Chapter 22. Setting up content synchronization using the SyncRepl protocol

Procedure

1. Verify if the Retro Changelog is enabled:

   # dsconf <instance_name> plugin retro-changelog show
   ...
   nsslapd-pluginEnabled: off

   If the Retro Changelog plugin is disabled, enable it:

   # dsconf <instance_name> plugin retro-changelog enable
   Enabled plugin 'Retro Changelog Plugin'

2. Add the nsuniqueid operational attribute with the targetUniqueId alias to the Retro Changelog plugin configuration:

   # dsconf <instance_name> plugin retro-changelog add --attribute nsuniqueid:targetUniqueId
   Successfully changed the cn=Retro Changelog Plugin,cn=plugins,cn=config

3. Optional: Apply the following recommendations to improve performance:

   1. Configure the maximum age of the Retro Changelog entries. For example, set the age to 2 days (2d):

      # dsconf <instance_name> plugin retro-changelog set --max-age 2d
      Successfully changed the cn=Retro Changelog Plugin,cn=plugins,cn=config

   2. If you know which backend or subtree your client accesses to synchronize data, limit the scope of the Retro Changelog plugin. For example, to exclude the cn=marketing,dc=example,dc=com subtree, enter:

      # dsconf <instance_name> plugin retro-changelog set --exclude-suffix "cn=marketing,dc=example,dc=com"
      Successfully changed the cn=Retro Changelog Plugin,cn=plugins,cn=config

4. Enable the Content Synchronization plugin:

   # dsconf <instance_name> plugin contentsync enable
   Enabled plugin 'Content Synchronization'

5. Optional: Adjust the ACI to limit who can use the SyncRepl control. By default, Directory Server creates the following access control instruction (ACI) in the oid=1.3.6.1.4.1.4203.1.9.1.1,cn=features,cn=config entry that enables all users to use the SyncRepl protocol:

   aci: (targetattr != "aci")(version 3.0; acl "Sync Request Control";
      allow( read, search ) userdn = "ldap:///all";)

   For details about how to adjust the ACI, see Defining ACI bind rules.

6. Restart the server:

   # dsctl <instance_name> restart