This appendix summarizes procedures used to configure and secure a multimaster replication (MMR) deployment. The information is taken directly from the Sun Directory Server Enterprise Edition 7.0 Administration Guide — and is not Identity Synchronization for Windows - specific.
Designing and implementing an MMR deployment is complex. Refer to the Sun Directory Server Enterprise Edition 7.0 Deployment Planning Guide to plan your deployment and the Sun Directory Server Enterprise Edition 7.0 Administration Guide to implement the deployment.
This appendix is organized into the following sections:
In multimaster replication (MMR) environments, Identity Synchronization for Windows allows you to specify a preferred and secondary master servers for any given Sun directory source.
Directory Server supports n-way MMR (where you can change the replicated database at any of the 'n' masters configured). When you install the plug-in at the preferred master, you must select the Other host type and enter Directory Server instance's parameters manually during plug-in installation.
The following steps assume you are replicating a single suffix. If you are replicating more than one suffix, you may configure them in parallel on each server. In other words, you may repeat each step to configure replication on multiple suffixes.
Define a replication manager entry on all servers except single masters (or use the default replication manager on all servers.)
On all servers containing a dedicated consumer replica:
On all servers containing a hub replica, if applicable:
On all servers containing a master replica:
Configure the replication agreements on all supplier replicas, in the following order:
Configure replication agreements between the hub replicas and their consumers.
For multimaster replication, initialize all masters from the same master replica containing the original copy of the data. Initialize the hub and consumer replicas.
In this procedure, all references are chapters in the Sun Directory Server Enterprise Edition 7.0 Administration Guide.
Configure both the supplier and consumer servers to use SSL.
Refer to Chapter 11, “Managing Authentication and Encryption” for details.
Replication over SSL will fail if the supplier server certificate is an SSL server-only certificate that cannot act as a client during an SSL handshake.
Replication over SSL is currently unsupported with self-signed certificates.
If replication is not configured for the suffix on the consumer server, enable it as described in Chapter 8, “Enabling a Consumer Replica.”
Follow the procedure in Chapter 8, “Advanced Consumer Configuration,” to define the DN of the certificate entry on the consumer as another replication manager.
If replication is not configured for the suffix on the supplier server, enable it as described in Chapter 8, “Enabling a Hub Replica” or “Enabling a Master Replica.”
On the supplier server, create a new replication agreement to send updates to the consumer on the secure SSL port. Follow the procedure in Chapter 8, “Creating Replication Agreements,” for detailed instructions. Specify a secure port on the consumer server and select the SSL option of either using a password or a certificate. Enter a DN for the SSL option that you chose, either a replication manager or a certificate.
After you finish configuring the replication agreement, the supplier will send all replication update messages to the consumer over SSL and will use certificates if you chose that option. Customer initialization will also use a secure connection if performed through the console using an agreement configure for SSL.
From the Identity Synchronization for Windows Console, specify a preferred master and secondary master servers for the suffix to be synchronized. (Review Creating a Sun Java System Directory Source)
You do not have to provide information about other Directory Servers in your topology.
Prepare the preferred master and secondary master servers from the Console or using the idsync prepds command line utility. (Review Preparing Sun Directory Source
If you use the command line utility, you should prepare both servers in a single invocation by specifying arguments for both the preferred and secondary servers.
Install the Directory Server Connector for the suffix replicated between these directories. (ReviewInstalling the Directory Server Connector)
Configure the Directory Server Plug-in on the preferred master, the secondary masters, and every other Directory Server instance that manages users in the replicated suffix (Review Using dspluginconfig)