RE: TLS replication/SALS bindmethod

["Darouichi, Aziz" <adarouic@post03.curry.edu>]

If I moved either entries   service fails to start.

-----Original Message-----
From: Michael Ströder [mailto:michael@stroeder.com] 
Sent: Monday, May 23, 2011 10:15 AM
To: Darouichi, Aziz
Cc: openldap-technical@openldap.org
Subject: Re: TLS replication/SALS bindmethod

Darouichi, Aziz wrote:
> I configured Muti-master replication, everything worked fine till I hashed
> rootpw to confirm to a hardcoded password in Oracle.
> I configured OpenLDAP servers to us SALS. This is my configuration.
> provider=ldap://xxx.xxx.xxx:389
> bindmethod=sasl
> saslmech=external
> starttls=yes
> tls_cert=/etc/pki/tls/certs/slapd.pem
> tls_key=/etc/pki/tls/private/ldap.pem
> tls_cacert=/etc/pki/tls/certs/ca-bundle.crt
> tls_reqcert=demand
> binddn="cn=ldap,dc=establishment,dc=edu"
> credentials={SSHA}2vNffW+5hEolqIykgH9tCpxq9jTTVSSu
> searchbase="dc=establishment,dc=edu"
> schemachecking=on
> type=refreshAndPersist
> retry="60 +"

I don't understand why you use

bindmethod=sasl
saslmech=external

and

binddn="cn=ldap,dc=establishment,dc=edu"
credentials={SSHA}2vNffW+5hEolqIykgH9tCpxq9jTTVSSu

together.

Anyway you have to provide the clear-text password here since the consumer is 
a LDAP client.

> when I run ldapsearch against servers I get response from both machines.
> ldapsearch -H ldap://server.establishment.edu -D
> "cn=ldap,dc=establishment,dc=edu" -w "PASSWORD" -x -b "dc=establishment
> ,dc=edu" "(objectclass=*)" uid.
> This what I get in the logs:
> May 23 09:37:01 ldap1 slapd[1559]: slap_client_connect:
> URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6)
> May 23 09:37:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying
> May 23 09:37:58 ldap1 slapd[1559]: conn=5220 op=0 do_extended: unsupported
> operation "1.3.6.1.4.1.1466.20037"
> May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect:
> URI=ldap://xxx.xxx.edu:389 Warning, ldap_start_tls failed (2)
> May 23 09:38:01 ldap1 slapd[1559]: slap_client_connect:
> URI=ldap://xxx.xxx.edu:389 ldap_sasl_interactive_bind_s failed (-6)
> May 23 09:38:01 ldap1 slapd[1559]: do_syncrepl: rid=002 rc -6 retrying

This basically means that TLS is not properly configured at the provider.

Ciao, Michael.