Denying access to syncrepl consumere during initial DIT content load

[Christian Kratzer <ck-lists@cksoft.de>]

Hi,

I remember a discussion some time ago about the possibility of delaying access to a syncrepl. consumer during the intial DIT load.

I have setup my servers to authenticate replication via sasl method external and the servers respective certificates which is nice.

I have also setup limits and acl to the DIT as using a groupOfNames:

olcLimits:
  group/groupOfNames/member="cn=replicators,ou=serviceaccounts,dc=cksoft,dc=net"
  size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited

olcAccess: to *
  by group/groupOfNames/member="cn=replicators,ou=serviceaccounts,dc=cksoft,dc=net" read

This is all nice and shiny and I like having my ldap consumers configured without cleartext credentials (apart from the cert private key of course) ;)

The fun starts when I delete the DIT from multiple consumers and allow them to resync from masters.  If they also resync from each other they could possibly authenticate using sasl external but they would not be allowed access to all of the DIT, all of the attributes or be unlimited using olcLimits as the group might not yet have been replicated.

I also had major fun just reseeding a single server out of a set of 4 causing data loss on the servers that connected to the not yet full synced up server.

This is another situation in which it would be nice to be able to disallow any ldap connections to a consumere while it is in the initial sync phase.

I seem to recall there was discussion in possibly addiing such a feature but my google foo is lacking and I cannot find the discussion.

In case there is not yet such a feauture I am considering firewalling access to slapd during the initial sync phase. Is there any ldap way of reliably detecting that initial sync has completed apart from tailing syslog and looking for csn commit messages ...

Greetings
Christian

--
Christian Kratzer                   CK Software GmbH
Email:   ck@cksoft.de               Wildberger Weg 24/2
Phone:   +49 7032 893 997 - 0       D-71126 Gaeufelden
Fax:     +49 7032 893 997 - 9       HRB 245288, Amtsgericht Stuttgart
Mobile:  +49 171 1947 843           Geschaeftsfuehrer: Christian Kratzer
Web:     http://www.cksoft.de/