Re: Remove an objectclasse during syncrepl

[masarati@aero.polimi.it]

> Hi all,
>
> We have a brand new ldap server that we are going to replicate with an
> outside replica, for an extranet purpose.
> During this replication, we would like to remove the "posixaccount"
> objectclass to only let the "inetorgperson" and "top" ones so we didn't
> need to put passwords or anything not needed
> I heard about slapo-rwm, but it seems to be buggy

Let "buggy" aside (it's not "buggy" but it may have interaction problems
with slapo-syncprov(5)).  Or, if you notice a bug, please submit an ITS.

> I'm sure that some of you all ready have done that, maybe there is a
> better way.

You should use the primary mechanism syncrepl provides for this purpose:
the filter, the attribute list and ACLs.  You can simply hide attributes
related to posixAccount in a specific set of ACLs that are only triggered
by the replicator's identity.  Something like

access to attrs=objectClass val=posixAccount
	by dn=cn=replicator none
        by * break

access to attrs=@posixAccount
	by dn=cn=replicator none
        by * break

Note: you may need to craft that a little bit if posixAccount also
contains stuff used by other objectClasses you don't want to be filtered
out.

p.