Permissions¶

Active Directory¶

A regular, read-only service account is enough for source.bind_dn. Dolly never writes to AD — it only binds and searches. The account needs read access to the configured users.base and groups.base, and to any entries referenced as group members (see out-of-scope members).

Target LDAP¶

The target.bind_dn needs:

• Write access to users_base, groups_base, and state_base (and, for Dolly to create a missing base, to add entries under its parent), and ideally nothing else. A groups-only deployment (dolly sync --groups only) never writes entries under users_base, so read access to it is enough there; but if users_base is missing, the first run creates it, which needs add access on its parent.
• Read access to every entry under groups_base and state_base, and under users_base for runs that sync users — not a filtered or size-limited view. A --groups run never reads all of users_base: it looks up only the uids it needs, 50 per search, so a users_base larger than the size limit is fine for it.

olcSizeLimit and olcLimits¶

OpenLDAP's default olcSizeLimit (500, or 10000 in the ad2openldap-era config) truncates search results for any bind DN except the server's rootdn. Since Dolly aborts the whole run on a truncated read rather than planning from partial data, a bind DN that hits this limit will block every sync once the target tree grows past it.

You have two options:

1. Bind as the rootdn. Simplest, but grants Dolly's bind DN full access to the whole directory, not just the bases it needs.
2. Raise the limit for Dolly's specific DN with olcLimits, leaving the global olcSizeLimit untouched for everyone else. Add it to the database entry (for example olcDatabase={1}mdb,cn=config) and adjust the DN to your target.bind_dn:

olcLimits: dn.exact="cn=dolly,dc=local" size=unlimited time=unlimited

Adjust dn.exact to match the actual target.bind_dn in your config. dolly check tests for a truncated search using the configured bind DN, so run it after changing either the account or the limit — see Commands. A truncated groups_base, or a truncated users_base without --groups, is reported as a failure; a truncated users_base with dolly check --groups is only a warning, since a groups-only run never reads users_base in full.