Enabling synchronization in consumer and provider ldap

Question

I am completely new to ldap (openldap in this case). My boss gave me the task of creating a second ldap server, and copying the data from the existing ldap server to the new one I created.

I was able to accomplish this by reading documentation and doing a lot of google. In any case, for the new ldap server I copied the slapd.conf file from the existing ldap server, and ran 'slaptest -f slapd.conf -F slapd.d' This created the cn=config.

My boss tested the environment. It works fine, but now he's asking me to do a one way synchronization from the existing ldap server to the new one that was just created.

Again after reading documentation, and doing a lot of google, I think I finally know what needs to be done.

This new ldap server is not being used, and I don't really know how to use ldapmodify or any ldap client tools for that matter, to add the parameters below. I am actually planning to delete the contents on the slapd.d directory, update the slapd.conf file with the new parameters, and re-run 'slaptest -f slapd.conf -F slapd.d' to recreate the cn=config with the new parameters. I know it's not the best way to do it, but it should work.

--sync consumer

syncrepl

rid=123

type=RefreshandPersist

provider=ldaps://ldap-master.example.com:389

bindmethod=simple

searchbase="dc=example,dc=com"

retry="10 6 60 +"

attrs="cn,sn,displayName,givenName,mail,uid"

binddn="cn=Manager,dc=test,dc=example,dc=com"

credentials={SSHA}password

Now, this method of updating the cn=config won't work for the changes that need to be made on the replica provider to enable the synchronization.

As far as I know, I only need to add one line:

overlay syncprov

My question is how do I add this line to the cn=config on the existing and working ldap server? I obviously can't recreate the configuration using slaptest.

Your help and suggestions are greatly appreciated

-V

Answer 1

The short answer is you need to get familiar with using ldapmodify, the man-page for it has examples which show how to make changes.

Without knowing how your LDAP server is configured, I can't give you a simple "do this" answer. However, you need to do something similar to the following:

# ldapmodify -Y EXTERNAL -H ldapi:///
dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov
^D

This is the cn=config equivalent of having overlay syncprov in the slapd.conf file. But I'm assuming you a) only have the one LDAP database backend configured, b) You're using the HDB backend, c) LDAPI connections are allowed. This also doesn't configure a user to be used for connecting from the new LDAP server, nor set up any ACL's to allow it to read everything, etc.

I would encourage you to read the OpenLDAP documentation, particularly http://www.openldap.org/doc/admin24/replication.html which covers setting up replication.