Re: ppolicy+syncrpl: pwd* attributes lost

[Gavin Henry <ghenry@OpenLDAP.org>]

Chris G. Sellers wrote:
> I have n-way multimaster replication setup.  Works great.
>
> I have slapo_ppolicy setup, it too works.
>
> the problem I appear to have is that whichever server does the password 
> change, the pwd* attributes are set, and then removed from the other server.
>
> So, if I do a password change on server1, the record for user A on 
> server1 shows pwdChangedTime
> The record for user A on server2 shows the modificationTime but the 
> pwdChangedTime is deleted
>
> The same goes if I use server2 and look at server1.
>
> At first, I thought it may be due to the clear_hash setting, but that 
> didn't seem to make an impact.  Any ideas?  I know I must have something 
> missing but I'm just not seeing it.
>
> ---
>
> password-hash   {SSHA}
>
>
> ###########################################################################
> database        bdb
> suffix          "dc=nitle,dc=org"
> rootdn          "cn=MASTERUSER,dc=nitle,dc=org"
> rootpw          {SSHA}WAYTOOSECRETFORYOU
> directory       /home/ldap/openldap/var/openldap-data
>
> serverID 1
> limits dn.exact="cn=mirroruser,ou=ou,dc=nitle,dc=org" size=unlimited 
> time=unlimited
>
> syncrepl rid=010 
> provider=ldap://ldapserveronoe.nitle.org:999999999 binddn="cn=mirroruser,ou=ou,dc=nitle,dc=org" 
> bindmethod=simple
>   credentials=OOOOOHHHH searchbase="dc=nitle,dc=org" 
> type=refreshAndPersist scope=sub
>   interval=00:00:00:10 retry="15 5 300 +" timeout=1 schemachecking=off 
> starttls=yes
>   attrs="*,structuralObjectClass,entryUUID,entryCSN,creatorsName,createTimestamp,modifiersName,modifyTimestamp,pwdPolicySubentry"
> #  syncdata=accesslog
>
> syncrepl rid=011 
> provider=ldap://ldapserverTwo.nitle.org:999999999 binddn="cn=ldap`1,dc=nitle,dc=org" 
> bindmethod=simple
>         credentials=OOOOOHHHH searchbase="dc=nitle,dc=org" 
> type=refreshAndPersist schemachecking=off scope=sub
>         interval=00:00:00:10 retry="15 5 300 +" timeout=1 starttls=yes
>        
>  attrs="*,structuralObjectClass,entryUUID,entryCSN,creatorsName,createTimestamp,modifiersName,modifyTimestamp,pwdPolicySubentry"
> #       syncdata=accesslog
>
> overlay syncprov
> mirrormode true
>
> ## INDICES TO MAINTAIN
> index   objectClass                                             eq
> index   cn,mail,surname,givenname                               
> eq,subinitial
> index   uidNumber,gidNumber,memberuid,member,uniqueMember       eq
>
> ## PASSWORD POLICY OVERLAY ##
> overlay ppolicy
> ppolicy_default "cn=default,ou=policies,dc=nitle,dc=org"
> ppolicy_hash_cleartext
> # ppolicy_use_lockout
>
> ++++++++++++++++++++++++++++++++++++++
> Chris G. Sellers |  Internet Engineer      |   NITLE
> 734.661.2318 |  chris.sellers@nitle.org <mailto:chris.sellers@nitle.org>
> Jabber: csellers@nitle.org <mailto:csellers@nitle.org>  | AIM: imthewherd


Where are your ACLs?

--
Kind Regards,

Gavin Henry.
OpenLDAP Engineering Team.

E ghenry@OpenLDAP.org

Community developed LDAP software.

http://www.openldap.org/project/