Home / server / Questions / 953723
Accepted
Heiner
Asked: 2019-02-14 03:55:23 +0800 CST

LDAP replication works - but user passwords are missing

  • 772

We created a master / slave environment, where a ldap server replicates another periodically. All entries are replicated correctly, but the attribute 'userPass' is not replicated. We assumed this is an ACL issue, so on the master side we added 

dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {3}to attrs=userPassword by dn.base="cn=syncprov,dc=thedomain,dc=com" read

but the userPass is still missing.

To debug this step-by-step, it would be helpful

  1. Is there a tool that helps me checking ACL issues? So i could impersonate a user and check an attribute?

  2. What logging level on the server side would display ACL issues?

  3. Whenever we try ldapmodify changes on the slave side, they are rejected with 'shadow context', which is pretty logical, but how can we make changes? Do we have to exclude the cn=config from replicating

  4. Since any changes on the slave side are rejected, how do we stop replication mode at all?

ldap

1 Answers

  1. Best Answer

    You can simply check if the ACL is correct now by logging in with the credentials for the replication user and confirming that the userPassword gets displayed when you query other user objects.

    For instance with a simple ldapsearch -D "cn=syncprov,dc=thedomain,dc=com" -w secret -p 389 -h server.example.com "cn=Heiner"

    If the ACL is correct, you should be able to see the userPassword.

    Fixing the ACL won't automatically start replicating the missing userPassword attributes to your slave.

    (The changed ACL does not modify the original user account object, although cn=syncprov can now see an extra attribute, that is not a "new" attribute, on the master server that account remains unchanged. And since replication only synchronizes objects that have been updated nothing happens.)

    You will need to completely initialise the slave again, this time with the userPasswords's.

    • 1