Hi,
meanwhile i fixed the issue and forget to answer.
The slaves which doesnt deliver the dynlist attribute memberof are
partial replicated instead of full replicated slaves. So the labeledURI
LDAP attribute value ldap:///dc=department,dc=organization,dc=X,dc=X?
has to be corrected to the basedn of the partial ldap slave, so
ou=xyz,dc=department,dc=organization,.... is correct and working.
cheers,
Andi
Am 02.02.23 um 15:35 schrieb Andreas Ladanyi:
Hi,
iam using one 2.5 Master / Provider / syncprov and some 2.5 Slaves /
Consumers / syncrepl. I added the dynlist to generate memberOf
attribute to slapd.conf on Master and all Slaves.
Problem is only on some slaves the dynlist doesnt generate memberof
attribute output when ldapsearch to a user. Iam using the objectClass
labeledURIObject and attribute labeledURI to store the LDAP URI for
dynlist to trigger / generate the DN of group membership for memberof
attribute of the user. The labeledURI attribute is replicated
successfully.
User entry output on non working slaves with attribute labeledURI,
memberof is missing:
ldapsearch -x -LLL -ZZ -H ldap://non_working_slave -b
'ou=X,dc=department,dc=organization,dc=X,dc=X' '(&(uid=X))' results in
the user entry with all objectClasses and all attributes except the
memberof attribute.
#start snip:
...
objectClass: labeledURIObject
...
labeledURI:
ldap:///dc=department,dc=organization,dc=X,dc=X??sub?(&(objectClass=groupOfNames)(member=uid=XXXX,ou=account,ou=X,dc=department,dc=organization,dc=X,dc=X))
#stop snip
slapd.conf:
overlay dynlist
dynlist-attrset labeledURIObject labeledURI memberOf
The difference between working and non working slaves is the length
of ACL list.
The important ACL entry is:
access to dn.sub=dc=department,dc=organization,dc=X,dc=X \
attrs=entry
by peername=IP_subnet read
by * break
access to
dn.regex=^[^,]+,ou=(account|group|groupOfNames),ou=X,dc=department,dc=organization,dc=X,dc=X$
by peername=IP_subnet read
by * break
i set no attrs= parameter at "access to dn.regex" rule to output all
attributes.
cheers,
Andreas
