Openldap

Installation

export LDFLAGS=-L/opt/applis/db-4.4.20-1/lib
export CPPFLAGS="-I/opt/applis/db-4.4.20-1/include"

./configure --prefix=/opt/applis/openldap-2.3.39-1 --enable-modules=yes --enable-syncprov=mod --enable-monitor=yes

make depend
make
make install

Configuration

Commune

• Activer le module pour la réplication

modulepath      /opt/applis/openldap/libexec/openldap/
moduleload      syncprov

• Le format de la base de données doit être bdb (les tests effectués montrent que openldap finit par ne plus répondre avec le format ldbm, pas de tests effectués avec le format hbd)

database        bdb

• Ajouter un index sur les propriétés entryCSN et entryUUID utilisées par le processus de réplication (amélioration des performances si indexés)

index           entryCSN,entryUUID eq

• Configuration rotation automatique des logs de transaction

dbconfig set_flags DB_LOG_AUTOREMOVE
checkpoint  128 5

Réplication

• Master

overlay syncprov
syncprov-checkpoint 256 10

• Slave

syncrepl rid=000
 provider=ldap://<MASTER>
 type=refreshAndPersist
 retry="5 10 300 +"
 searchbase="dc=domain,dc=local"
 attrs="*,+"
 bindmethod=simple
 binddn="cn=admin,dc=domain,dc=local"
 credentials=<PASSWORD>

Master

(...)
# Load dynamic backend modules:
modulepath      /opt/applis/openldap/libexec/openldap/
moduleload      syncprov
(...)
#######################################################################
# BDB database definitions
#######################################################################

database        bdb
suffix             "dc=domain,dc=local"
rootdn          "cn=admin,dc=domain,dc=local"
rootpw          {SSHA}s0m3h4sh
directory       /opt/data/ldap/ldap_data
index           objectClass,cn  eq
index           businessCategory eq
index           entryCSN,entryUUID eq
sizelimit unlimited

# autocreate DB_CONFIG file if not exists
dbconfig set_cachesize 0 268435456 1
dbconfig set_lg_regionmax 262144
dbconfig set_lg_bsize 2097152
dbconfig set_flags DB_LOG_AUTOREMOVE

# checkpoint DB every new 128KB or every 5 min
checkpoint  128 5

# replication
overlay syncprov
syncprov-checkpoint 256 10
(...)

loglevel 256

defaultaccess none

access to dn.subtree="dc=sub1,dc=domain,dc=local"
        by anonymous auth
        by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
        by dn="cn=admin2,o=sub2,dc=sub1,dc=domain,dc=local" write
        by * none
access to *
        by anonymous auth
        by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
        by * none

Slave

(...)
# Load dynamic backend modules:
modulepath      /opt/applis/openldap/libexec/openldap/
moduleload      syncprov
(...)
#######################################################################
# BDB database definitions
#######################################################################

database        bdb
suffix             "dc=domain,dc=local"
rootdn          "cn=admin,dc=domain,dc=local"
rootpw          {SSHA}s0m3h4sh
directory       /opt/data/ldap/ldap_data
index           objectClass,cn  eq
index           businessCategory eq
index           entryCSN,entryUUID eq
sizelimit unlimited

# autocreate DB_CONFIG file if not exists
dbconfig set_cachesize 0 268435456 1
dbconfig set_lg_regionmax 262144
dbconfig set_lg_bsize 2097152
dbconfig set_flags DB_LOG_AUTOREMOVE

# checkpoint DB every new 128KB or every 5 min
checkpoint  128 5

syncrepl rid=000
 provider=ldap://<MASTER>
 type=refreshAndPersist
 retry="5 10 300 +"
 searchbase="dc=domain,dc=local"
 attrs="*,+"
 bindmethod=simple
 binddn="cn=admin,dc=domain,dc=local"
 credentials=<PASSWORD>

(...)

loglevel 256

defaultaccess none

access to dn.subtree="dc=sub1,dc=domain,dc=local"
        by anonymous auth
        by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
        by dn="cn=admin2,o=sub2,dc=sub1,dc=domain,dc=local" write
        by * none
access to *
        by anonymous auth
        by dn="cn=admin1,o=sub2,dc=sub1,dc=domain,dc=local" write
        by * none