[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: chain and ppolicy question

Tony Earnshaw wrote:
OpenLDAP 2.3.38.

My site is implementing ppolicy on a 4-server OpenLDAP/RHEL5 setup. I
have a problem with chaining referrals from the 3 slaves to the master.
I followed the slapo-chain man page and chaining works:

moduleload      back_ldap.la

overlay chain

chain-uri               "ldaps://mercurius.intern"
chain-idassert-bind     bindmethod="simple"
chain-return-error      true

cn=proxy,dc=barlaeus,dc=nl is the rootdn on all servers, thus also on
the master.

The rootdn is not able to update passwords. I have no idea why the rootdn shouldn't be able to update passwords (PASSMOD). However, it seems to me that the chaining from the slave should be carried out as the actual user and not rootdn. I can find nothing in slapo-chain or slapd-ldap that lists this possibility.

Can anyone here help with this?

What are you logs/-d saying?

Kind Regards,

Gavin Henry.
Managing Director.

T +44 (0) 1224 279484
M +44 (0) 7930 323266
F +44 (0) 1224 824887
E ghenry@suretecsystems.com

Open Source. Open Solutions(tm).