Re: syncrepl 'access to' constraints

[Maurizio Lo Bosco <maurizio.lobosco@eng.it>]

> > I think that some access rules are missing for the user, something like
> > contextCSN in the user dn.
>
> The only requirement is that the DN that is used as the binddn in the
> syncrepl statement on the consumer must have read access to all the
> attributes that are required to be replicated to the consumer, plus the
> entryCSN/entryUUID on all the entries that must be replicated, plus the
> contextCSN on the basedn. Additionally, the DN must have a sufficiently
> large "quota" (time/size limits) to retrieve the entire contents that
> matches the filter used in the consumer configuration.
I have a single master server replicating with syncrepl a consumer openldap. 
The same version 2.3.30-5 of openldap is used on every server on the same OS 
debian etch.

The user for the syncrepl has full read access to every entry in the provider 
so I think thera are no problems for the replication, in fact if I modify the 
attribute with a different user the replace is correctly  replicated.

The problem is with the user making the replace of the attribute.

Since the Radius User must only write a single attribute I have just inserted 
the rule for the single attribute

access to attrs=RASPassword
	[...]
        by dn="cn=Radius User,ou=SysAccount,o=engineering,c=it" write

This way I can change the attribute using 
-------
ldapmodify -x  -f cambia_raspwd.ldif  -D "cn=Radius 
User,ou=SysAccount,o=engineering,c=it" -W 
-------
but the replace is not propagated to the consumer.

If I insert a _read_ access for the Radius User to the tree containing the 
entries whose RASPassword is going to be changed

access to dn.subtree="ou=Persone,o=Engineering,c=IT"
	[...]
        by dn="cn=Radius User,ou=SysAccount,o=engineering,c=it" read

the change on the attribute is correctly replicated to the consumer!

I don't know why but without the read access granted to the Radius User the 
replace modify is not propagated to the consumers.
What am I missing?
Hope I have provided enough info.
Thanks 
  Mau