On 02/22/2011 02:07 AM, Howard Chu wrote:
Hugo Monteiro wrote:
Hello list,
I have been trying to use translucent overlay to merge attributes
between a remote and a local server (both 2.4.23).
From the slapo-translucent man page i read:
"Attributes may be specified as both local and remote if desired."
and
"In any case, both the local and remote entries corresponding to a
search result will be merged before being returned to the client."
The thing is that if i specify an attribute (objectclass) to be both
local and remote, i can only get/search for the local entries. Choosing
either separately will work as advertised though.
Again, i ask if this is a bug, a subtlety i have missed or this is not
supposed to work with objectClass attribute?
Hello Howard,
Re-read the manpage. 1st paragraph.
"Entries retrieved
from a remote LDAP server may have some or all attributes
overridden,
or new attributes added, by entries in the local database
before being
presented to the client."
This overlay does not merge attributes, it replaces them.
In that case, i would understand that if i specified the objectClass
attribute to be both remote and local, i would be able to perform
queries which would match locally stored values, and in the event that
there wasn't any satifying stored values, then the query would be made
on the remote database.
in slapd.conf i have
translucent_remote
objectClass,description,sambaLMPassword,sambaNTPassword
translucent_local
description,objectClass,sambaSID,sambaPrimaryGroupSID,sambaAcctFlags,sambaHomeDrive,sambaHomePath,sambaLogonScript,sambaProfilePath,sambaAcctFlags,sambaPwdLastSet,sambaPwdCanChange,sambaPwdMustChange,sambaLogonTime,sambaLogoffTime,sambaKickoffTime,sambaBadPasswordCount,sambaBadPasswordTime,sambaLogonHours,sambaHomeDrive,sambaLogonScript,sambaProfilePath,sambaUserWorkstations,sambaHomePath,sambaDomainName,sambaMungedDial,sambaPasswordHistory,sambaSID,sambaPrimaryGroupSID,sambaSIDList,sambaGroupType,sambaNextUserRid,sambaNextGroupRid,sambaNextRid,sambaAlgorithmicRidBase
and as an example:
ldapsearch -b "ou=grupos,dc=fct,dc=unl,dc=pt" -h remoteserver -x
"(cn=agt)"
# extended LDIF
#
# LDAPv3
# base <ou=grupos,dc=fct,dc=unl,dc=pt> with scope subtree
# filter: (cn=agt)
# requesting: ALL
#
# 0, grupos, fct.unl.pt
dn: uniqueIdentifier=0,ou=grupos,dc=fct,dc=unl,dc=pt
displayName: agentes
cn: agt
uniqueIdentifier: 0
gidNumber: 1000
objectClass: top
objectClass: grupoUNL
objectClass: posixGroup
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
ldapsearch -b "ou=grupos,dc=fct,dc=unl,dc=pt" -h localhost -x "(cn=agt)"
# extended LDIF
#
# LDAPv3
# base <ou=grupos,dc=fct,dc=unl,dc=pt> with scope subtree
# filter: (cn=agt)
# requesting: ALL
#
# 0, grupos, fct.unl.pt
dn: uniqueIdentifier=0,ou=grupos,dc=fct,dc=unl,dc=pt
displayName: agentes
cn: agt
uniqueIdentifier: 0
gidNumber: 1000
objectClass: top
objectClass: grupoUNL
objectClass: posixGroup
objectClass: sambaGroupMapping
sambaSID: S-1-5-21-1327543176-3185848629-1254536839-1000
sambaGroupType: 2
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
So far so good. But when i try to filter per objectClass:
ldapsearch -b "ou=grupos,dc=fct,dc=unl,dc=pt" -h localhost -x
"(&(objectClass=sambaGroupMapping)(cn=agt))"
# extended LDIF
#
# LDAPv3
# base <ou=grupos,dc=fct,dc=unl,dc=pt> with scope subtree
# filter: (&(objectClass=sambaGroupMapping)(cn=agt))
# requesting: ALL
#
# search result
search: 2
result: 0 Success
# numResponses: 1
Hopefully i was able to explain the hurt that i'm feeling. =)
I am i wrong to assume that local rewrites don't go beyond the entry
retrieval? If this is not the role for translucent, is there any other
way i can accomplish this?
Regards,
Hugo Monteiro.