Symas OpenLDAP Knowledge Base

Replication Gotchas

Created by Greg Noe, last modified by Emmanuel Lécharny on May 19, 2016

Linux Listening on Localhost Only Thing

<Something about that thing where Linux hosts only listen on localhost or something>

 

“no update referral” error

You will get this errors in the logs when the mirrorMode flag is not present in the configuration :

 

Nov 10 17:07:12 ldap01-test-cv slapd[5255]: conn=1006 op=18 SEARCH RESULT tag=101 err=32 duration=0.447ms nentries=0 text=
Nov 10 17:07:17 ldap01-test-cv slapd[5255]: conn=1006 op=19 ADD dn="cn=bobdole,dc=powerhrg,dc=com"
Nov 10 17:07:17 ldap01-test-cv slapd[5255]: conn=1006 op=19 RESULT tag=105 err=53 duration=0.670ms text=shadow context; no update referral

Simply add the mirrorMode flag in your database.

“<mirrormode> database is not a shadow” error

You will get this error when configuring replication using the slad.conf file and if you add the mirrorMode flag at the wrong place (ie, not where the syncrepl parameter is added ) :

syncrepl rid=001
    provider=<the remote server and port>
    binddn="<the DN of the replication user>"
    bindmethod=simple
    credentials=secret
    searchbase="<The base DN on the server we want to replcate from>"
    type=refreshAndPersis
    interval=00:00:00:10
    retry="5 5 300 5"
    timeout=1

mirrorMode TRUE
...

 

Here is the error you will get :

Nov 10 17:13:38 ldap01-test-cv slapd[5431]: /opt/symas/etc/openldap/slapd.conf: line 55: <mirrormode> database is not a shadow

 

A server can’t define two syncrepl consumer pointing on the same DIT

 

Let’s say you have a server with a DIT containing two branches :

  • ou=people,dc=symas,dc=com
  • ou=groups,dc=symas,dc=com

where dc=symas,dc=com is a namingContext (so associated with a database).

A remote server won’t be able to define two consumers, one pointing on the ou=people,dc=symas,dc=com branch, and another pointing on the ou=grouos,dc=symas,dc=com branch. Such a configuration, for instance, will not work :

syncrepl rid=001
    provider=ldap://producer:389/
    type=refreshAndPersist
    retry="60 10 300 3 600 +"
    searchbase="ou=people,dc=symas,dc=com"
    filter="(objectClass=*)"
    scope=sub
    schemachecking=off
    bindmethod=simple
    binddn="cn=replicator,dc=symas,dc=com"
    credentials=secret

syncrepl rid=002
    provider=ldap://producer:389/
    type=refreshAndPersist
    retry="60 10 300 3 600 +"
    searchbase="ou=groups,dc=symas,dc=com"
    filter="(objectClass=*)"
    scope=sub
    schemachecking=off
    bindmethod=simple
    binddn="cn=replicator,dc=symas,dc=com"
    credentials=secret

 

You will get errors like : do_syncrep2: rid=001 CSN too old, ignoring 20160518141951.128946Z#000000#001#000000

The provider defines only one contextCSN per database, that does not play well on the consumer side.