Hi all,

I've been trying to set up Chain on Update on CentOS DS 8.1. The master-slave replication works. Search queries return data from the replicated database on the slave perfectly.

When I send an update request, the slave binds with the master with the proper credentials but the ACI evaluation fails on the master. From the ACI logs on the master, it seems to me that the master evaluates the ACIs for the multiplexor bind dn rather than for the original user identity. This leads me to believe that somehow, proxy authentication is not happening. How do I solve this problem?

In my setup,

Following is the suffix and db configuration on the slave:

# Suffix dn: cn="ou=Roster,dc=example,dc=com",cn=mapping tree,cn=config cn: "ou=Roster,dc=example,dc=com" objectClass: top objectClass: extensibleObject objectClass: nsMappingTree nsslapd-state: backend nsslapd-backend: RosterData nsslapd-backend: RosterDataChain nsslapd-distribution-plugin: /usr/lib/dirsrv/plugins/libreplication-plugin.so nsslapd-distribution-funct: repl_chain_on_update nsslapd-parent-suffix: "dc=example,dc=com"

# Database dn: cn=RosterData,cn=ldbm database,cn=plugins,cn=config objectClass: top objectClass: extensibleObject objectClass: nsBackendInstance nsslapd-suffix: ou=Roster,dc=example,dc=com

# Replica dn: cn=replica,cn="ou=Roster,dc=example,dc=com",cn=mapping tree,cn=config cn: replica objectClass: top objectClass: nsds5replica objectClass: extensibleObject nsds5replicaroot: ou=Roster,dc=example,dc=com nsds5replicaid: 21 nsds5replicatype: 2 nsds5flags: 0 nsds5ReplicaBindDN: cn=dirhost1.example.net,ou=Replication Managers,cn=config nsds5ReplicaBindDN: cn=dirhost2.example.net,ou=Replication Managers,cn=config

# Chaining Database dn: cn=RosterDataChain,cn=chaining database,cn=plugins,cn=config changetype: add objectClass: top objectClass: extensibleObject objectClass: nsBackendInstance cn: RosterDataChain nsslapd-suffix: ou=Roster,dc=example,dc=com nsFarmServerUrl: ldap://dirhost1.example.net ldap://dirhost2.example.net nsCheckLocalACI: on nsUseStartTls: on nsBindMethod: nsMultiplexorBindDn: cn=dirslave1.example.net,ou=Replication Managers,cn=config nsMultiplexorCredentials: secret

I've tried with the following ACI combinations on ou=Roster,dc=example,dc=com on dirhost1 and dirhost2

1> aci: (targetattr="*") (version 3.0; acl "Proxy access for chain-on-update"; allow (proxy) userdn="ldap:///cn=dirslave1.example.net,ou=replication managers,cn=config";)

2> aci: (target=ldap:///uid=*,ou=Users,ou=Roster,dc=example,dc=com)(targetattr=*) (version 3.0; acl "Proxy access for chain-on-update as normal users"; allow (proxy) userdn="ldap:///cn=dirslave1.example.net,ou=Replication Managers,cn=config";)

I see the following error in the ACI logs:

[20/Aug/2009:12:57:24 +051800] NSACLPlugin - conn=201 op=2 (main): Deny write on entry(uid=mrugesh.karnik,ou=users,ou=roster,dc=example,dc=com).attr(userPassword) to cn=dirslave1.example.net,ou=replication managers,cn=config: no aci matched the subject by aci(70): aciname= "Write access to personal info", acidn="ou=users,ou=roster,dc=example,dc=com"

Thanks, Mrugesh

P.S. The users can modify their own userpassword attribute properly.