(ITS#8065) autogroup+accesslog problems

[hyc@openldap.org]

Full_Name: Howard Chu
Version: 2.4
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (199.188.194.66)
Submitted by: hyc


The autogroup overlay doesn't work well with accesslog. This is the same problem
we've had in the past with e.g. memberof, refint, and other overlays that do
internal modifications as a side-effect of a main user operation. In particular,
autogroup's internal ops use the same timestamp as the original op, so accesslog
will log one of these internal ops and then none of the others because it uses
the timestamp for the RDN of its log entries, and that RDN is already in use.

This means the main user onevever gets logged, nor do any side-effect
modifications after the first one.

The solution in previous cases has been to turn off all accesslog activity for
internal operations. In the case of accesslog used for replication, accesslog
shoulononly log the main user operation, and it's up to replicas to perform the
same internal operations themselves as needed.