OpenLDAP - 多主配置

Question

我必须在多主模式下配置两个 OpenLDAP 节点。 我还将它们与我们的公司 Active Directory 集成，经过一些验证，集成似乎有效。 即使日志说复制工作正常，我也验证了添加到一个节点的实体没有在另一个节点上复制。 这是我的 slapd.conf，如下所示。两个 slapd.conf 之间的唯一区别是 serverID

### Schema includes ###########################################################
include                 /etc/openldap/schema/core.schema
include                 /etc/openldap/schema/cosine.schema
include                 /etc/openldap/schema/inetorgperson.schema
include                 /etc/openldap/schema/misc.schema
include                 /etc/openldap/schema/nis.schema
include                 /etc/openldap/schema/microsoft.minimal.schema

## Module paths ##############################################################
modulepath              /usr/lib64/openldap/
moduleload              back_ldap
moduleload              rwm
moduleload      syncprov
moduleload      accesslog

### Logging ###################################################################
logfile         /var/log/slapd/slapd.log
loglevel        sync

# Main settings ###############################################################
pidfile                 /var/run/openldap/slapd.pid
argsfile                /var/run/openldap/slapd.args

# Allow v2 binding for legacy clients #########################################
allow bind_v2

### Database local ############################################################
database        bdb
suffix          "dc=farm,dc=it"
rootdn          "cn=manager,dc=farm,dc=it"
rootpw          {SSHA}B29rxKxtjTN8JJIppPGJt7ahvUPhd1pa
directory       /var/lib/ldap

# Indexes for this back end
index           objectClass                     eq,pres
index           ou,cn,mail,surname,givenname    eq,pres,sub
index           uid                             eq,pres,sub

access to attrs=userPassword
    by self =xw
    by dn.exact="cn=manager,dc=farm,dc=it"
    by dn.exact="cn=replica,dc=farm,dc=it"
    by anonymous auth
    by * none
access to *
    by anonymous auth
    by self write
    by dn.exact="cn=replica,dc=farm,dc=it" read
    by users read
    by * none



# Replica #####################################################################

#Define the server ID.
serverID 2

# Replication configuration, only things you may have to change here are provider, binddn, credentials and searchbase.
syncrepl rid=001
    provider=ldap://almldap01.farm.it:389
    binddn="cn=replica,dc=farm,dc=it"
    bindmethod=simple
    credentials="3L3jkKZcSb5anj8ReCi3ZDWnbv9HNeB8"
    searchbase="dc=farm,dc=it"
    type=refreshAndPersist
    interval=00:00:00:10
    retry="5 5 300 5"
    timeout=1

#Rest replication configuration goes to end of the file.
mirrormode TRUE
overlay syncprov
syncprov-nopresent TRUE
syncprov-reloadhint TRUE
syncprov-checkpoint 1000 60


### Database definition (Proxy to AD) #########################################
database                ldap
readonly                yes
protocol-version        3
rebind-as-user      yes
uri                     "ldap://corp.farm.group:389"
suffix                  "dc=corp,dc=farm,dc=group"
idassert-bind       bindmethod=simple
            mode=none
            binddn="CN=WfLdapBind,OU=Users,OU=WebFarm,DC=corp,DC=farm,DC=group"
            credentials="djW5l5hvTPcMcLvV"
idassert-authzFrom  "*"
overlay                 rwm
rwm-map         attribute       uid         sAMAccountName
rwm-map         objectClass posixAccount    person

Answer 1

syncrepl rid 和 provider 在每种情况下也应该不同。 rid 应该是唯一的，provider 应该指向另一个 OpenLDAP 主服务器。