I'd like to set up a read-only consumer that never returns referrals to a writable master server. Basically, any write requests that aren't replication updates would just be dropped. It doesn't look like there is an analogous setting for this in the suffix-level "nsslapd-state" variable. The closest thing is "referral on update" (default consumer behavior). Then there is the "nsslapd-readonly" attribute, but I think this would also disable updates from the master replica. One way would be to set a bogus suffix referral, so that client updates are referred to a non-existent server. Does anyone have a more elegant solution? Thank you! -- George
