openldap replication... Is this possible?

trey85stang · 04-19-2012, 02:45 PM

I am new to openldap/slapd never really worked with it but I need to configure a replication setup and this is how I would like to do it:

1 master server, with multiple containers. multiple slave servers that each replicate a specific container from the master (not all).

Is this possible to do? If so which replication scheme should I be looking at? I see multiple ways to do replication but none that really get into the gritty details of what I am looking to do.

I'm thinking slurpd might be able to do this but I dont see anything specifically stating that it will or wont.

danliston · 04-19-2012, 05:24 PM

This might only be a hint or a clue in your investigation, but I thought slurpd was supposed to be for replication in the open LDAP world.

Like you, I have never worked in this space, and have always used the Netscape/iPlanet/Sun(Oracle) DSEE to do split DB, multi-master, proxied replication. It was my understanding that Netscape LDAP was sold/given to RedHat, but not sure if that is the code base that has become the openLDAP standard.

It will be interesting to see where this thread goes.

trey85stang · 04-20-2012, 10:04 AM

Quote:

Originally Posted by danliston

This might only be a hint or a clue in your investigation, but I thought slurpd was supposed to be for replication in the open LDAP world.

Like you, I have never worked in this space, and have always used the Netscape/iPlanet/Sun(Oracle) DSEE to do split DB, multi-master, proxied replication. It was my understanding that Netscape LDAP was sold/given to RedHat, but not sure if that is the code base that has become the openLDAP standard.

It will be interesting to see where this thread goes.

Ill keep it updated then, so far I found I can only replicate from the DIT down so individual ou replication is not possible. Now onto figure out slapd configuration on centos 6 which is totally different then you standard slapd.conf configuration.

trey85stang · 04-24-2012, 05:35 PM

FYI: what I was wanting is possible using snycrepl in a master/slave or provider consumer setup. This is all with openldap 2.4 using the old style config (that I have since converted to cn=config)

once the provider is setup the syncrepl statements (multiple statements) can be configured to allow syncing via a specific searchbase or with a filter parsing out the results you want to sync.

I went with this:

Code:

syncrepl rid=123
  provider=ldap://ldap-master
  type=refreshAndPersist
  searchbase="ou=container1,dc=yourdomain,dc=com"
  scope=sub
  schemachecking=off
  bindmethod=simple
  binddn="cn=Manager,dc=yourdomain,dc=com"
  credentials=supersecretpasword
  retry="10 3 100 3"

syncrepl rid=124
  provider=ldap://ldap-master
  type=refreshAndPersist
  searchbase="ou=containter2,dc=yourdomain,dc=com"
  scope=sub
  schemachecking=off
  bindmethod=simple
  binddn="cn=Manager,dc=yourdomain,dc=com"
  credentials=supersecretpassword
  retry="10 3 100 3"

Last for secrity, I created sync accounts for each of my containers so each one has a different account for keeping in sync.