OpenLDAP - Multi Master Configuration

Question

I have to configure two OpenLDAP nodes in multi-master mode. I've also integrated them with our corporate Active Directory, and the integration seems to work, after some verification. Even if the log say the replication is working fine, I verified that an entity added to one node didn't replicate on the other. This is my slapd.conf is shown below. The only difference between the two slapd.conf is serverID

### Schema includes ###########################################################
include                 /etc/openldap/schema/core.schema
include                 /etc/openldap/schema/cosine.schema
include                 /etc/openldap/schema/inetorgperson.schema
include                 /etc/openldap/schema/misc.schema
include                 /etc/openldap/schema/nis.schema
include                 /etc/openldap/schema/microsoft.minimal.schema

## Module paths ##############################################################
modulepath              /usr/lib64/openldap/
moduleload              back_ldap
moduleload              rwm
moduleload      syncprov
moduleload      accesslog

### Logging ###################################################################
logfile         /var/log/slapd/slapd.log
loglevel        sync

# Main settings ###############################################################
pidfile                 /var/run/openldap/slapd.pid
argsfile                /var/run/openldap/slapd.args

# Allow v2 binding for legacy clients #########################################
allow bind_v2

### Database local ############################################################
database        bdb
suffix          "dc=farm,dc=it"
rootdn          "cn=manager,dc=farm,dc=it"
rootpw          {SSHA}B29rxKxtjTN8JJIppPGJt7ahvUPhd1pa
directory       /var/lib/ldap

# Indexes for this back end
index           objectClass                     eq,pres
index           ou,cn,mail,surname,givenname    eq,pres,sub
index           uid                             eq,pres,sub

access to attrs=userPassword
    by self =xw
    by dn.exact="cn=manager,dc=farm,dc=it"
    by dn.exact="cn=replica,dc=farm,dc=it"
    by anonymous auth
    by * none
access to *
    by anonymous auth
    by self write
    by dn.exact="cn=replica,dc=farm,dc=it" read
    by users read
    by * none



# Replica #####################################################################

#Define the server ID.
serverID 2

# Replication configuration, only things you may have to change here are provider, binddn, credentials and searchbase.
syncrepl rid=001
    provider=ldap://almldap01.farm.it:389
    binddn="cn=replica,dc=farm,dc=it"
    bindmethod=simple
    credentials="3L3jkKZcSb5anj8ReCi3ZDWnbv9HNeB8"
    searchbase="dc=farm,dc=it"
    type=refreshAndPersist
    interval=00:00:00:10
    retry="5 5 300 5"
    timeout=1

#Rest replication configuration goes to end of the file.
mirrormode TRUE
overlay syncprov
syncprov-nopresent TRUE
syncprov-reloadhint TRUE
syncprov-checkpoint 1000 60


### Database definition (Proxy to AD) #########################################
database                ldap
readonly                yes
protocol-version        3
rebind-as-user      yes
uri                     "ldap://corp.farm.group:389"
suffix                  "dc=corp,dc=farm,dc=group"
idassert-bind       bindmethod=simple
            mode=none
            binddn="CN=WfLdapBind,OU=Users,OU=WebFarm,DC=corp,DC=farm,DC=group"
            credentials="djW5l5hvTPcMcLvV"
idassert-authzFrom  "*"
overlay                 rwm
rwm-map         attribute       uid         sAMAccountName
rwm-map         objectClass posixAccount    person

score 0 · Answer 1 · answered Oct 05 '15 at 22:19

0

The syncrepl rid and provider should also be different in each case. rid should be unique, and provider should point to the other OpenLDAP master.

answered Oct 05 '15 at 22:19

user207421

305,947
44
307
483

Hi @EJP, thank you for your answer. Just to clear some points: 1. It is ok for **provider**: the first node must have the hostname of the second node and vice versa. 2. Must the **syncrepl rid** be different on the both node with a unique rid value? I thought this number have to be the same on the both node, according to this [article](http://www.youritgoeslinux.com/impl/ha/ldap2mm). – Luigi Oct 06 '15 at 11:29
@Luigi (1) That's what I said. (2) Your source is wrong. Don't rely on the-party documentation. The [real documentation](http://www.openldap.org/doc/admin24/slapdconfig.html#syncrepl) says the `rid` must be unique. – user207421 Oct 06 '15 at 21:02

OpenLDAP - Multi Master Configuration

1 Answers1