LDAP allows you to have a master+slave server setup, with automatic failover in case of problems or just to spread the load. This has obvious advantages, but it can hide problems with the master server.
If your master server is down but the slaves are OK, ldapsearch and other lookups will work fine. But if you try to modify the database (e.g., with ldapadd), you'll get this kind of error message:
ldap_add: Referral (10) referrals: ldaps://masterldap.example.com/uid=test,ou=People, dc=example,dc=com
You can confirm the diagnosis by trying: ldapsearch -H ldaps://masterldap.example.com to force a bind to the master server.
The next stage is to find out what's causing the problem. Set the loglevel in /etc/ldap/slapd.conf to 1, then restart slapd and check the logs.
Two common problems:
slapd: bdb_db_open: alock package is unstable slapd: backend_startup_one: bi_db_open failed! (-1)
Remember to return the loglevel to normal afterward, or the server will be very slow. Also, consider using monitoring software to catch these silent problems!
This article was first published on ServerWatch.com.