Actually it does work!
On Apr 30, 2011, at 1:06 PM, Arthur de Jong wrote: > From the logs above > it seems that you are mixing ldaps:// with StartTLS. I think nslcd may > be trying to use StartTLS on an ldaps:// connection. Perhaps the slave > should provide a referral with ldap:// instead? I should have figured that out. That was the problem. Sorry to have you debug a configuration issue. Please close this bug report unless you think further action is needed regarding referrals using ldaps. Below are the nslcd debug messages for a functional password change referral to ldap://ldapmaster.my.tld Thanks very much, Chris nslcd: DEBUG: add_uri(ldap://ldapslave1.my.tld) nslcd: DEBUG: add_uri(ldap://ldapslave2.my.tld) nslcd: DEBUG: add_uri(ldap://ldapmaster.my.tld) nslcd: DEBUG: ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT,2) nslcd: DEBUG: ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE,"/etc/ssl/certs/SNL_CA.pem") nslcd: version 0.7.13 starting nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory nslcd: DEBUG: setgroups(0,NULL) done nslcd: accepting connections nslcd: [8b4567] DEBUG: connection from pid=5426 uid=0 gid=0 nslcd: [8b4567] DEBUG: nslcd_group_bymember(root) nslcd: [8b4567] DEBUG: myldap_search(base="dc=my,dc=base", filter="(&(objectClass=posixAccount)(uid=root))") nslcd: [8b4567] DEBUG: ldap_initialize(ldap://ldapslave1.my.tld) nslcd: [8b4567] DEBUG: ldap_set_rebind_proc() nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,180) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,180) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,180) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_start_tls_s() nslcd: [8b4567] DEBUG: ldap_simple_bind_s(NULL,NULL) (uri="ldap://ldapslave1.my.tld";) nslcd: [8b4567] DEBUG: ldap_result(): end of results nslcd: [8b4567] DEBUG: myldap_search(base="dc=my,dc=base", filter="(&(objectClass=posixGroup)(memberUid=root))") nslcd: [8b4567] DEBUG: ldap_result(): end of results nslcd: [7b23c6] DEBUG: connection from pid=5574 uid=0 gid=1235 nslcd: [7b23c6] DEBUG: nslcd_pam_authc("username","","passwd","***") nslcd: [7b23c6] DEBUG: myldap_search(base="dc=my,dc=base", filter="(&(objectClass=posixAccount)(uid=username))") nslcd: [7b23c6] DEBUG: ldap_initialize(ldap://ldapslave1.my.tld) nslcd: [7b23c6] DEBUG: ldap_set_rebind_proc() nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,180) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,180) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,180) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [7b23c6] DEBUG: ldap_start_tls_s() nslcd: [7b23c6] DEBUG: ldap_simple_bind_s(NULL,NULL) (uri="ldap://ldapslave1.my.tld";) nslcd: [7b23c6] DEBUG: myldap_search(base="uid=username,ou=People,dc=my,dc=base", filter="(objectClass=posixAccount)") nslcd: [7b23c6] DEBUG: ldap_initialize(ldap://ldapslave1.my.tld) nslcd: [7b23c6] DEBUG: ldap_set_rebind_proc() nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,180) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,180) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,180) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [7b23c6] DEBUG: ldap_start_tls_s() nslcd: [7b23c6] DEBUG: ldap_simple_bind_s("uid=username,ou=People,dc=my,dc=base","***") (uri="ldap://ldapslave1.my.tld";) nslcd: [7b23c6] DEBUG: ldap_unbind() nslcd: [7b23c6] DEBUG: bind successful nslcd: [3c9869] DEBUG: connection from pid=5574 uid=0 gid=1235 nslcd: [3c9869] DEBUG: nslcd_pam_pwmod("username","uid=username,ou=People,dc=my,dc=base","passwd","***","***") nslcd: [3c9869] DEBUG: myldap_search(base="uid=username,ou=People,dc=my,dc=base", filter="(objectClass=posixAccount)") nslcd: [3c9869] DEBUG: ldap_initialize(ldap://ldapslave1.my.tld) nslcd: [3c9869] DEBUG: ldap_set_rebind_proc() nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,180) nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,180) nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,180) nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [3c9869] DEBUG: ldap_start_tls_s() nslcd: [3c9869] DEBUG: ldap_simple_bind_s("uid=username,ou=People,dc=my,dc=base","***") (uri="ldap://ldapslave1.my.tld";) nslcd: [3c9869] DEBUG: myldap_passwd(userdn="uid=username,ou=People,dc=my,dc=base",oldpasswd="***",newpasswd="***") nslcd: [3c9869] DEBUG: myldap_passwd(): try ldap_passwd_s() without old password nslcd: [3c9869] DEBUG: rebinding to ldap://ldapmaster.my.tld nslcd: [3c9869] DEBUG: ldap_start_tls_s() nslcd: [3c9869] DEBUG: ldap_simple_bind_s("uid=username,ou=People,dc=my,dc=base","***") (uri="ldap://ldapmaster.my.tld";) nslcd: [3c9869] DEBUG: ldap_unbind() -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
