How to configure replication on openldap 2.4.23

Configure ldap Replication

Populate master node with a replication account :
On master Node : 
create a ldif file contains account informations :
# cat /tmp/addreplicator.ldif
dn: cn=replication,dc=el01,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
cn: replication
sn: replication
userPassword:: e3NzaGF9V0xuYVpQaWRibENDU1hKYkpiVXVTSGhWb3hVRHFLZ09jT2RJSmc9P

Add replication account by using ldapadd command : 
#  ldapadd -x -D "cn=Manager,dc=el01,dc=com" -w welcome1 -f addreplicator.ldif -h localhost -p 389
adding new entry "cn=Replication,dc=el01,dc=com"

Add access to replication user
On master node : 
Edit /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif to grant read permissions to replication user on all attributes :
# vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif 
…
olcAccess: {0}to attrs=userPassword
  by self =xw
  by dn.exact="uid=pwreset,dc=el01,dc=com" =xw
  by dn.exact="uid=replication,dc=el01,dc=com" read
  by anonymous auth
  by * none
olcAccess: {1}to *
  by anonymous auth
  by self write
  by dn.exact="uid=replication,dc=el01,dc=com" read
  by users read
  by * none

Enable syncProv module
On master node : 
Create a new file /etc/openldap/slapd.d/cn=config/cn=module{0}.ldif with the following content :
# vi /etc/openldap/slapd.d/cn=config/cn=module{0}.ldif 
dn: cn=module{0}
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}back_bdb
olcModuleLoad: {1}syncprov

Configure syncProv module
- Turn on SyncProv module for each directory to synchronize :
# mkdir /etc/openldap/slapd.d/cn=config/olcDatabase={0}config

# mkdir /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb

# touch /etc/openldap/slapd.d/cn=config/olcDatabase\=\{0\}config/olcOverlay={0}syncprov.ldif

# touch /etc/openldap/slapd.d/cn=config/olcDatabase\=\{2\}bdb/olcOverlay={0}syncprov.ldif 

- Add the following content to each synchprov ldif file :
dn: olcOverlay={0}syncprov
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
# 
# Sync Setup for the main LDAP Database
#
olcOverlay: {0}syncprov
# Sync Checkpoints every 20 changes or 1 hour
olcSpCheckpoint: 20 60
# Keep a fair number of operations in the log
olcSpSessionlog: 1000

Restart ldap service
On master Node : 
start ldap service and control there is no errors :

# service ldap start
Starting slapd:                                            [  OK  ]

Configure slave(s)
On slave Node, install and configure openldap as indicate in my previous article, except step for populate directory.

Configure ldap slave
On slave Node : 
edit /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif :
# vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif
olcSyncrepl: rid=100
  provider="ldaps://ldap-master.example.org:389/"
  type=refreshAndPersist
  retry="60 30 300 +"
  searchbase="dc=el01,dc=com"
  bindmethod=simple
  binddn="uid=replication,dc=el01,dc=com"
  credentials=replicationPASSWORD

Note : RID must be unique per slave and needs to be a 3 digits number.

Note : ldap Directory must be empty before starting slapd. 

Start slapd
Start ldap service :
# service ldap start
Starting slapd:                                            [  OK  ]

Replication control
Control replication by using ldapsearch on the second node :
# ldapsearch -x -b "cn=wls,ou=Group,dc=el01,dc=com" -D "cn=Manager,dc=el01,dc=com" -w welcome1 -h <slaveNodeAddress>
# extended LDIF
#
# LDAPv3
# base <cn=wls,ou=Group,dc=el01,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# wls, Group, el01.com
dn: cn=wls,ou=Group,dc=el01,dc=com
objectClass: posixGroup
objectClass: top
cn: wls
gidNumber: 600

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

If the result is one or more entries, the replication is working.

Note : It is possible to control replication with replica log file on master node

Install & configure openldap 2.4.23

How to install and configure openldap 2.4.23 on OEL6.5 :

Prerequisites
- Ntp Server : 
On each server, ntp must be configured.
Update /etc/ntp.conf with customer ntp, if enterprise ntp server can be joined.
If not, it is possible to use Ops Center virtual server as ntp server.
After modification, restart ntp service :
# service ntpd stop
Shutting down ntpd:                                        [  OK  ]
# service ntpd start
Starting ntpd:                                             [  OK  ]

- Name service :

To complete configuration, it is recommended to add ldap servers in Enterprise Name Service directory.
If not possible, add each entry in /etc/hosts file, and each ldap servers node, and in each ldap clients node.

Installation
Rpm packages :
If no yum repository is configured, you can install rpm openldap with dependencies rpm.
On each ldap client machine : 
Openldap-clients
nss-pam-ldapd
nss-util
authconfig-gtk
pam_ldap

On each ldap server : 
Openldap-servers
Nss-ldap
Libtool-ltld
cyrus-sasl-devel

Configure

Configuration file : 

/etc/openldap/slapd.d/cn=config.ldif

Make a backup of this file before any modification.

Edit the cn=config.ldif file to provide security informations : 

Delete ldapv2 connections, allow only ldapv3, by deleting this line : 

olcAllows: bind_v2

Add Idle Connection Timeout to avoid maintaining Idle connections, add or modify the following line :

olcIdleTimeout 60

Database files

Create a Rootpassword : 

Create an encoded root password for ldap directory with slappasswd command : 

# slappasswd

New password:

Re-enter new password:

{SSHA}F8SO2XunEKdP2qK4ZTFWicmaF/DrkW1Q

Edit Database file : olcDatabase={2}bdb.ldif

Make a backup of this file before any modification.

Edit /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif :

Modify olcSuffix to desired ldap configuration : 

 olcSuffix: dc=el01,dc=com

Modify ldap administrator olcRootDN : 

 olcRootDN: cn=manager,dc=el01,dc=com

Add Root password (with password generated in 4.2.1) : 

olcRootPW: {SSHA}F8SO2XunEKdP2qK4ZTFWicmaF/DrkW1Q

Start ldap service

Start the ldap service to check configuration files and to populate database online.

# chkconfig sldapd on

# service slapd start

Starting slapd: [OK]

Populate database (online)

Populate the database with ldif file for creating users and groups branchs : 

Create ldif file for create ldap tree (following contents is an example) : 

# vi /tmp/ldapentries.ldif

dn: dc=el01,dc=com

objectclass: dcObject

objectclass: organization

o: el01 com

dc: el01

dn: ou=People,dc=el01,dc=com

objectClass: organizationalUnit

objectClass: top

ou: People

dn: ou=Group,dc=el01,dc=com

objectClass: organizationalUnit

objectClass: top

ou: Group

dn: cn=admin,dc=el01,dc=com

objectclass: organizationalRole

cn: admin

# Add a user to test ldap

dn: uid=ddewailly,ou=People,dc=el01,dc=com

objectclass: top

objectclass: person

objectclass: inetOrgPerson

objectclass: organizationalPerson

uid: ddewailly

cn: David Dewailly

sn: Dewailly

givenName: David

Use clear text mode : 
If you don't want to use ldaps, modify /etc/sysconfig/authconfig file and replace FORCELEGACY=no by FORCELEGACY=yes

Populate with ldapadd command : 

# ldapadd -f /tmp/ldapentries.ldif -x -D cn=Manager,dc=el01,dc=com -W -c

Note : No space must be placed at the end of each line, use only new line characters.

Make a search to control entries previously added : 

# ldapsearch -x -D cn=Manager,dc=el01,dc=com -W -b 'dc=el01,dc=com' '(objectclass=*)'