Thank you for your response and for nudging me towards the test scripts. Shortly after your email, I had to deal with an emergency, so am only now circling back around to this.
I currently have the "ldap-utils" package installed from the base Ubuntu repositories on Ubuntu 20.04. This is version 2.4.49 of openldap.
I then downloaded the source code for openldap-2.5.9, and have figured out how to run "make test" to run all of the test scripts.
Unfortunately, the test045 script keeps failing because it says that the necessary backend isn't even available, which is really confusing to me, because I've ensured that back-mdb is enabled.
See below for output of `slapcat` as well as the modules enabled. Why is the test045 script telling me that the "LDAP backend not available, test skipped" when back-mdb and syncprov are both clearly available? Am I missing something else?
root@davidw-ldap-provider-with-proxy:~/source/openldap-2.5.9/tests# slapcat dn: dc=ma,dc=us,dc=test,dc=com objectClass: top objectClass: dcObject objectClass: organization o: ma.us.test.com dc: ma structuralObjectClass: organization entryUUID: 3ed370ee-e7c5-103b-8925-e9568cf98aa1 creatorsName: cn=admin,dc=ma,dc=us,dc=test,dc=com createTimestamp: 20211202140944Z entryCSN: 20211202140944.954584Z#000000#000#000000 modifiersName: cn=admin,dc=ma,dc=us,dc=test,dc=com modifyTimestamp: 20211202140944Z contextCSN: 20211202160434.733327Z#000000#000#000000
dn: cn=admin,dc=ma,dc=us,dc=test,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: REDACTED structuralObjectClass: organizationalRole entryUUID: 3ee5958a-e7c5-103b-8926-e9568cf98aa1 creatorsName: cn=admin,dc=ma,dc=us,dc=test,dc=com createTimestamp: 20211202140945Z entryCSN: 20211202140945.073555Z#000000#000#000000 modifiersName: cn=admin,dc=ma,dc=us,dc=test,dc=com modifyTimestamp: 20211202140945Z
dn: cn=replicate,dc=ma,dc=us,dc=test,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole description: Replication User userPassword:: REDACTED structuralObjectClass: organizationalRole cn: replicate entryUUID: 327948be-e7cf-103b-93fa-e17a6939fd39 creatorsName: cn=admin,dc=ma,dc=us,dc=test,dc=com createTimestamp: 20211202152059Z entryCSN: 20211202152059.198404Z#000000#000#000000 modifiersName: cn=admin,dc=ma,dc=us,dc=test,dc=com modifyTimestamp: 20211202152059Z
root@davidw-ldap-provider-with-proxy:~/source/openldap-2.5.9/tests# slapcat -n 0 | grep olcModuleLoad olcModuleLoad: {0}back_mdb olcModuleLoad: {1}syncprov
Sent with ProtonMail Secure Email.
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Wednesday, December 1st, 2021 at 10:23 PM, Howard Chu hyc@symas.com wrote:
David White wrote:
Hello,
I have some basic experience interacting with & troubleshooting OpenLDAP as well as 389-ds, but I don't have a whole lot of experience setting them up or
configuring an OpenLDAP server.
My goal is to setup replication from a Primary inside a trusted network outwards to a Replica that is in an untrusted network, without allowing the replica any
direct access to the primary, due to firewall flows and network requirements. This is true even for the initial connection, so a simple RefreshAndPersist
configuration won't work.
I have read that it is possible to setup a push-based replication using a proxy, such that:
- The proxy gets installed as a "hidden" database onto the same server as the primary
- The proxy sets up replication with the primary using RefreshAndPersist
- The proxy is then able to push the data out of the replica
I have skimmed over, and re-read, a lot of portions from this document: https://www.openldap.org/doc/admin24/replication.html
I have also followed this basic guide to setup a Primary with replication capability: https://ubuntu.com/server/docs/service-ldap-replication
What I'm having trouble with, is finding a useful guide that will walk me through the process to setup and configure the proxy as I've described above.
A working example is in test045 of the test suite. You can simply convert the slapd.conf files to LDIF format from there.
Questions:
- Based on my requirements above, will the proxy with syncrepl meet my needs?
o If I put the proxy onto the same server as the primary, then due to firewall flows, the replica will not have any access to the primary. All
communication will need to be initiated outbound
o If I put the proxy into the same network as the replica, well.... that won't work either, for the same reason
- The following URL from the OpenLDAP docs provides some example configs: https://www.openldap.org/doc/admin24/replication.html#Syncrepl Proxy
o If I'm reading everything correctly, though, the "new" / "accepted" / "preferred" way to configure the ldap server is to use the `ldapadd`,
`ldapmodify`, and related commands. My confusion and question here is.... should I try to configure all of this by editing the old slapd.conf file as
the openldap.org docs provide examples, or is there a way to do this using the ldapmodify & related commands?
o If I can / should do this from the command line... are there any guides or tutorials that will take me step-by-step through the process as I try to
build this in a lab environment?
Thanks in advance,
David
Sent with ProtonMail https://protonmail.com/ Secure Email.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/