Show Table of Contents
15.22. Replicating o=NetscapeRoot for Administration Server Failover
Replication usually occurs between Directory Server user databases to distribute directory data, but it is also possible to use replication to provide failover support for the Administration Server database,
o=NetscapeRoot
.
- Install and configure the first Directory Server instance.The
setup-ds-admin.pl
script has an option,-f
, which references aninf
. Theinf
can be used to import LDIF files through theConfigFile
parameter, and the LDIF files can create databases, suffixes, and replication entries. (Theinf
file is described in more detail in the Red Hat Directory Server Installation Guide.)# setup-ds-admin.pl -f /tmp/server1.inf
To configure theo=NetscapeRoot
database onserver1
as a multi-master supplier replica, use the following statements in theinf
file:[slapd] ... ConfigFile = repluser.ldif Example 15.4, “Example Supplier Bind DN Entry” ConfigFile = changelog.ldif Example 15.1, “Example Changelog Entry” ConfigFile = replica.ldif Example 15.2, “Example Supplier Replica Entry” ConfigFile = replagreement.ldif Example 15.3, “Example Replication Agreement Entry” ...
- Install and configure the second Directory Server instance. For the second server,
server2.example.com
, use thesetup-ds.pl
command, which installs a Directory Server instance without installing a local Administration Server.# setup-ds.pl -f /tmp/server2.inf
With server2, use theinf
file to create and configure ao=NetscapeRoot
database onserver2
as a multi-master supplier replica:[slapd] ... ConfigFile = netscaperootdb.ldif Section 2.1.1.3, “Creating Root and Sub Suffixes using the Command Line” ConfigFile = repluser.ldif Example 15.4, “Example Supplier Bind DN Entry” ConfigFile = changelog.ldif Example 15.1, “Example Changelog Entry” ConfigFile = replica.ldif Example 15.2, “Example Supplier Replica Entry” ConfigFile = replagreement.ldif Example 15.3, “Example Replication Agreement Entry” ...
- Initialize the
o=NetscapeRoot
database onserver2
fromserver1
. Add thensds5replicarefresh
attribute to the replication agreement onserver1
.# ldapmodify -D "cn=Directory Manager" -W -x -h supplier1.example.com dn: cn=ExampleAgreement1,cn=replica,cn=o=NetscapeRoot,cn=mapping tree,cn=config changetype: modify replace: nsds5beginreplicarefresh nsds5beginreplicarefresh: start
- Run the
register-ds-admin.pl
to create a local Administration Server onserver2
and switch the configuration directory forserver2
to its owno=NetscapeRoot
database fromserver1
.# register-ds-admin.pl
- Add the following access control instructions (ACI) on
server2
, to enable members of theConfiguration Administrators Group
, the server instance entrySIE group
, and theadmin
user, to run on suffixes belonging toserver2
. For example, to run on thedc=example,dc=com
suffix, enter:# ldapmodify -D "cn=Directory Manager" -W -x -h server2.example.com dn: dc=example,dc=com changetype: modify add: aci aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; allow (all) groupdn="ldap:///cn=Configuration Administrators,ou=Groups, ou=TopologyManagement,o=NetscapeRoot";) - add: aci aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (all) userdn="ldap:///uid=admin, ou=Administrators,ou=TopologyManagement,o=NetscapeRoot";) - add: aci aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "ldap:///cn=slapd-instance,cn=Red Hat Directory Server,cn=Server Group, cn=machine_name,ou=example.com,o=NetscapeRoot";)
- Disable the PTA Plug-in on
server2
so that it does not pass bind operations for the administrative users in itso=NetscapeRoot
toserver1
.