Replication

Context

The entryCSN and entryUUID attributs are used during the replication process to decide what need to be transfered, so they need to be indexed for good performance:

index entryCSN,entryUUID eq

When using the memberof overlay, the memberof-dangling option set to drop can lead to a replication failure due to a constrain violation.

To setup the replication for a branch, the ldap process must have a read access on the branch, an entry is assumed to be created for that purpose with required access right, for the user: uid=ldap-sync,ou=Admins,dc=example,dc=comLDAP sync user

# ldap-sync, Admins, example.com
dn: uid=ldap-sync,ou=Admins,dc=example,dc=comLDAP sync user
objectClass: account
objectClass: simpleSecurityObject
uid: ldap-syncLDAP sync user
userPassword: ${SSHA}????????????????????????????????Hashed credential

Master

Load and configure the overlay (syncprov) performing the replication. The contextCSN attribut is saved on disk every 100 operations or 10 minutes (syncprov-checkpoint), a log of the last 100 write operations is kept in memory (syncprov-sessionlog), and the reloadHint flag is honored (syncprov-reloadhint):

overlay                 syncprov
syncprov-checkpoint     100Number of operations 10Number of minutes
syncprov-sessionlog     100Number of write operations
syncprov-reloadhint     TRUE 

Give read access to the whole branch that need to be replicated:

access to dn.subtree=dc=example,dc=comLDAP branch
       by dn.exact=uid=ldap-sync,ou=Admins,dc=example,dc=comLDAP sync user read
       by * break

Slave

To allow the replication on the slave side, the main parameter to setup are:

• a unique identifier (rid)
• the server to contact (provider)
• the branch to replicate (searchbase), the scope (scope) and the filters (filter)
• the authentication (bindmethod, binddn, credentials)
• the replication type (type)
• the read frequency (interval), and how to manage retry in case of connection errors (retry)

syncrepl rid=369Unique identifier
      provider=ldaps://ldap.example.comLDAP server
      type=refreshAndPersist
      interval=00:00:30:00 retry="60 10 300 +"
      searchbase="dc=example,dc=comLDAP branch"
      tls_crlcheck=none
      scope=sub
      bindmethod=simple
      binddn="uid=ldap-sync,ou=Admins,dc=example,dc=comLDAP sync user"
      credentials=xxxxxxCredential