[Date Prev][Date Next]
Re: Rép. : Re: Overlay Chain
now I have:
a referral link like this:
and on slapd.conf this
then I can see on ldap Browser a subtree like : ou=users
When I want to see the ou subtree I must re entrer a login and
password, so I don't understand what it's wong
I can bind all the directories
>>> "Pierangelo Masarati" <firstname.lastname@example.org> 01/12 11:20 >>>
> thanks, for the help.
> I have see the example and tested it like this:
> overlay chain
> chain-uri ldaps://ip:636
> chain-idassert-bind bindmethod=simple
> the server start (i use an openLdap 2.3.13 for the moment) but I
> see any subtree relative to the chainning on ldap Browser (my
> for the moment).
If you ran test032 and it succeeded, this means that chaining works.
this point you should go step by step and check if all the bricks are
place or you made any errors in setting the system up.
1) "I don't see any subtree relative to the chainning on ldap Browser"
not very useful information to trace the problem; can you produce logs
a reasonable level ("stats") of both the local and the remote servers
you run a few queries? Do the logs tell you anything relevant about
reason chaining failed?
2) can you query ldaps://ip:636 directly using ldapsearch, simple bind
the above identity (to clarify, does:
ldapsearch -x -H ldaps://ip:636 \
-D "cn=Manager,o=Managers,dc=monAnnuaire,dc=fr" -w secret \
return anything? Can you show the __exact__ message you get? In case
get an error, can you retry adding -d -1 and post the __exact output
3) in case (2) passes, can you post the entire content of your
slapd.conf(5) (you may omit comments, schema and other details; the
of the databases, overlays and so should suffice; since you're using
ldaps, you should also include your TLS/SSL configuration parameters).
4) did you try without TLS/SSL? I'd suggest you first make sure
work; then complete them with TLS details, which represent a
> if I change the chain-uri like ldaps://ip:636/dc=monAnnuaire2,dc=fr
> don't work.
If you just read slapo-chain(5) it'll point you to slapd-ldap(5) for
"uri" directive; slapd-ldap(5) will tell you that the DN in the URI is
strictly prohibited. I'd first try something smarter before changing
parameters randomly and against their documented usage.
Ing. Pierangelo Masarati
Responsabile Open Solution
OpenLDAP Core Team
Via Dossi, 8 - 27100 Pavia - ITALIA