[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: refreshAndPersit vs. ACLs

Norbert Klasen wrote:
we want entries to be replicated to a public slave, only if they have an attribute worldreadable=TRUE.

So I've setup an ACL on the master which basically is like
access to * filter=(worldreadable=FALSE)
    by * none
access to *
    by * read
Thus, the consumer only sees entries it is allowed to replicate.

Now if an entry's worldreadable attribute is changed from TRUE to false, this modification will not propagate to the consumer and the entry stays visible.
However, with refreshOnly this 'lost' entry is detected and removed (syncrepl_del_nonpresent).

You should include the filter in your consumer's search spec in order to get these changes propagated immediately.

  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc
  OpenLDAP Core Team            http://www.openldap.org/project/