Chapter 5. Configuring multi-supplier replication with certificate-based authentication

Procedure

1. Create the ou=services entry if it does not exist:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: ou=services,dc=example,dc=com
   objectClass: organizationalunit
   objectClass: top
   ou: services

2. Create accounts for both servers, such as cn=server1,ou=services,dc=example,dc=com and cn=server2,ou=services,dc=example,dc=com:

   # ldapadd -D "cn=Directory Manager" -W -H ldaps://server1.example.com -x
   
   dn: cn=server1,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server1
   cn: server1
   userPassword: password
   userCertificate:< file:///root/server1.der
   
   adding new entry "cn=server1,ou=services,dc=example,dc=com"
   
   dn: cn=server2,ou=services,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: inetOrgPerson
   sn: server2
   cn: server2
   userPassword: password
   userCertificate:< file:///root/server2.der
   
   adding new entry "cn=server2,ou=services,dc=example,dc=com"

3. Create a group, such as cn=repl_servers,dc=groups,dc=example,dc=com:

   # dsidm <server1_instance_name> -b "dc=example,dc=com" group create --cn "repl_servers"

4. Add the two replication accounts as members to the group:

   # dsidm <server1_instance_name> -b "dc=example,dc=com" group add_member repl_servers "cn=server1,ou=services,dc=example,dc=com"
   
   # dsidm <server1_instance_name> -b "dc=example,dc=com" group add_member repl_servers "cn=server2,ou=services,dc=example,dc=com"

Procedure

1. On server2.example.com, enable replication for the dc=example,dc=com suffix:

   # dsconf <server2_instance_name> replication enable --suffix "dc=example,dc=com" --role "supplier" --replica-id 2 --bind-dn "cn=replication manager,cn=config" --bind-passwd "password"

   This command configures the server2.example.com host as a supplier for the dc=example,dc=com suffix, and sets the replica ID of this host to 2. Additionally, the command creates a temporary cn=replication manager,cn=config user with the specified password and allows this account to replicate changes for the suffix to this host.

   The replica ID must be a unique integer between 1 and 65534 for a suffix across all suppliers in the topology.

2. On server1.example.com:

   1. Enable replication:

      # dsconf <server1_instance_name> replication enable --suffix="dc=example,dc=com" --role="supplier" --replica-id="1"

   2. Create a temporary replication agreement which uses the temporary account from the previous step for authentication:

      # dsconf <server1_instance_name> repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-dn="cn=Replication Manager,cn=config" --bind-passwd="password" --bind-method=SIMPLE --init temporary_agreement

Verification

1. Verify that the initialization was successful:

   # dsconf <server1_instance_name> repl-agmt init-status --suffix "dc=example,dc=com" temporary_agreement
   Agreement successfully initialized.

Procedure

1. On server1.example.com:

   1. Remove the temporary replication agreement:

      # dsconf <server1_instance_name> repl-agmt delete --suffix="dc=example,dc=com" temporary_agreement

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf <server1_instance_name> replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf <server1_instance_name> replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

2. On server2.example.com:

   1. Remove the temporary replication manager account:

      # dsconf <server2_instance_name> replication delete-manager --suffix="dc=example,dc=com" --name="Replication Manager"

   2. Add the cn=repl_servers,dc=groups,dc=example,dc=com bind group to the replication settings:

      # dsconf <server2_instance_name> replication set --suffix="dc=example,dc=com" --repl-bind-group "cn=repl_servers,dc=groups,dc=example,dc=com"

   3. Configure Directory Server to automatically check for changes in the bind group:

      # dsconf <server2_instance_name> replication set --suffix="dc=example,dc=com" --repl-bind-group-interval=0

   4. Create the replication agreement with certificate-based authentication:

      # dsconf <server2_instance_name> repl-agmt create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server2-to-server1*

3. On server1.example.com, create the replication agreement with certificate-based authentication:

   # dsconf <server1_instance_name> repl-agmt create --suffix="dc=example,dc=com" --host="server2.example.com" --port=636 --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" --init server1-to-server2

Verification

1. Verify on each server that the initialization was successful:

   # dsconf <server1_instance_name> repl-agmt init-status --suffix "dc=example,dc=com" server1-to-server2
   Agreement successfully initialized.
   
   # dsconf <server2_instance_name> repl-agmt init-status --suffix "dc=example,dc=com" server2-to-server1
   Agreement successfully initialized.