[Date Prev][Date Next]
Re: Migrating from slapd 2.3 to 2.4
Nick Milas wrote:
> If a non-root DN is used for replication, then only
> the parts of the DIT that are accessible by that DN will be
> Additionally, slapcat outputs operational attributes too, which I
> think can not be identical on both ends.
Because it is possible to initialize a replica with a slapcat output,
we need all attributes which are in this output. All other
operational attributes are not needed.
I have not done this in practice but I believe one may try it this way.
Assume you have an entry cn=111. So we slapcat this entry and
do a temporarely search. attributes which are in slapcat and NOT in
search must be added to the final search. Then compare the output of both
slapcat -n1 -H 'ldap:///???(cn=111)' 2>/dev/null |cut -d: -f1
ldapsearch -xAMMLLL 'cn=111' '*' 2>/dev/null |cut -d: -f1
In this case, a db which is not a replica, we must add
structuralObjectClass entryUUID creatorsName createTimestamp entryCSN modifiersName modifyTimestamp
so the final search is:
ldapsearch -xMMLLL 'cn=111' '*' structuralObjectClass entryUUID creatorsName createTimestamp entryCSN modifiersName
The used switches MM and LLL are important.
So now we have a way to partial slapcat a DIT and do a search which
produces the same result if the user who is doing the search, has
the rights to see all attributes.
Use the mentioned perl tools to sort and diff the output.