MemberOf out of sync on consumer[s]

To: openldap-technical@openldap.org

Subject: MemberOf out of sync on consumer[s]

From: Yuri Bank <yuribank@gmail.com>

Date: Fri, 3 Dec 2010 10:16:27 -0800

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=UqCCOP0mHoMgdfr4kSyaVrb6lniESg+A0mo211yvgI8=; b=bcRSuw4EXHbGFF7bjyhPMOfDFuggdoq33YB26XTVNReTjqCyvky7hpY3YQ3+8bcVCd Zjscv8g0xe/pl9pdQ8E3ZjKjba1MKAlkMef+LegQVvgTUlimTgHZvuosD+yQIc84ObiC edeIO5sFhyTDLd1nt0/9q7HqZoYPw4TaGJIEY=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=xPC8fEZXaObEA5N930ZMVpDJoLP/Y/qyEYsGwWdJZ9kT+WoRO2c1j7qT1qzOjSTbWs GHCjla0n5n6BuNJP4V9TatbrIugwk20a5ld6E0hMgocR4lJDdF8r1zdpsEyDW9SqUDFQ XKXrTVXhyI0G6q7n41Z8ozVXKtpoH6w4zi5BI=

In-reply-to: <AANLkTinsKH1mf83EHdo9ivMhnNBCHgoxauhsj2Fko1u6@mail.gmail.com>

References: <AANLkTinsKH1mf83EHdo9ivMhnNBCHgoxauhsj2Fko1u6@mail.gmail.com>

I've been putting this off for a while, but this is happening frequently enough that I think its time to ask for opinions on the bug I'm running into with OpenLDAP and the MemberOf overlay.

Version: 2.4.23

Configuration: Single Provider, with 4 Consumers.

It seems that when I add a new users on my provider, the MemberOf attribute disappears randomly for some users, on some ( not all ) consumer nodes. Everything in the DIT is in tact, and the changes made on my provider are replicated to the consumers correctly. The only issue here is with the memberof attribute. The only way for me to remedy this problem is to shutdown slapd on the affected consumer node, delete everything in /var/sun/slapd, and then start slapd again which then fully syncs with my provider with all memberof attributes in tact. My testing shows that this is triggered by making changes to to my LDAP groups/users on the provider node, but that is all I can find. Nothing in the logs gives me any clues as to what is happening.

Has anyone experienced similar problems?

Thanks,
-Yuri