I have a couple of LDAP servers, redundant with replication enabled.

I'm having trouble with Apache Directory Studio not being able to fetch the base DN of one of these LDAP servers, showing an empty Root DSE.

For the other server, however, it shows the whole DIT without problems.

I found that the problem is the root node of my tree is missing on the problematic server when I perform an ldapsearch:

SERVER-1# ldapsearch -D "cn=manager,dc=example,dc=com" -w pass -LL -b "dc=example,dc=com" -s base 
version: 1

dn: dc=example,dc=com
dc: example
objectClass: top
objectClass: domain

SERVER-2# ldapsearch -D "cn=manager,dc=example,dc=com" -w pass -LL -b "dc=example,dc=com" -s base
version: 1

If I try to add the missing entry, I get an error, because it does exist:

# ldapadd -vc -D "cn=manager,dc=example,dc=com" -w pass < domain.ldif 
ldap_initialize( <DEFAULT> )
add dc:
add objectClass:
adding new entry "dc=example,dc=com"
ldap_add: Already exists (68)

If it does exist, how come it doesn't show in ldapsearch? I don't have any ACLs configured.

  • Since you're using openldap (as mentioned by the tags), does the missing entry show up on SERVER-2 when using slapcat(8)?
    – SailorCire
    Jan 16 '15 at 16:22
  • No, it doesn't :-( What I don't understand is why the ldapadd is giving me an error then. Jan 19 '15 at 10:52
  • What sort of replication are you using? A solution that would work, but isn't recommended, is to stop openldap on SERVER-2, purge the ldap directory on SERVER-2, slapcat > data.ldif on SERVER-1, slapadd -l data.ldif on SERVER-2, and then start up openldap on SERVER-2.
    – SailorCire
    Jan 19 '15 at 12:48
  • We're using multi-master refreshAndPersist. Unfortunately, these servers are in production, so I can't stop them at any time, unless we reserve a maintenance window. You gave me an idea though: I modified the entry on SERVER-1 adding a "dummy" description attribute, and it synced right away. Now the domain entry shows up on both servers! Jan 20 '15 at 8:46

Having multi-master replication in place, modifying the problematic domain entry by just adding a simple description on the working server seemed to solve the issue. The entry got replicated to the troublesome server automatically.

dn: dc=example,dc=com
changetype: modify
add: description
description: example

Now it works as expected. I don't know what may have caused the object to disappear though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.