monline

I used to get "<= bdb_equality_candidates: (cn) not indexed" messages in my /var/log/debug log file all the time. The linked page describes the fix (assuming a split OpenLDAP configuration), but it's specialized for Ebox. It's quite easy to adapt the instructions for a generic OpenLDAP setup.

Update (2013.08.12): the below instructions are not really the right way to go. Use ldapmodify instead, as described on Ubuntu's "Samba and LDAP" page.

1. Stop the LDAP server:
   
   sudo stop slapd
2. Open the right OpenLDAP config file with an editor:
   
   sudo vi /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{1\}hdb.ldif
3. Add new lines (after the one with olcDbIndex: objectClass eq in it) for the missing indexes. Eg.:
   
   olcDbIndex: cn eq
olcDbIndex: gidNumber eq
olcDbIndex: memberUid eq
olcDbIndex: uid eq
olcDbIndex: uidNumber eq
olcDbIndex: uniqueMember eq
4. Run the OpenLDAP indexer for your configuration:
   
   sudo -u openldap slapindex -F /etc/ldap/slapd.d/
5. Start the LDAP server:
   
   sudo start slapd

PS: don't forget to back up your OpenLDAP database (in /var/lib/ldap) before you touch it.

PS2: after applying the changes I was hit by something that might be a bug (or it's just me not knowing all the internals). Our users and groups come from the LDAP server which is a fileserver too. One of our users was denied access on all of our (LTSP) servers to an NFS mounted directory (that was mounted from an NFS export of the LDAP server). The directory was set to be accessible to a specific LDAP group and requesting the effective groups of that users showed that it had that group assigned. I tried reloading the nfs-kernel-server service on the LDAP+file server, I tried restarting the nscd service on both the LDAP+file server and the other (LTSP) servers and I tried remounting the directory. It didn't help. What helped was a reboot of both the LDAP server and the other (LTSP) servers. It might have been sufficient to reboot just the other (LTSP) servers, but I didn't want to pull this out any longer so I just rebooted all servers that might have been part of the problem.