[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: (ITS#7107) cn=config syncrepl fails with "controls require LDAPv3" on bound v3 connection
- To: openldap-its@OpenLDAP.org
- Subject: Re: (ITS#7107) cn=config syncrepl fails with "controls require LDAPv3" on bound v3 connection
- From: hyc@symas.com
- Date: Thu, 8 Dec 2011 20:52:01 GMT
- Auto-submitted: auto-generated (OpenLDAP-ITS)
hume-ol@bofh.ca wrote:
> Full_Name: Brandon Hume
> Version: 2.4.28
> OS: RHEL EL6.1, kernel 2.6.32-131.12.1.el6.x86_64
> URL: http://den.bofh.ca/~hume/ol_v3_fail_syslog.txt
> Submission from: (NULL) (2001:410:a010:2:223:aeff:fe74:400e)
>
>
> OpenLDAP 2.4.28 compiled with BerkeleyDB 5.2.36, attempting to configure for
> multi-master replication. Problems occurred with the second server complaining
> about operations errors while attempting to replicate the cn=config tree; I've
> been able to reproduce the problem from the command line using ldapsearch from
> the same compile.
>
> The host is RHEL 6.1 running inside VMWare. Version of OpenLDAP is 2.4.28,
> compiled with BerkeleyDB 5.2.36 (no patches available from Oracle at the time I
> downloaded). Configuration options used are visible in
> http://den.bofh.ca/~hume/config_ol_sh.txt
>
> The problem does *not* seem to be consistent, as *sometimes* it will work but
> most of the time not. I've run the example query once, had it fail, run it
> again immediately and had it succeed, and then again fail a dozen times in a
> row. Wireshark traces showed the connection was established using LDAPv3;
> putting the server in debug "Any" mode also confirms the same. The syslogs
> generated are viewable at http://den.bofh.ca/~hume/ol_v3_fail_syslog.txt
>
> I've compiled 2.4.27 with the same options and it *seemed* to behave, though I
> may have merely gotten lucky.
Only two source files are changed between 2.4.27 and 2.4.28, and neither of
the changes affect cn=config, syncrepl, or Bind operations. If you're seeing a
difference in behavior here then I can only conclude that your build
environment is corrupted.
> Example ldapsearch invocation:
>
> $ /appl/ldap/bin/ldapsearch -x -D 'cn=config' -h kil-ds-3.its.dal.ca -b
> cn=config -w bindpass -s sub -E sync=rp -e manageDSAit 'objectclass=*'
> # extended LDIF
> #
> # LDAPv3
> # base<cn=config> with scope subtree
> # filter: objectclass=*
> # requesting: ALL
> # with manageDSAit control
> #
>
> # search result
> search: 2
> result: 2 Protocol error
> text: controls require LDAPv3
>
> # numResponses: 1
> ldap_result: Can't contact LDAP server (-1)
>
>
> These servers are not yet in production and I have ~two weeks to play and tweak
> to generate more debugging information if you'd find it useful.
>
>
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/