15.6. Configuring Replication Partners to use Certificate-based Authentication

Instead of using a bind DN and password to authenticate to a replication partner, you can use certificate-based authentication.

The following procedure describes how to add a new server named server2.example.com to the replication topology, and how to set up replication agreements between the new host and the existing server1.example.com using certificate-based authentication:

On both hosts, set up certificate-based authentication. For details, see Section 9.9.1, “Setting up Certificate-based Authentication”.
On the server1.example.com host:
1. Create accounts for both servers, such as cn=server1,example,dc=com and cn=server2,dc=example,dc=com and add the client certificates to the corresponding accounts. For details, see:
  - Section 3.1.3.1, “Adding an Entry Using ldapadd”.
  - Section 9.9.2, “Adding a Certificate to a User”
  Both servers will later use these accounts and certificates to authenticate when they establish a replication connection to each other.
2. Create a group, such as cn=repl_server,ou=Groups,dc=example,dc=com, and add both server accounts. See Section 8.1, “Using Groups”.
3. Create the replica entry and set the nsds5ReplicaBindDNGroup attribute to the DN of the group created in the previous step:
```
# dsconf -D "cn=Directory Manager" ldap://server1.example.com replication \
    enable --suffix="dc=example,dc=com" --role="supplier" --replica-id="7" \
    --bind-group-dn="cn=repl_server,ou=Groups,dc=example,dc=com"
```
4. Set the replica entry's interval in which Directory Server checks if the group has been changed to 0:
```
# dsconf -D "cn=Directory Manager" ldap://server1.example.com replication \
     set --suffix="dc=example,dc=com" --repl-bind-group-interval=0
```
Initialize the new server:
1. Create a temporary replication manager account, such as cn=Replication Manager,cn=config, on server2.example.com.
2. On server1.example.com, create a temporary replication agreement which uses the account from the previous step for authentication:
```
# dsconf -D "cn=Directory Manager" ldap://server2.example.com repl-agmt \
     create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 \
     --conn-protocol=LDAPS --bind-dn="cn=Replication Manager,cn=config" \
     --bind-passwd="password" --bind-method=SIMPLE --init \
     temporary_agreement
```
  This agreement uses the previously-created replication manager account to initialize the database. Before this initialization, the database on server2.example.com is empty and the accounts with the associated certificates do not exist. Therefore, replication using certificates is not possible before the database is initialized.

After the new server has been initialized:

Remove the temporary replication agreement from server1.example.com:

# dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-agmt \
     delete --suffix="dc=example,dc=com" temporary_agreement

Remove the temporary replication manager account from server2.example.com:

# dsconf -D "cn=Directory Manager" ldap://server2.example.com replication \
     delete-manager --suffix="dc=example,dc=com" --name="Replication Manager"

Create a replication agreement on both servers that use certificate-based authentication:

On server1.example.com:

# dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-agmt \
     create --suffix="dc=example,dc=com" --host="server2.example.com" --port=636 \
     --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" \
     --init example_agreement

On server2.example.com:

# dsconf -D "cn=Directory Manager" ldap://server2.example.com repl-agmt \
     create --suffix="dc=example,dc=com" --host="server1.example.com" --port=636 \
     --conn-protocol=LDAPS --bind-method="SSLCLIENTAUTH" \
     --init example_agreement

To verify the replication works correctly, display the nsds5replicaLastUpdateStatus attribute in the replication agreement:
```
# dsconf -D "cn=Directory Manager" ldap://server1.example.com repl-agmt status --suffix="dc=example,dc=com" example_agreement
```
For details about possible statuses, see the Replication Agreement Status appendix in the Red Hat Directory Server Configuration, Command, and File Reference.

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

15.6. Configuring Replication Partners to use Certificate-based Authentication

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links