right order mmr-main-DB combined with mmr cn=config

Wednesday, 15 December 2021

Hello,

I'm still working on replication of cn=config. The replication of the
main DB is working with delta-syncrepl but I still have problems getting
mmr running for cn=config. As I use Ansible to configure it here my
question:
Is the order of setting up the replication relevant?
What I do at the moment:

Setting up a basic config for all 4 servers:
-----------------------------------------
dn: cn=config
objectClass: olcGlobal
cn: config
olcLogLevel: sync
olcLogLevel: stats
olcPidFile: /var/symas/run/slapd.pid
olcArgsFile: /var/symas/run/slapd.args
olcToolThreads: 1
olcServerID: 1 ldap://ldap01.example.net
olcServerID: 2 ldap://ldap02.example.net
olcServerID: 3 ldap://ldap03.example.net
olcServerID: 4 ldap://ldap04.example.net

# create cn=config
#dn: olcBackend={0}mdb,cn=config
#objectClass: olcBackendConfig
#olcBackend: {0}mdb

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /opt/symas/lib/openldap
olcModuleLoad: back_mdb
olcModuleLoad: back_monitor
olcModuleLoad: autoca.la
olcModuleLoad: otp.la
olcModuleLoad: argon2.la
olcModuleLoad: syncprov
olcModuleLoad: back_monitor
olcModuleLoad: accesslog.la

include: file:///opt/symas/etc/openldap/schema/core.ldif
include: file:///opt/symas/etc/openldap/schema/cosine.ldif
include: file:///opt/symas/etc/openldap/schema/nis.ldif
include: file:///opt/symas/etc/openldap/schema/inetorgperson.ldif
include: file:///opt/symas/etc/openldap/schema/dyngroup.ldif
include: file:///opt/symas/etc/openldap/schema/kerberos.openldap.ldif

dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcSizeLimit: 500
olcAccess: {0}to *
  by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
manage
  by
dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth
manage
  by * break
olcAccess: {1}to dn=""  by * read
olcAccess: {2}to dn.base="cn=subschema"  by * read
olcPasswordHash: {ARGON2}

dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcRootDN: cn=admin,cn=config
olcRootPW:
{ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4
olcAccess: {0}to *
  by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
manage
  by
dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth
manage
  by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write
  by * break

dn: olcDatabase={1}monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to dn.subtree="cn=monitor"
  by dn.exact=cn=admin,cn=config read
  by dn.exact=cn=admin,dc=example,dc=net read

dn: olcDatabase={2}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcmdbConfig
olcDatabase: {2}mdb
olcSuffix: dc=example,dc=net
olcRootDN: cn=admin,dc=example,dc=net
olcRootPW:
{ARGON2}$argon2i$v=19$m=4096,t=3,p=1$cXdlcnJ0enV6dWlvMTIz$G/l0lynf7ygdz0tG+E7S1fBibsFs/L80AUSisiGl/v4
olcSizeLimit: unlimited
olcTimeLimit: unlimited
olcDbCheckpoint: 512 30
olcDbDirectory: /var/symas/openldap-data
olcDbIndex: default eq
olcDbIndex: objectClass
olcDbIndex: entryUUID
olcDbIndex: entryCSN
olcDbIndex: cn pres,eq,sub
olcDbIndex: uid pres,eq,sub
olcDbIndex: mail pres,eq,sub
olcDbIndex: sn pres,eq,sub
olcDbIndex: description pres,eq,sub
olcDbIndex: title pres,eq,sub
olcDbIndex: givenName pres,eq,sub
olcDbMaxSize: 85899345920
olcAccess: {0} to *
  by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
manage
  by
dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=external,cn=auth
manage
  by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write
  by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read
  by * break
olcAccess: {1}to dn.exact=""  by * read
olcAccess: {2}to dn.base="cn=subschema"  by * read
olcAccess: {3} to attrs=userPassword
  by anonymous auth by self write by * none
olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net"
  time=unlimited
  size=unlimited
olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net"
  time=unlimited
  size=unlimited
-----------------------------------------

As you can see serverID is already set to URL-style for all servers ;-)

But now I'm not sure, do I have to set up the replication for cn=config
on all 4 servers and then set up replication of the main DB on just one
of the servers and let it be replicated by the cn=config-replication?

Or do I have to set up replication of the main DB on all servers first
and then add the replication of cn=config to all servers and only
replicate the changes made afterwards?

Or do I have to set up the replication of main-DB and replication of
cn=config on one server at a time?

Or can I do it either way?

The testsuit is showing using updateref on the replication of the
main-DB do I really need it for mmr? If yes, do I need it for mmr of
cn=config?

I could not find any example that uses both, mmr for main-DB and mmr for
cn=config.

here is the order of my set up for cn=config replication:
------------------------
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov

dn: olcDatabase={0}config,cn=config
changetype: modify
replace: olcSyncRepl
olcSyncRepl: rid=1
  provider=ldap://ldap01.example.net
  binddn="cn=admin,cn=config"
  bindmethod=simple
  credentials=secret
  searchbase="cn=config"
  type=refreshAndPersist
  retry="5 5 300 20"
  timeout=1
  starttls=yes
  tls_reqcert=allow
olcSyncRepl: rid=2
  provider=ldap://ldap02.example.net
  binddn="cn=admin,cn=config"
  bindmethod=simple
  credentials=secret
  searchbase="cn=config"
  type=refreshAndPersist
  retry="5 5 300 20"
  timeout=1
  starttls=yes
  tls_reqcert=allow
olcSyncRepl: rid=3
  provider=ldap://ldap03.example.net
  binddn="cn=admin,cn=config"
  bindmethod=simple
  credentials=secret
  searchbase="cn=config"
  type=refreshAndPersist
  retry="5 5 300 20"
  timeout=1
  starttls=yes
  tls_reqcert=allow
olcSyncRepl: rid=4
  provider=ldap://ldap04.example.net
  binddn="cn=admin,cn=config"
  bindmethod=simple
  credentials=secret
  searchbase="cn=config"
  type=refreshAndPersist
  retry="5 5 300 20"
  timeout=1
  starttls=yes
  tls_reqcert=allow
-
add: olcMultiprovider
olcMultiprovider: TRUE
------------------------

And last but not least the set up of the main-DB replication:
-----------------------
dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcSyncrepl
olcSyncrepl: rid=102
  provider=ldap://ldap02.example.net
  bindmethod=simple
  timeout=0
  network-timeout=0
  binddn=uid=repl-user,ou=users,dc=example,dc=net
  credentials=secret
  filter="(objectclass=*)"
  searchbase="dc=example,dc=net"
  logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"
  logbase=cn=accesslog
  scope=sub
  schemachecking=off
  type=refreshAndPersist
  retry="60 +"
  syncdata=accesslog
  keepalive=240:10:30
  starttls=yes
  tls_reqcert=allow
olcSyncrepl: rid=103
  provider=ldap://ldap03.example.net
  bindmethod=simple
  timeout=0
  network-timeout=0
  binddn=uid=repl-user,ou=users,dc=example,dc=net
  credentials=secret
  filter="(objectclass=*)"
  searchbase="dc=example,dc=net"
  logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"
  logbase=cn=accesslog
  scope=sub
  schemachecking=off
  type=refreshAndPersist
  retry="60 +"
  syncdata=accesslog
  keepalive=240:10:30
  starttls=yes
  tls_reqcert=allow
olcSyncrepl: rid=104
  provider=ldap://ldap04.example.net
  bindmethod=simple
  timeout=0
  network-timeout=0
  binddn=uid=repl-user,ou=users,dc=example,dc=net
  credentials=secret
  filter="(objectclass=*)"
  searchbase="dc=example,dc=net"
  logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"
  logbase=cn=accesslog
  scope=sub
  schemachecking=off
  type=refreshAndPersist
  retry="60 +"
  syncdata=accesslog
  keepalive=240:10:30
  starttls=yes
  tls_reqcert=allow
-
add: olcMultiprovider
olcMultiprovider: TRUE
-----------------------

 This is the ldif for the first server so olcSyncrepl for
ldap01.example.net is not configured. On the other servers is the same
the own URI has no olcSyncrepl entry. Here olcUpdatRef is not
configured. Replication of the main-DB is running. BTW olcUpdateRef is
also not configured in the howto of Quanah ;-) So it must be ok :-)

Could you please take a look if I did something wrong. I don't know
where to look anymore.

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007