OpenLDAP-多主机配置

我必须在多主模式下配置两个OpenLDAP节点。 我还将它们与我们公司的Active Directory进行了集成，经过一些验证，集成似乎有效。 即使日志显示复制工作正常，我也验证了添加到一个节点的实体没有在另一个节点上复制。 这是我的slapd.conf，如下所示。两个slapd.conf之间的唯一区别是serverID

---

syncrepl rid和提供程序在每种情况下也应该不同。rid应该是唯一的，提供者应该指向另一个OpenLDAP主机。

Hi@EJP，谢谢您的回答。我只想澄清几点：1。对于提供者来说这是可以的：第一个节点必须具有第二个节点的主机名，反之亦然。2.两个节点上的syncrepl rid必须不同且具有唯一rid值吗？根据这个，我认为两个节点上的数字必须相同。@Luigi 1我就是这么说的。你的消息来源是错误的。不要依赖党的文件。报告说rid必须是唯一的。

### Schema includes ###########################################################
include                 /etc/openldap/schema/core.schema
include                 /etc/openldap/schema/cosine.schema
include                 /etc/openldap/schema/inetorgperson.schema
include                 /etc/openldap/schema/misc.schema
include                 /etc/openldap/schema/nis.schema
include                 /etc/openldap/schema/microsoft.minimal.schema

## Module paths ##############################################################
modulepath              /usr/lib64/openldap/
moduleload              back_ldap
moduleload              rwm
moduleload      syncprov
moduleload      accesslog

### Logging ###################################################################
logfile         /var/log/slapd/slapd.log
loglevel        sync

# Main settings ###############################################################
pidfile                 /var/run/openldap/slapd.pid
argsfile                /var/run/openldap/slapd.args

# Allow v2 binding for legacy clients #########################################
allow bind_v2

### Database local ############################################################
database        bdb
suffix          "dc=farm,dc=it"
rootdn          "cn=manager,dc=farm,dc=it"
rootpw          {SSHA}B29rxKxtjTN8JJIppPGJt7ahvUPhd1pa
directory       /var/lib/ldap

# Indexes for this back end
index           objectClass                     eq,pres
index           ou,cn,mail,surname,givenname    eq,pres,sub
index           uid                             eq,pres,sub

access to attrs=userPassword
    by self =xw
    by dn.exact="cn=manager,dc=farm,dc=it"
    by dn.exact="cn=replica,dc=farm,dc=it"
    by anonymous auth
    by * none
access to *
    by anonymous auth
    by self write
    by dn.exact="cn=replica,dc=farm,dc=it" read
    by users read
    by * none



# Replica #####################################################################

#Define the server ID.
serverID 2

# Replication configuration, only things you may have to change here are provider, binddn, credentials and searchbase.
syncrepl rid=001
    provider=ldap://almldap01.farm.it:389
    binddn="cn=replica,dc=farm,dc=it"
    bindmethod=simple
    credentials="3L3jkKZcSb5anj8ReCi3ZDWnbv9HNeB8"
    searchbase="dc=farm,dc=it"
    type=refreshAndPersist
    interval=00:00:00:10
    retry="5 5 300 5"
    timeout=1

#Rest replication configuration goes to end of the file.
mirrormode TRUE
overlay syncprov
syncprov-nopresent TRUE
syncprov-reloadhint TRUE
syncprov-checkpoint 1000 60


### Database definition (Proxy to AD) #########################################
database                ldap
readonly                yes
protocol-version        3
rebind-as-user      yes
uri                     "ldap://corp.farm.group:389"
suffix                  "dc=corp,dc=farm,dc=group"
idassert-bind       bindmethod=simple
            mode=none
            binddn="CN=WfLdapBind,OU=Users,OU=WebFarm,DC=corp,DC=farm,DC=group"
            credentials="djW5l5hvTPcMcLvV"
idassert-authzFrom  "*"
overlay                 rwm
rwm-map         attribute       uid         sAMAccountName
rwm-map         objectClass posixAccount    person