15.6. Configuring Replication Partners to use Certificate-based Authentication

1. Create accounts for both servers, such as cn=server1,example,dc=com and cn=server2,dc=example,dc=com and add the client certificates to the corresponding accounts. For details, see:
   • Section 3.1.3.1, “Adding an Entry Using ldapadd”.
   • Section 9.9.2, “Adding a Certificate to a User”
   Both servers will later use these accounts and certificates to authenticate when they establish a replication connection to each other.
2. Create a group, such as cn=repl_server,ou=Groups,dc=example,dc=com, and add both server accounts. See Section 8.1, “Using Groups”.
3. Create the replica entry and set the nsds5ReplicaBindDNGroup attribute to the DN of the group created in the previous step:

   # dsconf -D "cn=Directory Manager" ldap://server1.example.com replication \
       enable --suffix="dc=example,dc=com" --role="supplier" --replica-id="7" \
       --bind-group-dn="cn=repl_server,ou=Groups,dc=example,dc=com"

4. Set the replica entry's interval in which Directory Server checks if the group has been changed to 0:

   # dsconf -D "cn=Directory Manager" ldap://server1.example.com replication \
        set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

1. Create a temporary replication manager account, such as cn=Replication Manager,cn=config, on server2.example.com.
2. On server1.example.com, create a temporary replication agreement which uses the account from the previous step for authentication:

   # dsconf -D "cn=Directory Manager" ldap://server2.example.com repl-agmt \
        create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 \
        --conn-protocol=LDAPS --bind-dn="cn=Replication Manager,cn=config" \
        --bind-passwd="password" --bind-method=SIMPLE --init \
        temporary_agreement

   This agreement uses the previously-created replication manager account to initialize the database. Before this initialization, the database on server2.example.com is empty and the accounts with the associated certificates do not exist. Therefore, replication using certificates is not possible before the database is initialized.

1. Remove the temporary replication agreement from server1.example.com:

   # dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-agmt \
        delete --suffix="dc=example,dc=com" temporary_agreement

2. Remove the temporary replication manager account from server2.example.com:

   # dsconf -D "cn=Directory Manager" ldap://server2.example.com replication \
        delete-manager --suffix="dc=example,dc=com" --name="Replication Manager"

1. On server1.example.com:

   # dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-agmt \
        create --suffix="dc=example,dc=com" --host="server2.example.com" --port=636 \
        --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" \
        --init example_agreement

2. On server2.example.com:

   # dsconf -D "cn=Directory Manager" ldap://server2.example.com repl-agmt \
        create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 \
        --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" \
        --init example_agreement

# dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-agmt status --suffix="dc=example,dc=com" example_agreement