ldap replication issues - ldap user rights issue

["Joel Wagler" <jwagler@rewardstream.com>]

Hello,

When I run the sldapd as root everything replicates fine from the master to
the slave.  However, if I run Slapd as ldap user the ldap directory entries
get changed but none of the changes to the ldap directory get written to the
replogfile (
/var/lib/ldap/master-slapd.replog).

I therefore think it must be a rights issue.  However, the ldap user has
read access to all files in the /etc/openldap directory inlcuding the
slapd.conf, and it also has read and write access to
/var/lib/ldap/master-slapd.replog file.

Is there any other files the slapd needs access to?

Any help would be appreciated.  By the way here is the slapd.conf file for
the master ldap server.

# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v
1.8.8.7 2001/09/27 20:00:31 kurt Exp $
#
# See slapd.conf(5) for details on configuration
options.
# This file should NOT be world readable.
#
include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include		/etc/openldap/schema/samba.schema
include
/etc/openldap/schema/redhat/rfc822-MailMember.schema
include		/etc/openldap/schema/redhat/autofs.schema
include
/etc/openldap/schema/redhat/kerberosobject.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a
working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		//tmp/slapd.pid
argsfile	//tmp/slapd.args
loglevel 5

# Create a replication log in /var/lib/ldap for use by
slurpd.
replogfile	/var/lib/ldap/master-slapd.replog

# Load dynamic backend modules:
# modulepath	/usr/sbin/openldap
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

#
# The next three lines allow use of TLS for
connections using a dummy test
# certificate, but you should generate a proper
certificate by changing to
# /usr/share/ssl/certs, running "make slapd.pem", and
fixing permissions on
# slapd.pem so that the ldap user or group can read
it.
# TLSCertificateFile /usr/share/ssl/certs/slapd.pem
# TLSCertificateKeyFile /usr/share/ssl/certs/slapd.pem
# TLSCACertificateFile
/usr/share/ssl/certs/ca-bundle.crt
#
# Sample Access Control
#	Allow read access of root DSE
#	Allow self write access
#	Allow authenticated users read access
#	Allow anonymous users to authenticate
#
#access to dn="" by * read
#access to *
access to dn=".*,dc=sambaserver,dc=rs"
	by dn="cn=replicator,dc=sambaserver,dc=rs" write
	by self					write
	by *					read
access to dn="dc=sambaserver,dc=rs"
	by dn="cn=replicator,dc=sambaserver,dc=rs" write
	by self					write
	by *			read
#	by self write
#	by users read
#	by anonymous auth
#
# if no access controls are present, the default is:
#	Allow read by all
#
# rootdn can always write!

#######################################################################
# ldbm database definitions
#######################################################################

database	ldbm
suffix		"dc=sambaserver,dc=rs"
#suffix		"o=My Organization Name,c=US"
rootdn		"cn=Manager,dc=sambaserver,dc=rs"
#rootdn		"cn=Manager,o=My Organization Name,c=US"
# Cleartext passwords, especially for the rootdn,
should
# be avoided.  See slappasswd(8) and slapd.conf(5) for
details.
# Use of strong authentication encouraged.
rootpw		a_secret_word
# rootpw		{crypt}ijFYNcSNctBYg
# The database directory MUST exist prior to running
slapd AND
# should only be accessible by the slapd/tools. Mode
700 recommended.
directory	/var/lib/ldap
# Indices to maintain
index
objectClass,rid,uid,uidNumber,gidNumber,memberUid	eq
index	cn,mail,surname,givenname			eq,subinitial
index 	default						sub
# Replicas to which we should propagate changes
replica	host=192.168.3.101:389
	binddn="cn=Manager,dc=sambaserver,dc=rs"
	bindmethod=simple credentials=secret
#	bindmethod=sasl saslmech=GSSAPI
#	authcId=host/ldap-master.example.com@EXAMPLE.COM

Joel