olcSyncrepl always gets reapplied

[MrPrimate]

When the olcSyncrepl value is set, it always gets reapplied, even when no changes have been made:

Debug: Executing '/usr/sbin/slapcat -b cn=config -o ldif-wrap=no -H ldap:///???'
Notice: /Stage[main]/Openldap::Server::Config/Openldap[olcDatabase={3}hdb,cn=config]/attributes: attributes changed {'objectClass' => ['olcDatabaseConfig', 'olcHdbConfig'], 'olcAccess' => [ACCESSRULES], 'olcDatabase' => ['{3}hdb'], 'olcDbDirectory' => ['/var/lib/ldap/data'], 'olcDbIndex' => ['objectClass eq,pres', 'ou,cn,mail,surname,givenname eq,pres,sub', 'uidNumber,gidNumber,loginShell eq,pres', 'uid,memberUid eq,pres,sub', 'nisMapName,nisMapEntry eq,pres,sub', 'uniqueMember eq,pres', 'entryCSN,entryUUID eq'], 'olcLimits' => ['{0}dn.exact="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited'], 'olcMirrorMode' => ['TRUE'], 'olcRootDN' => ['cn=Manager,dc=dev,dc=website1,dc=com'], 'olcRootPW' => ['SECRET], 'olcSecurity' => ['tls=1'], 'olcSuffix' => ['dc=dev,dc=website1,dc=com'], 'olcSyncrepl' => ['{0}rid=001 provider=ldap://ldap01.dev.website1.com/ searchbase="dc=dev,dc=website1,dc=com" bindmethod=simple binddn="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" credentials=secret logbase="cn=log" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog timeout=3 starttls=yes', '{1}rid=002 provider=ldap://ldap02.dev.website1.com/ searchbase="dc=dev,dc=website1,dc=com" bindmethod=simple binddn="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" credentials=secret logbase="cn=log" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog timeout=3 starttls=yes']} to '{"objectClass"=>["olcDatabaseConfig", "olcHdbConfig"], "olcAccess"=>["ACCESSRULES"], "olcDatabase"=>["{3}hdb"], "olcDbDirectory"=>["/var/lib/ldap/data"], "olcDbIndex"=>["objectClass eq,pres", "ou,cn,mail,surname,givenname eq,pres,sub", "uidNumber,gidNumber,loginShell eq,pres", "uid,memberUid eq,pres,sub", "nisMapName,nisMapEntry eq,pres,sub", "uniqueMember eq,pres", "entryCSN,entryUUID eq"], "olcLimits"=>["{0}dn.exact=\"cn=Replicator,ou=system,dc=dev,dc=website1,dc=com\" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited"], "olcRootDN"=>["cn=Manager,dc=dev,dc=website1,dc=com"], "olcRootPW"=>["SECRET"], "olcSuffix"=>["dc=dev,dc=website1,dc=com"], "olcSyncrepl"=>["rid=001 provider=ldap://ldap01.dev.website1.com/ searchbase=\"dc=dev,dc=website1,dc=com\" bindmethod=simple binddn=\"cn=Replicator,ou=system,dc=dev,dc=website1,dc=com\" credentials=secret logbase=\"cn=log\" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" schemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog timeout=3 starttls=yes", "rid=002 provider=ldap://ldap02.dev.website1.com/ searchbase=\"dc=dev,dc=website1,dc=com\" bindmethod=simple binddn=\"cn=Replicator,ou=system,dc=dev,dc=website1,dc=com\" credentials=secret logbase=\"cn=log\" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" schemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog timeout=3 starttls=yes"], "olcMirrorMode"=>["TRUE"], "olcSecurity"=>["tls=1"]}'
Debug: dn: olcDatabase={3}hdb,cn=config
changetype: modify
replace: olcSyncrepl
olcSyncrepl: rid=001 provider=ldap://ldap01.dev.website1.com/ searchbase="dc=dev,dc=website1,dc=com" bindmethod=simple binddn="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" credentials=secret logbase="cn=log" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog timeout=3 starttls=yes
olcSyncrepl: rid=002 provider=ldap://ldap02.dev.website1.com/ searchbase="dc=dev,dc=website1,dc=com" bindmethod=simple binddn="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" credentials=secret logbase="cn=log" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog timeout=3 starttls=yes

Debug: Executing '/usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/openldap.olcDatabase={3}hdb,cn=config20150706-26103-1hp3yy'

Looking at the comparison a bit more it looks like it might be the {0} and {1} at the beginning of the string?

'olcSyncrepl' => [
'{0}rid=001 provider=ldap://ldap01.dev.website1.com/ searchbase="dc=dev,dc=website1,dc=com" bindmethod=simple binddn="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" credentials=SECRET logbase="cn=log" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog timeout=3 starttls=yes', 
'{1}rid=002 provider=ldap://ldap02.dev.website1.com/ searchbase="dc=dev,dc=website1,dc=com" bindmethod=simple binddn="cn=Replicator,ou=system,dc=dev,dc=website1,dc=com" credentials=SECRET logbase="cn=log" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog timeout=3 starttls=yes']} 
"olcSyncrepl"=>[
"rid=001 provider=ldap://ldap01.dev.website1.com/ searchbase=\"dc=dev,dc=website1,dc=com\" bindmethod=simple binddn=\"cn=Replicator,ou=system,dc=dev,dc=website1,dc=com\" credentials=SECRET logbase=\"cn=log\" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" schemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog timeout=3 starttls=yes", 
"rid=002 provider=ldap://ldap02.dev.website1.com/ searchbase=\"dc=dev,dc=website1,dc=com\" bindmethod=simple binddn=\"cn=Replicator,ou=system,dc=dev,dc=website1,dc=com\" credentials=SECRET logbase=\"cn=log\" logfilter=\"(&(objectClass=auditWriteObject)(reqResult=0))\" schemachecking=on type=refreshAndPersist retry=\"60 +\" syncdata=accesslog timeout=3 starttls=yes"], 

[bodgit]

Yup, the values should have been prefixed internally to match what slapd will do implicitly. What masked the issue slightly was that my test cases were also wrong; once I fixed them the issue showed up 😉

[MrPrimate]

Ah, excellent, thanks.