<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Hi,
<div>I think there are 2 issues at play</div>
<div>1. The certs/CA isn’t right on one of the servers (hence the TLS errors) do the syncrepl bind is failing.</div>
<div>2. It looks like SASL can’t find a password entry for the user in the bind attempt. Might be worth checking your SASL config to ensure the mechanisms you expect are available and your authzregexp is set up correctly.<br>
<br>
<div dir="ltr">Sent from my iPhone</div>
<div dir="ltr"><br>
<blockquote type="cite">On 20 May 2022, at 18:56, Tahir Hafiz <tahir.hafiz@gmail.com> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div style="background-color:#fff2e6; border:2px dotted #ff884d"><span style="font-size:12pt; font-family: sans-serif; color:black; font-weight:bold; padding:.2em">This email was sent to you by someone outside the University.</span>
<div style="font-size:10pt; font-family: sans-serif; font-style:normal; padding:.2em">
You should only click on links or attachments if you are certain that the email is genuine and the content is safe.</div>
</div>
<div>
<div dir="ltr">
<div>Hi, <br>
</div>
<div><br>
</div>
<div>We have two OpenLDAP servers (sso1 and sso2, ignore alpha - that one I think they decommissioned it years ago).</div>
<div>sso1 and sso2 are meant to be in mirror mode (sometimes called multi-master mode).</div>
<div>I had to switch sso1 off a while ago because it was no longer responding and didn't have much time to look at it back then.
<br>
</div>
<div><br>
</div>
<div>I have now had some spare time to look at it, updated the web certs which had to be renewed and restarted the openldap server in question.
<br>
</div>
<div>But I see the following error (and Google has not helped much on this one):<br>
<br>
<div>May 20 16:11:44 sso1 slapd[9008]: slapd starting</div>
<div>May 20 16:11:44 sso1 slapd[9008]: slap_client_connect: URI=ldaps://<a href="http://alpha.redacted.net/">alpha.redacted.net/</a> TLS context initialization failed (-1)</div>
<div>May 20 16:11:44 sso1 slapd[9008]: do_syncrepl: rid=003 rc -1 retrying (4 retries left)</div>
<div>May 20 16:11:44 sso1 slapd[9008]: slap_client_connect: URI=ldaps://<a href="http://sso2.redacted.net/">sso2.redacted.net/</a> TLS context initialization failed (-1)</div>
<div>May 20 16:11:44 sso1 slapd[9008]: do_syncrepl: rid=002 rc -1 retrying (4 retries left)</div>
<div>May 20 16:12:13 sso1 slapd[9008]: SASL [conn=1001] Failure: no secret in database</div>
<div><br>
</div>
<div>The weird thing is the OpenLDAP sso1 box is synching to sso2 ldap box, and I can connect to it with an ldap client on my home desktop and it now has the latest records so it is working as an ldap server but I'm not sure what the errors really mean.</div>
<div>Are there any avenues I can explore on this or has anyone seen something like this before (N.B. I am no ldap expert) ?
<br>
</div>
<div><br>
</div>
<div>Thanking you in advance,</div>
<div>Tahir<br>
</div>
</div>
</div>
</div>
<span>-- </span><br>
<span>EdLUG mailing list</span><br>
<span>EdLUG@mailman.lug.org.uk</span><br>
<span>https://lists.edlug.org.uk/mailman/listinfo/edlug</span><br>
</div>
</blockquote>
</div>
The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th’ ann an Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.
</body>
</html>