The evilness of OpenLDAP

Actually thats not entirely fair. I’ve been spending sometime trying to make OpenLDAP work with replication – I had a serious go a few months ago, but ending up giving up because other stuff got in the way.

Turns out the reason is annoyingly simple. I was using slapcat and slapadd to create the slave. As it turns out, slapadd (naturally enough) creates the files as root. OpenLDAP under RedHat runs as user ldap, not root (this is good). But it can’t read the files.

Best solution is to change the ownership of the files. Of course, it would be nice if OpenLDAP actually told you that, instead of leaving you to work it out for yourself, but it’s now working fine.

The other thing you should do is ensure the DN you’re using for binding as the replicator exists in the directory that you import with slapadd. Otherwise, you’re not going to be able to bind to the slave from the master.

Comments are closed.