Steps of configuration of chain modification :
- On master 389DS server
- Create a new ACI on dc=example,dc=com : (targetattr = "*")(version 3.0; acl "Proxied authorization for database links";
allow (proxy) (userdn = "ldap:///cn=Replication Manager,cn=config");) - Create cn=replication manager,cn=config on the master after getting this error from the slave's log :
- [17/Feb/2019:14:31:30.151680780 +0000] - ERR - slapi_ldap_bind - Error: could not bind id [cn=replication manager,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object)
[17/Feb/2019:14:31:30.153315712 +0000] - ERR - chaining database - cb_get_connection - Can't bind to server <idm01.example.com> port <636>. (LDAP error 32 - No such object; Netscape Portable Runtime error 0 - no error)
[17/Feb/2019:14:31:30.154527249 +0000] - ERR - chaining database - chaining_back_modify - cb_get_connection failed (-11) Connect error
- On slave 389DS server
- Create the chain entry with ldapadd -x -W -D "cn=Directory Manager" -f chain.ldiff
- dn: cn=chainbe1,cn=chaining database,cn=plugins,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsBackendInstance
cn: chainbe1
nsslapd-suffix: dc=example,dc=com
nsfarmserverurl: ldaps://idm01.example.com:636
nsmultiplexorbinddn: cn=replication manager,cn=config
nsmultiplexorcredentials: reppassword
nsCheckLocalACI: on
- Modify the existing : dn: cn="dc=example,dc=com",cn=mapping tree,cn=config or to be exact dn: cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
- The original Entry was :
- dn: cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
cn: dc=example,dc=com
cn: "dc=example,dc=com"
nsslapd-state: referral on update
nsslapd-backend: userRoot
nsslapd-referral: ldap://idm01.exemple.com:389/dc%3Dexample%2Cdc%3Dcom
- The modified entry is :
- dn: cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
cn: dc=example,dc=com
cn: "dc=example,dc=com"
nsslapd-backend: userRoot
nsslapd-referral: ldap://idm01.exemple.com:389/dc%3Dexample%2Cdc%3Dcom
nsslapd-state: backend
nsslapd-distribution-plugin: /usr/lib64/dirsrv/plugins/libreplication-plugin.so
nsslapd-distribution-funct: repl_chain_on_update
Errors :
- From 389DS slave server :
- Erorr Log
- [17/Feb/2019:14:44:24.514362428 +0000] - ERR - chaining database - chaining_back_modify - invalid password syntax - passwords with storage scheme are not allowed
- From Zimbra mail server
Did I respect the procedure?
i didn't find anything about chain modification on RedHat documentation, did I miss anything?