Re: syncRepl blocks updates (ITS#3114)

[quanah@stanford.edu]

--On Tuesday, June 01, 2004 4:13 PM -0400 Jong <jongchoi@OpenLDAP.org> 
wrote:

> Quanah,
> Sorry for delaying to address this issue.
> If you have it, can you send me a log file at the master when ldapadd is
> executed and hung ?
> If you don't, can you generate a trace / log file and send it to me ?
> Only the part of the trace on and after the ldapadd event seems relevant
> for which the debugging level of -1 is preferred.
> Best regards,
> - Jong-Hyuk

Jong,

In working to get this set up for you and looking at the output, I believe 
I found the issue.  It has to do with how group ACL's and regular ACL's are 
evaluated.

When my ACL is this:

access to *
        by 
dn.base="cn=replicator,cn=service,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 write
        by group.base="cn=ldapReplica,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 read
        by group.base="cn=Supervisor,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 write
        by group.base="cn=ldapAdmin,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 read
        by 
dn.base="cn=RegistryDataAuditor,cn=service,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=5
6 read
        by * break

Everything *works*.

When my ACL is this:

access to *
        by 
dn.base="cn=replicator,cn=service,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 write
        by group.base="cn=Supervisor,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 write
        by group.base="cn=ldapAdmin,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 read
        by 
dn.base="cn=RegistryDataAuditor,cn=service,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=5
6 read
        by group.base="cn=ldapReplica,cn=Applications,dc=stanford,dc=edu" 
sasl_ssf=56 read
        by * break

I get the lock situation, because slapd never iterates cn=ldapReplica group!


Please close this ITS, and I will open a new one related to the ACL's, with 
relevant debugging information.

--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITSS/Shared Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html