{"id":340,"date":"2011-07-22T11:05:09","date_gmt":"2011-07-22T11:05:09","guid":{"rendered":""},"modified":"2016-02-22T13:07:34","modified_gmt":"2016-02-22T12:07:34","slug":"konfiguracja-replikacji-multi-master-opendj","status":"publish","type":"post","link":"https:\/\/drfugazi.eu.org\/en\/konfiguracja-replikacji-multi-master-opendj\/","title":{"rendered":"(Polski) Konfiguracja replikacji Multi-Master w OpenDJ"},"content":{"rendered":"

Sorry, this entry is only available in Polish<\/a>. For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.<\/p>

G\u0142\u00f3wnym powodem mojej migracji us\u0142ug katalogowych z OpenLDAP do OpenDJ jest w\u0142asnie mechanizm replikacji, a raczej jego niezbyt przewidywalne dzia\u0142anie w OpenLDAP. Dop\u00f3ki w katalogu znajdowa\u0142o si\u0119 mniej ni\u017c 5 tys. entry to nie mia\u0142em powod\u00f3w do narzeka\u0144. Problemy zacz\u0119\u0142y si\u0119 gdy wrzuci\u0142em do katalogu LDAP oko\u0142o 40 tys. wpis\u00f3w. W dodatku, co ciekawe problemy zwykle wyst\u0119puj\u0105 przy masowym usuwaniu a nie dodawaniu entry.<\/p>\n

Wszyscy znani mi fachowcy zajmuj\u0105cy si\u0119 LDAPem, kiedy zacz\u0105\u0142em wypytywa\u0107 o mo\u017cliwe przyczyny stwierdzili jednomy\u015blnie, \u017ce znane s\u0105 im problemy z replikacj\u0105 w OpenLDAP przy liczbie entry id\u0105cej w dziesi\u0105tki tysi\u0119cy. Na pytanie jak rozwi\u0105za\u0107 ten problem us\u0142ysza\u0142em, \u017ce OpenLDAPa stosuj\u0105 dla ma\u0142ej ilo\u015bci, tak do 5 tys. entry, powy\u017cej tego instaluj\u0105 DSEE, OpenDS lub OpenDJ.<\/p>\n

Poniewa\u017c DSEE przesta\u0142o by\u0107 darmowe po przej\u0119ciu firmy SUN przez Oracle, to zdecydowa\u0142em si\u0119 na instalacj\u0119 OpenDJ jako nast\u0119pc\u0119 serwera OpenDS, tworzonego przez ludzi, kt\u00f3rzy po cz\u0119\u015bci odeszli z Oracle po przej\u0119ciu.
\n<\/p>\n

Replikacja pos\u0142u\u017cy zapewnieniu wysokiej dost\u0119pno\u015bci (HA) us\u0142ug katalogowych, dlatego te\u017c bli\u017aniaczy serwer LDAP skonfiguruj\u0119 na innym serwerze, w przeznaczonym do tego kontenerze. Po instalacji i ustawieniu \u015brodowiska rozpakowa\u0142em archiwum z serwerem OpenDJ i zainstalowa\u0142em go analogicznie jak w opisie instalacji (link poni\u017cej).<\/p>\n

Do konfiguracji do\u0142o\u017cy\u0142em mo\u017cliwo\u015b\u0107 importu zaszyfrowanych hase\u0142 (patrz: opis konfiguracji), wgra\u0142em tak\u017ce odpowiednie schematy oraz indeksy (patrz: linki pod artyku\u0142em). Innymi s\u0142owy, zadba\u0142em o to, aby konfiguracja obu LDAP\u00f3w by\u0142a taka sama. Czas na konfiguracj\u0119 replikacji multi-master.<\/p>\n

Najpierw nale\u017cy zadba\u0107 o to, aby system widzia\u0142 obie nazwy serwer\u00f3w LDAP. Najlepiej dopisa\u0107 je do \/etc\/hosts<\/code>. To jest bardzo wa\u017cne i bez tego mo\u017cna si\u0119 spotka\u0107 z r\u00f3\u017cnymi dziwnymi problemami, kt\u00f3re nawet trudno z tym powi\u0105za\u0107. Radz\u0119 wi\u0119c zrobi\u0107 to od razu, nawet je\u015bli b\u0119dziecie u\u017cywa\u0107 explicite adres\u00f3w IP.<\/p>\n

root@ldapdj2:\/data\/var\/OpenDJ-2.4.3# vi \/etc\/hosts\r\n#\r\n# Internet host table\r\n#\r\n::1     localhost\r\n127.0.0.1      localhost loghost\r\n192.168.1.45   ldapdj1\r\n192.168.1.46   ldapdj2 \r\n<\/code><\/pre>\n
Oba serwery OpenDJ musz\u0105 dzia\u0142a\u0107, wtedy uruchamiamy program konfiguracyjny, zrobi\u0119 to interaktywnie:<\/p>\n
root@ldapdj2:~# \/data\/var\/OpenDJ-2.4.3\/bin\/dsreplication\r\nWhat do you want to do?\r\n\r\n    1)  Enable Replication\r\n    2)  Disable Replication\r\n    3)  Initialize Replication on one Server\r\n    4)  Initialize All Servers\r\n    5)  Pre External Initialization\r\n    6)  Post External Initialization\r\n    7)  Display Replication Status\r\n    8)  Purge Historical\r\n\r\n    c)  cancel\r\n\r\nEnter choice: 1\r\n\r\n\r\n>>>> Specify server administration connection parameters for the first server\r\n\r\nDirectory server hostname or IP address [ldapdj2]: ldapdj1\r\n\r\nDirectory server administration port number [4444]: \r\n\r\nHow do you want to trust the server certificate?\r\n\r\n    1)  Automatically trust\r\n    2)  Use a truststore\r\n    3)  Manually validate\r\n\r\nEnter choice [3]: \r\n\r\nGlobal Administrator User ID, or bind DN if no Global Administrator is defined\r\n[admin]: cn=dirmgr\r\n\r\nPassword for user 'cn=dirmgr': \r\n\r\nServer Certificate:\r\n\r\nUser DN  : CN=ldapdj1, O=Administration Connector Self-Signed Certificate\r\nValidity : From 'Mon Jul 11 12:20:17 CEST 2011'\r\n             To 'Wed Jul 10 12:20:17 CEST 2013'\r\nIssuer   : CN=ldapdj1, O=Administration Connector Self-Signed Certificate\r\n\r\n\r\nDo you trust this server certificate?\r\n\r\n    1)  No\r\n    2)  Yes, for this session only\r\n    3)  Yes, also add it to a truststore\r\n    4)  View certificate details\r\n\r\nReplication port for the first server (the port must be free) [8989]: \r\n\r\nDo you want replication to use encrypted communication when connecting to\r\nreplication port 8989 on the first server? (yes \/ no) [no]: \r\n\r\n\r\n\r\n>>>> Specify server administration connection parameters for the second server\r\n\r\nDirectory server hostname or IP address [ldapdj2]: \r\n\r\nDirectory server administration port number [4444]: \r\n\r\nGlobal Administrator User ID, or bind DN if no Global Administrator is defined\r\n[admin]: cn=dirmgr\r\n\r\nPassword for user 'cn=dirmgr': \r\nReplication port for the second server (the port must be free) [8989]: \r\n\r\nDo you want replication to use encrypted communication when connecting to\r\nreplication port 8989 on the second server? (yes \/ no) [no]: \r\n\r\nYou must choose at least one base DN to be replicated.\r\nReplicate base DN dc=domain,dc=tld? (yes \/ no) [yes]: \r\n\r\nEstablishing connections ..... Done.\r\nChecking registration information ..... Done.\r\nConfiguring Replication port on server ldapdj1:4444 ..... Done.\r\nConfiguring Replication port on server ldapdj2:4444 ..... Done.\r\nUpdating replication configuration for baseDN dc=domain,dc=tld on server ldapdj1:4444 ..... Done.\r\nUpdating replication configuration for baseDN dc=domain,dc=tld on server ldapdj2:4444 ..... Done.\r\nUpdating registration configuration on server ldapdj1:4444 ..... Done.\r\nUpdating registration configuration on server ldapdj2:4444 ..... Done.\r\nUpdating replication configuration for baseDN cn=schema on server ldapdj1:4444 ..... Done.\r\nUpdating replication configuration for baseDN cn=schema on server ldapdj2:4444 ..... Done.\r\nInitializing registration information on server ldapdj2:4444 with the contents of server ldapdj1:4444 ..... Done.\r\nInitializing schema on server ldapdj2:4444 with the contents of server ldapdj1:4444 ..... Done.\r\n\r\nReplication has been successfully enabled.  Note that for replication to work you must initialize the contents of the base DN's that are being replicated (use dsreplication initialize to do so).\r\n\r\nSee \/var\/tmp\/opends-replication-3358902381985550693.log for a detailed log of\r\nthis operation.\r\n<\/code><\/pre>\n
Trzeba poda\u0107 dane serwera \u017ar\u00f3d\u0142owego i docelowego dla replikacji i dane Globalnego Administratora, lub u\u017cytkownika maj\u0105cego uprawnienia do konfiguracji tego\u017c. Sprawdzam status replikacji (OpenDJ\/bin mam w \u015bcie\u017cce):<\/p>\n
root@ldapdj2:~# dsreplication \r\nWhat do you want to do?\r\n\r\n    1)  Enable Replication\r\n    2)  Disable Replication\r\n    3)  Initialize Replication on one Server\r\n    4)  Initialize All Servers\r\n    5)  Pre External Initialization\r\n    6)  Post External Initialization\r\n    7)  Display Replication Status\r\n    8)  Purge Historical\r\n\r\n    c)  cancel\r\n\r\nEnter choice: 7\r\n\r\n\r\n>>>> Specify OpenDS LDAP connection parameters\r\n\r\nDirectory server hostname or IP address [ldapdj2]: ldapdj1\r\n\r\nDirectory server administration port number [4444]: \r\n\r\nHow do you want to trust the server certificate?\r\n\r\n    1)  Automatically trust\r\n    2)  Use a truststore\r\n    3)  Manually validate\r\n\r\nEnter choice [3]: 1\r\n\r\nGlobal Administrator User ID [admin]: \r\n\r\nPassword for user 'admin': \r\n\r\ndc=domain,dc=tld - Replication Enabled\r\n========================================\r\nServer       : Entries : M.C. (1) : A.O.M.C. (2) : Port (3) : Security (4)\r\n-------------:---------:----------:--------------:----------:-------------\r\nldapdj1:4444 : 43746   : 0        : N\/A          : 8989     : Disabled\r\nldapdj2:4444 : 1       : 0        : N\/A          : 8989     : Disabled\r\n\r\n[1] The number of changes that are still missing on this server (and that have been applied to at least one of the other servers).\r\n[2] Age of oldest missing change: the date on which the oldest change that has not arrived on this server was generated.\r\n[3] The port used to communicate between the servers whose contents are being replicated.\r\n[4] Whether the replication communication through the replication port is encrypted or not.\r\n<\/code><\/pre>\n
W \u017ar\u00f3d\u0142owym katalogu LDAP jest 43746 entry a w docelowym tylko jeden (bazowy), pora zainicjalizowa\u0107 ldapdj2 danymi z ldapdj1. Wa\u017cne aby dobrze okre\u015bli\u0107 kierunek, \u017ceby si\u0119 nie okaza\u0142o, \u017ce zamiast w obu mie\u0107 43 tys. wpis\u00f3w to w obu mamy po jednym \ud83d\ude09<\/p>\n
root@ldapdj2:~# dsreplication \r\nWhat do you want to do?\r\n\r\n    1)  Enable Replication\r\n    2)  Disable Replication\r\n    3)  Initialize Replication on one Server\r\n    4)  Initialize All Servers\r\n    5)  Pre External Initialization\r\n    6)  Post External Initialization\r\n    7)  Display Replication Status\r\n    8)  Purge Historical\r\n\r\n    c)  cancel\r\n\r\nEnter choice: 3\r\n\r\n\r\n>>>> Specify server administration connection parameters for the source server\r\n\r\nDirectory server hostname or IP address [ldapdj2]: ldapdj1\r\n\r\nDirectory server administration port number [4444]: \r\n\r\nHow do you want to trust the server certificate?\r\n\r\n    1)  Automatically trust\r\n    2)  Use a truststore\r\n    3)  Manually validate\r\n\r\nEnter choice [3]: 3\r\n\r\nGlobal Administrator User ID [admin]: \r\n\r\nPassword for user 'admin': \r\n\r\nServer Certificate:\r\n\r\nUser DN  : CN=ldapdj1, O=Administration Connector Self-Signed Certificate\r\nValidity : From 'Mon Jul 11 12:20:17 CEST 2011'\r\n             To 'Wed Jul 10 12:20:17 CEST 2013'\r\nIssuer   : CN=ldapdj1, O=Administration Connector Self-Signed Certificate\r\n\r\n\r\nDo you trust this server certificate?\r\n\r\n    1)  No\r\n    2)  Yes, for this session only\r\n    3)  Yes, also add it to a truststore\r\n    4)  View certificate details\r\n\r\nEnter choice [2]: \r\n\r\n\r\n>>>> Specify server administration connection parameters for the destination\r\nserver\r\n\r\nDirectory server hostname or IP address [ldapdj2]: \r\n\r\nDirectory server administration port number [4444]: \r\n\r\nYou must choose at least one base DN to be initialized.\r\nInitialize base DN dc=domain,dc=tld? (yes \/ no) [yes]: \r\n\r\nInitializing the contents of a base DN removes all the existing contents of\r\nthat base DN.  Do you want to remove the contents of the selected base DN's on\r\nserver ldapdj2:4444 and replace them with the contents of server ldapdj1:4444?\r\n(yes \/ no) [yes]: \r\n\r\n\r\nInitializing base DN dc=domain,dc=tld with the contents from ldapdj1:4444:\r\n0 entries processed (0 % complete).\r\n4843 entries processed (11 % complete).\r\n12823 entries processed (29 % complete).\r\n30104 entries processed (68 % complete).\r\n43373 entries processed (99 % complete).\r\n43740 entries processed (99 % complete).\r\nBase DN initialized successfully.\r\n\r\nSee \/var\/tmp\/opends-replication-1031665462980592921.log for a detailed log of\r\nthis operation.\r\n<\/code><\/pre>\n
Sprawdzam status replikacji:<\/p>\n
root@ldapdj2:~# dsreplication status  \r\n\r\n\r\n>>>> Specify OpenDS LDAP connection parameters\r\n\r\nDirectory server hostname or IP address [ldapdj2]: \r\n\r\nDirectory server administration port number [4444]: \r\n\r\nGlobal Administrator User ID [admin]: \r\n\r\nPassword for user 'admin': \r\nThe Certificate presented by the server ldapdj1:4444 could not be trusted.\r\nPossible reasons for this error:\r\n-The Certificate Authority that issued the certificate is not recognized (this\r\nis the case of the self-signed certificates).\r\n-The server's certificate is incomplete due to a misconfiguration.\r\n-The server's certificate has expired.\r\n-There is a time difference between the server machine clock and the local\r\nmachine clock.\r\nBefore accepting this certificate, you should examine the server's certificate\r\ncarefully.\r\n\r\nServer Certificate:\r\n\r\nUser DN  : CN=ldapdj1, O=Administration Connector Self-Signed Certificate\r\nValidity : From 'Mon Jul 11 12:20:17 CEST 2011'\r\n             To 'Wed Jul 10 12:20:17 CEST 2013'\r\nIssuer   : CN=ldapdj1, O=Administration Connector Self-Signed Certificate\r\n\r\n\r\nDo you trust this server certificate?\r\n\r\n    1)  No\r\n    2)  Yes, for this session only\r\n    3)  Yes, also add it to a truststore\r\n    4)  View certificate details\r\n\r\nEnter choice [2]: \r\n\r\ndc=domain,dc=tld - Replication Enabled\r\n========================================\r\nServer       : Entries : M.C. (1) : A.O.M.C. (2) : Port (3) : Security (4)\r\n-------------:---------:----------:--------------:----------:-------------\r\nldapdj1:4444 : 43746   : 0        : N\/A          : 8989     : Disabled\r\nldapdj2:4444 : 43746   : 0        : N\/A          : 8989     : Disabled\r\n\r\n[1] The number of changes that are still missing on this server (and that have been applied to at least one of the other servers).\r\n[2] Age of oldest missing change: the date on which the oldest change that has not arrived on this server was generated.\r\n[3] The port used to communicate between the servers whose contents are being replicated.\r\n[4] Whether the replication communication through the replication port is encrypted or not.\r\n<\/code><\/pre>\n
“That’s all folks” jak to zwykle pokazuje si\u0119 na ko\u0144cu kresk\u00f3wki o Kr\u00f3liku Bugsie \ud83d\ude42 Replikacja jest skonfigurowana i zainicjalizowana. Ka\u017cda zmiana w jednym z serwer\u00f3w b\u0119dzie zaraz odwzorowana w drugim.<\/p>","protected":false},"excerpt":{"rendered":"
Sorry, this entry is only available in Polish. For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.G\u0142\u00f3wnym powodem...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[115],"tags":[6,88],"jetpack_publicize_connections":[],"acf":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7M9Tz-5u","jetpack-related-posts":[{"id":299,"url":"https:\/\/drfugazi.eu.org\/en\/ldap-meta-directory\/","url_meta":{"origin":340,"position":0},"title":"LDAP meta directory","author":"drfugazi","date":"Thursday August  4th, 2011","format":false,"excerpt":"Sometimes you need to combine two or more LDAP directories with same suffixes to one directory or you just need to have a proxy. My first attempts to combine two OpenLDAP directories was to make replication from two different sources. This solution however has some disadvantages. First of all: to\u2026","rel":"","context":"In "LDAP"","block_context":{"text":"LDAP","link":"https:\/\/drfugazi.eu.org\/en\/category\/ldap\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":373,"url":"https:\/\/drfugazi.eu.org\/en\/budowa-systemu-pocztowego\/","url_meta":{"origin":340,"position":1},"title":"Building mail system","author":"drfugazi","date":"Monday August 13th, 2012","format":false,"excerpt":"This description is based on my experience, which I gained during mail system implementation on University of Silesia (Katowice\/Poland). In the first stage there was about 3 000 of users, now the system is handling about 40 k of mail users. Whole system (exluding Sophos AV) is based on Open\u2026","rel":"","context":"In "Mail system"","block_context":{"text":"Mail system","link":"https:\/\/drfugazi.eu.org\/en\/category\/mail-system\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":285,"url":"https:\/\/drfugazi.eu.org\/en\/konfiguracja\/","url_meta":{"origin":340,"position":2},"title":"Konfiguracja OpenDJ","author":"drfugazi","date":"Monday July 11th, 2011","format":false,"excerpt":"Po rozpakowaniu i instalacji OpenDJ jest wst\u0119pnie skonfigurowany. W moim przypadku posiada te\u017c wpis bazowy (base entry), tutaj niech to b\u0119dzie dc=domain,dc=tld. Je\u015bli kto\u015b dopiero buduje drzewo LDAP, to pewnie teraz doda sobie standardowe ou=People i tam b\u0119dzie umieszcza\u0142 u\u017cytkownik\u00f3w za pomoc\u0105 narz\u0119dzi do zarz\u0105dzania katalogiem LDAP. Zwykle jednak jest\u2026","rel":"","context":"In "LDAP"","block_context":{"text":"LDAP","link":"https:\/\/drfugazi.eu.org\/en\/category\/ldap\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":339,"url":"https:\/\/drfugazi.eu.org\/en\/migracja-danych-openldap-opendj\/","url_meta":{"origin":340,"position":3},"title":"Migracja danych z OpenLDAP do OpenDJ","author":"drfugazi","date":"Thursday July 14th, 2011","format":false,"excerpt":"Sorry, this entry is only available in Polish. For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.Je\u015bli posiadacie ju\u017c jakie\u015b dane w katalogu opartym na OpenLDAP i istnieje potrzeba migracji tych\u017ce do OpenDJ, to\u2026","rel":"","context":"In "LDAP"","block_context":{"text":"LDAP","link":"https:\/\/drfugazi.eu.org\/en\/category\/ldap\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":338,"url":"https:\/\/drfugazi.eu.org\/en\/dodawanie-indeksow-opendj\/","url_meta":{"origin":340,"position":4},"title":"Dodawanie indeks\u00f3w do OpenDJ","author":"drfugazi","date":"Tuesday July 12th, 2011","format":false,"excerpt":"Sorry, this entry is only available in Polish. For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.Indeksy to bardzo wa\u017cna rzecz w katalogu LDAP. Je\u015bli s\u0105 problemy wydajno\u015bciowe z katalogiem i zacznie si\u0119 szuka\u0107\u2026","rel":"","context":"In "LDAP"","block_context":{"text":"LDAP","link":"https:\/\/drfugazi.eu.org\/en\/category\/ldap\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":337,"url":"https:\/\/drfugazi.eu.org\/en\/dodawanie-schematow-opendj\/","url_meta":{"origin":340,"position":5},"title":"Dodawanie schemat\u00f3w do OpenDJ","author":"drfugazi","date":"Tuesday July 12th, 2011","format":false,"excerpt":"Sorry, this entry is only available in Polish. For the sake of viewer convenience, the content is shown below in the alternative language. You may click the link to switch the active language.OpenDJ podobnie jak inne us\u0142ugi katalogowe pozwala na rozszerzanie funkcjonalno\u015bci katalogu poprzez dodawanie schemat\u00f3w. Istnieje szereg gotowych schemat\u00f3w,\u2026","rel":"","context":"In "LDAP"","block_context":{"text":"LDAP","link":"https:\/\/drfugazi.eu.org\/en\/category\/ldap\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/posts\/340"}],"collection":[{"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/comments?post=340"}],"version-history":[{"count":0,"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/posts\/340\/revisions"}],"wp:attachment":[{"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/media?parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/categories?post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drfugazi.eu.org\/en\/wp-json\/wp\/v2\/tags?post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}