Chapter 22. Setting up content synchronization using the SyncRepl protocol

Procedure

1. Verify if the Retro Changelog is enabled:

   # dsconf <instance_name> plugin retro-changelog show
   ...
   nsslapd-pluginEnabled: off

   Copy to Clipboard Toggle word wrap

   If the Retro Changelog plugin is disabled, enable it:

   # dsconf <instance_name> plugin retro-changelog enable
   Enabled plugin 'Retro Changelog Plugin'

   Copy to Clipboard Toggle word wrap

2. Add the nsuniqueid operational attribute with the targetUniqueId alias to the Retro Changelog plugin configuration:

   # dsconf <instance_name> plugin retro-changelog add --attribute nsuniqueid:targetUniqueId
   Successfully changed the cn=Retro Changelog Plugin,cn=plugins,cn=config

   Copy to Clipboard Toggle word wrap

3. Optional: Apply the following recommendations to improve performance:

   1. Configure the maximum age of the Retro Changelog entries. For example, set the age to 2 days (2d):

      # dsconf <instance_name> plugin retro-changelog set --max-age 2d
      Successfully changed the cn=Retro Changelog Plugin,cn=plugins,cn=config

      Copy to Clipboard Toggle word wrap

   2. If you know which backend or subtree your client accesses to synchronize data, limit the scope of the Retro Changelog plugin. For example, to exclude the cn=marketing,dc=example,dc=com subtree, enter:

      # dsconf <instance_name> plugin retro-changelog set --exclude-suffix "cn=marketing,dc=example,dc=com"
      Successfully changed the cn=Retro Changelog Plugin,cn=plugins,cn=config

      Copy to Clipboard Toggle word wrap

4. Enable the Content Synchronization plugin:

   # dsconf <instance_name> plugin contentsync enable
   Enabled plugin 'Content Synchronization'

   Copy to Clipboard Toggle word wrap

5. Optional: Adjust the ACI to limit who can use the SyncRepl control. By default, Directory Server creates the following access control instruction (ACI) in the oid=1.3.6.1.4.1.4203.1.9.1.1,cn=features,cn=config entry that enables all users to use the SyncRepl protocol:

   aci: (targetattr != "aci")(version 3.0; acl "Sync Request Control";
      allow( read, search ) userdn = "ldap:///all";)

   Copy to Clipboard Toggle word wrap

   For details about how to adjust the ACI, see Defining ACI bind rules.

6. Restart the server:

   # dsctl <instance_name> restart

   Copy to Clipboard Toggle word wrap