Openldap

Installation

export LDFLAGS=-L/opt/applis/db-4.4.20-1/lib
export CPPFLAGS="-I/opt/applis/db-4.4.20-1/include"

./configure --prefix=/opt/applis/openldap-2.3.39-1 --enable-modules=yes --enable-syncprov=mod --enable-monitor=yes

make depend
make
make install

Configuration

• Commune
  • Activer le module pour la réplication

modulepath      /opt/applis/openldap/libexec/openldap/
moduleload      syncprov

 * Le format de la base de données doit être bdb (les tests effectués montrent que openldap finit par ne plus répondre avec le format ldbm, pas de tests effectués avec le format hbd)

database        bdb

• • Ajouter un index sur les propriétés entryCSN et entryUUID utilisées par le processus de réplication (amélioration des performances si indexés)

index           entryCSN,entryUUID eq

• • Configuration rotation automatique des logs de transaction

dbconfig set_flags DB_LOG_AUTOREMOVE
checkpoint  128 5

• Réplication
  • Master

overlay syncprov
syncprov-checkpoint 256 10

• • Slave

syncrepl rid=000
 provider=ldap://<MASTER>
 type=refreshAndPersist
 retry="5 10 300 +"
 searchbase="dc=domain,dc=local"
 attrs="*,+"
 bindmethod=simple
 binddn="cn=admin,dc=domain,dc=local"
 credentials=<PASSWORD>

Master

{{{ (...)

1. Load dynamic backend modules:

modulepath /opt/applis/openldap/libexec/openldap/ moduleload syncprov (...)

2. BDB database definitions

database bdb suffix "dc=domain,dc=local" rootdn "cn=admin,dc=domain,dc=local" rootpw {SSHA}s0m3h4sh directory /opt/data/ldap/ldap_data index objectClass,cn eq index businessCategory eq index entryCSN,entryUUID eq sizelimit unlimited

1. autocreate DB_CONFIG file if not exists

dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_flags DB_LOG_AUTOREMOVE

1. checkpoint DB every new 128KB or every 5 min

checkpoint 128 5

1. replication

overlay syncprov syncprov-checkpoint 256 10 (...)

loglevel 256

defaultaccess none

access to dn.subtree="dc=sub1,dc=domain,dc=local"

       by anonymous auth
       by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
       by dn="cn=admin2,o=sub2,dc=sub1,dc=domain,dc=local" write
       by * none

access to *

       by anonymous auth
       by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
       by * none

}}}

Slave

{{{ (...)

1. Load dynamic backend modules:

modulepath /opt/applis/openldap/libexec/openldap/ moduleload syncprov (...)

2. BDB database definitions

database bdb suffix "dc=domain,dc=local" rootdn "cn=admin,dc=domain,dc=local" rootpw {SSHA}s0m3h4sh directory /opt/data/ldap/ldap_data index objectClass,cn eq index businessCategory eq index entryCSN,entryUUID eq sizelimit unlimited

1. autocreate DB_CONFIG file if not exists

dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 dbconfig set_flags DB_LOG_AUTOREMOVE

1. checkpoint DB every new 128KB or every 5 min

checkpoint 128 5

syncrepl rid=000

provider=ldap://<MASTER>
type=refreshAndPersist
retry="5 10 300 +"
searchbase="dc=domain,dc=local"
attrs="*,+"
bindmethod=simple
binddn="cn=admin,dc=domain,dc=local"
credentials=<PASSWORD>

(...)

loglevel 256

defaultaccess none

access to dn.subtree="dc=sub1,dc=domain,dc=local"

       by anonymous auth
       by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
       by dn="cn=admin2,o=sub2,dc=sub1,dc=domain,dc=local" write
       by * none

access to *

       by anonymous auth
       by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
       by * none

}}}