Context

The entryCSN and entryUUID attributs are used during the replication process to decide what need to be transfered, so they need to be indexed for good performance:

1

index entryCSN,entryUUID eq

When using the memberof overlay, the memberof-dangling option set to drop can lead to a replication failure due to a constrain violation.

To setup the replication for a branch, the ldap process must have a read access on the branch, an entry is assumed to be created for that purpose with required access right, for the user: uid=ldap-sync,ou=Admins,dc=example,dc=com

1
2
3
4
5
6

# ldap-sync, Admins, example.com
dn: uid=ldap-sync,ou=Admins,dc=example,dc=com
objectClass: account
objectClass: simpleSecurityObject
uid: ldap-sync
userPassword: ${SSHA}????????????????????????????????

Master

Load and configure the overlay (syncprov) performing the replication. The contextCSN attribut is saved on disk every 100 operations or 10 minutes (syncprov-checkpoint), a log of the last 100 write operations is kept in memory (syncprov-sessionlog), and the reloadHint flag is honored (syncprov-reloadhint):

1
2
3
4

overlay                 syncprov
syncprov-checkpoint     100 10
syncprov-sessionlog     100
syncprov-reloadhint     TRUE 

Give read access to the whole branch that need to be replicated:

1
2
3

access to dn.subtree=dc=example,dc=com
       by dn.exact=uid=ldap-sync,ou=Admins,dc=example,dc=com read
       by * break

Slave

To allow the replication on the slave side, the main parameter to setup are:

• a unique identifier (rid)
• the server to contact (provider)
• the branch to replicate (searchbase), the scope (scope) and the filters (filter)
• the authentication (bindmethod, binddn, credentials)
• the replication type (type)
• the read frequency (interval), and how to manage retry in case of connection errors (retry)

1
2
3
4
5
6
7
8
9
10

syncrepl rid=369
      provider=ldaps://ldap.example.com
      type=refreshAndPersist
      interval=00:00:30:00 retry="60 10 300 +"
      searchbase="dc=example,dc=com"
      tls_crlcheck=none
      scope=sub
      bindmethod=simple
      binddn="uid=ldap-sync,ou=Admins,dc=example,dc=com"
      credentials=xxxxxx