com"
rootdn          "cn=admin,dc=domain,dc=com"
rootpw          {SSHA}T2JGZkB3Q2x57s/O
overlay         chain
chain-uri       ldap://info.domain.com:389
chain-rebind-as-user    TRUE
chain-idassert-bind     bindmethod=simple
                        binddn="cn=admin,dc=domain,dc=com"
                        credentials=secret
                        mode=self
directory       /usr/local/var/openldap-data
index   objectClass     eq
index entryUUID eq

syncrepl        rid=0
                provider=ldap://info.domain.com:389
                starttls=yes
                bindmethod=simple
                binddn="cn=syncuser,dc=domain,dc=com"
                credentials=secretsyncpasswd
                searchbase="dc=domain,dc=com"
                logbase="cn=accesslog"
                logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"
                schemaChecking=on
                type=refreshAndPersist
                retry="60 +"
                syncdata=accesslog

updateref       ldap://info.domain.com:389