I have previously set up two servers with multi-master replication, using the cn=config configuration format (I think I've seen it referred to as 'OLC'?). It was a process similar to this (although this is not the guide I followed):


Both my configuration database and actual user database are replicated between both, and I have tested that changes work as expected in both directions.

I need to add a third host into the replication. (Ultimately I am removing one server and replacing it with the third, but there will be a few months of overlap.) I have not been able to find any information on the recommended way to add a new server into a multi-master setup. Is it possible, and if so, what is the recommended way?

  • Have you read the OpenLDAP guide and example? – Andrew Sep 17 '13 at 1:54
  • @Andrew: yes, but that appears to be a section about setting them up from scratch or from a clean setup. I'm interested in adding a third to an already existing setup, and replicating the config to the third from the existing setup. At present, the only way I can see is to manually set up the third with the same configuration as the first two, which seems to lose some of the point of the replicated cn=config. – Michael Sallaway Sep 18 '13 at 2:58

In essence do the same thing you did to get Multi-Master running in the first place.

  1. On your new server make sure that all necessary certificate, keytab, module paths and db directories are created/populated as as they are on your existing servers.
    • They have to be the same as slapd-config only distinguishes servers for replication, not configuration.
    • This is easier if all of your servers are running the same distribution.
    • If each server has its own certificate, symlinks are your friend. (You probably already know this if you had to do it for your original setup.)
    • Don't copy the files (except DB_CONFIG, if you use it) from your olcDbDirectory.
  2. On one of your existing servers make sure the new server's syncrepl dn, whatever it will to be, has read access to your entire directory.
    • It's best to do this the same way you're doing it for your existing servers.
  3. On one of your existing servers add the new server's olcServerID and olcSyncrepl entries.
    • Your new server's slapd should not be running at this time.
    • Depending on the settings of your olcSyncrepl retry your existing servers may give up trying to contact your new server. You may want to set retry for the new server to unlimited (i.e. +) during this time.
    • For what should be obvious reasons, your existing servers will not be able to connect to your new server yet. Don't worry about log messages about this except as it relates to the previous point.
  4. Replace the slapd.d directory on your new server one from one existing servers.
    • Make sure the permissions allow the slapd daemon to write to the directory.
  5. Start your new server.
  6. Wait for your new server to finish syncing.
    • You may want to add sync to your olcLogLevel during this time.
  • Fantastic! That makes perfect sense, thanks for that. So, to confirm, it sounds like the only way to replicate the cn=config database to the new server is to actually copy and replace the slapd.d from one of the existing servers? (It makes more sense to have the new server preconfigured on an existing before the copy, though; seems less ad-hoc than having to manually replicate the entire config.) – Michael Sallaway Sep 23 '13 at 0:57
  • @MichaelSallaway Yes, I think you understand. It's the easiest way I know, and saves me from having to worry that a new empty database suffix with overwrite an older populated one. Not that one shouldn't have backups for all kinds of reasons. – 84104 Sep 23 '13 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.