Hi Tomas,

> If I understand you correctly, the primary server is filled with data
> using bind-dyndb-ldap from an LDAP backend. Then the DS records are
> present on the primary server. At this point, bind-dyndb-ldap's work
> should be done, since it only serves as the backend LDAP driver for BIND.

You understand correctly.

> The issue happens when you try to replicate the zone to the secondary
> nameserver using AXFR. This leads me to believe that this might be some
> issue in the BIND component itself. Perhaps some special configuration
> is required.

I've not found any documentation that suggests special configuration
is required. I spoke to some of the people in #bind before posting to
this list, they were also surprised it wasn't working.

> It might help you if you'd test the setup without bind-dyndb-ldap with
> some mock data directly in BIND. If the AXFR doesn't contain the DS
> records then, it's related to BIND. Perhaps the BIND users
> (bind-us...@lists.isc.org) list might be able to assist you.

I've setup the test case directly on one of the primary nameservers
with a couple of domains and do see the DS glue records included in
the AXFR, so the missing records seem to only be happening when the
zonefile is backed by bind-dyndb-ldap.

Ben Roberts

Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to