Thanks Rick, Yes this is what I did. I find the error message not very user-friendly. Anyway, when I use a different bind dn, it says that my sub suffix l=location B,ou=people,o=suffix does not exist. Do I need to add that object as well? Thought, the directory takes care of this one. -Reinhard -----Original Message----- From: fedora-directory-users-bounces at redhat.com [mailto:fedora-directory-users-bounces at redhat.com] On Behalf Of Rich Megginson Sent: Monday, July 20, 2009 12:37 PM To: General discussion list for the 389 Directory server project. Subject: Re: [389-users] Db-link setup question Reinhard Nappert wrote: > Hi, > > I have two LDAP Servers setup (Server A and Server B). Both of them > have the identical suffix (o=suffix). Again, both of them have a > people organizational unit (ou=people,o=suffix). Server B has a big > subtree (ou=region B,ou=people,o=suffix). > > My intension is to create a db link on Server A, which links to the > ou=region B,ou=people,o=suffix subtree on Server B. > > I did create the database link and a new suffix l=location > B,ou=people,o=suffix on Server A with the following entries: > > dn: cn=serverBlink,cn=chaining database,cn=plugins,cn=config > objectclass: top > objectclass: extensibleObject > objectclass: nsBackendInstance > nsslapd-suffix: ou=region B,ou=people,o=suffix > nsfarmserverurl: ldap://serverB:389/ > nsmultiplexorbinddn: cn=proxy admin,cn=config > nsmultiplexorcredentials: secret > cn: serverBlink > > dn: cn="l=location B,ou=people,o=suffix",cn=mapping tree,cn=config > objectclass: top > objectclass: extensibleObject > objectclass: nsMappingTree > nsslapd-state: backend > nsslapd-backend: serverBlink > nsslapd-parent-suffix: "ou=people,o=suffix " > cn: "l=location B,ou=people,o=suffix" > > I am only interested in reading the server B information, when > accessing from server A. The "proxy admin" user was created as well. > > When I do a search with the base l=location B,ou=people,o=suffix, > accessing server A, I always get the following error "Proxy dn should > not be rootdn". > > What did I miss for the setup? You cannot chain the directory manager user (aka rootdn). I'm assuming you're doing a search like ldapsearch -D "cn=directory manager" ... This will not work - you must use a user other than directory manager. > > Thanks, > -Reinhard > > ---------------------------------------------------------------------- > -- > > -- > 389 users mailing list > 389-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
