On Fri, 13 Dec 2013 18:40:02 +0100 (CET) Christian Kratzer <ck-lists(a)cksoft.de&gt; wrote > - Allow writes to those edge sites for the purpososes of slapo_ppolicy, > slapo_lastbind and password changes. Note that with OpenLDAP operational attributes set by slapo-ppolicy and slapo-lastbind are not replicated anyway (with some exceptions like pwdChangedTime).

Hi, I have been thinking about a scalable multi site deployment architecture for openldap where I would like to: - Have a small number of master servers centrally in the enterprise with MMR. - All account provisioning would be at the central sites. - Have multiple edge sites replicate of those masters in a star toplogy with MMR. - Allow writes to those edge sites for the purpososes of slapo_ppolicy, slapo_lastbind and password changes. I would like to avoid fully meshing all servers for MMR and would prefer a star topology where each edge site only replicates with the central site. I would also like to avoid chaining. See my previous posts why. Before I set this up in my lab I would like a second opinion. The customer is asking for best practice in large deployments.

Hi, On Fri, 13 Dec 2013, Dieter Klünter wrote: > Michael is quite correct in his comments regarding slapo_policy, > but in priciple i have realised this design in a cascading > directory with more than 100 slaves. read only slaves or slaves with full write access ? The latter is the thing I need and the thing I am concerned about.

Hi, On Sat, 14 Dec 2013, Dieter Klünter wrote: > Am Sat, 14 Dec 2013 11:31:09 +0100 (CET) > schrieb Christian Kratzer <ck-lists(a)cksoft.de&gt;: > >> Hi, >> >> On Fri, 13 Dec 2013, Dieter Klünter wrote: >>> Michael is quite correct in his comments regarding slapo_policy, >>> but in priciple i have realised this design in a cascading >>> directory with more than 100 slaves. >> >> read only slaves or slaves with full write access ? >> >> The latter is the thing I need and the thing I am concerned about. > > read, and write operations by chaining. chaining seems to block on a global lock for olcConnectionTimeout when connectivity to the referral servers is lost. This took down the customers slaves with chaining when a network issue separated the slaves from the masters. See my other post about a week ago. I would need at least one or at best two masters servers per site as a target for chaining to cater for network partitions. An option would be to fix the chaining issues. Thinking about my options I wanted to explore the other option of having the clients on MMR masters. Also those MMR masters would not be fully meshed with the other sites.