Chapter 17. Setting up Content Synchronization Using the SyncRepl Protocol

Using the Content Synchronization plug-in, Directory Server supports the SyncRepl protocol according to RFC 4533. This protocol enables LDAP servers and clients to use Red Hat Directory Server as a source to synchronize their local database with the changing content of Directory Server.
To use the SyncRepl protocol:
  • Enable the Content Synchronization plug-in in Directory Server and optionally create a new user which the client will use to bind to Directory Server. The account must have permissions to read the content in the directory.
  • Configure the client. For example, set the search base for a subtree to synchronize. For further details, see your client's documentation.

17.1. Configuring the Content Synchronization Plug-in Using the Command Line

To configure the Content Synchronization plug-in using the command line:
  1. The Content Synchronization plug-in requires the Retro Changelog plug-in to log the nsuniqueid attribute:
    1. To verify if the retro changelog is already enabled, enter:
      # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog show
      ...
      nsslapd-pluginEnabled: off
      If the nsslapd-pluginEnabled parameter is set to off, the retro changelog is disabled. To enable, see Section 15.20.1, “Enabling the Retro Changelog Plug-in”.
    2. Add the nsuniqueid attribute to retro changelog plug-in configuration:
      # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog set --attribute nsuniqueid:targetUniqueId
    3. Optionally, apply the following recommendations for improved performance:
      1. Set maximum validity for entries in the retro change log. For example, to set 2 days (2d):
        # ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x
        
        dn: cn=changelog5,cn=config
        changetype: modify
        replace: nsslapd-changelogmaxage
        nsslapd-changelogmaxage: 2d
      2. If you know which back end or subtree clients access to synchronize data, limit the scope of the Retro Changelog plug-in. For example, to exclude the cn=demo,dc=example,dc=com subtree, enter:
        # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog set --exclude-suffix "cn=demo,dc=example,dc=com"
  2. Enable the Content Synchronization plug-in:
    # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin retro-changelog enable
  3. Using the defaults, Directory Server creates an access control instruction (ACI) in the oid=1.3.6.1.4.1.4203.1.9.1.1,cn=features,cn=config entry that enables all users to use the SyncRepl protocol:
    aci: (targetattr != "aci")(version 3.0; acl "Sync Request Control";
       allow( read, search ) userdn = "ldap:///all";)
    Optionally, update the ACI to limit using the SyncRepl control. For further details about ACIs, see Section 18.10, “Defining Bind Rules”.
  4. Restart Directory Server:
    # dsctl instance_name restart
Clients are now able to synchronize data with Directory Server using the SyncRepl protocol.